@vibexp/api-client 0.97.0 → 0.99.0

package/dist/axios/types.gen.d.ts

@@ -6291,7 +6291,13 @@ export type AdminInstanceEmailSettings = {
  * only `has_credential` and, on an upsert's `after`, a `secret` marker
  * saying whether the credential was `changed` or `unchanged`; the `search`
  * and `ai_summary` snapshots are the settings' values, which hold no
- * credential.
+ * credential. For `auth_providers` each entry is one provider, reporting
+ * only `has_client_secret` and, on an upsert's `after`, a `client_secret`
+ * marker (`changed` or `unchanged`); `auth_allowlist`, `instance_admins`
+ * and `auth_setup` snapshots hold no credential (the setup token and its
+ * hash are never recorded). A snapshot of any of these four settings
+ * carries `source: cli` when the change was made by the `vibexp admin auth`
+ * commands rather than through this API.
  *
  */
 export type AdminInstanceSettingsAuditEntry = {
@@ -6302,7 +6308,7 @@ export type AdminInstanceSettingsAuditEntry = {
     /**
      * The instance setting the entry describes.
      */
-    setting: 'email_provider' | 'search' | 'ai_summary';
+    setting: 'email_provider' | 'search' | 'ai_summary' | 'auth_providers' | 'auth_allowlist' | 'instance_admins' | 'auth_setup';
     /**
      * `upsert` (created or replaced by an admin), `delete` (removed by an
      * admin) or `import` (the boot-time import from config.yaml, which has no
@@ -6431,18 +6437,22 @@ export type AdminInstanceSearchSettings = {
     updated_by_name: string | null;
     /**
      * The stored row's optimistic-lock version; null when nothing is stored.
-     * Send it back as `expected_version` to reject a save that would
-     * overwrite someone else's change.
+     * Send it back as `expected_version` (`0` when it is null) to reject a
+     * save that would overwrite someone else's change.
      *
      */
     version: number | null;
 };
 /**
  * A whole replacement of the instance search ranking defaults. Every value is
- * required. `expected_version` is optional: when present, the save is
- * rejected with 409 unless it equals the stored version (and when nothing is
- * stored, any `expected_version` other than null is a conflict). Omit it for
- * last-write-wins.
+ * required. `expected_version` is optional and makes the save a
+ * compare-and-set:
+ *
+ * - omitted or null: last-write-wins, never a conflict.
+ * - `0`: nothing may be stored yet; the save is rejected with 409 when a row
+ * is stored. Send it when the `version` last read was null.
+ * - a positive value: the save is rejected with 409 unless it equals the
+ * stored `version`, and also when nothing is stored.
  *
  */
 export type AdminInstanceSearchSettingsUpdate = {
@@ -6453,7 +6463,10 @@ export type AdminInstanceSearchSettingsUpdate = {
     rank_half_life_days: number;
     rank_candidate_cap: number;
     /**
-     * The `version` the caller last read; omit or null for last-write-wins.
+     * The `version` the caller last read. Send `0` when that `version` was
+     * null, to save only while nothing is stored. Omit it or send null for
+     * last-write-wins. A negative value matches nothing and is a 409.
+     *
      */
     expected_version?: number | null;
 };
@@ -6536,18 +6549,22 @@ export type AdminInstanceAiSummarySettings = {
     updated_by_name: string | null;
     /**
      * The stored row's optimistic-lock version; null when nothing is stored.
-     * Send it back as `expected_version` to reject a save that would
-     * overwrite someone else's change.
+     * Send it back as `expected_version` (`0` when it is null) to reject a
+     * save that would overwrite someone else's change.
      *
      */
     version: number | null;
 };
 /**
  * A whole replacement of the instance AI summary settings. Every value is
- * required. `expected_version` is optional: when present, the save is
- * rejected with 409 unless it equals the stored version (and when nothing is
- * stored, any `expected_version` other than null is a conflict). Omit it for
- * last-write-wins.
+ * required. `expected_version` is optional and makes the save a
+ * compare-and-set:
+ *
+ * - omitted or null: last-write-wins, never a conflict.
+ * - `0`: nothing may be stored yet; the save is rejected with 409 when a row
+ * is stored. Send it when the `version` last read was null.
+ * - a positive value: the save is rejected with 409 unless it equals the
+ * stored `version`, and also when nothing is stored.
  *
  */
 export type AdminInstanceAiSummarySettingsUpdate = {
@@ -6559,10 +6576,371 @@ export type AdminInstanceAiSummarySettingsUpdate = {
     total_context_chars: number;
     request_timeout_ms: number;
     /**
-     * The `version` the caller last read; omit or null for last-write-wins.
+     * The `version` the caller last read. Send `0` when that `version` was
+     * null, to save only while nothing is stored. Omit it or send null for
+     * last-write-wins. A negative value matches nothing and is a 409.
+     *
+     */
+    expected_version?: number | null;
+};
+/**
+ * The kind of sign-in identity provider. At most one `google` and one
+ * `github` provider can be stored; any number of `oidc` providers.
+ *
+ */
+export type AdminAuthProviderType = 'google' | 'github' | 'oidc';
+/**
+ * The provider's build outcome on the replica that served the request:
+ * `healthy` (built and offered for sign-in), `unhealthy` (enabled but it
+ * failed to build, so it is excluded from sign-in), `disabled` (not enabled,
+ * so never built) or `unknown` (enabled, but this replica could not resolve
+ * it for this request).
+ *
+ */
+export type AdminAuthProviderHealthStatus = 'healthy' | 'unhealthy' | 'disabled' | 'unknown';
+/**
+ * The provider's health as seen by the replica that served the request.
+ * Health is held in memory per replica and is not persisted.
+ *
+ */
+export type AdminAuthProviderHealth = {
+    status: AdminAuthProviderHealthStatus;
+    /**
+     * Why an `unhealthy` provider failed to build; null otherwise.
+     */
+    last_error: string | null;
+    /**
+     * When the provider was last built (or tried); null for `disabled` and `unknown`.
+     */
+    checked_at: string | null;
+};
+/**
+ * One sign-in identity provider. The client secret is write-only: it is never
+ * returned, and `has_client_secret` reports only whether one is stored.
+ *
+ */
+export type AdminAuthProvider = {
+    /**
+     * Provider id.
+     */
+    id: string;
+    type: AdminAuthProviderType;
+    /**
+     * The provider's url-safe name, used in the sign-in URL. Immutable.
+     */
+    slug: string;
+    /**
+     * The name shown on the sign-in button.
+     */
+    display_name: string;
+    /**
+     * Whether the provider is offered for sign-in.
+     */
+    enabled: boolean;
+    /**
+     * Position on the sign-in page, ascending.
+     */
+    sort_order: number;
+    /**
+     * The OAuth client id.
+     */
+    client_id: string;
+    /**
+     * Whether a client secret is stored.
+     */
+    has_client_secret: boolean;
+    /**
+     * The OIDC issuer URL; null for `google` and `github`.
+     */
+    issuer_url: string | null;
+    /**
+     * The redirect URI to register in the identity provider's console. It is
+     * derived from the instance's own URL, is the same for every provider and
+     * cannot be changed here.
+     *
+     */
+    redirect_uri: string;
+    health: AdminAuthProviderHealth;
+    created_at: string;
+    updated_at: string;
+    /**
+     * Who last saved the provider. Null for the boot-time config import, a
+     * save made on a setup session, or once that user has been deleted.
+     *
+     */
+    updated_by_user_id: string | null;
+};
+/**
+ * Every stored sign-in identity provider, in sign-in page order, with the
+ * `version` of the instance authentication settings. Send that `version` back
+ * as `expected_version` when changing a provider.
+ *
+ */
+export type AdminAuthProviderList = {
+    providers: Array<AdminAuthProvider>;
+    /**
+     * The shared version of the authentication settings. Every provider and
+     * allowlist change increments it.
+     *
+     */
+    version: number;
+};
+/**
+ * A provider as stored by a create or an update, with the settings `version`
+ * after the change. `provider.health` is resolved after the change, so the
+ * response waits for the provider to be built (for `oidc` and `google`, one
+ * bounded discovery request) and reports whether sign-in can use it.
+ *
+ */
+export type AdminAuthProviderSaved = {
+    provider: AdminAuthProvider;
+    /**
+     * The shared authentication settings version after the change.
+     */
+    version: number;
+};
+/**
+ * A new sign-in identity provider. `type` and `slug` cannot be changed later.
+ * `expected_version` is optional: when present, the create is rejected with
+ * 409 unless it equals the current authentication settings `version`.
+ *
+ */
+export type AdminAuthProviderCreate = {
+    type: AdminAuthProviderType;
+    /**
+     * 1-63 lower-case letters, digits or hyphens, not starting with a hyphen.
+     */
+    slug: string;
+    display_name: string;
+    /**
+     * Whether the provider is offered for sign-in. Defaults to true.
+     */
+    enabled?: boolean;
+    /**
+     * Position on the sign-in page, ascending. Defaults to 0.
+     */
+    sort_order?: number;
+    client_id: string;
+    /**
+     * The OAuth client secret. Stored encrypted and never returned.
+     */
+    client_secret: string;
+    /**
+     * Required for `oidc` and rejected for `google` and `github`. An absolute
+     * `https://` URL (`http://` only for localhost) with no query or fragment.
+     *
+     */
+    issuer_url?: string;
+    /**
+     * The `version` the caller last read; omit or null to apply to the current version.
+     */
+    expected_version?: number | null;
+};
+/**
+ * A whole replacement of a provider's editable fields; `type` and `slug` are
+ * immutable and are rejected as unknown fields. `display_name`, `enabled`,
+ * `sort_order`, `client_id` and `expected_version` are required.
+ *
+ * `client_secret` is write-only. Omit it to keep the stored secret; an empty
+ * string is rejected. It cannot be omitted when `issuer_url` changes: the
+ * stored secret is only ever kept for the issuer it was saved with.
+ *
+ * A change that disables the last enabled provider, or the provider the
+ * calling admin signed in with, is rejected with 409 `lockout_risk` unless
+ * `confirm_lockout_risk` is true.
+ *
+ */
+export type AdminAuthProviderUpdate = {
+    display_name: string;
+    enabled: boolean;
+    sort_order: number;
+    client_id: string;
+    /**
+     * A new client secret. Omit to keep the stored one. Never returned.
+     */
+    client_secret?: string;
+    /**
+     * Required for `oidc`, rejected for `google` and `github`.
+     */
+    issuer_url?: string;
+    /**
+     * The authentication settings `version` the caller last read.
+     */
+    expected_version: number;
+    /**
+     * Set to true to apply a change that was rejected with `lockout_risk`.
+     */
+    confirm_lockout_risk?: boolean;
+};
+/**
+ * What to test. Nothing is stored and nothing is audited.
+ *
+ * - `id` alone tests the STORED provider with its stored secret.
+ * - Without `id`, the body is an unsaved candidate: `type`, `client_id` and
+ * `client_secret` are required (and `issuer_url` for `oidc`).
+ * - `id` with other fields tests the stored provider with those fields
+ * replaced, as an edit form does before saving. `type` cannot differ from
+ * the stored one. When `client_secret` is omitted the stored secret is
+ * used: it is never sent to a candidate-chosen endpoint (OIDC discovery
+ * sends no secret, and the GitHub credential check goes only to GitHub).
+ *
+ */
+export type AdminAuthProviderTestRequest = {
+    /**
+     * A stored provider's id.
+     */
+    id?: string;
+    type?: AdminAuthProviderType;
+    client_id?: string;
+    /**
+     * The candidate client secret. Never returned.
+     */
+    client_secret?: string;
+    issuer_url?: string;
+};
+/**
+ * The outcome of a provider test: OIDC discovery for `oidc` and `google`, a
+ * credential check against GitHub for `github`.
+ *
+ */
+export type AdminAuthProviderTestResult = {
+    /**
+     * Whether the provider could be built with the tested configuration.
+     */
+    is_valid: boolean;
+    /**
+     * Why the test failed; null when it passed.
+     */
+    message: string | null;
+};
+/**
+ * The instance's sign-in access allowlist. A user may sign in when their
+ * email's domain is in `domains` or the address is in `emails`. With both
+ * lists empty, or nothing stored, access is open: every user may sign in
+ * (`active` is false). Root instance admins are always exempt.
+ *
+ */
+export type AdminAuthAllowlist = {
+    domains: Array<string>;
+    emails: Array<string>;
+    /**
+     * Whether the allowlist restricts sign-in (at least one domain or email).
+     */
+    active: boolean;
+    /**
+     * The stored allowlist's own version; null when nothing is stored. Send
+     * it back as `expected_version` (`0` when it is null) to reject a save
+     * that would overwrite someone else's change.
+     *
+     */
+    version: number | null;
+    /**
+     * When the allowlist was last saved; null when nothing is stored.
+     */
+    updated_at: string | null;
+    /**
+     * Who last saved the allowlist. Null when nothing is stored, for the
+     * boot-time config import, a save made on a setup session, or once that
+     * user has been deleted.
+     *
+     */
+    updated_by_user_id: string | null;
+};
+/**
+ * A whole replacement of the access allowlist. Both lists are required (send
+ * `[]` for none). Entries are trimmed, lower-cased and de-duplicated; a domain
+ * is a DNS name of at least two labels with no leading `@`. Storing two empty
+ * lists means open access.
+ *
+ * `expected_version` is optional and makes the save a compare-and-set:
+ *
+ * - omitted or null: last-write-wins, never a conflict.
+ * - `0`: no allowlist may be stored yet; the save is rejected with 409 when
+ * one is. Send it when the `version` last read was null.
+ * - a positive value: the save is rejected with 409 unless it equals the
+ * stored allowlist's `version`, and also when nothing is stored.
+ *
+ */
+export type AdminAuthAllowlistUpdate = {
+    domains: Array<string>;
+    emails: Array<string>;
+    /**
+     * The `version` the caller last read. Send `0` when that `version` was
+     * null, to save only while nothing is stored. Omit it or send null for
+     * last-write-wins. A negative value matches nothing and is a 409.
+     *
      */
     expected_version?: number | null;
 };
+/**
+ * A candidate allowlist to preview. Both lists are required (send `[]` for none).
+ */
+export type AdminAuthAllowlistPreviewRequest = {
+    domains: Array<string>;
+    emails: Array<string>;
+};
+/**
+ * What replacing the allowlist with a candidate would do: the active
+ * (non-suspended) users who would stop matching it. Root instance admins are
+ * exempt and never counted. An open-access candidate affects nobody.
+ *
+ */
+export type AdminAuthAllowlistImpact = {
+    /**
+     * How many active users match neither list of the candidate.
+     */
+    count: number;
+    /**
+     * Up to 20 of their emails, in alphabetical order.
+     */
+    sample: Array<string>;
+    /**
+     * Whether `count` exceeds the number of emails in `sample`.
+     */
+    sample_truncated: boolean;
+};
+/**
+ * One instance admin granted in the database.
+ */
+export type AdminInstanceAdmin = {
+    user_id: string;
+    email: string;
+    /**
+     * The admin's display name, when set.
+     */
+    name: string | null;
+    /**
+     * The root admin who granted it; null once that user has been deleted.
+     */
+    granted_by_user_id: string | null;
+    granted_at: string;
+};
+/**
+ * The instance's admins. `root_admins` are the emails named in config.yaml's
+ * `auth.instance_admins`: read-only here, they cannot be granted or revoked.
+ * `admins` are the users granted in the database, oldest first.
+ *
+ */
+export type AdminInstanceAdminList = {
+    /**
+     * The root admins' normalized emails, sorted.
+     */
+    root_admins: Array<string>;
+    admins: Array<AdminInstanceAdmin>;
+};
+/**
+ * The existing user to make an instance admin, named by exactly one of
+ * `user_id` or `email`.
+ *
+ */
+export type AdminInstanceAdminGrant = {
+    user_id?: string;
+    email?: string;
+};
+/**
+ * Which authentication setting's audit log to read.
+ */
+export type AdminAuthSettingsAuditSetting = 'auth_providers' | 'auth_allowlist' | 'instance_admins' | 'auth_setup';
 export type ProjectResponse = Project & {
     /**
      * Whether the project's git URL matches a repository accessible via the team's GitHub App installation
@@ -15564,6 +15942,448 @@ export type ListAdminAiSummarySettingsAuditResponses = {
     200: AdminInstanceSettingsAuditPage;
 };
 export type ListAdminAiSummarySettingsAuditResponse = ListAdminAiSummarySettingsAuditResponses[keyof ListAdminAiSummarySettingsAuditResponses];
+export type ListAdminAuthProvidersData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/providers';
+};
+export type ListAdminAuthProvidersErrors = {
+    /**
+     * Not found — the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type ListAdminAuthProvidersError = ListAdminAuthProvidersErrors[keyof ListAdminAuthProvidersErrors];
+export type ListAdminAuthProvidersResponses = {
+    /**
+     * The stored providers and the settings version
+     */
+    200: AdminAuthProviderList;
+};
+export type ListAdminAuthProvidersResponse = ListAdminAuthProvidersResponses[keyof ListAdminAuthProvidersResponses];
+export type CreateAdminAuthProviderData = {
+    body: AdminAuthProviderCreate;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/providers';
+};
+export type CreateAdminAuthProviderErrors = {
+    /**
+     * Bad request — a field is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`, with
+     * `validation_errors` naming it), or the body is malformed or carries an
+     * unknown field
+     *
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Conflict — `expected_version` does not match the current version
+     * (`INSTANCE_SETTINGS_VERSION_CONFLICT`), or the slug is taken or a second
+     * `google`/`github` provider was sent (`INSTANCE_AUTH_PROVIDER_CONFLICT`);
+     * nothing was changed
+     *
+     */
+    409: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type CreateAdminAuthProviderError = CreateAdminAuthProviderErrors[keyof CreateAdminAuthProviderErrors];
+export type CreateAdminAuthProviderResponses = {
+    /**
+     * The stored provider and the settings version after the change
+     */
+    201: AdminAuthProviderSaved;
+};
+export type CreateAdminAuthProviderResponse = CreateAdminAuthProviderResponses[keyof CreateAdminAuthProviderResponses];
+export type TestAdminAuthProviderData = {
+    body: AdminAuthProviderTestRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/providers/test';
+};
+export type TestAdminAuthProviderErrors = {
+    /**
+     * Bad request — the candidate is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`),
+     * or the body is malformed or carries an unknown field
+     *
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — no provider has that `id`, or the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type TestAdminAuthProviderError = TestAdminAuthProviderErrors[keyof TestAdminAuthProviderErrors];
+export type TestAdminAuthProviderResponses = {
+    /**
+     * The outcome of the test
+     */
+    200: AdminAuthProviderTestResult;
+};
+export type TestAdminAuthProviderResponse = TestAdminAuthProviderResponses[keyof TestAdminAuthProviderResponses];
+export type DeleteAdminAuthProviderData = {
+    body?: never;
+    path: {
+        /**
+         * Provider id (UUID)
+         */
+        id: string;
+    };
+    query?: {
+        /**
+         * The authentication settings `version` the caller last read; omit to apply to the current version.
+         */
+        expected_version?: number;
+        /**
+         * Set to true to apply a delete that was rejected with `lockout_risk`.
+         */
+        confirm_lockout_risk?: boolean;
+    };
+    url: '/api/v1/admin/settings/auth/providers/{id}';
+};
+export type DeleteAdminAuthProviderErrors = {
+    /**
+     * Bad request — malformed provider id or query parameter
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — no provider has that id, or the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Conflict — `expected_version` does not match the current version
+     * (`INSTANCE_SETTINGS_VERSION_CONFLICT`), or the delete risks locking sign-in
+     * out (`lockout_risk`); nothing was changed
+     *
+     */
+    409: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type DeleteAdminAuthProviderError = DeleteAdminAuthProviderErrors[keyof DeleteAdminAuthProviderErrors];
+export type DeleteAdminAuthProviderResponses = {
+    /**
+     * The provider was deleted
+     */
+    204: void;
+};
+export type DeleteAdminAuthProviderResponse = DeleteAdminAuthProviderResponses[keyof DeleteAdminAuthProviderResponses];
+export type UpdateAdminAuthProviderData = {
+    body: AdminAuthProviderUpdate;
+    path: {
+        /**
+         * Provider id (UUID)
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/settings/auth/providers/{id}';
+};
+export type UpdateAdminAuthProviderErrors = {
+    /**
+     * Bad request — a field is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`, with
+     * `validation_errors` naming it), the provider id is malformed, or the body is
+     * malformed, omits or nulls a required field, or carries an unknown field
+     *
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — no provider has that id, or the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Conflict — `expected_version` does not match the current version
+     * (`INSTANCE_SETTINGS_VERSION_CONFLICT`), or the change risks locking sign-in
+     * out (`lockout_risk`); nothing was changed
+     *
+     */
+    409: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type UpdateAdminAuthProviderError = UpdateAdminAuthProviderErrors[keyof UpdateAdminAuthProviderErrors];
+export type UpdateAdminAuthProviderResponses = {
+    /**
+     * The stored provider and the settings version after the change
+     */
+    200: AdminAuthProviderSaved;
+};
+export type UpdateAdminAuthProviderResponse = UpdateAdminAuthProviderResponses[keyof UpdateAdminAuthProviderResponses];
+export type ResetAdminAuthAllowlistData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/allowlist';
+};
+export type ResetAdminAuthAllowlistErrors = {
+    /**
+     * Not found — the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type ResetAdminAuthAllowlistError = ResetAdminAuthAllowlistErrors[keyof ResetAdminAuthAllowlistErrors];
+export type ResetAdminAuthAllowlistResponses = {
+    /**
+     * Access is now open
+     */
+    204: void;
+};
+export type ResetAdminAuthAllowlistResponse = ResetAdminAuthAllowlistResponses[keyof ResetAdminAuthAllowlistResponses];
+export type GetAdminAuthAllowlistData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/allowlist';
+};
+export type GetAdminAuthAllowlistErrors = {
+    /**
+     * Not found — the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetAdminAuthAllowlistError = GetAdminAuthAllowlistErrors[keyof GetAdminAuthAllowlistErrors];
+export type GetAdminAuthAllowlistResponses = {
+    /**
+     * The access allowlist
+     */
+    200: AdminAuthAllowlist;
+};
+export type GetAdminAuthAllowlistResponse = GetAdminAuthAllowlistResponses[keyof GetAdminAuthAllowlistResponses];
+export type UpdateAdminAuthAllowlistData = {
+    body: AdminAuthAllowlistUpdate;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/allowlist';
+};
+export type UpdateAdminAuthAllowlistErrors = {
+    /**
+     * Bad request — an entry is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`, with
+     * `validation_errors` naming the list), or the body is malformed, omits or
+     * nulls a list, or carries an unknown field
+     *
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Conflict — `expected_version` does not match the stored version (`INSTANCE_SETTINGS_VERSION_CONFLICT`); nothing was changed
+     */
+    409: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type UpdateAdminAuthAllowlistError = UpdateAdminAuthAllowlistErrors[keyof UpdateAdminAuthAllowlistErrors];
+export type UpdateAdminAuthAllowlistResponses = {
+    /**
+     * The stored allowlist
+     */
+    200: AdminAuthAllowlist;
+};
+export type UpdateAdminAuthAllowlistResponse = UpdateAdminAuthAllowlistResponses[keyof UpdateAdminAuthAllowlistResponses];
+export type PreviewAdminAuthAllowlistData = {
+    body: AdminAuthAllowlistPreviewRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/allowlist/preview';
+};
+export type PreviewAdminAuthAllowlistErrors = {
+    /**
+     * Bad request — an entry is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`), or
+     * the body is malformed, omits or nulls a list, or carries an unknown field
+     *
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — the caller is neither an instance admin nor on a setup session
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type PreviewAdminAuthAllowlistError = PreviewAdminAuthAllowlistErrors[keyof PreviewAdminAuthAllowlistErrors];
+export type PreviewAdminAuthAllowlistResponses = {
+    /**
+     * The impact of the candidate
+     */
+    200: AdminAuthAllowlistImpact;
+};
+export type PreviewAdminAuthAllowlistResponse = PreviewAdminAuthAllowlistResponses[keyof PreviewAdminAuthAllowlistResponses];
+export type ListAdminInstanceAdminsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/admins';
+};
+export type ListAdminInstanceAdminsErrors = {
+    /**
+     * Not found — the caller is not an instance admin
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type ListAdminInstanceAdminsError = ListAdminInstanceAdminsErrors[keyof ListAdminInstanceAdminsErrors];
+export type ListAdminInstanceAdminsResponses = {
+    /**
+     * The instance admins
+     */
+    200: AdminInstanceAdminList;
+};
+export type ListAdminInstanceAdminsResponse = ListAdminInstanceAdminsResponses[keyof ListAdminInstanceAdminsResponses];
+export type GrantAdminInstanceAdminData = {
+    body: AdminInstanceAdminGrant;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/settings/auth/admins';
+};
+export type GrantAdminInstanceAdminErrors = {
+    /**
+     * Bad request — the body names neither or both of `user_id` and `email`, the
+     * user is suspended, or the body is malformed or carries an unknown field
+     *
+     */
+    400: ErrorResponse;
+    /**
+     * Forbidden — the caller is an instance admin but not a root admin
+     */
+    403: ErrorResponse;
+    /**
+     * Not found — no such user, or the caller is not an instance admin
+     */
+    404: ErrorResponse;
+    /**
+     * Conflict — the user is a root admin, whose access comes from config.yaml
+     */
+    409: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GrantAdminInstanceAdminError = GrantAdminInstanceAdminErrors[keyof GrantAdminInstanceAdminErrors];
+export type GrantAdminInstanceAdminResponses = {
+    /**
+     * The grant
+     */
+    200: AdminInstanceAdmin;
+};
+export type GrantAdminInstanceAdminResponse = GrantAdminInstanceAdminResponses[keyof GrantAdminInstanceAdminResponses];
+export type RevokeAdminInstanceAdminData = {
+    body?: never;
+    path: {
+        /**
+         * The granted admin's user id (UUID)
+         */
+        user_id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/settings/auth/admins/{user_id}';
+};
+export type RevokeAdminInstanceAdminErrors = {
+    /**
+     * Bad request — malformed user id
+     */
+    400: ErrorResponse;
+    /**
+     * Forbidden — the caller is an instance admin but not a root admin
+     */
+    403: ErrorResponse;
+    /**
+     * Not found — the user holds no grant, or the caller is not an instance admin
+     */
+    404: ErrorResponse;
+    /**
+     * Conflict — the user is a root admin, whose access comes from config.yaml
+     */
+    409: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type RevokeAdminInstanceAdminError = RevokeAdminInstanceAdminErrors[keyof RevokeAdminInstanceAdminErrors];
+export type RevokeAdminInstanceAdminResponses = {
+    /**
+     * The grant was revoked
+     */
+    204: void;
+};
+export type RevokeAdminInstanceAdminResponse = RevokeAdminInstanceAdminResponses[keyof RevokeAdminInstanceAdminResponses];
+export type ListAdminAuthSettingsAuditData = {
+    body?: never;
+    path?: never;
+    query: {
+        /**
+         * Which authentication setting's audit log to read.
+         */
+        setting: AdminAuthSettingsAuditSetting;
+        /**
+         * Opaque cursor from a previous page's `next_cursor`.
+         */
+        cursor?: string;
+        /**
+         * Page size.
+         */
+        limit?: number;
+    };
+    url: '/api/v1/admin/settings/auth/audit';
+};
+export type ListAdminAuthSettingsAuditErrors = {
+    /**
+     * Bad request — missing or unknown `setting`, malformed cursor, or `limit` out of range
+     */
+    400: ErrorResponse;
+    /**
+     * Not found — the caller is not an instance admin
+     */
+    404: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type ListAdminAuthSettingsAuditError = ListAdminAuthSettingsAuditErrors[keyof ListAdminAuthSettingsAuditErrors];
+export type ListAdminAuthSettingsAuditResponses = {
+    /**
+     * One page of audit entries, newest first
+     */
+    200: AdminInstanceSettingsAuditPage;
+};
+export type ListAdminAuthSettingsAuditResponse = ListAdminAuthSettingsAuditResponses[keyof ListAdminAuthSettingsAuditResponses];
 export type ListCommentsData = {
     body?: never;
     path: {