From 03ebe34b30fb5131e9e2d2da8e76e9ee55767437 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Mon, 31 Aug 2026 23:04:49 -0700
Subject: [PATCH 01/59] feat(codex): add authoritative subagent tracking
 foundation

---
 cmd/entire/cli/agent/agent.go                 |  37 ++
 cmd/entire/cli/agent/capabilities.go          |  11 +-
 cmd/entire/cli/agent/capabilities_test.go     |  25 +
 cmd/entire/cli/agent/codex/codex.go           | 187 ++++++
 cmd/entire/cli/agent/codex/lifecycle.go       |  29 +-
 cmd/entire/cli/agent/codex/lifecycle_test.go  | 128 ++++-
 cmd/entire/cli/agent/codex/subagent_test.go   | 530 ++++++++++++++++++
 cmd/entire/cli/agent/codex/transcript.go      | 342 ++++++++++-
 cmd/entire/cli/agent/codex/transcript_test.go |  60 ++
 cmd/entire/cli/agent/event.go                 |  10 +
 cmd/entire/cli/agent/types/token_usage.go     |  43 +-
 .../cli/agent/types/token_usage_test.go       |  40 +-
 .../codex_image_externalize_test.go           |   2 +-
 .../codex_shadow_sanitize_test.go             |   4 +-
 cmd/entire/cli/session/state.go               | 178 +++++-
 cmd/entire/cli/session/state_test.go          | 202 +++++++
 .../cli/strategy/manual_commit_session.go     |  41 ++
 cmd/entire/cli/strategy/manual_commit_test.go |  90 +++
 18 files changed, 1930 insertions(+), 29 deletions(-)
 create mode 100644 cmd/entire/cli/agent/codex/subagent_test.go

diff --git a/cmd/entire/cli/agent/agent.go b/cmd/entire/cli/agent/agent.go
index 20f1566cf1..e955eaf789 100644
--- a/cmd/entire/cli/agent/agent.go
+++ b/cmd/entire/cli/agent/agent.go
@@ -304,6 +304,43 @@ type TokenCalculator interface {
 	CalculateTokenUsage(transcriptData []byte, fromOffset int) (*TokenUsage, error)
 }
 
+// SubagentReference is the authoritative record of one spawned agent supplied
+// by the session ledger. Transcript paths are hints only: implementations must
+// verify that a path's native metadata identifies this exact AgentID.
+type SubagentReference struct {
+	AgentID                string
+	DeclaredTranscriptPath string
+	ResolvedTranscriptPath string
+}
+
+// SubagentAnalysis is the exact evidence available for one supplied subagent.
+// TokenUsage is nil when its cumulative native usage cannot be read exactly.
+type SubagentAnalysis struct {
+	AgentID         string
+	ResolvedPath    string
+	ModifiedFiles   []string
+	TokenUsage      *TokenUsage
+	TerminalTurnIDs []string
+}
+
+// InventoryExtraction contains parent evidence plus analysis of the supplied
+// authoritative child inventory. TokenUsage records parent usage and, when
+// complete, its exact cumulative child aggregate in SubagentTokens.
+type InventoryExtraction struct {
+	ModifiedFiles []string
+	TokenUsage    *TokenUsage
+	Children      []SubagentAnalysis
+}
+
+// InventoryAwareExtractor analyzes only an already-authoritative inventory of
+// children. It is intentionally built-in only: external agents have no
+// equivalent protocol capability yet.
+type InventoryAwareExtractor interface {
+	Agent
+
+	ExtractWithSubagentInventory(parent []byte, fromOffset int, refs []SubagentReference) (InventoryExtraction, error)
+}
+
 // ModelExtractor extracts the LLM model identifier from a transcript for agents
 // that do not report the model through lifecycle hooks. Pi, for example, records
 // the model on every assistant message (message.model) but its hook events carry
diff --git a/cmd/entire/cli/agent/capabilities.go b/cmd/entire/cli/agent/capabilities.go
index bebb33c9e7..ef5f5a56a0 100644
--- a/cmd/entire/cli/agent/capabilities.go
+++ b/cmd/entire/cli/agent/capabilities.go
@@ -18,7 +18,8 @@ type CapabilityDeclarer interface {
 //
 // Not every optional interface appears here: built-in-only capabilities that
 // have no external-protocol equivalent (SessionBaseDirProvider, ModelExtractor,
-// SkillEventExtractor, TranscriptSanitizer, TranscriptFetcher) are intentionally
+// SkillEventExtractor, TranscriptSanitizer, TranscriptFetcher,
+// InventoryAwareExtractor) are intentionally
 // excluded — their As* helpers resolve by type assertion alone (see
 // builtinCapability), with no DeclaredCaps gate.
 type DeclaredCaps struct {
@@ -148,6 +149,14 @@ func AsTokenCalculator(ag Agent) (TokenCalculator, bool) {
 	return declaredCapability[TokenCalculator](ag, func(c DeclaredCaps) bool { return c.TokenCalculator })
 }
 
+// AsInventoryAwareExtractor returns the agent as InventoryAwareExtractor when
+// it implements the built-in-only inventory protocol. External agents cannot
+// declare this capability because its authoritative child ledger is internal to
+// Entire rather than the external-agent protocol.
+func AsInventoryAwareExtractor(ag Agent) (InventoryAwareExtractor, bool) {
+	return builtinCapability[InventoryAwareExtractor](ag)
+}
+
 // AsTextGenerator returns the agent as TextGenerator if it both
 // implements the interface and (for CapabilityDeclarer agents) has declared the capability.
 func AsTextGenerator(ag Agent) (TextGenerator, bool) {
diff --git a/cmd/entire/cli/agent/capabilities_test.go b/cmd/entire/cli/agent/capabilities_test.go
index e56db9b87a..7b2be3444a 100644
--- a/cmd/entire/cli/agent/capabilities_test.go
+++ b/cmd/entire/cli/agent/capabilities_test.go
@@ -78,6 +78,11 @@ func (m *mockFullAgent) PrepareTranscript(context.Context, string) error { retur
 // TokenCalculator
 func (m *mockFullAgent) CalculateTokenUsage([]byte, int) (*TokenUsage, error) { return nil, nil } //nolint:nilnil // test mock
 
+// InventoryAwareExtractor is built-in only and deliberately has no DeclaredCaps bit.
+func (m *mockFullAgent) ExtractWithSubagentInventory([]byte, int, []SubagentReference) (InventoryExtraction, error) {
+	return InventoryExtraction{}, nil
+}
+
 // ModelExtractor
 func (m *mockFullAgent) ExtractModel([]byte) (string, error) { return "mock-model", nil }
 
@@ -257,6 +262,26 @@ func TestAsTokenCalculator(t *testing.T) {
 	})
 }
 
+func TestAsInventoryAwareExtractor(t *testing.T) {
+	t.Parallel()
+
+	t.Run("not implemented", func(t *testing.T) {
+		t.Parallel()
+		_, ok := AsInventoryAwareExtractor(&mockBaseAgent{})
+		if ok {
+			t.Error("expected false")
+		}
+	})
+
+	t.Run("implemented without declared capability", func(t *testing.T) {
+		t.Parallel()
+		extractor, ok := AsInventoryAwareExtractor(&mockFullAgent{})
+		if !ok || extractor == nil {
+			t.Error("expected built-in-only type assertion to succeed")
+		}
+	})
+}
+
 func TestAsModelExtractor(t *testing.T) {
 	t.Parallel()
 
diff --git a/cmd/entire/cli/agent/codex/codex.go b/cmd/entire/cli/agent/codex/codex.go
index 46a2ae6f10..047ef41c5b 100644
--- a/cmd/entire/cli/agent/codex/codex.go
+++ b/cmd/entire/cli/agent/codex/codex.go
@@ -5,6 +5,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
+	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -26,6 +28,191 @@ func init() {
 //nolint:revive // CodexAgent is clearer than Agent in this context
 type CodexAgent struct {
 	CommandRunner agent.TextCommandRunner
+	// RolloutRoots overrides the active and archived rollout roots for callers
+	// that already know them (notably tests). Nil uses Codex's normal home.
+	RolloutRoots []string
+	// loadRollout and walkDir are package-private deterministic test seams.
+	// Production always uses regular-file, same-descriptor loading and
+	// filepath.WalkDir respectively.
+	loadRollout func(string) (loadedRollout, error)
+	walkDir     func(string, fs.WalkDirFunc) error
+}
+
+type loadedRollout struct {
+	Path string
+	Data []byte
+}
+
+func rolloutRegularMode(mode fs.FileMode) bool {
+	return mode.Type() == 0
+}
+
+func readRegularRollout(path string) (loadedRollout, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return loadedRollout{}, fmt.Errorf("lstat rollout: %w", err)
+	}
+	if !rolloutRegularMode(info.Mode()) {
+		return loadedRollout{}, errors.New("rollout is not a regular file")
+	}
+	file, err := os.Open(path) //nolint:gosec // Lstat above rejects known special entries; Stat below verifies the opened descriptor.
+	if err != nil {
+		return loadedRollout{}, fmt.Errorf("open rollout: %w", err)
+	}
+	defer file.Close()
+	opened, err := file.Stat()
+	if err != nil {
+		return loadedRollout{}, fmt.Errorf("stat opened rollout: %w", err)
+	}
+	if !rolloutRegularMode(opened.Mode()) || !os.SameFile(info, opened) {
+		return loadedRollout{}, errors.New("rollout changed or is not a regular file")
+	}
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return loadedRollout{}, fmt.Errorf("read rollout: %w", err)
+	}
+	return loadedRollout{Path: path, Data: data}, nil
+}
+
+func (c *CodexAgent) loadCandidateRollout(path string) (loadedRollout, error) {
+	if c.loadRollout != nil {
+		return c.loadRollout(path)
+	}
+	return readRegularRollout(path)
+}
+
+func (c *CodexAgent) loadVerifiedRollout(path, agentID string) (loadedRollout, bool) {
+	loaded, err := c.loadCandidateRollout(path)
+	if err != nil {
+		return loadedRollout{}, false
+	}
+	if loaded.Path == "" {
+		loaded.Path = path
+	}
+	if loaded.Path != path {
+		return loadedRollout{}, false
+	}
+	id, err := sessionMetaID(loaded.Data)
+	if err != nil || id != agentID {
+		return loadedRollout{}, false
+	}
+	return loaded, true
+}
+
+func (c *CodexAgent) rolloutRoots() []string {
+	if c.RolloutRoots != nil {
+		return c.RolloutRoots
+	}
+	sessionDir, err := c.GetSessionDir("")
+	if err != nil {
+		return nil
+	}
+	codexHome, err := resolveCodexHome()
+	if err != nil {
+		return []string{sessionDir}
+	}
+	return []string{sessionDir, filepath.Join(codexHome, "archived_sessions")}
+}
+
+func (c *CodexAgent) loadDirectRollout(ref agent.SubagentReference) (loadedRollout, bool) {
+	for _, path := range []string{ref.DeclaredTranscriptPath, ref.ResolvedTranscriptPath} {
+		if path == "" {
+			continue
+		}
+		if loaded, ok := c.loadVerifiedRollout(path, ref.AgentID); ok {
+			return loaded, true
+		}
+	}
+	return loadedRollout{}, false
+}
+
+func (c *CodexAgent) walkRollouts(root string, visit fs.WalkDirFunc) error {
+	if c.walkDir != nil {
+		return c.walkDir(root, visit)
+	}
+	if err := filepath.WalkDir(root, visit); err != nil {
+		return fmt.Errorf("walk Codex rollouts: %w", err)
+	}
+	return nil
+}
+
+// scanFallbackRollouts scans every configured root once. Any traversal or
+// regular-candidate metadata failure discards all results: partial results
+// cannot prove a child ID is unique.
+func (c *CodexAgent) scanFallbackRollouts(agentIDs map[string]struct{}) map[string]loadedRollout {
+	matches := make(map[string][]loadedRollout)
+	seenPaths := make(map[string]struct{})
+	for _, root := range c.rolloutRoots() {
+		if root == "" {
+			continue
+		}
+		walkErr := c.walkRollouts(root, func(path string, entry fs.DirEntry, entryErr error) error {
+			if entryErr != nil {
+				if path == root && errors.Is(entryErr, fs.ErrNotExist) {
+					return nil // Missing configured roots are normal.
+				}
+				return fmt.Errorf("walk rollout candidate: %w", entryErr)
+			}
+			if entry.IsDir() || filepath.Ext(path) != ".jsonl" {
+				return nil
+			}
+			info, err := entry.Info()
+			if err != nil {
+				return fmt.Errorf("stat rollout candidate: %w", err)
+			}
+			if !rolloutRegularMode(info.Mode()) {
+				return nil
+			}
+			loaded, err := c.loadCandidateRollout(path)
+			if err != nil {
+				return fmt.Errorf("load rollout candidate: %w", err)
+			}
+			if loaded.Path == "" {
+				loaded.Path = path
+			}
+			if loaded.Path != path {
+				return errors.New("rollout loader returned a different path")
+			}
+			id, err := sessionMetaID(loaded.Data)
+			if err != nil {
+				return fmt.Errorf("read rollout metadata: %w", err)
+			}
+			if _, wanted := agentIDs[id]; !wanted {
+				return nil
+			}
+			if _, duplicate := seenPaths[path]; !duplicate {
+				seenPaths[path] = struct{}{}
+				matches[id] = append(matches[id], loaded)
+			}
+			return nil
+		})
+		if walkErr != nil {
+			return nil
+		}
+	}
+	resolved := make(map[string]loadedRollout)
+	for id, candidates := range matches {
+		if len(candidates) == 1 {
+			resolved[id] = candidates[0]
+		}
+	}
+	return resolved
+}
+
+// resolveSubagentRollout is the path-only compatibility wrapper used by
+// callers that need only discovery. Inventory extraction uses the verified
+// bytes returned by the same load operation instead.
+func (c *CodexAgent) resolveSubagentRollout(ref agent.SubagentReference) string {
+	if ref.AgentID == "" {
+		return ""
+	}
+	if loaded, ok := c.loadDirectRollout(ref); ok {
+		return loaded.Path
+	}
+	if loaded, ok := c.scanFallbackRollouts(map[string]struct{}{ref.AgentID: {}})[ref.AgentID]; ok {
+		return loaded.Path
+	}
+	return ""
 }
 
 // NewCodexAgent creates a new Codex agent instance.
diff --git a/cmd/entire/cli/agent/codex/lifecycle.go b/cmd/entire/cli/agent/codex/lifecycle.go
index c33bdacfd1..f04adf6de2 100644
--- a/cmd/entire/cli/agent/codex/lifecycle.go
+++ b/cmd/entire/cli/agent/codex/lifecycle.go
@@ -150,6 +150,8 @@ func (c *CodexAgent) parseSubagentStart(stdin io.Reader) (*agent.Event, error) {
 		SessionID:    raw.SessionID,
 		SessionRef:   derefString(raw.TranscriptPath),
 		ToolUseID:    raw.AgentID,
+		TurnID:       raw.TurnID,
+		SubagentID:   raw.AgentID,
 		SubagentType: raw.AgentType,
 		Model:        raw.Model,
 		Timestamp:    time.Now(),
@@ -165,15 +167,18 @@ func (c *CodexAgent) parseSubagentStop(stdin io.Reader) (*agent.Event, error) {
 		return nil, err
 	}
 	return &agent.Event{
-		Type:                   agent.SubagentEnd,
-		SessionID:              raw.SessionID,
-		SessionRef:             derefString(raw.TranscriptPath),
-		ToolUseID:              raw.AgentID,
-		SubagentID:             raw.AgentID,
-		SubagentType:           raw.AgentType,
-		SubagentTranscriptPath: derefString(raw.AgentTranscriptPath),
-		Model:                  raw.Model,
-		Timestamp:              time.Now(),
+		Type:                    agent.SubagentEnd,
+		SessionID:               raw.SessionID,
+		SessionRef:              derefString(raw.TranscriptPath),
+		ToolUseID:               raw.AgentID,
+		TurnID:                  raw.TurnID,
+		SubagentID:              raw.AgentID,
+		StopHookActive:          raw.StopHookActive,
+		ProvisionalSubagentStop: true,
+		SubagentType:            raw.AgentType,
+		SubagentTranscriptPath:  derefString(raw.AgentTranscriptPath),
+		Model:                   raw.Model,
+		Timestamp:               time.Now(),
 	}, nil
 }
 
@@ -201,6 +206,9 @@ func (c *CodexAgent) parseTurnStart(stdin io.Reader) (*agent.Event, error) {
 	if err != nil {
 		return nil, err
 	}
+	if classifyRollout(derefString(raw.TranscriptPath)) != rolloutRoot {
+		return nil, nil //nolint:nilnil // only proven root rollouts mutate lifecycle state
+	}
 	return &agent.Event{
 		Type:       agent.TurnStart,
 		SessionID:  raw.SessionID,
@@ -272,6 +280,9 @@ func (c *CodexAgent) parseTurnEnd(stdin io.Reader) (*agent.Event, error) {
 	if err != nil {
 		return nil, err
 	}
+	if classifyRollout(derefString(raw.TranscriptPath)) != rolloutRoot {
+		return nil, nil //nolint:nilnil // only proven root rollouts mutate lifecycle state
+	}
 	return &agent.Event{
 		Type:       agent.TurnEnd,
 		SessionID:  raw.SessionID,
diff --git a/cmd/entire/cli/agent/codex/lifecycle_test.go b/cmd/entire/cli/agent/codex/lifecycle_test.go
index ed51ebfe51..74c4a11683 100644
--- a/cmd/entire/cli/agent/codex/lifecycle_test.go
+++ b/cmd/entire/cli/agent/codex/lifecycle_test.go
@@ -2,6 +2,8 @@ package codex
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -12,6 +14,13 @@ import (
 
 const testRolloutPath = "/Users/test/.codex/rollouts/01/01/rollout-20260324-550e8400.jsonl"
 
+func writeRootRollout(t *testing.T) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "rollout.jsonl")
+	require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":{"thread_source":"user"}}`+"\n"), 0o600))
+	return path
+}
+
 // SessionStart and SessionEnd share one parser, so they are covered together.
 // SessionEnd (Codex 0.146+) is what finally lets a quit Codex session be
 // finalized; its payload is thinner than every other Codex hook — no model, no
@@ -122,10 +131,11 @@ func TestCodexAgent_SessionEndBudgetFitsConfiguredTimeout(t *testing.T) {
 func TestParseHookEvent_UserPromptSubmit(t *testing.T) {
 	t.Parallel()
 	ag := &CodexAgent{}
+	rolloutPath := writeRootRollout(t)
 	input := `{
 		"session_id": "test-uuid",
 		"turn_id": "turn-123",
-		"transcript_path": "/tmp/rollout.jsonl",
+		"transcript_path": "` + rolloutPath + `",
 		"cwd": "/tmp/testrepo",
 		"hook_event_name": "UserPromptSubmit",
 		"model": "gpt-4.1",
@@ -138,7 +148,7 @@ func TestParseHookEvent_UserPromptSubmit(t *testing.T) {
 	require.NotNil(t, event)
 	require.Equal(t, agent.TurnStart, event.Type)
 	require.Equal(t, "test-uuid", event.SessionID)
-	require.Equal(t, "/tmp/rollout.jsonl", event.SessionRef)
+	require.Equal(t, rolloutPath, event.SessionRef)
 	require.Equal(t, "Create a hello.txt file", event.Prompt)
 	require.Equal(t, "gpt-4.1", event.Model)
 }
@@ -146,10 +156,11 @@ func TestParseHookEvent_UserPromptSubmit(t *testing.T) {
 func TestParseHookEvent_Stop(t *testing.T) {
 	t.Parallel()
 	ag := &CodexAgent{}
+	rolloutPath := writeRootRollout(t)
 	input := `{
 		"session_id": "test-uuid",
 		"turn_id": "turn-123",
-		"transcript_path": "/tmp/rollout.jsonl",
+		"transcript_path": "` + rolloutPath + `",
 		"cwd": "/tmp/testrepo",
 		"hook_event_name": "Stop",
 		"model": "gpt-4.1",
@@ -163,10 +174,80 @@ func TestParseHookEvent_Stop(t *testing.T) {
 	require.NotNil(t, event)
 	require.Equal(t, agent.TurnEnd, event.Type)
 	require.Equal(t, "test-uuid", event.SessionID)
-	require.Equal(t, "/tmp/rollout.jsonl", event.SessionRef)
+	require.Equal(t, rolloutPath, event.SessionRef)
 	require.Equal(t, "gpt-4.1", event.Model)
 }
 
+func TestParseHookEvent_UserPromptSubmitAndStopRequireRootRollout(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		metadata  string
+		wantEvent bool
+	}{
+		{
+			name:      "root thread source",
+			metadata:  `{"type":"session_meta","payload":{"thread_source":"user"}}` + "\n",
+			wantEvent: true,
+		},
+		{
+			name:      "root legacy string source",
+			metadata:  `{"type":"session_meta","payload":{"source":"exec"}}` + "\n",
+			wantEvent: true,
+		},
+		{
+			name:     "child thread source",
+			metadata: `{"type":"session_meta","payload":{"thread_source":"subagent"}}` + "\n",
+		},
+		{
+			name:     "child legacy structured source",
+			metadata: `{"type":"session_meta","payload":{"source":{"subagent":{"thread_spawn":{"parent_thread_id":"root-thread"}}}}}` + "\n",
+		},
+		{
+			name:     "missing session metadata",
+			metadata: `{"type":"response_item","payload":{}}` + "\n",
+		},
+		{
+			name:     "malformed JSON",
+			metadata: `{"type":"session_meta","payload":` + "\n",
+		},
+		{
+			name: "missing path",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			transcriptPath := ""
+			if tt.metadata != "" {
+				transcriptPath = filepath.Join(t.TempDir(), "rollout.jsonl")
+				require.NoError(t, os.WriteFile(transcriptPath, []byte(tt.metadata), 0o600))
+			}
+
+			for _, hookName := range []string{HookNameUserPromptSubmit, HookNameStop} {
+				t.Run(hookName, func(t *testing.T) {
+					t.Parallel()
+					pathJSON := "null"
+					if transcriptPath != "" {
+						pathJSON = `"` + transcriptPath + `"`
+					}
+					input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":` + pathJSON + `,"model":"gpt-5","prompt":"do work","stop_hook_active":true}`
+
+					event, err := (&CodexAgent{}).ParseHookEvent(context.Background(), hookName, strings.NewReader(input))
+					require.NoError(t, err)
+					if tt.wantEvent {
+						require.NotNil(t, event)
+					} else {
+						require.Nil(t, event)
+					}
+				})
+			}
+		})
+	}
+}
+
 func TestParseHookEvent_PreToolUse_ReturnsNil(t *testing.T) {
 	t.Parallel()
 	ag := &CodexAgent{}
@@ -323,6 +404,45 @@ func TestCodexAgent_ContextInjector(t *testing.T) {
 // testCodexAgentID is the subagent thread id used by the subagent hook tests.
 const testCodexAgentID = "child-thread-9"
 
+func TestParseHookEvent_SubagentNormalizesHookIdentity(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name            string
+		hookName        string
+		input           string
+		stopHookActive  bool
+		provisionalStop bool
+	}{
+		{
+			name:     "start",
+			hookName: HookNameSubagentStart,
+			input:    `{"session_id":"root-session-1","turn_id":"turn-child-1","agent_id":"agent-child-1","agent_type":"reviewer"}`,
+		},
+		{
+			name:            "stop",
+			hookName:        HookNameSubagentStop,
+			input:           `{"session_id":"root-session-1","turn_id":"turn-child-1","agent_id":"agent-child-1","agent_type":"reviewer","stop_hook_active":true}`,
+			stopHookActive:  true,
+			provisionalStop: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			ev, err := (&CodexAgent{}).ParseHookEvent(context.Background(), tt.hookName, strings.NewReader(tt.input))
+			require.NoError(t, err)
+			require.NotNil(t, ev)
+			require.Equal(t, "turn-child-1", ev.TurnID)
+			require.Equal(t, "agent-child-1", ev.SubagentID)
+			require.Equal(t, tt.stopHookActive, ev.StopHookActive)
+			require.Equal(t, tt.provisionalStop, ev.ProvisionalSubagentStop)
+			require.False(t, ev.Final)
+		})
+	}
+}
+
 // TestParseHookEvent_SubagentStart pins the identity mapping, which is the part a
 // future reader is most likely to get backwards: session_id is the identity shared
 // by the root thread and all descendants (the user's session), agent_id the child
diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
new file mode 100644
index 0000000000..9deebb2435
--- /dev/null
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -0,0 +1,530 @@
+package codex
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveRollout_UsesExactMetadataID(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	active := filepath.Join(root, "sessions")
+	archived := filepath.Join(root, "archived_sessions")
+	ag := &CodexAgent{RolloutRoots: []string{active, archived}}
+
+	activePath := writeRollout(t, active, "2026/08/31/rollout-near-child-a.jsonl", "child-a", nil)
+	archivedPath := writeRollout(t, archived, "2026/08/30/rollout-child-b.jsonl", "child-b", nil)
+	writeRollout(t, active, "2026/08/31/rollout-child-a-suffix.jsonl", "not-child-a", nil)
+
+	got := ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child-a"})
+	require.Equal(t, activePath, got)
+
+	got = ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child-b"})
+	require.Equal(t, archivedPath, got)
+}
+
+func TestResolveRollout_DefaultCodexHomeIncludesArchivedSessions(t *testing.T) {
+	// This test changes CODEX_HOME, so it must not run in parallel.
+	codexHome := t.TempDir()
+	t.Setenv("CODEX_HOME", codexHome)
+	t.Setenv("ENTIRE_TEST_CODEX_SESSION_DIR", "")
+
+	active := filepath.Join(codexHome, "sessions")
+	archived := filepath.Join(codexHome, "archived_sessions")
+	activePath := writeRollout(t, active, "2026/08/31/rollout-active.jsonl", "active", nil)
+	archivedPath := writeRollout(t, archived, "2026/08/30/rollout-archived.jsonl", "archived", nil)
+	ag := &CodexAgent{}
+
+	require.Equal(t, activePath, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "active"}))
+	require.Equal(t, archivedPath, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "archived"}))
+}
+
+func TestResolveRollout_MismatchedKnownPathsFallBackOnlyToExactID(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	active := filepath.Join(root, "sessions")
+	ag := &CodexAgent{RolloutRoots: []string{active}}
+	mismatch := writeRollout(t, root, "declared.jsonl", "wrong", nil)
+	exact := writeRollout(t, active, "2026/08/31/rollout-child.jsonl", "child", nil)
+
+	for _, ref := range []agent.SubagentReference{
+		{AgentID: "child", DeclaredTranscriptPath: mismatch},
+		{AgentID: "child", ResolvedTranscriptPath: mismatch},
+	} {
+		require.Equal(t, exact, ag.resolveSubagentRollout(ref))
+	}
+}
+
+func TestResolveRollout_KnownExactPathsNeedNoFallbackRoot(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	declared := writeRollout(t, root, "declared.jsonl", "declared", nil)
+	resolved := writeRollout(t, root, "resolved.jsonl", "resolved", nil)
+	ag := &CodexAgent{RolloutRoots: []string{filepath.Join(root, "no-fallback-here")}}
+
+	require.Equal(t, declared, ag.resolveSubagentRollout(agent.SubagentReference{
+		AgentID:                "declared",
+		DeclaredTranscriptPath: declared,
+	}))
+	require.Equal(t, resolved, ag.resolveSubagentRollout(agent.SubagentReference{
+		AgentID:                "resolved",
+		ResolvedTranscriptPath: resolved,
+	}))
+}
+
+func TestResolveRollout_RejectsInferredAndAmbiguousCandidates(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	active := filepath.Join(root, "sessions")
+	ag := &CodexAgent{RolloutRoots: []string{active}}
+	writeRollout(t, active, "2026/08/31/rollout-child.jsonl", "childish", nil)
+	require.Empty(t, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child"}))
+
+	writeRollout(t, active, "2026/08/30/rollout-child-one.jsonl", "child", nil)
+	writeRollout(t, active, "2026/08/31/rollout-child-two.jsonl", "child", nil)
+	require.Empty(t, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child"}))
+}
+
+func TestResolveRollout_RejectsSymlinkHint(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	target := writeRollout(t, root, "target.jsonl", "child", nil)
+	link := filepath.Join(root, "child-link.jsonl")
+	require.NoError(t, os.Symlink(target, link))
+
+	ag := &CodexAgent{RolloutRoots: []string{}}
+	require.Empty(t, ag.resolveSubagentRollout(agent.SubagentReference{
+		AgentID:                "child",
+		DeclaredTranscriptPath: link,
+	}))
+}
+
+func TestRolloutRegularMode_RejectsSpecialEntries(t *testing.T) {
+	t.Parallel()
+
+	for _, mode := range []fs.FileMode{0, fs.ModeDir, fs.ModeSymlink, fs.ModeNamedPipe, fs.ModeDevice, fs.ModeSocket} {
+		require.Equal(t, mode == 0, rolloutRegularMode(mode), "mode %v", mode)
+	}
+}
+
+func TestTerminalTurnIDs_OnlyAcceptsUnambiguousBoundaries(t *testing.T) {
+	t.Parallel()
+
+	valid := rolloutData(t, "child", []json.RawMessage{
+		taskEvent("task_started", stringPointer("one")),
+		taskEvent("task_complete", stringPointer("one")),
+		taskEvent("task_started", stringPointer("two")),
+		taskEvent("task_complete", nil),
+	})
+	require.Equal(t, []string{"one", "two"}, terminalTurnIDs(valid))
+
+	for _, invalid := range [][]json.RawMessage{
+		{taskEvent("task_complete", stringPointer("one"))},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_started", stringPointer("two")), taskEvent("task_complete", nil)},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("two"))},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")), taskEvent("task_complete", stringPointer("one"))},
+	} {
+		require.Empty(t, terminalTurnIDs(rolloutData(t, "child", invalid)))
+	}
+}
+
+func TestTerminalTurnIDs_RealWireShape(t *testing.T) {
+	t.Parallel()
+
+	modern := rolloutData(t, "child", []json.RawMessage{
+		taskEvent("task_started", stringPointer("modern")),
+		taskEvent("task_complete", stringPointer("modern")),
+	})
+	require.Equal(t, []string{"modern"}, terminalTurnIDs(modern))
+
+	legacy := rolloutData(t, "child", []json.RawMessage{
+		taskEvent("task_started", stringPointer("legacy")),
+		taskEvent("task_complete", nil),
+	})
+	require.Equal(t, []string{"legacy"}, terminalTurnIDs(legacy))
+}
+
+func TestTerminalTurnIDs_RejectsInvalidRealWireBoundaries(t *testing.T) {
+	t.Parallel()
+
+	validThenMalformed := []json.RawMessage{
+		taskEvent("task_started", stringPointer("one")),
+		taskEvent("task_complete", stringPointer("one")),
+		json.RawMessage(`{"type":"event_msg","payload":{"type":"task_started","turn_id":`),
+	}
+	for _, invalid := range [][]json.RawMessage{
+		{taskEvent("task_complete", stringPointer("one"))},
+		{taskEvent("task_started", nil)},
+		{taskEvent("task_started", stringPointer("one"))},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_started", stringPointer("two"))},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("two"))},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")), taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one"))},
+		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", nil), taskEvent("task_complete", nil)},
+		{json.RawMessage(`{"type":"event_msg","payload":{"type":"task_started","turn_id":7}}`)},
+		validThenMalformed,
+	} {
+		require.Empty(t, terminalTurnIDs(rolloutData(t, "child", invalid)))
+	}
+}
+
+func TestExactTokenUsage_UsesOnlyLastRecognizableSnapshot(t *testing.T) {
+	t.Parallel()
+
+	valid := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
+		"input_tokens": 15, "cached_input_tokens": 12, "output_tokens": 3,
+		"reasoning_output_tokens": 2, "total_tokens": 18,
+	}})
+	usage := exactCumulativeTokenUsage(rolloutData(t, "child", []json.RawMessage{valid}))
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 12, OutputTokens: 3}, usage)
+
+	malformedLast := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
+		"input_tokens": 10, "cached_input_tokens": 11, "output_tokens": 3,
+	}})
+	require.Nil(t, exactCumulativeTokenUsage(rolloutData(t, "child", []json.RawMessage{valid, malformedLast})))
+
+	missingRequired := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
+		"input_tokens": 10, "output_tokens": 3,
+	}})
+	require.Nil(t, exactCumulativeTokenUsage(rolloutData(t, "child", []json.RawMessage{missingRequired})))
+}
+
+func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testing.T) {
+	t.Parallel()
+
+	valid := func(values map[string]any) []byte {
+		return rolloutData(t, "child", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": values})})
+	}
+	require.Nil(t, exactCumulativeTokenUsage(rolloutData(t, "child", nil)))
+
+	for _, values := range []map[string]any{
+		{"cached_input_tokens": 0, "output_tokens": 1},
+		{"input_tokens": 1, "output_tokens": 1},
+		{"input_tokens": 1, "cached_input_tokens": 0},
+		{"input_tokens": -1, "cached_input_tokens": 0, "output_tokens": 0},
+		{"input_tokens": 1, "cached_input_tokens": -1, "output_tokens": 0},
+		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": -1},
+		{"input_tokens": 1, "cached_input_tokens": 2, "output_tokens": 0},
+		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "total_tokens": -1},
+		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "total_tokens": 1},
+		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "reasoning_output_tokens": -1},
+		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "reasoning_output_tokens": 2},
+	} {
+		require.Nil(t, exactCumulativeTokenUsage(valid(values)))
+	}
+
+	zeros := exactCumulativeTokenUsage(valid(map[string]any{"input_tokens": 0, "cached_input_tokens": 0, "output_tokens": 0}))
+	require.Equal(t, &agent.TokenUsage{}, zeros)
+
+	multiple := rolloutData(t, "child", []json.RawMessage{
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 9, "cached_input_tokens": 1, "output_tokens": 2}}),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
+	})
+	usage := exactCumulativeTokenUsage(multiple)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 1, OutputTokens: 2}, usage)
+	require.Zero(t, usage.APICallCount, "snapshot record count is not an API-call count")
+
+	malformedFinal := rolloutData(t, "child", []json.RawMessage{
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
+		tokenCountEvent(map[string]any{"total_token_usage": "not-an-object"}),
+	})
+	require.Nil(t, exactCumulativeTokenUsage(malformedFinal), "must not fall back to the earlier valid snapshot")
+}
+
+func TestSubagentInventory_CollectsExactEvidenceAndDoesNotPartialAggregate(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	ag := &CodexAgent{RolloutRoots: []string{root}}
+	childOne := writeRollout(t, root, "rollout-one.jsonl", "one", []json.RawMessage{
+		patchEvent("child.txt"),
+		taskEvent("task_started", stringPointer("child-turn")),
+		taskEvent("task_complete", stringPointer("child-turn")),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 5, "cached_input_tokens": 2, "output_tokens": 1}}),
+	})
+	childTwo := writeRollout(t, root, "rollout-two.jsonl", "two", []json.RawMessage{
+		patchEvent("two.txt"),
+		taskEvent("task_started", stringPointer("two-turn")),
+		taskEvent("task_complete", stringPointer("two-turn")),
+	})
+	parent := rolloutData(t, "parent", []json.RawMessage{patchEvent("parent.txt")})
+
+	result, err := ag.ExtractWithSubagentInventory(parent, 0, []agent.SubagentReference{
+		{AgentID: "one", DeclaredTranscriptPath: childOne},
+		{AgentID: "two", ResolvedTranscriptPath: childTwo},
+	})
+	require.NoError(t, err)
+	require.Equal(t, []string{"parent.txt", "child.txt", "two.txt"}, result.ModifiedFiles)
+	require.Len(t, result.Children, 2)
+	require.Equal(t, childOne, result.Children[0].ResolvedPath)
+	require.Equal(t, []string{"child.txt"}, result.Children[0].ModifiedFiles)
+	require.Equal(t, []string{"child-turn"}, result.Children[0].TerminalTurnIDs)
+	require.NotNil(t, result.Children[0].TokenUsage)
+	require.Equal(t, []string{"two.txt"}, result.Children[1].ModifiedFiles)
+	require.Equal(t, []string{"two-turn"}, result.Children[1].TerminalTurnIDs)
+	require.Nil(t, result.Children[1].TokenUsage)
+	require.NotNil(t, result.TokenUsage)
+	require.Nil(t, result.TokenUsage.SubagentTokens)
+	require.NotNil(t, result.TokenUsage.SubagentTokensComplete)
+	require.False(t, *result.TokenUsage.SubagentTokensComplete)
+}
+
+func TestSubagentInventory_AggregatesOnlyCompleteExactChildren(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	ag := &CodexAgent{RolloutRoots: []string{root}}
+	first := writeRollout(t, root, "first.jsonl", "first", []json.RawMessage{
+		patchEvent("first.txt"),
+		taskEvent("task_started", stringPointer("first-turn")),
+		taskEvent("task_complete", stringPointer("first-turn")),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 5, "cached_input_tokens": 2, "output_tokens": 1}}),
+	})
+	second := writeRollout(t, root, "second.jsonl", "second", []json.RawMessage{
+		patchEvent("second.txt"),
+		taskEvent("task_started", stringPointer("second-turn")),
+		taskEvent("task_complete", nil),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 10, "cached_input_tokens": 3, "output_tokens": 5}}),
+	})
+
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{
+		{AgentID: "first", DeclaredTranscriptPath: first},
+		{AgentID: "second", ResolvedTranscriptPath: second},
+	})
+	require.NoError(t, err)
+	require.Equal(t, []string{"first.txt", "second.txt"}, result.ModifiedFiles)
+	require.Len(t, result.Children, 2, "one analysis is retained for each supplied reference")
+	require.Equal(t, "first", result.Children[0].AgentID)
+	require.Equal(t, first, result.Children[0].ResolvedPath)
+	require.Equal(t, []string{"first.txt"}, result.Children[0].ModifiedFiles)
+	require.Equal(t, []string{"first-turn"}, result.Children[0].TerminalTurnIDs)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1}, result.Children[0].TokenUsage)
+	require.Equal(t, "second", result.Children[1].AgentID)
+	require.Equal(t, second, result.Children[1].ResolvedPath)
+	require.Equal(t, []string{"second.txt"}, result.Children[1].ModifiedFiles)
+	require.Equal(t, []string{"second-turn"}, result.Children[1].TerminalTurnIDs)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 7, CacheReadTokens: 3, OutputTokens: 5}, result.Children[1].TokenUsage)
+	require.NotNil(t, result.TokenUsage)
+	require.NotNil(t, result.TokenUsage.SubagentTokensComplete)
+	require.True(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 10, CacheReadTokens: 5, OutputTokens: 6}, result.TokenUsage.SubagentTokens)
+}
+
+func TestSubagentInventory_EmptyInventoryIsExactWithoutChildTotal(t *testing.T) {
+	t.Parallel()
+
+	result, err := (&CodexAgent{RolloutRoots: []string{t.TempDir()}}).ExtractWithSubagentInventory(nil, 0, nil)
+	require.NoError(t, err)
+	require.Empty(t, result.Children)
+	require.NotNil(t, result.TokenUsage)
+	require.NotNil(t, result.TokenUsage.SubagentTokensComplete)
+	require.True(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Nil(t, result.TokenUsage.SubagentTokens)
+}
+
+func TestSubagentInventory_UnresolvedChildPreventsPartialAggregate(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	ag := &CodexAgent{RolloutRoots: []string{root}}
+	available := writeRollout(t, root, "available.jsonl", "available", []json.RawMessage{
+		patchEvent("available.txt"),
+		taskEvent("task_started", stringPointer("available-turn")),
+		taskEvent("task_complete", stringPointer("available-turn")),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 2, "cached_input_tokens": 1, "output_tokens": 1}}),
+	})
+
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{
+		{AgentID: "available", DeclaredTranscriptPath: available},
+		{AgentID: "missing"},
+	})
+	require.NoError(t, err)
+	require.Len(t, result.Children, 2)
+	require.Equal(t, []string{"available.txt"}, result.ModifiedFiles)
+	require.Equal(t, []string{"available-turn"}, result.Children[0].TerminalTurnIDs)
+	require.NotNil(t, result.Children[0].TokenUsage)
+	require.Empty(t, result.Children[1].ResolvedPath)
+	require.Nil(t, result.Children[1].TokenUsage)
+	require.False(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Nil(t, result.TokenUsage.SubagentTokens)
+}
+
+func TestSubagentInventory_LoaderFailureFailsClosedBeforeResolution(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	path := writeRollout(t, root, "child.jsonl", "child", []json.RawMessage{
+		patchEvent("child.txt"),
+		taskEvent("task_started", stringPointer("child-turn")),
+		taskEvent("task_complete", stringPointer("child-turn")),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 2, "cached_input_tokens": 1, "output_tokens": 1}}),
+	})
+	readFailure := errors.New("injected child load failure")
+	ag := &CodexAgent{
+		RolloutRoots: []string{},
+		loadRollout: func(gotPath string) (loadedRollout, error) {
+			if gotPath == "" {
+				return loadedRollout{}, readFailure
+			}
+			require.Equal(t, path, gotPath)
+			return loadedRollout{}, readFailure
+		},
+	}
+
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{
+		AgentID:                "child",
+		DeclaredTranscriptPath: path,
+	}})
+	require.NoError(t, err)
+	require.Len(t, result.Children, 1)
+	require.Equal(t, "child", result.Children[0].AgentID)
+	require.Empty(t, result.Children[0].ResolvedPath, "same-byte validation cannot retain a failed load")
+	require.Empty(t, result.Children[0].ModifiedFiles)
+	require.Empty(t, result.Children[0].TerminalTurnIDs)
+	require.Nil(t, result.Children[0].TokenUsage)
+	require.False(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Nil(t, result.TokenUsage.SubagentTokens)
+}
+
+func TestSubagentInventory_RevalidatesInjectedRolloutBytes(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "child.jsonl")
+	ag := &CodexAgent{
+		RolloutRoots: []string{},
+		loadRollout: func(gotPath string) (loadedRollout, error) {
+			if gotPath == "" {
+				return loadedRollout{}, errors.New("empty path")
+			}
+			require.Equal(t, path, gotPath)
+			return loadedRollout{Path: path, Data: rolloutData(t, "other-child", nil)}, nil
+		},
+	}
+
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{
+		AgentID:                "child",
+		DeclaredTranscriptPath: path,
+	}})
+	require.NoError(t, err)
+	require.Empty(t, result.Children[0].ResolvedPath)
+	require.False(t, *result.TokenUsage.SubagentTokensComplete)
+}
+
+func TestSubagentInventory_BatchesFallbackTraversal(t *testing.T) {
+	t.Parallel()
+
+	firstRoot := t.TempDir()
+	secondRoot := t.TempDir()
+	first := writeRollout(t, firstRoot, "first.jsonl", "first", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1}})})
+	second := writeRollout(t, secondRoot, "second.jsonl", "second", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 2, "cached_input_tokens": 0, "output_tokens": 1}})})
+	_ = first
+	_ = second
+	walks := 0
+	ag := &CodexAgent{
+		RolloutRoots: []string{firstRoot, secondRoot},
+		walkDir: func(root string, visit fs.WalkDirFunc) error {
+			walks++
+			return filepath.WalkDir(root, visit)
+		},
+	}
+
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{AgentID: "first"}, {AgentID: "second"}})
+	require.NoError(t, err)
+	require.Equal(t, 2, walks, "one traversal per configured root, not per child")
+	require.Equal(t, []string{"first", "second"}, []string{result.Children[0].AgentID, result.Children[1].AgentID})
+	require.True(t, *result.TokenUsage.SubagentTokensComplete)
+}
+
+func TestSubagentInventory_FallbackTraversalFailureDiscardsMatches(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	writeRollout(t, root, "child.jsonl", "child", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1}})})
+	traversalFailure := errors.New("injected traversal failure after match")
+	ag := &CodexAgent{
+		RolloutRoots: []string{root},
+		walkDir: func(root string, visit fs.WalkDirFunc) error {
+			require.NoError(t, filepath.WalkDir(root, visit))
+			return traversalFailure
+		},
+	}
+
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{AgentID: "child"}})
+	require.NoError(t, err)
+	require.Empty(t, result.Children[0].ResolvedPath)
+	require.False(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Nil(t, result.TokenUsage.SubagentTokens)
+}
+
+func writeRollout(t *testing.T, root, name, id string, events []json.RawMessage) string {
+	t.Helper()
+	path := filepath.Join(root, name)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, rolloutData(t, id, events), 0o600))
+	return path
+}
+
+func rolloutData(t *testing.T, id string, events []json.RawMessage) []byte {
+	t.Helper()
+	lines := make([][]byte, 0, len(events)+1)
+	meta, err := json.Marshal(map[string]any{"type": "session_meta", "payload": map[string]any{"id": id}})
+	require.NoError(t, err)
+	lines = append(lines, meta)
+	for _, event := range events {
+		lines = append(lines, event)
+	}
+	return append([]byte(joinLines(lines)), '\n')
+}
+
+func tokenCountEvent(info map[string]any) json.RawMessage {
+	data, err := json.Marshal(map[string]any{"type": "event_msg", "payload": map[string]any{"type": "token_count", "info": info}})
+	if err != nil {
+		panic(err)
+	}
+	return data
+}
+
+func taskEvent(eventType string, turnID *string) json.RawMessage {
+	payload := map[string]any{"type": eventType}
+	if turnID != nil {
+		payload["turn_id"] = *turnID
+	}
+	data, err := json.Marshal(map[string]any{"type": "event_msg", "payload": payload})
+	if err != nil {
+		panic(err)
+	}
+	return data
+}
+
+func stringPointer(value string) *string { return &value }
+
+func patchEvent(path string) json.RawMessage {
+	data, err := json.Marshal(map[string]any{"type": "response_item", "payload": map[string]any{"type": "custom_tool_call", "name": "apply_patch", "input": "*** Update File: " + path}})
+	if err != nil {
+		panic(err)
+	}
+	return data
+}
+
+func joinLines(lines [][]byte) string {
+	var result strings.Builder
+	for index, line := range lines {
+		if index > 0 {
+			result.WriteByte('\n')
+		}
+		result.Write(line)
+	}
+	return result.String()
+}
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index 3c98d9f7ff..d0cd495824 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -20,11 +20,50 @@ import (
 var (
 	_ agent.TranscriptAnalyzer          = (*CodexAgent)(nil)
 	_ agent.TokenCalculator             = (*CodexAgent)(nil)
+	_ agent.InventoryAwareExtractor     = (*CodexAgent)(nil)
 	_ agent.PromptExtractor             = (*CodexAgent)(nil)
 	_ agent.RestoredSessionPathResolver = (*CodexAgent)(nil)
 	_ agent.TranscriptSanitizer         = (*CodexAgent)(nil)
 )
 
+// readSessionMetaID reads the first record of a Codex rollout and returns its
+// non-empty native thread ID. Callers use it to prove a path belongs to a
+// supplied child rather than inferring that fact from its filename or age.
+//
+//nolint:unused // Kept as the path helper for direct internal callers; evidence uses same-byte loading instead.
+func readSessionMetaID(path string) (string, error) {
+	if path == "" {
+		return "", errors.New("empty rollout path")
+	}
+	loaded, err := readRegularRollout(path)
+	if err != nil {
+		return "", fmt.Errorf("load rollout: %w", err)
+	}
+	return sessionMetaID(loaded.Data)
+}
+
+func sessionMetaID(data []byte) (string, error) {
+	lines := splitJSONL(data)
+	if len(lines) == 0 {
+		return "", errors.New("rollout is empty")
+	}
+	var line rolloutLine
+	if err := json.Unmarshal(lines[0], &line); err != nil {
+		return "", fmt.Errorf("parse first rollout record: %w", err)
+	}
+	if line.Type != rolloutLineTypeSessionMeta {
+		return "", fmt.Errorf("first transcript line is %q, want session_meta", line.Type)
+	}
+	var meta sessionMetaPayload
+	if err := json.Unmarshal(line.Payload, &meta); err != nil {
+		return "", fmt.Errorf("parse session_meta payload: %w", err)
+	}
+	if meta.ID == "" {
+		return "", errors.New("session_meta id is empty")
+	}
+	return meta.ID, nil
+}
+
 // rolloutLine is the top-level JSONL line structure in Codex rollout files.
 type rolloutLine struct {
 	Timestamp string          `json:"timestamp"`
@@ -32,12 +71,92 @@ type rolloutLine struct {
 	Payload   json.RawMessage `json:"payload"`
 }
 
-const rolloutLineTypeResponseItem = "response_item"
+const (
+	rolloutLineTypeResponseItem = "response_item"
+	rolloutLineTypeSessionMeta  = "session_meta"
+	rolloutLineTypeEventMsg     = "event_msg"
+	eventMsgTypeTokenCount      = "token_count"
+)
+
+// rolloutClassification identifies whether a rollout belongs to a root thread
+// or a child thread. Lifecycle hooks mutate the root session, so uncertainty is
+// intentionally distinct from root and must not be treated as a root rollout.
+type rolloutClassification uint8
+
+const (
+	rolloutUnknown rolloutClassification = iota
+	rolloutRoot
+	rolloutChild
+)
 
 // sessionMetaPayload is the payload for type="session_meta" lines.
 type sessionMetaPayload struct {
-	ID        string `json:"id"`
-	Timestamp string `json:"timestamp"`
+	ID           string          `json:"id"`
+	Timestamp    string          `json:"timestamp"`
+	ThreadSource string          `json:"thread_source"`
+	Source       json.RawMessage `json:"source"`
+}
+
+// classifyRollout reads only the rollout's session_meta record. Newer Codex
+// rollouts identify root and child threads with thread_source; older rollouts
+// encode their source as either a recognized root string or source.subagent.
+func classifyRollout(path string) rolloutClassification {
+	if path == "" {
+		return rolloutUnknown
+	}
+
+	file, err := os.Open(path) //nolint:gosec // Path comes from agent hook input
+	if err != nil {
+		return rolloutUnknown
+	}
+	defer file.Close()
+
+	lineData, err := bufio.NewReader(file).ReadBytes('\n')
+	if err != nil && !errors.Is(err, io.EOF) {
+		return rolloutUnknown
+	}
+
+	var line rolloutLine
+	if json.Unmarshal(lineData, &line) != nil || line.Type != rolloutLineTypeSessionMeta {
+		return rolloutUnknown
+	}
+
+	var meta sessionMetaPayload
+	if json.Unmarshal(line.Payload, &meta) != nil {
+		return rolloutUnknown
+	}
+
+	switch meta.ThreadSource {
+	case "user":
+		return rolloutRoot
+	case "subagent":
+		return rolloutChild
+	case "":
+		// Fall through to the legacy source encoding.
+	default:
+		return rolloutUnknown
+	}
+
+	var source string
+	if json.Unmarshal(meta.Source, &source) == nil {
+		switch source {
+		case "startup", "resume", "clear", "compact", "cli", codexExecCommand, "vscode", "mcp":
+			return rolloutRoot
+		default:
+			return rolloutUnknown
+		}
+	}
+
+	var structuredSource struct {
+		Subagent json.RawMessage `json:"subagent"`
+	}
+	if json.Unmarshal(meta.Source, &structuredSource) == nil &&
+		len(structuredSource.Subagent) > 0 &&
+		!bytes.Equal(structuredSource.Subagent, []byte("null")) {
+		return rolloutChild
+	}
+
+	return rolloutUnknown
 }
 
 // responseItemPayload is the payload for type="response_item" lines.
@@ -57,8 +176,9 @@ type contentItem struct {
 
 // eventMsgPayload is the payload for type="event_msg" lines.
 type eventMsgPayload struct {
-	Type string          `json:"type"` // "token_count", "task_started", "user_message", "agent_message", "task_complete"
-	Info json.RawMessage `json:"info,omitempty"`
+	Type   string          `json:"type"` // "token_count", "task_started", "user_message", "agent_message", "task_complete"
+	TurnID *string         `json:"turn_id,omitempty"`
+	Info   json.RawMessage `json:"info,omitempty"`
 }
 
 // tokenCountInfo contains token usage data from event_msg.token_count.
@@ -75,6 +195,17 @@ type tokenUsageData struct {
 	TotalTokens           int `json:"total_tokens"`
 }
 
+// exactTokenUsageData uses pointers so a native zero is distinguishable from a
+// field Codex did not report. It is used for child cumulative snapshots, where
+// approximation would turn an incomplete inventory into a misleading total.
+type exactTokenUsageData struct {
+	InputTokens           *int `json:"input_tokens"`
+	CachedInputTokens     *int `json:"cached_input_tokens"`
+	OutputTokens          *int `json:"output_tokens"`
+	ReasoningOutputTokens *int `json:"reasoning_output_tokens"`
+	TotalTokens           *int `json:"total_tokens"`
+}
+
 // Apply-patch envelope verbs Codex uses in tool_input.command — see
 // codex-rs/core/src/tools/handlers/apply_patch.rs. Capture group 1 is the
 // verb, group 2 is the path.
@@ -280,14 +411,14 @@ func (c *CodexAgent) CalculateTokenUsage(transcriptData []byte, fromOffset int)
 		if json.Unmarshal(lineData, &line) != nil {
 			continue
 		}
-		if line.Type != "event_msg" {
+		if line.Type != rolloutLineTypeEventMsg {
 			continue
 		}
 		var evt eventMsgPayload
 		if json.Unmarshal(line.Payload, &evt) != nil {
 			continue
 		}
-		if evt.Type != "token_count" || len(evt.Info) == 0 {
+		if evt.Type != eventMsgTypeTokenCount || len(evt.Info) == 0 {
 			continue
 		}
 		var info tokenCountInfo
@@ -330,6 +461,201 @@ func (c *CodexAgent) CalculateTokenUsage(transcriptData []byte, fromOffset int)
 	}, nil
 }
 
+// exactCumulativeTokenUsage returns the last recognizable Codex token_count
+// snapshot exactly as reported. A malformed final snapshot makes the entire
+// result unavailable instead of silently falling back to an earlier record.
+func exactCumulativeTokenUsage(data []byte) *agent.TokenUsage {
+	var lastInfo json.RawMessage
+	found := false
+	for _, lineData := range splitJSONL(data) {
+		var line rolloutLine
+		if json.Unmarshal(lineData, &line) != nil || line.Type != rolloutLineTypeEventMsg {
+			continue
+		}
+		var event eventMsgPayload
+		if json.Unmarshal(line.Payload, &event) != nil || event.Type != eventMsgTypeTokenCount {
+			continue
+		}
+		found = true
+		lastInfo = event.Info
+	}
+	if !found || len(lastInfo) == 0 {
+		return nil
+	}
+	var info struct {
+		TotalTokenUsage *exactTokenUsageData `json:"total_token_usage"`
+	}
+	if json.Unmarshal(lastInfo, &info) != nil || info.TotalTokenUsage == nil {
+		return nil
+	}
+	usage := info.TotalTokenUsage
+	if usage.InputTokens == nil || usage.CachedInputTokens == nil || usage.OutputTokens == nil {
+		return nil
+	}
+	input, cached, output := *usage.InputTokens, *usage.CachedInputTokens, *usage.OutputTokens
+	if input < 0 || cached < 0 || output < 0 || cached > input {
+		return nil
+	}
+	if usage.ReasoningOutputTokens != nil && (*usage.ReasoningOutputTokens < 0 || *usage.ReasoningOutputTokens > output) {
+		return nil
+	}
+	if usage.TotalTokens != nil && (*usage.TotalTokens < 0 || *usage.TotalTokens != input+output) {
+		return nil
+	}
+	return &agent.TokenUsage{InputTokens: input - cached, CacheReadTokens: cached, OutputTokens: output}
+}
+
+// terminalTurnIDs accepts only ordered, one-at-a-time task boundaries. Modern
+// records name the same turn at both ends; the legacy ID-less completion is
+// accepted only while exactly one started turn is open.
+func terminalTurnIDs(data []byte) []string {
+	var terminal []string
+	open := ""
+	seen := make(map[string]struct{})
+	for _, lineData := range splitJSONL(data) {
+		var line rolloutLine
+		if json.Unmarshal(lineData, &line) != nil {
+			return nil
+		}
+		if line.Type != rolloutLineTypeEventMsg {
+			continue
+		}
+		var rawEvent struct {
+			Type string `json:"type"`
+		}
+		if json.Unmarshal(line.Payload, &rawEvent) != nil {
+			return nil
+		}
+		if rawEvent.Type != "task_started" && rawEvent.Type != "task_complete" {
+			continue
+		}
+		var event eventMsgPayload
+		if json.Unmarshal(line.Payload, &event) != nil {
+			return nil
+		}
+		switch event.Type {
+		case "task_started":
+			if open != "" || event.TurnID == nil || *event.TurnID == "" {
+				return nil
+			}
+			if _, duplicate := seen[*event.TurnID]; duplicate {
+				return nil
+			}
+			open = *event.TurnID
+		case "task_complete":
+			if open == "" || (event.TurnID != nil && (*event.TurnID == "" || *event.TurnID != open)) {
+				return nil
+			}
+			terminal = append(terminal, open)
+			seen[open] = struct{}{}
+			open = ""
+		}
+	}
+	if open != "" {
+		return nil
+	}
+	return terminal
+}
+
+// ExtractWithSubagentInventory gathers evidence only for refs supplied by the
+// caller's authoritative ledger. It never discovers children from transcript
+// text, filenames, timestamps, or token-count events.
+func (c *CodexAgent) ExtractWithSubagentInventory(parent []byte, fromOffset int, refs []agent.SubagentReference) (agent.InventoryExtraction, error) {
+	result := agent.InventoryExtraction{ModifiedFiles: extractFilesFromData(parent, fromOffset)}
+	parentUsage, err := c.CalculateTokenUsage(parent, fromOffset)
+	if err != nil {
+		return result, err
+	}
+	complete := true
+	var childTotal *agent.TokenUsage
+	resolved := make([]loadedRollout, len(refs))
+	unresolvedIDs := make(map[string]struct{})
+	for index, ref := range refs {
+		if loaded, ok := c.loadDirectRollout(ref); ok {
+			resolved[index] = loaded
+		} else if ref.AgentID != "" {
+			unresolvedIDs[ref.AgentID] = struct{}{}
+		}
+	}
+	fallback := c.scanFallbackRollouts(unresolvedIDs)
+	for index, ref := range refs {
+		if resolved[index].Path == "" {
+			resolved[index] = fallback[ref.AgentID]
+		}
+	}
+	for index, ref := range refs {
+		analysis := agent.SubagentAnalysis{AgentID: ref.AgentID}
+		loaded := resolved[index]
+		analysis.ResolvedPath = loaded.Path
+		if loaded.Path == "" {
+			complete = false
+			result.Children = append(result.Children, analysis)
+			continue
+		}
+		analysis.ModifiedFiles = extractFilesFromData(loaded.Data, 0)
+		analysis.TerminalTurnIDs = terminalTurnIDs(loaded.Data)
+		analysis.TokenUsage = exactCumulativeTokenUsage(loaded.Data)
+		if analysis.TokenUsage == nil {
+			complete = false
+		} else {
+			childTotal = addExactUsage(childTotal, analysis.TokenUsage)
+		}
+		result.ModifiedFiles = appendUniqueFiles(result.ModifiedFiles, analysis.ModifiedFiles)
+		result.Children = append(result.Children, analysis)
+	}
+	result.TokenUsage = withChildCoverage(parentUsage, complete)
+	if complete && len(refs) > 0 {
+		result.TokenUsage.SubagentTokens = childTotal
+	}
+	return result, nil
+}
+
+func withChildCoverage(usage *agent.TokenUsage, complete bool) *agent.TokenUsage {
+	if usage == nil {
+		return &agent.TokenUsage{SubagentTokensComplete: &complete}
+	}
+	result := *usage
+	result.SubagentTokens = nil
+	result.SubagentTokensComplete = &complete
+	return &result
+}
+
+func extractFilesFromData(data []byte, fromOffset int) []string {
+	var files []string
+	for index, lineData := range splitJSONL(data) {
+		if index+1 <= fromOffset {
+			continue
+		}
+		files = appendUniqueFiles(files, extractFilesFromLine(lineData))
+	}
+	return files
+}
+
+func appendUniqueFiles(files, additions []string) []string {
+	seen := make(map[string]struct{}, len(files)+len(additions))
+	for _, file := range files {
+		seen[file] = struct{}{}
+	}
+	for _, file := range additions {
+		if _, exists := seen[file]; !exists {
+			seen[file] = struct{}{}
+			files = append(files, file)
+		}
+	}
+	return files
+}
+
+func addExactUsage(total, addition *agent.TokenUsage) *agent.TokenUsage {
+	if total == nil {
+		cloned := *addition
+		return &cloned
+	}
+	total.InputTokens += addition.InputTokens
+	total.CacheReadTokens += addition.CacheReadTokens
+	total.OutputTokens += addition.OutputTokens
+	return total
+}
+
 // ExtractPrompts returns user prompts from the transcript starting at the given offset.
 func (c *CodexAgent) ExtractPrompts(sessionRef string, fromOffset int) ([]string, error) {
 	data, err := os.ReadFile(sessionRef) //nolint:gosec // Path comes from agent hook input
@@ -585,7 +911,7 @@ func parseSessionStartTime(data []byte) (time.Time, error) {
 	if err := json.Unmarshal(lines[0], &line); err != nil {
 		return time.Time{}, fmt.Errorf("parse first transcript line: %w", err)
 	}
-	if line.Type != "session_meta" {
+	if line.Type != rolloutLineTypeSessionMeta {
 		return time.Time{}, fmt.Errorf("first transcript line is %q, want session_meta", line.Type)
 	}
 
diff --git a/cmd/entire/cli/agent/codex/transcript_test.go b/cmd/entire/cli/agent/codex/transcript_test.go
index 0a329f8db4..68c8fe2cc0 100644
--- a/cmd/entire/cli/agent/codex/transcript_test.go
+++ b/cmd/entire/cli/agent/codex/transcript_test.go
@@ -32,6 +32,66 @@ func writeSampleRollout(t *testing.T) string {
 	return path
 }
 
+func TestClassifyRollout(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		data string
+		want rolloutClassification
+	}{
+		{
+			name: "root thread source",
+			data: `{"type":"session_meta","payload":{"thread_source":"user"}}` + "\n",
+			want: rolloutRoot,
+		},
+		{
+			name: "root legacy string source",
+			data: `{"type":"session_meta","payload":{"source":"exec"}}` + "\n",
+			want: rolloutRoot,
+		},
+		{
+			name: "child thread source",
+			data: `{"type":"session_meta","payload":{"thread_source":"subagent"}}` + "\n",
+			want: rolloutChild,
+		},
+		{
+			name: "child legacy structured source",
+			data: `{"type":"session_meta","payload":{"source":{"subagent":{"thread_spawn":{"parent_thread_id":"root-thread"}}}}}` + "\n",
+			want: rolloutChild,
+		},
+		{
+			name: "missing session metadata",
+			data: `{"type":"response_item","payload":{}}` + "\n",
+			want: rolloutUnknown,
+		},
+		{
+			name: "malformed JSON",
+			data: `{"type":"session_meta","payload":` + "\n",
+			want: rolloutUnknown,
+		},
+		{
+			name: "unrecognized source",
+			data: `{"type":"session_meta","payload":{"source":"other"}}` + "\n",
+			want: rolloutUnknown,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			path := filepath.Join(t.TempDir(), "rollout.jsonl")
+			require.NoError(t, os.WriteFile(path, []byte(tt.data), 0o600))
+			require.Equal(t, tt.want, classifyRollout(path))
+		})
+	}
+
+	t.Run("missing path", func(t *testing.T) {
+		t.Parallel()
+		require.Equal(t, rolloutUnknown, classifyRollout(filepath.Join(t.TempDir(), "missing.jsonl")))
+	})
+}
+
 func TestGetTranscriptPosition(t *testing.T) {
 	t.Parallel()
 	ag := &CodexAgent{}
diff --git a/cmd/entire/cli/agent/event.go b/cmd/entire/cli/agent/event.go
index 95b7d172b9..a5bf085f8c 100644
--- a/cmd/entire/cli/agent/event.go
+++ b/cmd/entire/cli/agent/event.go
@@ -108,9 +108,19 @@ type Event struct {
 	// ToolUseID identifies the tool invocation (for SubagentStart/SubagentEnd events).
 	ToolUseID string
 
+	// TurnID identifies the agent turn that produced the event.
+	TurnID string
+
 	// SubagentID identifies the subagent instance (for SubagentEnd events).
 	SubagentID string
 
+	// StopHookActive reports whether the agent's Stop hook remains active.
+	StopHookActive bool
+
+	// ProvisionalSubagentStop is true when a subagent-stop event may arrive
+	// before the root rollout has reached its final state.
+	ProvisionalSubagentStop bool
+
 	// Final is true only for events that represent true completion of a
 	// subagent (Claude Code's SubagentStop), never for the launch-time
 	// PostToolUse SubagentEnd, which fires at the background launch stub
diff --git a/cmd/entire/cli/agent/types/token_usage.go b/cmd/entire/cli/agent/types/token_usage.go
index 9c6082079d..c651610eaa 100644
--- a/cmd/entire/cli/agent/types/token_usage.go
+++ b/cmd/entire/cli/agent/types/token_usage.go
@@ -15,6 +15,21 @@ type TokenUsage struct {
 	APICallCount int `json:"api_call_count"`
 	// SubagentTokens contains token usage from spawned subagents (if any)
 	SubagentTokens *TokenUsage `json:"subagent_tokens,omitempty"`
+	// SubagentTokensComplete says whether the outer result has exact child coverage.
+	SubagentTokensComplete *bool `json:"subagent_tokens_complete,omitempty"`
+}
+
+// WithClearedSubagentTokens returns an independent usage result with child
+// totals removed and an explicit coverage marker. A nil usage becomes a
+// marker-only result so unavailable coverage persists.
+func WithClearedSubagentTokens(usage *TokenUsage, complete bool) *TokenUsage {
+	if usage == nil {
+		usage = &TokenUsage{}
+	}
+	cleared := *usage
+	cleared.SubagentTokens = nil
+	cleared.SubagentTokensComplete = &complete
+	return &cleared
 }
 
 // MaxSubagentDepth caps how deep a SubagentTokens chain is walked. Real chains
@@ -61,18 +76,40 @@ func addTokenUsageAtDepth(a, b *TokenUsage, depth int) *TokenUsage {
 		bSub = b.SubagentTokens
 	}
 	if depth >= MaxSubagentDepth {
+		if depth == 0 {
+			sum.SubagentTokensComplete = tokenCompleteness(a, b)
+		}
 		return sum
 	}
 	sum.SubagentTokens = addTokenUsageAtDepth(aSub, bSub, depth+1)
+	if depth == 0 {
+		sum.SubagentTokensComplete = tokenCompleteness(a, b)
+	}
 	return sum
 }
 
+func tokenCompleteness(a, b *TokenUsage) *bool {
+	if a != nil && a.SubagentTokensComplete != nil {
+		complete := *a.SubagentTokensComplete
+		return &complete
+	}
+	if b != nil && b.SubagentTokensComplete != nil {
+		complete := *b.SubagentTokensComplete
+		return &complete
+	}
+	return nil
+}
+
 // SubtractTokenUsage returns a-b, recursing into subagent usage and clamping
 // every field at zero (a nil operand is treated as zero). Neither input is
 // mutated. Used to rescope a cumulative-since-session-start snapshot (e.g.
 // subagent token usage, which is always re-read from the start of each
 // subagent transcript) down to a delta since a previously captured baseline.
 func SubtractTokenUsage(a, b *TokenUsage) *TokenUsage {
+	return subtractTokenUsageAtDepth(a, b, 0)
+}
+
+func subtractTokenUsageAtDepth(a, b *TokenUsage, depth int) *TokenUsage {
 	if a == nil {
 		return nil
 	}
@@ -86,7 +123,11 @@ func SubtractTokenUsage(a, b *TokenUsage) *TokenUsage {
 		OutputTokens:        clampSubtract(a.OutputTokens, b.OutputTokens),
 		APICallCount:        clampSubtract(a.APICallCount, b.APICallCount),
 	}
-	diff.SubagentTokens = SubtractTokenUsage(a.SubagentTokens, b.SubagentTokens)
+	diff.SubagentTokens = subtractTokenUsageAtDepth(a.SubagentTokens, b.SubagentTokens, depth+1)
+	if depth == 0 && a.SubagentTokensComplete != nil {
+		complete := *a.SubagentTokensComplete
+		diff.SubagentTokensComplete = &complete
+	}
 	return diff
 }
 
diff --git a/cmd/entire/cli/agent/types/token_usage_test.go b/cmd/entire/cli/agent/types/token_usage_test.go
index f0d82d250b..19a766f3b1 100644
--- a/cmd/entire/cli/agent/types/token_usage_test.go
+++ b/cmd/entire/cli/agent/types/token_usage_test.go
@@ -1,6 +1,44 @@
 package types
 
-import "testing"
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestTokenUsage_SubagentTokensCompleteRoundTripAndClear(t *testing.T) {
+	t.Parallel()
+
+	complete := true
+	usage := &TokenUsage{
+		InputTokens:            3,
+		SubagentTokens:         &TokenUsage{OutputTokens: 2},
+		SubagentTokensComplete: &complete,
+	}
+	data, err := json.Marshal(usage)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var roundTripped TokenUsage
+	if err := json.Unmarshal(data, &roundTripped); err != nil {
+		t.Fatal(err)
+	}
+	if roundTripped.SubagentTokensComplete == nil || !*roundTripped.SubagentTokensComplete {
+		t.Fatalf("round trip completeness = %v, want true", roundTripped.SubagentTokensComplete)
+	}
+
+	cleared := WithClearedSubagentTokens(&roundTripped, false)
+	if cleared == &roundTripped || cleared.SubagentTokens != nil || cleared.SubagentTokensComplete == nil || *cleared.SubagentTokensComplete {
+		t.Fatalf("cleared usage = %+v, want independent explicitly incomplete copy", cleared)
+	}
+	if roundTripped.SubagentTokens == nil || roundTripped.SubagentTokensComplete == nil || !*roundTripped.SubagentTokensComplete {
+		t.Fatalf("clear mutated input: %+v", roundTripped)
+	}
+
+	usageCopy := AddTokenUsage(nil, usage)
+	if usageCopy.SubagentTokensComplete == nil || !*usageCopy.SubagentTokensComplete {
+		t.Fatalf("AddTokenUsage copy dropped completeness: %+v", usageCopy)
+	}
+}
 
 func TestAddTokenUsage(t *testing.T) {
 	t.Parallel()
diff --git a/cmd/entire/cli/integration_test/codex_image_externalize_test.go b/cmd/entire/cli/integration_test/codex_image_externalize_test.go
index 97cc518307..c292f6ba9e 100644
--- a/cmd/entire/cli/integration_test/codex_image_externalize_test.go
+++ b/cmd/entire/cli/integration_test/codex_image_externalize_test.go
@@ -42,7 +42,7 @@ func TestCodexImageExternalization_FullHookFlow(t *testing.T) {
 	// A Codex rollout: session meta, then a user message with an inline image
 	// data-URI (the confirmed real format), then an assistant reply.
 	rollout := strings.Join([]string{
-		`{"timestamp":"2026-01-01T00:00:00Z","type":"session_meta","payload":{"id":"` + sessionID + `","cwd":"` + env.RepoDir + `"}}`,
+		`{"timestamp":"2026-01-01T00:00:00Z","type":"session_meta","payload":{"id":"` + sessionID + `","thread_source":"user","cwd":"` + env.RepoDir + `"}}`,
 		`{"timestamp":"2026-01-01T00:00:01Z","type":"response_item","payload":{"type":"message","role":"user","content":[` +
 			`{"type":"input_text","text":"add feature.txt and look at this screenshot"},` +
 			`{"type":"input_image","image_url":"data:image/png;base64,` + b64 + `"}` +
diff --git a/cmd/entire/cli/integration_test/codex_shadow_sanitize_test.go b/cmd/entire/cli/integration_test/codex_shadow_sanitize_test.go
index b010d457c4..ece4683874 100644
--- a/cmd/entire/cli/integration_test/codex_shadow_sanitize_test.go
+++ b/cmd/entire/cli/integration_test/codex_shadow_sanitize_test.go
@@ -29,7 +29,7 @@ var codexCiphertext = strings.Repeat("QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVph", 40)
 // the `encrypted_content` key; that is the only key the sanitizer strips.
 func codexRolloutWithEncryptedReasoning(sessionID, repoDir, ciphertext string) string {
 	return strings.Join([]string{
-		`{"timestamp":"2026-01-01T00:00:00Z","type":"session_meta","payload":{"id":"` + sessionID + `","cwd":"` + repoDir + `"}}`,
+		`{"timestamp":"2026-01-01T00:00:00Z","type":"session_meta","payload":{"id":"` + sessionID + `","thread_source":"user","cwd":"` + repoDir + `"}}`,
 		`{"timestamp":"2026-01-01T00:00:01Z","type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"add feature.txt"}]}}`,
 		`{"timestamp":"2026-01-01T00:00:02Z","type":"response_item","payload":{"type":"reasoning","summary":[],"encrypted_content":"` + ciphertext + `"}}`,
 		`{"timestamp":"2026-01-01T00:00:03Z","type":"response_item","payload":{"type":"compaction","encrypted_content":"` + ciphertext + `"}}`,
@@ -318,7 +318,7 @@ func TestCodexCondense_NoAssetsFromSanitizedAwayContent(t *testing.T) {
 	sessionID := "codex-sanitize-before-extract"
 	transcriptPath := filepath.Join(env.RepoDir, ".entire", "tmp", "codex-rollout.jsonl")
 	rollout := strings.Join([]string{
-		`{"timestamp":"2026-01-01T00:00:00Z","type":"session_meta","payload":{"id":"` + sessionID + `","cwd":"` + env.RepoDir + `"}}`,
+		`{"timestamp":"2026-01-01T00:00:00Z","type":"session_meta","payload":{"id":"` + sessionID + `","thread_source":"user","cwd":"` + env.RepoDir + `"}}`,
 		`{"timestamp":"2026-01-01T00:00:01Z","type":"response_item","payload":{"type":"message","role":"user","content":[` +
 			`{"type":"input_text","text":"add feature.txt and look at this screenshot"},` +
 			`{"type":"input_image","image_url":"data:image/png;base64,` + keptB64 + `"}` +
diff --git a/cmd/entire/cli/session/state.go b/cmd/entire/cli/session/state.go
index 6703e4fbf9..86f4eedb41 100644
--- a/cmd/entire/cli/session/state.go
+++ b/cmd/entire/cli/session/state.go
@@ -332,6 +332,9 @@ type State struct {
 	// cumulative total on every checkpoint.
 	SubagentTokensBaseline *agent.TokenUsage `json:"subagent_tokens_baseline,omitempty"`
 
+	// SubagentTokensBaselineComplete records whether the baseline is exact.
+	SubagentTokensBaselineComplete *bool `json:"subagent_tokens_baseline_complete,omitempty"`
+
 	// SkillEvents records explicit native skill signals observed during this session.
 	// Stored as sidecar metadata so consumers can collapse skill-related transcript events
 	// without mutating the raw agent transcript.
@@ -424,6 +427,28 @@ type State struct {
 	// TaskRecords tracks subagents dispatched by this session — the durable
 	// pointer ledger for subagent work. See TaskRecord.
 	TaskRecords []TaskRecord `json:"task_records,omitempty"`
+
+	// SubagentInventory retains Codex child identities independently of task
+	// records so follow-up turns remain discoverable after materialization.
+	SubagentInventory []SubagentInventoryEntry `json:"subagent_inventory,omitempty"`
+	// SubagentLedgerVersion advances on a new child identity or non-empty turn.
+	SubagentLedgerVersion uint64 `json:"subagent_ledger_version,omitempty"`
+	// SubagentInventoryComplete distinguishes exact empty from legacy unknown.
+	SubagentInventoryComplete *bool `json:"subagent_inventory_complete,omitempty"`
+}
+
+type SubagentStopCandidate struct {
+	ObservedAt     time.Time `json:"observed_at"`
+	StopHookActive bool      `json:"stop_hook_active,omitempty"`
+}
+
+type SubagentInventoryEntry struct {
+	AgentID                string                           `json:"agent_id"`
+	DeclaredTranscriptPath string                           `json:"declared_transcript_path,omitempty"`
+	ResolvedTranscriptPath string                           `json:"resolved_transcript_path,omitempty"`
+	ObservedTurnIDs        []string                         `json:"observed_turn_ids,omitempty"`
+	PendingStops           map[string]SubagentStopCandidate `json:"pending_stops,omitempty"`
+	FinalizedTurnIDs       []string                         `json:"finalized_turn_ids,omitempty"`
 }
 
 // TaskRecord is the durable pointer ledger entry for a subagent dispatched by
@@ -502,6 +527,125 @@ func (s *State) AddTaskRecord(task TaskRecord) {
 	s.TaskRecords = append(s.TaskRecords, task)
 }
 
+// EnsureTaskRecord adds a follow-up record only after an earlier completed
+// record was materialized and removed. Existing unmaterialized content wins.
+func (s *State) EnsureTaskRecord(task TaskRecord) bool {
+	if task.ToolUseID == "" || s.FindTaskRecord(task.ToolUseID) != nil {
+		return false
+	}
+	s.AddTaskRecord(task)
+	return true
+}
+
+// FindSubagentInventory returns an entry that aliases state. Callers must use
+// it only inside their current MutateSessionState closure.
+func (s *State) FindSubagentInventory(agentID string) *SubagentInventoryEntry {
+	for i := range s.SubagentInventory {
+		if s.SubagentInventory[i].AgentID == agentID {
+			return &s.SubagentInventory[i]
+		}
+	}
+	return nil
+}
+
+// RegisterSubagent observes a stable child identity and optionally one child
+// turn. Only a first child or first non-empty turn invalidates cached totals.
+func (s *State) RegisterSubagent(agentID, turnID string) bool {
+	if agentID == "" {
+		return false
+	}
+	entry := s.FindSubagentInventory(agentID)
+	newObservation := false
+	if entry == nil {
+		s.SubagentInventory = append(s.SubagentInventory, SubagentInventoryEntry{AgentID: agentID})
+		entry = &s.SubagentInventory[len(s.SubagentInventory)-1]
+		newObservation = true
+	}
+	if turnID != "" && !containsString(entry.ObservedTurnIDs, turnID) {
+		entry.ObservedTurnIDs = append(entry.ObservedTurnIDs, turnID)
+		newObservation = true
+	}
+	if newObservation {
+		s.invalidateSubagentTokenUsage()
+	}
+	return newObservation
+}
+
+// RecordSubagentStop records a provisional stop. Stops can arrive before
+// starts, so observing the child and turn happens in this same mutation.
+func (s *State) RecordSubagentStop(agentID, turnID string, candidate SubagentStopCandidate) bool {
+	observed := s.RegisterSubagent(agentID, turnID)
+	if agentID == "" || turnID == "" {
+		return observed
+	}
+	entry := s.FindSubagentInventory(agentID)
+	if entry == nil || containsString(entry.FinalizedTurnIDs, turnID) {
+		return observed
+	}
+	if entry.PendingStops == nil {
+		entry.PendingStops = make(map[string]SubagentStopCandidate)
+	}
+	if existing, exists := entry.PendingStops[turnID]; exists {
+		if existing == candidate {
+			return observed
+		}
+		entry.PendingStops[turnID] = candidate
+		return true
+	}
+	entry.PendingStops[turnID] = candidate
+	return true
+}
+
+// UpdateSubagentTranscriptPaths enriches an already-observed child's path
+// metadata. Resolution is not an inventory observation, so it deliberately
+// does not advance SubagentLedgerVersion or invalidate token coverage.
+func (s *State) UpdateSubagentTranscriptPaths(agentID, declaredPath, resolvedPath string) bool {
+	entry := s.FindSubagentInventory(agentID)
+	if entry == nil {
+		return false
+	}
+	changed := false
+	if declaredPath != "" && entry.DeclaredTranscriptPath != declaredPath {
+		entry.DeclaredTranscriptPath = declaredPath
+		changed = true
+	}
+	if resolvedPath != "" && entry.ResolvedTranscriptPath != resolvedPath {
+		entry.ResolvedTranscriptPath = resolvedPath
+		changed = true
+	}
+	return changed
+}
+
+// FinalizeSubagentTurn moves an observed turn out of PendingStops and into the
+// finalized set atomically. A finalized turn is never finalized twice.
+func (s *State) FinalizeSubagentTurn(agentID, turnID string) bool {
+	if agentID == "" || turnID == "" {
+		return false
+	}
+	entry := s.FindSubagentInventory(agentID)
+	if entry == nil || !containsString(entry.ObservedTurnIDs, turnID) || containsString(entry.FinalizedTurnIDs, turnID) {
+		return false
+	}
+	delete(entry.PendingStops, turnID)
+	entry.FinalizedTurnIDs = append(entry.FinalizedTurnIDs, turnID)
+	return true
+}
+
+func (s *State) invalidateSubagentTokenUsage() {
+	s.SubagentLedgerVersion++
+	s.TokenUsage = types.WithClearedSubagentTokens(s.TokenUsage, false)
+	s.CheckpointTokenUsage = types.WithClearedSubagentTokens(s.CheckpointTokenUsage, false)
+}
+
+func containsString(values []string, value string) bool {
+	for _, existing := range values {
+		if existing == value {
+			return true
+		}
+	}
+	return false
+}
+
 // RemoveTaskRecord clears the record for toolUseID, if present. No-op when no
 // record matches. Retained for tests and any caller that genuinely wants to
 // discard a record outright — ordinary completion should use
@@ -657,6 +801,27 @@ func (s *State) NormalizeAfterLoad(ctx context.Context) {
 	if s.DivergenceNoticeShown && s.AttributionBaseCommit == s.BaseCommit {
 		s.DivergenceNoticeShown = false
 	}
+
+	// Codex states saved before the authoritative child ledger cannot claim an
+	// exact child aggregate. Keep any exact task-record IDs as discovery hints,
+	// but make their coverage conservative and invalidate old totals.
+	if s.AgentType == agent.AgentTypeCodex {
+		if s.SubagentInventoryComplete == nil {
+			incomplete := false
+			s.SubagentInventoryComplete = &incomplete
+			for _, record := range s.TaskRecords {
+				if record.AgentID != "" && s.FindSubagentInventory(record.AgentID) == nil {
+					s.SubagentInventory = append(s.SubagentInventory, SubagentInventoryEntry{AgentID: record.AgentID})
+				}
+			}
+			s.TokenUsage = types.WithClearedSubagentTokens(s.TokenUsage, false)
+			s.CheckpointTokenUsage = types.WithClearedSubagentTokens(s.CheckpointTokenUsage, false)
+		}
+		if s.SubagentTokensBaselineComplete == nil {
+			incomplete := false
+			s.SubagentTokensBaselineComplete = &incomplete
+		}
+	}
 }
 
 // ClearLegacyTranscriptOffsets clears deprecated transcript offset fields so
@@ -710,9 +875,18 @@ func (s *State) ClearCondensationAttempt() {
 // helper (resetCheckpointWindow) and cross-repo session adoption, which likewise
 // opens a fresh target-local window. Sharing this here keeps the two in step.
 func (s *State) RebaselineSubagentTokens() {
-	if s.TokenUsage != nil {
-		s.SubagentTokensBaseline = s.TokenUsage.SubagentTokens
+	if s.TokenUsage == nil || (s.TokenUsage.SubagentTokensComplete != nil && !*s.TokenUsage.SubagentTokensComplete) {
+		incomplete := false
+		s.SubagentTokensBaseline = nil
+		s.SubagentTokensBaselineComplete = &incomplete
+		return
 	}
+	// A nil marker retains the historic behaviour: the implicit initial
+	// baseline is exact zero. An explicit complete marker can intentionally
+	// snapshot a nil aggregate for an authoritative empty inventory.
+	complete := true
+	s.SubagentTokensBaseline = s.TokenUsage.SubagentTokens
+	s.SubagentTokensBaselineComplete = &complete
 }
 
 // RealignAttributionBase sets AttributionBaseCommit to newBase and clears any
diff --git a/cmd/entire/cli/session/state_test.go b/cmd/entire/cli/session/state_test.go
index f3eb8e09d6..1330a8dc5c 100644
--- a/cmd/entire/cli/session/state_test.go
+++ b/cmd/entire/cli/session/state_test.go
@@ -1026,3 +1026,205 @@ func TestState_LiveTaskRecords(t *testing.T) {
 
 	assert.Empty(t, (&State{}).LiveTaskRecords())
 }
+
+func TestState_SubagentInventoryLedger(t *testing.T) {
+	t.Parallel()
+
+	complete := true
+	state := &State{
+		TokenUsage:           &agent.TokenUsage{InputTokens: 5, SubagentTokens: &agent.TokenUsage{InputTokens: 3}, SubagentTokensComplete: &complete},
+		CheckpointTokenUsage: &agent.TokenUsage{OutputTokens: 2, SubagentTokens: &agent.TokenUsage{OutputTokens: 1}, SubagentTokensComplete: &complete},
+	}
+	if !state.RegisterSubagent("child-1", "turn-1") {
+		t.Fatal("first child observation must be recorded")
+	}
+	assert.Equal(t, uint64(1), state.SubagentLedgerVersion)
+	assert.Nil(t, state.TokenUsage.SubagentTokens)
+	assert.False(t, *state.TokenUsage.SubagentTokensComplete)
+	assert.Nil(t, state.CheckpointTokenUsage.SubagentTokens)
+	assert.False(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+
+	// A later exact extraction may have refreshed both aggregates. Duplicate
+	// observations and path-only enrichment must preserve that fresh coverage.
+	refreshedComplete := true
+	state.TokenUsage.SubagentTokens = &agent.TokenUsage{InputTokens: 21}
+	state.TokenUsage.SubagentTokensComplete = &refreshedComplete
+	state.CheckpointTokenUsage.SubagentTokens = &agent.TokenUsage{OutputTokens: 13}
+	state.CheckpointTokenUsage.SubagentTokensComplete = &refreshedComplete
+	versionBeforeDuplicate := state.SubagentLedgerVersion
+	totalBeforeDuplicate := state.TokenUsage.SubagentTokens
+	checkpointTotalBeforeDuplicate := state.CheckpointTokenUsage.SubagentTokens
+	coverageBeforeDuplicate := *state.TokenUsage.SubagentTokensComplete
+	checkpointCoverageBeforeDuplicate := *state.CheckpointTokenUsage.SubagentTokensComplete
+	if state.RegisterSubagent("child-1", "turn-1") {
+		t.Fatal("duplicate agent/turn observation must be a true no-op")
+	}
+	assert.Equal(t, versionBeforeDuplicate, state.SubagentLedgerVersion)
+	assert.Same(t, totalBeforeDuplicate, state.TokenUsage.SubagentTokens)
+	assert.Same(t, checkpointTotalBeforeDuplicate, state.CheckpointTokenUsage.SubagentTokens)
+	assert.Equal(t, coverageBeforeDuplicate, *state.TokenUsage.SubagentTokensComplete)
+	assert.Equal(t, checkpointCoverageBeforeDuplicate, *state.CheckpointTokenUsage.SubagentTokensComplete)
+	versionBeforePathEnrichment := state.SubagentLedgerVersion
+	totalBeforePathEnrichment := state.TokenUsage.SubagentTokens
+	checkpointTotalBeforePathEnrichment := state.CheckpointTokenUsage.SubagentTokens
+	coverageBeforePathEnrichment := *state.TokenUsage.SubagentTokensComplete
+	checkpointCoverageBeforePathEnrichment := *state.CheckpointTokenUsage.SubagentTokensComplete
+	assert.True(t, state.UpdateSubagentTranscriptPaths("child-1", "/tmp/declared.jsonl", "/tmp/resolved.jsonl"))
+	assert.Equal(t, versionBeforePathEnrichment, state.SubagentLedgerVersion, "path enrichment must not churn the ledger generation")
+	assert.Same(t, totalBeforePathEnrichment, state.TokenUsage.SubagentTokens)
+	assert.Same(t, checkpointTotalBeforePathEnrichment, state.CheckpointTokenUsage.SubagentTokens)
+	assert.Equal(t, coverageBeforePathEnrichment, *state.TokenUsage.SubagentTokensComplete)
+	assert.Equal(t, checkpointCoverageBeforePathEnrichment, *state.CheckpointTokenUsage.SubagentTokensComplete)
+
+	stopObservedAt := time.Now().UTC().Truncate(time.Second)
+	stopCandidate := SubagentStopCandidate{ObservedAt: stopObservedAt, StopHookActive: true}
+	if !state.RecordSubagentStop("child-1", "turn-2", stopCandidate) {
+		t.Fatal("stop-first new turn must be recorded")
+	}
+	assert.Equal(t, uint64(2), state.SubagentLedgerVersion)
+	assert.Nil(t, state.TokenUsage.SubagentTokens, "new child turn must invalidate refreshed session totals")
+	require.NotNil(t, state.TokenUsage.SubagentTokensComplete)
+	assert.False(t, *state.TokenUsage.SubagentTokensComplete)
+	assert.Nil(t, state.CheckpointTokenUsage.SubagentTokens, "new child turn must invalidate refreshed checkpoint totals")
+	require.NotNil(t, state.CheckpointTokenUsage.SubagentTokensComplete)
+	assert.False(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+	entry := state.FindSubagentInventory("child-1")
+	require.NotNil(t, entry)
+	require.Contains(t, entry.PendingStops, "turn-2")
+
+	// A stop retry may carry richer metadata. Both a true duplicate and the
+	// metadata refresh must leave already-calculated token coverage intact.
+	stopRefreshComplete := true
+	state.TokenUsage.SubagentTokens = &agent.TokenUsage{InputTokens: 34}
+	state.TokenUsage.SubagentTokensComplete = &stopRefreshComplete
+	state.CheckpointTokenUsage.SubagentTokens = &agent.TokenUsage{OutputTokens: 21}
+	state.CheckpointTokenUsage.SubagentTokensComplete = &stopRefreshComplete
+	versionBeforeStopRefresh := state.SubagentLedgerVersion
+	totalBeforeStopRefresh := state.TokenUsage.SubagentTokens
+	checkpointTotalBeforeStopRefresh := state.CheckpointTokenUsage.SubagentTokens
+	coverageBeforeStopRefresh := *state.TokenUsage.SubagentTokensComplete
+	checkpointCoverageBeforeStopRefresh := *state.CheckpointTokenUsage.SubagentTokensComplete
+	assert.False(t, state.RecordSubagentStop("child-1", "turn-2", stopCandidate), "exact duplicate stop must be a no-op")
+	assert.Equal(t, versionBeforeStopRefresh, state.SubagentLedgerVersion)
+	assert.Same(t, totalBeforeStopRefresh, state.TokenUsage.SubagentTokens)
+	assert.Same(t, checkpointTotalBeforeStopRefresh, state.CheckpointTokenUsage.SubagentTokens)
+	assert.Equal(t, coverageBeforeStopRefresh, *state.TokenUsage.SubagentTokensComplete)
+	assert.Equal(t, checkpointCoverageBeforeStopRefresh, *state.CheckpointTokenUsage.SubagentTokensComplete)
+
+	refreshedCandidate := SubagentStopCandidate{ObservedAt: stopObservedAt.Add(time.Second), StopHookActive: false}
+	assert.True(t, state.RecordSubagentStop("child-1", "turn-2", refreshedCandidate), "changed stop metadata must upsert")
+	assert.Equal(t, refreshedCandidate, entry.PendingStops["turn-2"])
+	assert.Equal(t, versionBeforeStopRefresh, state.SubagentLedgerVersion)
+	assert.Same(t, totalBeforeStopRefresh, state.TokenUsage.SubagentTokens)
+	assert.Same(t, checkpointTotalBeforeStopRefresh, state.CheckpointTokenUsage.SubagentTokens)
+	assert.Equal(t, coverageBeforeStopRefresh, *state.TokenUsage.SubagentTokensComplete)
+	assert.Equal(t, checkpointCoverageBeforeStopRefresh, *state.CheckpointTokenUsage.SubagentTokensComplete)
+
+	state.RecordSubagentStop("child-1", "turn-3", SubagentStopCandidate{ObservedAt: time.Now()})
+	require.Len(t, entry.PendingStops, 2, "several pending stops must coexist")
+	if !state.FinalizeSubagentTurn("child-1", "turn-2") {
+		t.Fatal("pending turn must finalize")
+	}
+	assert.NotContains(t, entry.PendingStops, "turn-2")
+	assert.Contains(t, entry.FinalizedTurnIDs, "turn-2")
+	if state.FinalizeSubagentTurn("child-1", "turn-2") {
+		t.Fatal("finalized turn must be exactly once")
+	}
+}
+
+func TestState_SubagentInventoryRoundTripAndTaskRecordRecovery(t *testing.T) {
+	t.Parallel()
+	now := time.Now().UTC().Truncate(time.Second)
+	complete := true
+	state := State{
+		AgentType:                      agent.AgentTypeCodex,
+		SubagentInventoryComplete:      &complete,
+		SubagentTokensBaselineComplete: &complete,
+		SubagentLedgerVersion:          7,
+		SubagentInventory: []SubagentInventoryEntry{{
+			AgentID:                "child-1",
+			DeclaredTranscriptPath: "/tmp/child.jsonl",
+			ResolvedTranscriptPath: "/tmp/resolved.jsonl",
+			ObservedTurnIDs:        []string{"turn-1"},
+			PendingStops:           map[string]SubagentStopCandidate{"turn-1": {ObservedAt: now, StopHookActive: true}},
+			FinalizedTurnIDs:       []string{"turn-0"},
+		}},
+	}
+	data, err := json.Marshal(state)
+	require.NoError(t, err)
+	var got State
+	require.NoError(t, json.Unmarshal(data, &got))
+	require.NotNil(t, got.SubagentInventoryComplete)
+	assert.True(t, *got.SubagentInventoryComplete)
+	require.NotNil(t, got.SubagentTokensBaselineComplete)
+	assert.True(t, *got.SubagentTokensBaselineComplete)
+	assert.Equal(t, uint64(7), got.SubagentLedgerVersion)
+	require.Len(t, got.SubagentInventory, 1)
+	entry := got.SubagentInventory[0]
+	assert.Equal(t, "child-1", entry.AgentID)
+	assert.Equal(t, "/tmp/child.jsonl", entry.DeclaredTranscriptPath)
+	assert.Equal(t, "/tmp/resolved.jsonl", entry.ResolvedTranscriptPath)
+	assert.Equal(t, []string{"turn-1"}, entry.ObservedTurnIDs)
+	require.Contains(t, entry.PendingStops, "turn-1")
+	pending := entry.PendingStops["turn-1"]
+	assert.True(t, now.Equal(pending.ObservedAt))
+	assert.True(t, pending.StopHookActive)
+	assert.Equal(t, []string{"turn-0"}, entry.FinalizedTurnIDs)
+
+	materialized := TaskRecord{ToolUseID: "child-1", AgentID: "child-1", StartedAt: now, CompletedAt: now}
+	got.AddTaskRecord(materialized)
+	assert.False(t, got.EnsureTaskRecord(TaskRecord{ToolUseID: "child-1", AgentID: "child-1", StartedAt: now.Add(time.Minute)}), "unmaterialized record must not be replaced")
+	assert.True(t, got.TaskRecords[0].CompletedAt.Equal(now))
+	got.RemoveTaskRecord("child-1")
+	assert.True(t, got.EnsureTaskRecord(TaskRecord{ToolUseID: "child-1", AgentID: "child-1", StartedAt: now.Add(time.Minute)}), "follow-up must recreate a materialized record")
+}
+
+func TestState_NormalizeAfterLoad_CodexInventoryMigration(t *testing.T) {
+	t.Parallel()
+	legacy := &State{
+		AgentType:            agent.AgentTypeCodex,
+		TokenUsage:           &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 4}},
+		CheckpointTokenUsage: &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 2}},
+		TaskRecords:          []TaskRecord{{AgentID: "child-1"}},
+	}
+	legacy.NormalizeAfterLoad(context.Background())
+	require.NotNil(t, legacy.SubagentInventoryComplete)
+	assert.False(t, *legacy.SubagentInventoryComplete)
+	require.NotNil(t, legacy.SubagentTokensBaselineComplete)
+	assert.False(t, *legacy.SubagentTokensBaselineComplete)
+	assert.Nil(t, legacy.TokenUsage.SubagentTokens)
+	assert.False(t, *legacy.TokenUsage.SubagentTokensComplete)
+	assert.Nil(t, legacy.CheckpointTokenUsage.SubagentTokens)
+	assert.False(t, *legacy.CheckpointTokenUsage.SubagentTokensComplete)
+	require.Len(t, legacy.SubagentInventory, 1)
+	assert.Equal(t, "child-1", legacy.SubagentInventory[0].AgentID)
+
+	nonCodex := &State{AgentType: agent.AgentTypeClaudeCode}
+	nonCodex.NormalizeAfterLoad(context.Background())
+	assert.Nil(t, nonCodex.SubagentInventoryComplete)
+	assert.Nil(t, nonCodex.SubagentTokensBaselineComplete)
+
+	explicitComplete := true
+	explicit := &State{AgentType: agent.AgentTypeCodex, SubagentInventoryComplete: &explicitComplete, SubagentTokensBaselineComplete: &explicitComplete, TokenUsage: &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 9}}}
+	explicit.NormalizeAfterLoad(context.Background())
+	assert.True(t, *explicit.SubagentInventoryComplete)
+	assert.NotNil(t, explicit.TokenUsage.SubagentTokens, "an explicit state must not be migrated again")
+}
+
+func TestState_RebaselineSubagentTokensPreservesTriState(t *testing.T) {
+	t.Parallel()
+	complete := true
+	incomplete := false
+
+	exactEmpty := &State{TokenUsage: &agent.TokenUsage{SubagentTokensComplete: &complete}}
+	exactEmpty.RebaselineSubagentTokens()
+	require.NotNil(t, exactEmpty.SubagentTokensBaselineComplete)
+	assert.True(t, *exactEmpty.SubagentTokensBaselineComplete)
+	assert.Nil(t, exactEmpty.SubagentTokensBaseline)
+
+	unknown := &State{TokenUsage: &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 9}, SubagentTokensComplete: &incomplete}}
+	unknown.RebaselineSubagentTokens()
+	require.NotNil(t, unknown.SubagentTokensBaselineComplete)
+	assert.False(t, *unknown.SubagentTokensBaselineComplete)
+	assert.Nil(t, unknown.SubagentTokensBaseline)
+}
diff --git a/cmd/entire/cli/strategy/manual_commit_session.go b/cmd/entire/cli/strategy/manual_commit_session.go
index c9d6584fa2..856442d326 100644
--- a/cmd/entire/cli/strategy/manual_commit_session.go
+++ b/cmd/entire/cli/strategy/manual_commit_session.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/entireio/cli/cmd/entire/cli/agent"
 	"github.com/entireio/cli/cmd/entire/cli/agent/types"
 	"github.com/entireio/cli/cmd/entire/cli/checkpoint"
 	"github.com/entireio/cli/cmd/entire/cli/checkpoint/id"
@@ -647,6 +648,11 @@ func (s *ManualCommitStrategy) initializeSession(ctx context.Context, repo *git.
 		TranscriptPath:        transcriptPath,
 		LastPrompt:            truncatePromptForStorage(userPrompt),
 	}
+	if agentType == agent.AgentTypeCodex {
+		complete := true
+		state.SubagentInventoryComplete = &complete
+		state.SubagentTokensBaselineComplete = &complete
+	}
 
 	// Take the gate, then re-check under lock. Without this re-check a
 	// concurrent turn-start hook that wrote a richer state in the gap
@@ -665,6 +671,41 @@ func (s *ManualCommitStrategy) initializeSession(ctx context.Context, repo *git.
 	if existing != nil && existing.BaseCommit != "" {
 		return nil
 	}
+	if existing != nil && agentType == agent.AgentTypeCodex {
+		// Repair the partial state in place. A child hook can have recorded task
+		// content and accounting before the parent session initializes, so a
+		// fresh replacement would silently discard durable child state.
+		state = existing
+		state.CLIVersion = versioninfo.Version
+		state.BaseCommit = headHash
+		state.AttributionBaseCommit = headHash
+		state.WorktreePath = worktreePath
+		state.WorktreeID = worktreeID
+		if state.StartedAt.IsZero() {
+			state.StartedAt = now
+		}
+		state.LastInteractionTime = &now
+		state.TurnID = turnID.String()
+		state.AgentType = agentType
+		if model != "" {
+			state.ModelName = model
+		}
+		if transcriptPath != "" {
+			state.TranscriptPath = transcriptPath
+		}
+		if userPrompt != "" {
+			state.LastPrompt = truncatePromptForStorage(userPrompt)
+		}
+		if state.UntrackedFilesAtStart == nil {
+			state.UntrackedFilesAtStart = untrackedFiles
+		}
+
+		// This is a repair, not an authoritative SessionStart inventory. Keep
+		// the ledger and token data but retain conservative coverage markers.
+		incomplete := false
+		state.SubagentInventoryComplete = &incomplete
+		state.SubagentTokensBaselineComplete = &incomplete
+	}
 	return s.saveSessionState(ctx, state)
 }
 
diff --git a/cmd/entire/cli/strategy/manual_commit_test.go b/cmd/entire/cli/strategy/manual_commit_test.go
index 655790c5cd..782403060f 100644
--- a/cmd/entire/cli/strategy/manual_commit_test.go
+++ b/cmd/entire/cli/strategy/manual_commit_test.go
@@ -28,6 +28,96 @@ import (
 
 const testTrailerCheckpointID id.CheckpointID = "a1b2c3d4e5f6"
 
+func TestCodexInventoryInitialization(t *testing.T) {
+	dir := t.TempDir()
+	testutil.InitRepo(t, dir)
+	testutil.WriteFile(t, dir, "initial.txt", "initial\n")
+	testutil.GitAdd(t, dir, "initial.txt")
+	testutil.GitCommit(t, dir, "initial")
+	t.Chdir(dir)
+
+	s := NewManualCommitStrategy()
+	repo, err := OpenRepository(context.Background())
+	require.NoError(t, err)
+	defer repo.Close()
+	require.NoError(t, s.initializeSession(context.Background(), repo, "codex-inventory-new", agent.AgentTypeCodex, "", "", ""))
+	newState, err := s.loadSessionState(context.Background(), "codex-inventory-new")
+	require.NoError(t, err)
+	require.NotNil(t, newState.SubagentInventoryComplete)
+	assert.True(t, *newState.SubagentInventoryComplete)
+	require.NotNil(t, newState.SubagentTokensBaselineComplete)
+	assert.True(t, *newState.SubagentTokensBaselineComplete)
+
+	incomplete := false
+	pendingAt := time.Now().UTC().Truncate(time.Second)
+	partialInventory := []session.SubagentInventoryEntry{{
+		AgentID:         "child-observed-before-parent",
+		ObservedTurnIDs: []string{"turn-pending", "turn-finalized"},
+		PendingStops: map[string]session.SubagentStopCandidate{
+			"turn-pending": {ObservedAt: pendingAt, StopHookActive: true},
+		},
+		FinalizedTurnIDs: []string{"turn-finalized"},
+	}}
+	partialTokenUsage := &agent.TokenUsage{InputTokens: 100, SubagentTokens: &agent.TokenUsage{InputTokens: 60}, SubagentTokensComplete: &incomplete}
+	partialCheckpointUsage := &agent.TokenUsage{OutputTokens: 50, SubagentTokens: &agent.TokenUsage{OutputTokens: 30}, SubagentTokensComplete: &incomplete}
+	partialBaseline := &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 40}, SubagentTokensComplete: &incomplete}
+	partialRecords := []session.TaskRecord{
+		{ToolUseID: "child-live", AgentID: "child-observed-before-parent", StartedAt: pendingAt},
+		{ToolUseID: "child-completed", AgentID: "child-observed-before-parent", StartedAt: pendingAt, CompletedAt: pendingAt.Add(time.Second)},
+	}
+	require.NoError(t, s.saveSessionState(context.Background(), &SessionState{
+		SessionID:                      "codex-inventory-partial",
+		StartedAt:                      time.Now(),
+		AgentType:                      agent.AgentTypeCodex,
+		SubagentInventory:              partialInventory,
+		SubagentLedgerVersion:          9,
+		SubagentInventoryComplete:      &incomplete,
+		SubagentTokensBaselineComplete: &incomplete,
+		TokenUsage:                     partialTokenUsage,
+		CheckpointTokenUsage:           partialCheckpointUsage,
+		SubagentTokensBaseline:         partialBaseline,
+		TaskRecords:                    partialRecords,
+	}))
+	beforeRepair, err := s.loadSessionState(context.Background(), "codex-inventory-partial")
+	require.NoError(t, err)
+	assert.Empty(t, beforeRepair.BaseCommit)
+	require.NotNil(t, beforeRepair.SubagentInventoryComplete)
+	assert.False(t, *beforeRepair.SubagentInventoryComplete)
+	assert.Equal(t, uint64(9), beforeRepair.SubagentLedgerVersion)
+	require.Len(t, beforeRepair.SubagentInventory, 1)
+	require.NoError(t, s.initializeSession(context.Background(), repo, "codex-inventory-partial", agent.AgentTypeCodex, "", "", ""))
+	partial, err := s.loadSessionState(context.Background(), "codex-inventory-partial")
+	require.NoError(t, err)
+	require.NotNil(t, partial.SubagentInventoryComplete)
+	assert.False(t, *partial.SubagentInventoryComplete, "partial-state repair must not promote unknown inventory coverage")
+	require.NotNil(t, partial.SubagentTokensBaselineComplete)
+	assert.False(t, *partial.SubagentTokensBaselineComplete)
+	assert.Equal(t, uint64(9), partial.SubagentLedgerVersion)
+	require.Len(t, partial.SubagentInventory, 1)
+	entry := partial.SubagentInventory[0]
+	assert.Equal(t, "child-observed-before-parent", entry.AgentID)
+	assert.Equal(t, []string{"turn-pending", "turn-finalized"}, entry.ObservedTurnIDs)
+	require.Contains(t, entry.PendingStops, "turn-pending")
+	assert.True(t, pendingAt.Equal(entry.PendingStops["turn-pending"].ObservedAt))
+	assert.True(t, entry.PendingStops["turn-pending"].StopHookActive)
+	assert.Equal(t, []string{"turn-finalized"}, entry.FinalizedTurnIDs)
+	assert.True(t, partial.HasTaskContent(), "repair must retain both live and completed-unmaterialized task content")
+	require.Len(t, partial.TaskRecords, 2)
+	assert.Equal(t, "child-live", partial.TaskRecords[0].ToolUseID)
+	assert.True(t, partial.TaskRecords[1].CompletedAt.Equal(pendingAt.Add(time.Second)))
+	require.NotNil(t, partial.TokenUsage)
+	assert.Equal(t, 100, partial.TokenUsage.InputTokens)
+	require.NotNil(t, partial.TokenUsage.SubagentTokens)
+	assert.Equal(t, 60, partial.TokenUsage.SubagentTokens.InputTokens)
+	require.NotNil(t, partial.CheckpointTokenUsage)
+	assert.Equal(t, 50, partial.CheckpointTokenUsage.OutputTokens)
+	require.NotNil(t, partial.CheckpointTokenUsage.SubagentTokens)
+	assert.Equal(t, 30, partial.CheckpointTokenUsage.SubagentTokens.OutputTokens)
+	require.NotNil(t, partial.SubagentTokensBaseline)
+	require.NotNil(t, partial.SubagentTokensBaseline.SubagentTokens)
+	assert.Equal(t, 40, partial.SubagentTokensBaseline.SubagentTokens.InputTokens)
+}
+
 // testTranscriptPromptResponse is a minimal transcript used across strategy tests.
 const testTranscriptPromptResponse = "{\"type\":\"human\",\"message\":{\"content\":\"test prompt\"}}\n{\"type\":\"assistant\",\"message\":{\"content\":\"test response\"}}\n"
 

From e5c44dffb109ed50c67447d3cac5975228529afc Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Mon, 31 Aug 2026 23:05:01 -0700
Subject: [PATCH 02/59] feat(codex): reconcile subagents with exact accounting

---
 cmd/entire/cli/agent/token_usage.go           |  16 ++
 cmd/entire/cli/lifecycle.go                   | 169 +++++++++++++++++-
 .../strategy/manual_commit_condensation.go    |   9 +-
 cmd/entire/cli/strategy/manual_commit_git.go  |  43 ++++-
 cmd/entire/cli/strategy/strategy.go           |   4 +
 .../cli/strategy/subagent_tokens_test.go      |  22 +++
 6 files changed, 256 insertions(+), 7 deletions(-)

diff --git a/cmd/entire/cli/agent/token_usage.go b/cmd/entire/cli/agent/token_usage.go
index cd9ec1920f..651a23cfd1 100644
--- a/cmd/entire/cli/agent/token_usage.go
+++ b/cmd/entire/cli/agent/token_usage.go
@@ -7,6 +7,22 @@ import (
 	"github.com/entireio/cli/cmd/entire/cli/logging"
 )
 
+// ExtractWithSubagentInventory gives built-in agents an authoritative child
+// ledger. It deliberately has no external-agent protocol equivalent: callers
+// supply the inventory rather than asking an agent to infer children from text.
+func ExtractWithSubagentInventory(ctx context.Context, ag Agent, transcriptData []byte, transcriptLinesAtStart int, refs []SubagentReference) (InventoryExtraction, bool) {
+	extractor, ok := AsInventoryAwareExtractor(ag)
+	if !ok {
+		return InventoryExtraction{}, false
+	}
+	extraction, err := extractor.ExtractWithSubagentInventory(transcriptData, transcriptLinesAtStart, refs)
+	if err != nil {
+		logging.Debug(ctx, "failed inventory-aware token extraction", slog.String("error", err.Error()))
+		return InventoryExtraction{}, false
+	}
+	return extraction, true
+}
+
 // CalculateTokenUsage calculates token usage from transcript data.
 // Returns nil if the agent doesn't support token calculation or on error.
 // Errors are debug-logged because callers treat nil token usage as "no data available".
diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 14b84ac467..db557ee21f 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -934,6 +934,19 @@ func handleLifecycleTurnEnd(ctx context.Context, ag agent.Agent, event *agent.Ev
 	relModifiedFiles = filterToUncommittedFiles(ctx, relModifiedFiles, repoRoot)
 	normalizeSpan.End()
 
+	// Codex owns an authoritative child ledger. Refresh it before the
+	// no-files gate: a read-only child can finish without producing a shadow
+	// checkpoint, but its exact availability still must replace stale coverage.
+	var codexInventoryUsage *agent.TokenUsage
+	var codexLedgerVersion uint64
+	if ag.Type() == agent.AgentTypeCodex {
+		inventoryOffset := 0
+		if preState != nil {
+			inventoryOffset = preState.TranscriptOffset
+		}
+		codexInventoryUsage, codexLedgerVersion = refreshCodexInventory(ctx, ag, sessionID, transcriptData, inventoryOffset)
+	}
+
 	// Check if there are any changes
 	totalChanges := len(relModifiedFiles) + len(relNewFiles) + len(relDeletedFiles)
 	if totalChanges == 0 {
@@ -993,7 +1006,11 @@ func handleLifecycleTurnEnd(ctx context.Context, ag agent.Agent, event *agent.Ev
 	// to include subagent tokens.
 	tokenUsage := event.TokenUsage
 	if tokenUsage == nil {
-		tokenUsage = agent.CalculateTokenUsage(ctx, ag, transcriptData, transcriptLinesAtStart, subagentsDir)
+		if codexInventoryUsage != nil {
+			tokenUsage = codexInventoryUsage
+		} else {
+			tokenUsage = agent.CalculateTokenUsage(ctx, ag, transcriptData, transcriptLinesAtStart, subagentsDir)
+		}
 	}
 
 	// Build fully-populated step context and delegate to strategy
@@ -1012,6 +1029,7 @@ func handleLifecycleTurnEnd(ctx context.Context, ag agent.Agent, event *agent.Ev
 		StepTranscriptIdentifier: transcriptIdentifierAtStart,
 		StepTranscriptStart:      transcriptLinesAtStart,
 		TokenUsage:               tokenUsage,
+		SubagentLedgerVersion:    codexLedgerVersion,
 	}
 
 	// finishTurn is the shared turn-end tail, run whether the save succeeded
@@ -1116,6 +1134,12 @@ func handleLifecycleSessionEnd(ctx context.Context, ag agent.Agent, event *agent
 	// (sessionEndCondenseDeadline) that budget-capped agents get; Claude Code
 	// sets no budget, and for agents that do, bounding the final captures
 	// against the same deadline is a known follow-up.
+	if ag.Type() == agent.AgentTypeCodex {
+		if transcript, readErr := ag.ReadTranscript(event.SessionRef); readErr == nil {
+			_, _ = refreshCodexInventory(ctx, ag, event.SessionID, transcript, 0)
+		}
+		finalizeCodexObservedAtSessionEnd(ctx, event.SessionID)
+	}
 	completeLiveTaskRecords(ctx, ag, event.SessionID, event.SessionRef)
 
 	if _, err := endSessionNow(ctx, event, event.SessionID, nil, sessionEndCondenseDeadline(ag), endedNow); err != nil {
@@ -1126,6 +1150,104 @@ func handleLifecycleSessionEnd(ctx context.Context, ag agent.Agent, event *agent
 	return nil
 }
 
+// finalizeCodexObservedAtSessionEnd closes every observed turn that did not
+// have a matching terminal record in the same verified rollout analysis. This
+// deliberately iterates the inventory rather than live task records: a
+// follow-up can be hidden behind a completed-but-unmaterialized record.
+func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
+	if err := strategy.MutateSessionState(ctx, sessionID, func(state *strategy.SessionState) error {
+		for _, entry := range state.SubagentInventory {
+			for _, turnID := range entry.ObservedTurnIDs {
+				if !state.FinalizeSubagentTurn(entry.AgentID, turnID) {
+					continue
+				}
+				for i := range state.TaskRecords {
+					record := &state.TaskRecords[i]
+					if record.AgentID == entry.AgentID && record.CompletedAt.IsZero() {
+						record.CompletedAt = time.Now()
+						record.TokenUsage = nil
+						break
+					}
+				}
+			}
+		}
+		return nil
+	}); err != nil && !errors.Is(err, strategy.ErrStateNotFound) {
+		logging.Debug(ctx, "failed to finalize codex turns at session end", slog.String("error", err.Error()))
+	}
+}
+
+// refreshCodexInventory snapshots the durable child ledger, performs the
+// potentially slow filesystem analysis outside its lock, then applies only
+// path enrichment and terminal evidence if no new child observation raced it.
+// It never manufactures an exact-empty result for an unknown/legacy ledger.
+func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string, parent []byte, fromOffset int) (*agent.TokenUsage, uint64) {
+	state, err := strategy.LoadSessionState(ctx, sessionID)
+	if err != nil || state == nil || state.SubagentInventoryComplete == nil {
+		return nil, 0
+	}
+	refs := make([]agent.SubagentReference, 0, len(state.SubagentInventory))
+	for _, entry := range state.SubagentInventory {
+		refs = append(refs, agent.SubagentReference{AgentID: entry.AgentID, DeclaredTranscriptPath: entry.DeclaredTranscriptPath, ResolvedTranscriptPath: entry.ResolvedTranscriptPath})
+	}
+	version := state.SubagentLedgerVersion
+	extraction, ok := agent.ExtractWithSubagentInventory(ctx, ag, parent, fromOffset, refs)
+	if !ok {
+		return nil, version
+	}
+
+	usage := extraction.TokenUsage
+	if !*state.SubagentInventoryComplete {
+		// A legacy/partial inventory may still provide main transcript evidence,
+		// but cannot truthfully claim full child coverage.
+		usage = types.WithClearedSubagentTokens(usage, false)
+	}
+	if err := strategy.MutateSessionState(ctx, sessionID, func(current *strategy.SessionState) error {
+		if current.SubagentLedgerVersion != version {
+			return strategy.ErrMutationSkip
+		}
+		for _, child := range extraction.Children {
+			current.UpdateSubagentTranscriptPaths(child.AgentID, "", child.ResolvedPath)
+			for _, turnID := range child.TerminalTurnIDs {
+				if !current.FinalizeSubagentTurn(child.AgentID, turnID) {
+					continue
+				}
+				for i := range current.TaskRecords {
+					record := &current.TaskRecords[i]
+					if record.AgentID != child.AgentID || !record.CompletedAt.IsZero() {
+						continue
+					}
+					record.CompletedAt = time.Now()
+					record.Files = child.ModifiedFiles
+					record.DeclaredTranscriptPath = child.ResolvedPath
+					// nil is evidence too: a newer terminal snapshot without exact
+					// usage must clear, never preserve, an earlier total.
+					record.TokenUsage = child.TokenUsage
+					current.FilesTouched = mergeUnique(current.FilesTouched, child.ModifiedFiles)
+					break
+				}
+			}
+		}
+		// This is also the no-file refresh path: retain the latest exact child
+		// snapshot (including authoritative empty or unavailable) without
+		// creating a checkpoint step or changing main-agent counters.
+		if usage != nil {
+			if current.TokenUsage == nil {
+				current.TokenUsage = &agent.TokenUsage{}
+			}
+			current.TokenUsage.SubagentTokens = usage.SubagentTokens
+			if usage.SubagentTokensComplete != nil {
+				complete := *usage.SubagentTokensComplete
+				current.TokenUsage.SubagentTokensComplete = &complete
+			}
+		}
+		return nil
+	}); err != nil && !errors.Is(err, strategy.ErrStateNotFound) {
+		logging.Debug(ctx, "failed to persist codex inventory evidence", slog.String("error", err.Error()))
+	}
+	return usage, version
+}
+
 // processStart approximates when this hook process began. Package
 // initialization runs before main, so it is within milliseconds of exec —
 // precise enough to bound work against a deadline the agent measures from the
@@ -1217,6 +1339,31 @@ func handleLifecycleSubagentStart(ctx context.Context, ag agent.Agent, event *ag
 		slog.String("transcript", event.SessionRef),
 	)
 
+	if ag.Type() == agent.AgentTypeCodex {
+		if event.SubagentID == "" || event.TurnID == "" || event.ToolUseID == "" {
+			return errors.New("invalid codex subagent start: agent, turn, and tool IDs are required")
+		}
+		// The ledger is authoritative. Persist it before the generic capture,
+		// whose worktree read is intentionally best effort for Codex children.
+		if err := GetStrategy(ctx).EnsureSessionExists(ctx, event.SessionID, ag.Type()); err != nil {
+			return fmt.Errorf("ensure codex subagent session: %w", err)
+		}
+		if err := strategy.MutateSessionState(ctx, event.SessionID, func(state *strategy.SessionState) error {
+			state.RegisterSubagent(event.SubagentID, event.TurnID)
+			state.EnsureTaskRecord(session.TaskRecord{
+				ToolUseID: event.ToolUseID, AgentID: event.SubagentID, StartedAt: time.Now(),
+				SubagentType: event.SubagentType, TaskDescription: event.TaskDescription,
+			})
+			return nil
+		}); err != nil {
+			return fmt.Errorf("register codex subagent: %w", err)
+		}
+		if err := CapturePreTaskState(ctx, event.ToolUseID); err != nil {
+			logging.Warn(logCtx, "best-effort codex pre-task capture failed", slog.String("error", err.Error()))
+		}
+		return nil
+	}
+
 	// Capture pre-task state
 	if err := CapturePreTaskState(ctx, event.ToolUseID); err != nil {
 		return fmt.Errorf("failed to capture pre-task state: %w", err)
@@ -1265,6 +1412,26 @@ func handleLifecycleSubagentEnd(ctx context.Context, ag agent.Agent, event *agen
 		// Extract subagent type and description from tool input
 		event.SubagentType, event.TaskDescription = ParseSubagentTypeAndDescription(event.ToolInput)
 	}
+	if ag.Type() == agent.AgentTypeCodex && event.ProvisionalSubagentStop {
+		if event.SubagentID == "" || event.TurnID == "" {
+			return errors.New("invalid codex provisional subagent stop: agent and turn IDs are required")
+		}
+		// Codex's stop hook is deliberately not completion: its rollout can
+		// still be changing. Record only the observation for later transcript
+		// reconciliation; do not capture the parent worktree or mark a task done.
+		err := strategy.MutateSessionState(logCtx, event.SessionID, func(state *strategy.SessionState) error {
+			state.RecordSubagentStop(event.SubagentID, event.TurnID, session.SubagentStopCandidate{ObservedAt: time.Now(), StopHookActive: event.StopHookActive})
+			state.UpdateSubagentTranscriptPaths(event.SubagentID, event.SubagentTranscriptPath, "")
+			return nil
+		})
+		if errors.Is(err, strategy.ErrStateNotFound) {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("record codex provisional subagent stop: %w", err)
+		}
+		return nil
+	}
 
 	if event.Final {
 		return handleSubagentStopFinal(logCtx, ag, event)
diff --git a/cmd/entire/cli/strategy/manual_commit_condensation.go b/cmd/entire/cli/strategy/manual_commit_condensation.go
index 2137790f3b..b1fc217e44 100644
--- a/cmd/entire/cli/strategy/manual_commit_condensation.go
+++ b/cmd/entire/cli/strategy/manual_commit_condensation.go
@@ -1146,11 +1146,18 @@ func hasTokenUsageData(usage *agent.TokenUsage) bool {
 // path could resolve a subagents dir from session state (as review/manifest.go
 // does) and rescope against SubagentTokensBaseline; deferred, not blocked.
 func withSubagentTokensFrom(usage, src *agent.TokenUsage) *agent.TokenUsage {
-	if usage == nil || usage.SubagentTokens != nil || src == nil || src.SubagentTokens == nil {
+	if usage == nil || usage.SubagentTokens != nil || usage.SubagentTokensComplete != nil || src == nil {
 		return usage
 	}
 	filled := *usage
 	filled.SubagentTokens = src.SubagentTokens
+	if src.SubagentTokensComplete != nil {
+		complete := *src.SubagentTokensComplete
+		filled.SubagentTokensComplete = &complete
+		if !complete {
+			filled.SubagentTokens = nil
+		}
+	}
 	return &filled
 }
 
diff --git a/cmd/entire/cli/strategy/manual_commit_git.go b/cmd/entire/cli/strategy/manual_commit_git.go
index 75db9466e9..bcd76babfa 100644
--- a/cmd/entire/cli/strategy/manual_commit_git.go
+++ b/cmd/entire/cli/strategy/manual_commit_git.go
@@ -46,6 +46,11 @@ func (s *ManualCommitStrategy) SaveStep(ctx context.Context, step StepContext) e
 	}
 
 	mutErr := MutateSessionState(ctx, sessionID, func(state *SessionState) error {
+		if step.SubagentLedgerVersion != 0 && state.SubagentLedgerVersion != step.SubagentLedgerVersion && step.TokenUsage != nil {
+			// Keep valid main-agent deltas but never persist a child aggregate
+			// computed against an older authoritative inventory.
+			step.TokenUsage = types.WithClearedSubagentTokens(step.TokenUsage, false)
+		}
 		_, migrateSpan := perf.Start(ctx, "migrate_shadow_branch")
 		if _, _, err := s.migrateShadowBranchIfNeeded(ctx, repo, state); err != nil {
 			migrateSpan.RecordError(err)
@@ -148,9 +153,23 @@ func (s *ManualCommitStrategy) SaveStep(ctx context.Context, step StepContext) e
 			// that would double-subtract and (via clampSubtract) shrink or zero a
 			// real subagent total. Recomputing from the session-wide cumulative
 			// is idempotent regardless of whether this step carried a snapshot.
-			if state.CheckpointTokenUsage != nil {
-				state.CheckpointTokenUsage.SubagentTokens = types.SubtractTokenUsage(
-					state.TokenUsage.SubagentTokens, state.SubagentTokensBaseline)
+			if state.CheckpointTokenUsage != nil && state.TokenUsage != nil {
+				complete := state.TokenUsage.SubagentTokensComplete
+				switch {
+				case complete != nil && !*complete:
+					state.CheckpointTokenUsage = types.WithClearedSubagentTokens(state.CheckpointTokenUsage, false)
+				case state.SubagentTokensBaselineComplete != nil && !*state.SubagentTokensBaselineComplete:
+					// A known-incomplete baseline cannot yield an exact delta, even
+					// when the current inventory has become complete again.
+					state.CheckpointTokenUsage = types.WithClearedSubagentTokens(state.CheckpointTokenUsage, false)
+				default:
+					state.CheckpointTokenUsage.SubagentTokens = types.SubtractTokenUsage(
+						state.TokenUsage.SubagentTokens, state.SubagentTokensBaseline)
+					if complete != nil {
+						value := *complete
+						state.CheckpointTokenUsage.SubagentTokensComplete = &value
+					}
+				}
 			}
 		}
 
@@ -446,7 +465,7 @@ func accumulateTokenUsage(existing, incoming *agent.TokenUsage) *agent.TokenUsag
 	}
 	if existing == nil {
 		// Return a copy to avoid sharing the pointer
-		return &agent.TokenUsage{
+		result := &agent.TokenUsage{
 			InputTokens:         incoming.InputTokens,
 			CacheCreationTokens: incoming.CacheCreationTokens,
 			CacheReadTokens:     incoming.CacheReadTokens,
@@ -454,6 +473,14 @@ func accumulateTokenUsage(existing, incoming *agent.TokenUsage) *agent.TokenUsag
 			APICallCount:        incoming.APICallCount,
 			SubagentTokens:      incoming.SubagentTokens,
 		}
+		if incoming.SubagentTokensComplete != nil {
+			complete := *incoming.SubagentTokensComplete
+			result.SubagentTokensComplete = &complete
+			if !complete {
+				result.SubagentTokens = nil
+			}
+		}
+		return result
 	}
 
 	// Accumulate values
@@ -466,7 +493,13 @@ func accumulateTokenUsage(existing, incoming *agent.TokenUsage) *agent.TokenUsag
 	// Replace (not add) subagent tokens: incoming.SubagentTokens is already
 	// the cumulative total as of this step, so the latest snapshot supersedes
 	// whatever was recorded before rather than stacking on top of it.
-	if incoming.SubagentTokens != nil {
+	if incoming.SubagentTokensComplete != nil {
+		complete := *incoming.SubagentTokensComplete
+		existing.SubagentTokensComplete = &complete
+		// An explicit inventory result is authoritative, including exact empty
+		// (complete with nil) and unavailable (incomplete with nil).
+		existing.SubagentTokens = incoming.SubagentTokens
+	} else if incoming.SubagentTokens != nil {
 		existing.SubagentTokens = incoming.SubagentTokens
 	}
 
diff --git a/cmd/entire/cli/strategy/strategy.go b/cmd/entire/cli/strategy/strategy.go
index 1b53eab631..d9304158db 100644
--- a/cmd/entire/cli/strategy/strategy.go
+++ b/cmd/entire/cli/strategy/strategy.go
@@ -161,6 +161,10 @@ type StepContext struct {
 
 	// TokenUsage contains the token usage for this checkpoint
 	TokenUsage *agent.TokenUsage
+
+	// SubagentLedgerVersion is the authoritative inventory version observed
+	// while token evidence was extracted. Zero means no inventory snapshot.
+	SubagentLedgerVersion uint64
 }
 
 // TaskStepContext contains all information needed for saving a task step checkpoint.
diff --git a/cmd/entire/cli/strategy/subagent_tokens_test.go b/cmd/entire/cli/strategy/subagent_tokens_test.go
index 626e69aeaa..9c5e731831 100644
--- a/cmd/entire/cli/strategy/subagent_tokens_test.go
+++ b/cmd/entire/cli/strategy/subagent_tokens_test.go
@@ -51,6 +51,28 @@ func TestAccumulateTokenUsage_SubagentTokensReplacedNotSummed(t *testing.T) {
 	require.Equal(t, 250, existing.SubagentTokens.OutputTokens, "SubagentTokens must be replaced, not summed")
 }
 
+func TestAccumulateTokenUsage_ExplicitIncompleteClearsPriorChildTotal(t *testing.T) {
+	t.Parallel()
+	complete := true
+	incomplete := false
+	existing := &agent.TokenUsage{InputTokens: 3, SubagentTokens: &agent.TokenUsage{InputTokens: 9}, SubagentTokensComplete: &complete}
+	got := accumulateTokenUsage(existing, &agent.TokenUsage{OutputTokens: 4, SubagentTokensComplete: &incomplete})
+	require.Nil(t, got.SubagentTokens)
+	require.NotNil(t, got.SubagentTokensComplete)
+	require.False(t, *got.SubagentTokensComplete)
+	require.Equal(t, 3, got.InputTokens)
+	require.Equal(t, 4, got.OutputTokens)
+}
+
+func TestAccumulateTokenUsage_ExplicitEmptyReplacesPriorChildTotal(t *testing.T) {
+	t.Parallel()
+	complete := true
+	got := accumulateTokenUsage(&agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 9}}, &agent.TokenUsage{SubagentTokensComplete: &complete})
+	require.Nil(t, got.SubagentTokens)
+	require.NotNil(t, got.SubagentTokensComplete)
+	require.True(t, *got.SubagentTokensComplete)
+}
+
 // TestSaveStep_SubagentTokensNotDoubleCountedAcrossCheckpoints exercises the
 // real SaveStep path for both Claude Code and Factory AI Droid (the two
 // agents whose CalculateTotalTokenUsage implementations discover subagent IDs

From 32cb75e4df21e2e45275f8fa63991759cffacc1b Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Mon, 31 Aug 2026 23:05:15 -0700
Subject: [PATCH 03/59] test(codex): verify subagent tracking integration

---
 cmd/entire/cli/agent/codex/AGENT.md           |  6 ++-
 .../integration_test/codex_subagent_test.go   | 40 ++++++++++++++-----
 2 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/cmd/entire/cli/agent/codex/AGENT.md b/cmd/entire/cli/agent/codex/AGENT.md
index 7c2115f870..449bae9bd0 100644
--- a/cmd/entire/cli/agent/codex/AGENT.md
+++ b/cmd/entire/cli/agent/codex/AGENT.md
@@ -344,7 +344,9 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - **Transcript may be null:** In `--ephemeral` mode, `transcript_path` is null. The integration handles this gracefully.
 - **No hooks fire under `-s read-only`:** verified against 0.147.0 — a `codex exec -s read-only` run produces no hook invocations at all, so no session is tracked. `-s workspace-write` fires the full set.
 - **Subagent identity fields are inverted from their names:** `SubagentStart` / `SubagentStop` (schemas at `codex-rs/hooks/schema/generated/subagent-{start,stop}.command.input.schema.json`) send `session_id` = the identity shared by the root thread *and every descendant*, i.e. the user's session, which maps straight to Entire's SessionID; `agent_id` = the subagent thread's own id. Codex sends no `tool_use_id`, so `agent_id` doubles as Entire's ToolUseID — it is the only value correlating a start with its stop, and Entire keys pre-task state and the task metadata directory on it. Getting this backwards attributes subagent work to a session Entire has never seen.
-- **`SubagentStop` carries two transcripts:** `transcript_path` is the *parent* rollout, `agent_transcript_path` the subagent's own. Entire forwards the latter as `Event.SubagentTranscriptPath`, so it never guesses a layout for Codex.
+- **`SubagentStop` is provisional, not authoritative completion.** It carries two transcripts: `transcript_path` is the *parent* rollout and `agent_transcript_path` the child rollout. Entire retains the child identity and declared path, then accepts a rollout only after its first `session_meta.id` exactly matches `agent_id`, it is a regular file, and the same verified bytes are analyzed. A hook-supplied filename is never trusted by itself.
+- **Completion is reconciled from the child rollout.** Only explicit matching `task_complete.turn_id` records (or the narrowly correlated legacy boundary) finalize a pending child turn. The root hook reads the authoritative inventory, batches exact-ID rollout lookup across active and archived trees, and fails closed on an ambiguous, unreadable, malformed, or non-regular candidate.
+- **Child accounting is exact-only.** Each child retains independently readable file and terminal evidence, but the aggregate is present only when every inventory child resolves and has a valid final cumulative token snapshot. A missing or malformed child makes aggregate coverage incomplete and leaves its aggregate nil; no timestamps, filenames, text length, or tool/API-call counts are estimated.
 - **Only thread-spawned subagents fire these hooks:** internal/synthetic ones expose no user-configured lifecycle hooks, so they are invisible to Entire.
 - **Hook response protocol differs from Claude Code:** Codex uses `systemMessage` (same field name) but also supports `hookSpecificOutput` with `additionalContext` for injecting context into the model. For Entire's purposes, `systemMessage` is sufficient.
 
@@ -353,7 +355,7 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - ~~Hooks require feature flag~~ — `CodexHooks` became `Stage::Stable, default_enabled: true` on 2026-04-23 (openai/codex#19012) and the config key was aliased from `codex_hooks` to `hooks` on 2026-05-01 (openai/codex#20522). No flag is needed.
 - ~~No SessionEnd hook~~ — added in 0.146; Entire consumes it.
 - ~~PreToolUse is shell-only~~ — now dispatched generically from the tool registry (`codex-rs/core/src/tools/registry.rs`), covering shell, `apply_patch`, MCP tools and unified_exec.
-- ~~No subagent hooks~~ — `SubagentStart` / `SubagentStop` exist, carrying `agent_id`, `agent_type` and `agent_transcript_path`, and Entire now consumes both: they are Codex's PreTask/PostTask equivalents and drive task checkpoints. See the identity and transcript gotchas above.
+- `SubagentStart` / `SubagentStop` retain child inventory. Start records the child before best-effort generic capture; stop only records a pending observation and never captures the whole parent worktree or marks completion. See the identity and transcript reconciliation rules above.
 
 ## Captured Payloads
 
diff --git a/cmd/entire/cli/integration_test/codex_subagent_test.go b/cmd/entire/cli/integration_test/codex_subagent_test.go
index 50ec2b2c16..f37716423b 100644
--- a/cmd/entire/cli/integration_test/codex_subagent_test.go
+++ b/cmd/entire/cli/integration_test/codex_subagent_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/agent/codex"
 	"github.com/entireio/cli/cmd/entire/cli/paths"
 	"github.com/entireio/cli/cmd/entire/cli/session"
 	"github.com/stretchr/testify/require"
@@ -30,20 +31,29 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 		agentID    = "child-thread-9"
 		editedFile = "docs/red.md"
 	)
+	complete := true
 
 	require.NoError(t, env.WriteSessionState(sessionID, &session.State{
-		SessionID:  sessionID,
-		AgentType:  agent.AgentTypeCodex,
-		BaseCommit: env.GetHeadHash(),
+		SessionID:                 sessionID,
+		AgentType:                 agent.AgentTypeCodex,
+		BaseCommit:                env.GetHeadHash(),
+		SubagentInventoryComplete: &complete,
 	}))
 
 	rolloutDir := filepath.Join(env.RepoDir, ".entire", "tmp", "codex-rollouts")
 	require.NoError(t, os.MkdirAll(rolloutDir, 0o750))
 	parentRollout := filepath.Join(rolloutDir, "rollout-"+sessionID+".jsonl")
-	require.NoError(t, os.WriteFile(parentRollout, []byte(`{"type":"session_meta","payload":{"id":"`+sessionID+`"}}`+"\n"), 0o600))
+	require.NoError(t, os.WriteFile(parentRollout, []byte(`{"type":"session_meta","payload":{"id":"`+sessionID+`","thread_source":"user"}}`+"\n"), 0o600))
 	subagentRollout := filepath.Join(rolloutDir, "rollout-"+agentID+".jsonl")
-	require.NoError(t, os.WriteFile(subagentRollout,
-		[]byte(`{"type":"response_item","payload":{"content":"wrote `+editedFile+`"}}`+"\n"), 0o600))
+	require.NoError(t, os.WriteFile(subagentRollout, []byte(
+		`{"type":"session_meta","payload":{"id":"`+agentID+`"}}`+"\n"+
+			`{"type":"event_msg","payload":{"type":"task_started","turn_id":"turn-1"}}`+"\n"+
+			`{"type":"response_item","payload":{"type":"custom_tool_call","status":"completed","name":"apply_patch","input":"*** Begin Patch\n*** Add File: `+editedFile+`\n+red\n*** End Patch"}}`+"\n"+
+			`{"type":"event_msg","payload":{"type":"token_count","info":{"total_token_usage":{"input_tokens":10,"cached_input_tokens":2,"output_tokens":3}}}}`+"\n"+
+			`{"type":"event_msg","payload":{"type":"task_complete","turn_id":"turn-1"}}`+"\n"), 0o600))
+	probe, err := (&codex.CodexAgent{RolloutRoots: []string{}}).ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{AgentID: agentID, DeclaredTranscriptPath: subagentRollout}})
+	require.NoError(t, err)
+	require.Equal(t, []string{"turn-1"}, probe.Children[0].TerminalTurnIDs)
 
 	hook := codexHooker(t, env.RepoDir, sessionID, parentRollout)
 	hook("subagent-start", map[string]any{
@@ -70,11 +80,19 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 	require.NoError(t, err)
 	rec := state.FindTaskRecord(agentID)
 	require.NotNil(t, rec, "expected a task record keyed by agent_id")
-	require.False(t, rec.CompletedAt.IsZero(), "subagent-stop must complete the record")
-	require.Equal(t, subagentRollout, rec.DeclaredTranscriptPath,
-		"the declared agent_transcript_path was not honoured")
-	require.True(t, containsFile(rec.Files, editedFile),
-		"the record must carry the subagent's edit, got %v", rec.Files)
+	require.True(t, rec.CompletedAt.IsZero(), "provisional subagent-stop must not complete the record")
+
+	// Root Stop observes terminal evidence in the same verified child rollout.
+	hook("stop", map[string]any{"hook_event_name": "Stop", "last_assistant_message": "done"})
+	state, err = env.GetSessionState(sessionID)
+	require.NoError(t, err)
+	require.Len(t, state.SubagentInventory, 1)
+	require.Equal(t, subagentRollout, state.SubagentInventory[0].DeclaredTranscriptPath)
+	require.Equal(t, []string{"turn-1"}, state.SubagentInventory[0].FinalizedTurnIDs)
+	rec = state.FindTaskRecord(agentID)
+	require.NotNil(t, rec)
+	require.False(t, rec.CompletedAt.IsZero(), "terminal child rollout must reconcile the record")
+	require.True(t, containsFile(rec.Files, editedFile), "the record must carry the child edit, got %v", rec.Files)
 
 	// Committing condenses the session, and the materializer must store the rollout
 	// itself — the storage guarantee this test is named for.

From 271b7f5d186ce54bf1e3ffc2c934538d15bbbb10 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Tue, 1 Sep 2026 10:06:15 -0700
Subject: [PATCH 04/59] fix(codex): address subagent tracking review findings

---
 cmd/entire/cli/agent/codex/lifecycle.go       | 29 ++++++++++++++-----
 cmd/entire/cli/agent/codex/lifecycle_test.go  | 25 ++++++++++++++++
 cmd/entire/cli/agent/types/token_usage.go     | 17 +++++++----
 .../cli/agent/types/token_usage_test.go       | 16 ++++++++++
 4 files changed, 75 insertions(+), 12 deletions(-)

diff --git a/cmd/entire/cli/agent/codex/lifecycle.go b/cmd/entire/cli/agent/codex/lifecycle.go
index f04adf6de2..f29ee61ab6 100644
--- a/cmd/entire/cli/agent/codex/lifecycle.go
+++ b/cmd/entire/cli/agent/codex/lifecycle.go
@@ -5,10 +5,12 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"os"
 	"time"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/logging"
 )
 
 // Compile-time interface assertions.
@@ -109,16 +111,16 @@ func (c *CodexAgent) SessionEndBudget() time.Duration { return sessionEndBudget
 
 // ParseHookEvent translates a Codex hook into a normalized lifecycle Event.
 // Returns nil if the hook has no lifecycle significance.
-func (c *CodexAgent) ParseHookEvent(_ context.Context, hookName string, stdin io.Reader) (*agent.Event, error) {
+func (c *CodexAgent) ParseHookEvent(ctx context.Context, hookName string, stdin io.Reader) (*agent.Event, error) {
 	switch hookName {
 	case HookNameSessionStart:
 		return c.parseSessionInfoEvent(stdin, agent.SessionStart)
 	case HookNameSessionEnd:
 		return c.parseSessionInfoEvent(stdin, agent.SessionEnd)
 	case HookNameUserPromptSubmit:
-		return c.parseTurnStart(stdin)
+		return c.parseTurnStart(ctx, stdin)
 	case HookNameStop:
-		return c.parseTurnEnd(stdin)
+		return c.parseTurnEnd(ctx, stdin)
 	case HookNamePreToolUse:
 		// PreToolUse has no lifecycle significance — pass through
 		return nil, nil //nolint:nilnil // nil event = no lifecycle action
@@ -201,12 +203,12 @@ func (c *CodexAgent) parseSessionInfoEvent(stdin io.Reader, eventType agent.Even
 	}, nil
 }
 
-func (c *CodexAgent) parseTurnStart(stdin io.Reader) (*agent.Event, error) {
+func (c *CodexAgent) parseTurnStart(ctx context.Context, stdin io.Reader) (*agent.Event, error) {
 	raw, err := agent.ReadAndParseHookInput[userPromptSubmitRaw](stdin)
 	if err != nil {
 		return nil, err
 	}
-	if classifyRollout(derefString(raw.TranscriptPath)) != rolloutRoot {
+	if !isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
 		return nil, nil //nolint:nilnil // only proven root rollouts mutate lifecycle state
 	}
 	return &agent.Event{
@@ -275,12 +277,12 @@ func isApplyPatchTool(name string) bool {
 	}
 }
 
-func (c *CodexAgent) parseTurnEnd(stdin io.Reader) (*agent.Event, error) {
+func (c *CodexAgent) parseTurnEnd(ctx context.Context, stdin io.Reader) (*agent.Event, error) {
 	raw, err := agent.ReadAndParseHookInput[stopRaw](stdin)
 	if err != nil {
 		return nil, err
 	}
-	if classifyRollout(derefString(raw.TranscriptPath)) != rolloutRoot {
+	if !isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
 		return nil, nil //nolint:nilnil // only proven root rollouts mutate lifecycle state
 	}
 	return &agent.Event{
@@ -291,3 +293,16 @@ func (c *CodexAgent) parseTurnEnd(stdin io.Reader) (*agent.Event, error) {
 		Timestamp:  time.Now(),
 	}, nil
 }
+
+func isRootTurnRollout(ctx context.Context, path string) bool {
+	switch classifyRollout(path) {
+	case rolloutRoot:
+		return true
+	case rolloutChild:
+		return false
+	case rolloutUnknown:
+		logging.Warn(ctx, "codex: skipped turn lifecycle event for unclassified rollout", slog.String("path", path))
+		return false
+	}
+	return false
+}
diff --git a/cmd/entire/cli/agent/codex/lifecycle_test.go b/cmd/entire/cli/agent/codex/lifecycle_test.go
index 74c4a11683..142bddd152 100644
--- a/cmd/entire/cli/agent/codex/lifecycle_test.go
+++ b/cmd/entire/cli/agent/codex/lifecycle_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/logging"
 	"github.com/stretchr/testify/require"
 )
 
@@ -248,6 +249,30 @@ func TestParseHookEvent_UserPromptSubmitAndStopRequireRootRollout(t *testing.T)
 	}
 }
 
+func TestParseHookEvent_UnknownTurnRolloutWritesDiagnostic(t *testing.T) {
+	t.Parallel()
+
+	rolloutPath := filepath.Join(t.TempDir(), "rollout.jsonl")
+	require.NoError(t, os.WriteFile(rolloutPath, []byte(`{"type":"session_meta","payload":{"source":"future-source"}}`+"\n"), 0o600))
+
+	logDir := t.TempDir()
+	logger, err := logging.New(logging.Config{Dir: logDir})
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, logger.Close()) })
+	ctx := logging.WithLogger(context.Background(), logger)
+	input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":"` + rolloutPath + `","model":"gpt-5","prompt":"do work"}`
+
+	event, err := (&CodexAgent{}).ParseHookEvent(ctx, HookNameUserPromptSubmit, strings.NewReader(input))
+	require.NoError(t, err)
+	require.Nil(t, event)
+	require.NoError(t, logger.Close())
+
+	logData, err := os.ReadFile(filepath.Join(logDir, "entire.log"))
+	require.NoError(t, err)
+	require.Contains(t, string(logData), "codex: skipped turn lifecycle event for unclassified rollout")
+	require.Contains(t, string(logData), rolloutPath)
+}
+
 func TestParseHookEvent_PreToolUse_ReturnsNil(t *testing.T) {
 	t.Parallel()
 	ag := &CodexAgent{}
diff --git a/cmd/entire/cli/agent/types/token_usage.go b/cmd/entire/cli/agent/types/token_usage.go
index c651610eaa..a04bc01fc3 100644
--- a/cmd/entire/cli/agent/types/token_usage.go
+++ b/cmd/entire/cli/agent/types/token_usage.go
@@ -89,12 +89,19 @@ func addTokenUsageAtDepth(a, b *TokenUsage, depth int) *TokenUsage {
 }
 
 func tokenCompleteness(a, b *TokenUsage) *bool {
-	if a != nil && a.SubagentTokensComplete != nil {
-		complete := *a.SubagentTokensComplete
-		return &complete
+	seen := false
+	for _, usage := range []*TokenUsage{a, b} {
+		if usage == nil || usage.SubagentTokensComplete == nil {
+			continue
+		}
+		seen = true
+		if !*usage.SubagentTokensComplete {
+			incomplete := false
+			return &incomplete
+		}
 	}
-	if b != nil && b.SubagentTokensComplete != nil {
-		complete := *b.SubagentTokensComplete
+	if seen {
+		complete := true
 		return &complete
 	}
 	return nil
diff --git a/cmd/entire/cli/agent/types/token_usage_test.go b/cmd/entire/cli/agent/types/token_usage_test.go
index 19a766f3b1..d62e72e4e2 100644
--- a/cmd/entire/cli/agent/types/token_usage_test.go
+++ b/cmd/entire/cli/agent/types/token_usage_test.go
@@ -69,6 +69,22 @@ func TestAddTokenUsage(t *testing.T) {
 	}
 }
 
+func TestAddTokenUsage_ExplicitIncompleteDominatesComplete(t *testing.T) {
+	t.Parallel()
+
+	complete := true
+	incomplete := false
+	for _, operands := range [][2]*TokenUsage{
+		{{SubagentTokensComplete: &complete}, {SubagentTokensComplete: &incomplete}},
+		{{SubagentTokensComplete: &incomplete}, {SubagentTokensComplete: &complete}},
+	} {
+		got := AddTokenUsage(operands[0], operands[1])
+		if got.SubagentTokensComplete == nil || *got.SubagentTokensComplete {
+			t.Fatalf("AddTokenUsage(%v, %v) completeness = %v, want false", *operands[0].SubagentTokensComplete, *operands[1].SubagentTokensComplete, got.SubagentTokensComplete)
+		}
+	}
+}
+
 // TestAddTokenUsage_TruncatesDeepSubagentChains pins MaxSubagentDepth. Token usage
 // is read back from per-session metadata.json blobs on the shared checkpoint
 // branch, so the chain depth is not trustworthy; an unbounded chain reaching the

From bc470d886e225f4685ccec4fd77c29e4af74cc34 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Tue, 1 Sep 2026 10:30:02 -0700
Subject: [PATCH 05/59] fix(codex): retain multi-turn child evidence

---
 cmd/entire/cli/lifecycle.go      |  6 ++-
 cmd/entire/cli/lifecycle_test.go | 71 ++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 2 deletions(-)

diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index db557ee21f..6d946bca6c 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1214,10 +1214,12 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 				}
 				for i := range current.TaskRecords {
 					record := &current.TaskRecords[i]
-					if record.AgentID != child.AgentID || !record.CompletedAt.IsZero() {
+					if record.AgentID != child.AgentID {
 						continue
 					}
-					record.CompletedAt = time.Now()
+					if record.CompletedAt.IsZero() {
+						record.CompletedAt = time.Now()
+					}
 					record.Files = child.ModifiedFiles
 					record.DeclaredTranscriptPath = child.ResolvedPath
 					// nil is evidence too: a newer terminal snapshot without exact
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index 5025cb40df..6a6572d6d7 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -134,6 +134,77 @@ func (m *mockAnalyzerAgent) ExtractModifiedFilesFromOffset(_ string, _ int) ([]s
 	return m.analyzerFiles, 0, nil
 }
 
+type mockInventoryAgent struct {
+	*mockLifecycleAgent
+
+	extraction agent.InventoryExtraction
+}
+
+var _ agent.InventoryAwareExtractor = (*mockInventoryAgent)(nil)
+
+func (m *mockInventoryAgent) ExtractWithSubagentInventory(_ []byte, _ int, _ []agent.SubagentReference) (agent.InventoryExtraction, error) {
+	return m.extraction, nil
+}
+
+func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *testing.T) {
+	// NOT parallel: setupStopTestRepo changes the process working directory.
+	setupStopTestRepo(t)
+	ctx := context.Background()
+	const (
+		sessionID = "codex-multi-turn-child"
+		agentID   = "child-1"
+	)
+	completedAt := time.Now().UTC().Truncate(time.Microsecond)
+	complete := true
+	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{
+		SessionID:                 sessionID,
+		StartedAt:                 time.Now(),
+		Phase:                     session.PhaseActive,
+		SubagentInventoryComplete: &complete,
+		SubagentLedgerVersion:     2,
+		SubagentInventory: []session.SubagentInventoryEntry{{
+			AgentID:          agentID,
+			ObservedTurnIDs:  []string{"turn-1", "turn-2"},
+			FinalizedTurnIDs: []string{"turn-1"},
+		}},
+		TaskRecords: []session.TaskRecord{{
+			ToolUseID:   agentID,
+			AgentID:     agentID,
+			StartedAt:   completedAt.Add(-time.Minute),
+			CompletedAt: completedAt,
+			Files:       []string{"first.go"},
+			TokenUsage:  &agent.TokenUsage{InputTokens: 10},
+		}},
+		FilesTouched: []string{"first.go"},
+	}))
+
+	ag := &mockInventoryAgent{
+		mockLifecycleAgent: newMockAgent(),
+		extraction: agent.InventoryExtraction{Children: []agent.SubagentAnalysis{{
+			AgentID:         agentID,
+			ResolvedPath:    "/tmp/child-1.jsonl",
+			ModifiedFiles:   []string{"first.go", "second.go"},
+			TokenUsage:      &agent.TokenUsage{InputTokens: 25},
+			TerminalTurnIDs: []string{"turn-2"},
+		}}},
+	}
+
+	_, version := refreshCodexInventory(ctx, ag, sessionID, nil, 0)
+	require.Equal(t, uint64(2), version)
+
+	state, err := strategy.LoadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	record := state.FindTaskRecord(agentID)
+	require.NotNil(t, record)
+	assert.Equal(t, completedAt, record.CompletedAt, "a later terminal turn updates evidence without completing the task twice")
+	assert.Equal(t, []string{"first.go", "second.go"}, record.Files)
+	require.NotNil(t, record.TokenUsage)
+	assert.Equal(t, 25, record.TokenUsage.InputTokens)
+	assert.Equal(t, "/tmp/child-1.jsonl", record.DeclaredTranscriptPath)
+	assert.ElementsMatch(t, []string{"first.go", "second.go"}, state.FilesTouched)
+	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
+}
+
 // --- DispatchLifecycleEvent tests ---
 
 func TestDispatchLifecycleEvent_NilAgent(t *testing.T) {

From 366fe69df4c06e488d413b8f77845e320b7f9bf5 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Tue, 1 Sep 2026 10:49:15 -0700
Subject: [PATCH 06/59] fix(codex): clear stale session-end evidence

---
 cmd/entire/cli/lifecycle.go      | 10 +++++---
 cmd/entire/cli/lifecycle_test.go | 40 ++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 6d946bca6c..cf5ed8247b 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1163,11 +1163,15 @@ func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
 				}
 				for i := range state.TaskRecords {
 					record := &state.TaskRecords[i]
-					if record.AgentID == entry.AgentID && record.CompletedAt.IsZero() {
+					if record.AgentID != entry.AgentID {
+						continue
+					}
+					if record.CompletedAt.IsZero() {
 						record.CompletedAt = time.Now()
-						record.TokenUsage = nil
-						break
 					}
+					record.Files = nil
+					record.TokenUsage = nil
+					break
 				}
 			}
 		}
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index 6a6572d6d7..d7f6bd43d6 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -205,6 +205,46 @@ func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *tes
 	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
 }
 
+func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildClearsStaleEvidence(t *testing.T) {
+	// NOT parallel: setupStopTestRepo changes the process working directory.
+	setupStopTestRepo(t)
+	ctx := context.Background()
+	const (
+		sessionID = "codex-session-end-multi-turn-child"
+		agentID   = "child-1"
+	)
+	completedAt := time.Now().UTC().Truncate(time.Microsecond)
+	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{
+		SessionID: sessionID,
+		StartedAt: time.Now(),
+		Phase:     session.PhaseActive,
+		SubagentInventory: []session.SubagentInventoryEntry{{
+			AgentID:          agentID,
+			ObservedTurnIDs:  []string{"turn-1", "turn-2"},
+			FinalizedTurnIDs: []string{"turn-1"},
+		}},
+		TaskRecords: []session.TaskRecord{{
+			ToolUseID:   agentID,
+			AgentID:     agentID,
+			StartedAt:   completedAt.Add(-time.Minute),
+			CompletedAt: completedAt,
+			Files:       []string{"first.go"},
+			TokenUsage:  &agent.TokenUsage{InputTokens: 10},
+		}},
+	}))
+
+	finalizeCodexObservedAtSessionEnd(ctx, sessionID)
+
+	state, err := strategy.LoadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	record := state.FindTaskRecord(agentID)
+	require.NotNil(t, record)
+	assert.Equal(t, completedAt, record.CompletedAt, "force-closing a later turn must not complete the task twice")
+	assert.Empty(t, record.Files, "files from an earlier turn are not exact evidence for an unresolved later turn")
+	assert.Nil(t, record.TokenUsage, "tokens from an earlier turn are not exact evidence for an unresolved later turn")
+	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
+}
+
 // --- DispatchLifecycleEvent tests ---
 
 func TestDispatchLifecycleEvent_NilAgent(t *testing.T) {

From a5d4e248183f81c0205f349e13c8002228b553c0 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Tue, 1 Sep 2026 11:04:19 -0700
Subject: [PATCH 07/59] fix(codex): guard exact usage completeness

---
 cmd/entire/cli/lifecycle.go      | 11 +++----
 cmd/entire/cli/lifecycle_test.go | 51 +++++++++++++++++++++++++++++++-
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index cf5ed8247b..259220cb8b 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1201,15 +1201,16 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 	}
 
 	usage := extraction.TokenUsage
-	if !*state.SubagentInventoryComplete {
-		// A legacy/partial inventory may still provide main transcript evidence,
-		// but cannot truthfully claim full child coverage.
-		usage = types.WithClearedSubagentTokens(usage, false)
-	}
 	if err := strategy.MutateSessionState(ctx, sessionID, func(current *strategy.SessionState) error {
 		if current.SubagentLedgerVersion != version {
 			return strategy.ErrMutationSkip
 		}
+		usage = extraction.TokenUsage
+		if current.SubagentInventoryComplete == nil || !*current.SubagentInventoryComplete {
+			// A legacy/partial inventory may still provide main transcript evidence,
+			// but cannot truthfully claim full child coverage.
+			usage = types.WithClearedSubagentTokens(usage, false)
+		}
 		for _, child := range extraction.Children {
 			current.UpdateSubagentTranscriptPaths(child.AgentID, "", child.ResolvedPath)
 			for _, turnID := range child.TerminalTurnIDs {
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index d7f6bd43d6..1b70669bce 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -137,12 +137,16 @@ func (m *mockAnalyzerAgent) ExtractModifiedFilesFromOffset(_ string, _ int) ([]s
 type mockInventoryAgent struct {
 	*mockLifecycleAgent
 
-	extraction agent.InventoryExtraction
+	extraction   agent.InventoryExtraction
+	beforeReturn func()
 }
 
 var _ agent.InventoryAwareExtractor = (*mockInventoryAgent)(nil)
 
 func (m *mockInventoryAgent) ExtractWithSubagentInventory(_ []byte, _ int, _ []agent.SubagentReference) (agent.InventoryExtraction, error) {
+	if m.beforeReturn != nil {
+		m.beforeReturn()
+	}
 	return m.extraction, nil
 }
 
@@ -245,6 +249,51 @@ func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildClearsStaleEvidence(t *
 	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
 }
 
+func TestRefreshCodexInventory_UsesCurrentCompletenessWhenPersistingUsage(t *testing.T) {
+	// NOT parallel: setupStopTestRepo changes the process working directory.
+	setupStopTestRepo(t)
+	ctx := context.Background()
+	const sessionID = "codex-completeness-race"
+	complete := true
+	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{
+		SessionID:                 sessionID,
+		StartedAt:                 time.Now(),
+		Phase:                     session.PhaseActive,
+		SubagentInventoryComplete: &complete,
+		SubagentLedgerVersion:     2,
+	}))
+
+	extractedComplete := true
+	ag := &mockInventoryAgent{
+		mockLifecycleAgent: newMockAgent(),
+		extraction: agent.InventoryExtraction{TokenUsage: &agent.TokenUsage{
+			SubagentTokens:         &agent.TokenUsage{InputTokens: 25},
+			SubagentTokensComplete: &extractedComplete,
+		}},
+		beforeReturn: func() {
+			require.NoError(t, strategy.MutateSessionState(ctx, sessionID, func(state *strategy.SessionState) error {
+				incomplete := false
+				state.SubagentInventoryComplete = &incomplete
+				return nil
+			}))
+		},
+	}
+
+	usage, version := refreshCodexInventory(ctx, ag, sessionID, nil, 0)
+	assert.Equal(t, uint64(2), version)
+	require.NotNil(t, usage)
+	require.NotNil(t, usage.SubagentTokensComplete)
+	assert.False(t, *usage.SubagentTokensComplete)
+	assert.Nil(t, usage.SubagentTokens)
+
+	state, err := strategy.LoadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	require.NotNil(t, state.TokenUsage)
+	require.NotNil(t, state.TokenUsage.SubagentTokensComplete)
+	assert.False(t, *state.TokenUsage.SubagentTokensComplete)
+	assert.Nil(t, state.TokenUsage.SubagentTokens)
+}
+
 // --- DispatchLifecycleEvent tests ---
 
 func TestDispatchLifecycleEvent_NilAgent(t *testing.T) {

From 863faec50347dbef7c090dd491e75f6279fdf27e Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Tue, 1 Sep 2026 11:52:24 -0700
Subject: [PATCH 08/59] fix(codex): skip empty fallback scans

---
 cmd/entire/cli/agent/codex/codex.go         |  3 +++
 cmd/entire/cli/agent/codex/subagent_test.go | 12 +++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/cmd/entire/cli/agent/codex/codex.go b/cmd/entire/cli/agent/codex/codex.go
index 047ef41c5b..6e9e64e178 100644
--- a/cmd/entire/cli/agent/codex/codex.go
+++ b/cmd/entire/cli/agent/codex/codex.go
@@ -140,6 +140,9 @@ func (c *CodexAgent) walkRollouts(root string, visit fs.WalkDirFunc) error {
 // regular-candidate metadata failure discards all results: partial results
 // cannot prove a child ID is unique.
 func (c *CodexAgent) scanFallbackRollouts(agentIDs map[string]struct{}) map[string]loadedRollout {
+	if len(agentIDs) == 0 {
+		return map[string]loadedRollout{}
+	}
 	matches := make(map[string][]loadedRollout)
 	seenPaths := make(map[string]struct{})
 	for _, root := range c.rolloutRoots() {
diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
index 9deebb2435..3b9b66f0b2 100644
--- a/cmd/entire/cli/agent/codex/subagent_test.go
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -325,8 +325,18 @@ func TestSubagentInventory_AggregatesOnlyCompleteExactChildren(t *testing.T) {
 func TestSubagentInventory_EmptyInventoryIsExactWithoutChildTotal(t *testing.T) {
 	t.Parallel()
 
-	result, err := (&CodexAgent{RolloutRoots: []string{t.TempDir()}}).ExtractWithSubagentInventory(nil, 0, nil)
+	root := t.TempDir()
+	walks := 0
+	ag := &CodexAgent{
+		RolloutRoots: []string{root},
+		walkDir: func(root string, visit fs.WalkDirFunc) error {
+			walks++
+			return filepath.WalkDir(root, visit)
+		},
+	}
+	result, err := ag.ExtractWithSubagentInventory(nil, 0, nil)
 	require.NoError(t, err)
+	require.Zero(t, walks, "an exact empty inventory has no unresolved child and must not scan rollout archives")
 	require.Empty(t, result.Children)
 	require.NotNil(t, result.TokenUsage)
 	require.NotNil(t, result.TokenUsage.SubagentTokensComplete)

From 62ba0a6f571230196d1a8bbcf8f95cac99b77e02 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 3 Sep 2026 00:47:38 -0700
Subject: [PATCH 09/59] fix(codex): harden subagent checkpoint tracking

Entire-Checkpoint: 01M1K3SP30MWG6YHC2QZ9R34A1
---
 cmd/entire/cli/agent/agent.go                 |   2 +-
 cmd/entire/cli/agent/capabilities_test.go     |   2 +-
 cmd/entire/cli/agent/codex/AGENT.md           |  13 +-
 cmd/entire/cli/agent/codex/codex.go           | 433 ++++++++++++++++--
 cmd/entire/cli/agent/codex/lifecycle.go       |   9 +-
 cmd/entire/cli/agent/codex/lifecycle_test.go  |  86 +++-
 cmd/entire/cli/agent/codex/subagent_test.go   | 174 ++++++-
 cmd/entire/cli/agent/codex/transcript.go      |  75 ++-
 cmd/entire/cli/agent/codex/transcript_test.go |  37 ++
 cmd/entire/cli/agent/token_usage.go           |   2 +-
 .../integration_test/codex_subagent_test.go   |   2 +-
 cmd/entire/cli/lifecycle.go                   |   7 +
 cmd/entire/cli/lifecycle_test.go              |  11 +-
 .../cli/strategy/agent_resolution_test.go     | 147 ++++++
 .../cli/strategy/manual_commit_hooks.go       |  61 ++-
 15 files changed, 960 insertions(+), 101 deletions(-)

diff --git a/cmd/entire/cli/agent/agent.go b/cmd/entire/cli/agent/agent.go
index e955eaf789..1f128bda53 100644
--- a/cmd/entire/cli/agent/agent.go
+++ b/cmd/entire/cli/agent/agent.go
@@ -338,7 +338,7 @@ type InventoryExtraction struct {
 type InventoryAwareExtractor interface {
 	Agent
 
-	ExtractWithSubagentInventory(parent []byte, fromOffset int, refs []SubagentReference) (InventoryExtraction, error)
+	ExtractWithSubagentInventory(ctx context.Context, parent []byte, fromOffset int, refs []SubagentReference) (InventoryExtraction, error)
 }
 
 // ModelExtractor extracts the LLM model identifier from a transcript for agents
diff --git a/cmd/entire/cli/agent/capabilities_test.go b/cmd/entire/cli/agent/capabilities_test.go
index 7b2be3444a..fe26b26171 100644
--- a/cmd/entire/cli/agent/capabilities_test.go
+++ b/cmd/entire/cli/agent/capabilities_test.go
@@ -79,7 +79,7 @@ func (m *mockFullAgent) PrepareTranscript(context.Context, string) error { retur
 func (m *mockFullAgent) CalculateTokenUsage([]byte, int) (*TokenUsage, error) { return nil, nil } //nolint:nilnil // test mock
 
 // InventoryAwareExtractor is built-in only and deliberately has no DeclaredCaps bit.
-func (m *mockFullAgent) ExtractWithSubagentInventory([]byte, int, []SubagentReference) (InventoryExtraction, error) {
+func (m *mockFullAgent) ExtractWithSubagentInventory(context.Context, []byte, int, []SubagentReference) (InventoryExtraction, error) {
 	return InventoryExtraction{}, nil
 }
 
diff --git a/cmd/entire/cli/agent/codex/AGENT.md b/cmd/entire/cli/agent/codex/AGENT.md
index 449bae9bd0..b38b3ef178 100644
--- a/cmd/entire/cli/agent/codex/AGENT.md
+++ b/cmd/entire/cli/agent/codex/AGENT.md
@@ -311,7 +311,8 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - The `transcript_path` field in hook payloads provides the exact path
 - Format: JSONL (line-delimited JSON)
 - Session ID extraction: `session_id` field from hook payload (UUID format)
-- Transcript may be null in `--ephemeral` mode
+- Transcript may be null in `--ephemeral` mode; root ownership cannot be
+  verified, so Entire skips turn lifecycle mutation and checkpoint capture.
 
 **Note:** Codex's primary storage is SQLite (`~/.codex/state`), but the JSONL rollout file is the file-based transcript we can read. The `transcript_path` in hook payloads points to this file.
 
@@ -341,7 +342,15 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - **SessionEnd must be trusted before it fires:** Codex silently skips hooks with no `trusted_hash` entry in the user's `config.toml`. Existing users have trusted the four older events but not `session_end`, so the hook does nothing until they approve it via `/hooks` inside Codex. `HookTrustGaps` and `InspectHookConfig(...).Missing` both cover `session_end`, so `entire doctor` and the SessionStart banner say so — without that it would fail silently. The e2e suite pre-trusts hooks by generating the same hashes itself (`e2e/agents/codex_trust.go`), so **an event added to `managedHooks` must also be added to `codexHookEventLabels`, the `codexHookEvents` struct, and the `codexEventGroups` switch there** — all three, or it is installed but inert for every e2e run; `TestCodexHookTrustState_CoversEveryInstalledEvent` fails when they drift.
 - **A pre-SessionEnd install still counts as installed:** `AreHooksInstalled` gates on the core events only, so adding an event does not retroactively drop Codex out of `entire status` and the agent pickers for everyone who enabled it earlier. The stale install is reported as drift through `InspectHookConfig(...).Missing` instead, with `entire enable` as the fix.
 - **`reason` carries no information:** always `"other"`, so a session ended by `/clear` is indistinguishable from one ended by quitting.
-- **Transcript may be null:** In `--ephemeral` mode, `transcript_path` is null. The integration handles this gracefully.
+- **Transcript may be null:** In `--ephemeral` mode, `transcript_path` is null.
+  Entire fails closed: it emits a categorized diagnostic and skips TurnStart /
+  TurnEnd state mutation and checkpoint capture because the root rollout cannot
+  be verified. Ephemeral Codex sessions therefore are not tracked.
+- **Unreadable, malformed, or future rollout metadata also fails closed:** the
+  turn hook emits a diagnostic categorized as `unreadable_transcript`,
+  `malformed_session_metadata`, or `unclassified_source`, then performs no root
+  lifecycle mutation. This prevents a child or unknown future rollout shape
+  from being attributed to the root session.
 - **No hooks fire under `-s read-only`:** verified against 0.147.0 — a `codex exec -s read-only` run produces no hook invocations at all, so no session is tracked. `-s workspace-write` fires the full set.
 - **Subagent identity fields are inverted from their names:** `SubagentStart` / `SubagentStop` (schemas at `codex-rs/hooks/schema/generated/subagent-{start,stop}.command.input.schema.json`) send `session_id` = the identity shared by the root thread *and every descendant*, i.e. the user's session, which maps straight to Entire's SessionID; `agent_id` = the subagent thread's own id. Codex sends no `tool_use_id`, so `agent_id` doubles as Entire's ToolUseID — it is the only value correlating a start with its stop, and Entire keys pre-task state and the task metadata directory on it. Getting this backwards attributes subagent work to a session Entire has never seen.
 - **`SubagentStop` is provisional, not authoritative completion.** It carries two transcripts: `transcript_path` is the *parent* rollout and `agent_transcript_path` the child rollout. Entire retains the child identity and declared path, then accepts a rollout only after its first `session_meta.id` exactly matches `agent_id`, it is a regular file, and the same verified bytes are analyzed. A hook-supplied filename is never trusted by itself.
diff --git a/cmd/entire/cli/agent/codex/codex.go b/cmd/entire/cli/agent/codex/codex.go
index 6e9e64e178..7bb97f7243 100644
--- a/cmd/entire/cli/agent/codex/codex.go
+++ b/cmd/entire/cli/agent/codex/codex.go
@@ -32,10 +32,15 @@ type CodexAgent struct {
 	// that already know them (notably tests). Nil uses Codex's normal home.
 	RolloutRoots []string
 	// loadRollout and walkDir are package-private deterministic test seams.
-	// Production always uses regular-file, same-descriptor loading and
-	// filepath.WalkDir respectively.
+	// Production uses verified same-descriptor reads plus the bounded,
+	// incremental directory walker.
 	loadRollout func(string) (loadedRollout, error)
 	walkDir     func(string, fs.WalkDirFunc) error
+	// scanLimits and observeRolloutRead are deterministic test seams for the
+	// fallback rollout budget. Production uses defaultRolloutScanLimits and no
+	// observer.
+	scanLimits         *rolloutScanLimits
+	observeRolloutRead func(string, int)
 }
 
 type loadedRollout struct {
@@ -43,11 +48,100 @@ type loadedRollout struct {
 	Data []byte
 }
 
+const (
+	rolloutScanTimeout       = 500 * time.Millisecond
+	rolloutCandidateLimit    = 20_000
+	rolloutMetadataByteLimit = int64(64 << 10)
+	rolloutBodyByteLimit     = int64(128 << 20)
+	rolloutAggregateLimit    = int64(256 << 20)
+	rolloutReadDirBatch      = 128
+	rolloutBodyReadChunk     = 32 << 10
+	rolloutMetadataChunk     = 1 << 10
+)
+
+type rolloutScanLimits struct {
+	timeout            time.Duration
+	candidateLimit     int
+	metadataByteLimit  int64
+	bodyByteLimit      int64
+	aggregateByteLimit int64
+	readDirBatch       int
+	now                func() time.Time
+}
+
+var defaultRolloutScanLimits = rolloutScanLimits{ //nolint:gochecknoglobals // immutable production defaults
+	timeout:            rolloutScanTimeout,
+	candidateLimit:     rolloutCandidateLimit,
+	metadataByteLimit:  rolloutMetadataByteLimit,
+	bodyByteLimit:      rolloutBodyByteLimit,
+	aggregateByteLimit: rolloutAggregateLimit,
+	readDirBatch:       rolloutReadDirBatch,
+	now:                time.Now,
+}
+
+var errRolloutScanBudget = errors.New("codex rollout scan budget exceeded")
+
+type rolloutScanBudget struct {
+	ctx            context.Context
+	limits         rolloutScanLimits
+	deadline       time.Time
+	candidates     int
+	aggregateBytes int64
+}
+
+func newRolloutScanBudget(ctx context.Context, limits rolloutScanLimits) *rolloutScanBudget {
+	if limits.now == nil {
+		limits.now = time.Now
+	}
+	if limits.readDirBatch <= 0 {
+		limits.readDirBatch = rolloutReadDirBatch
+	}
+	return &rolloutScanBudget{
+		ctx:      ctx,
+		limits:   limits,
+		deadline: limits.now().Add(limits.timeout),
+	}
+}
+
+func (b *rolloutScanBudget) check() error {
+	if err := b.ctx.Err(); err != nil {
+		return fmt.Errorf("rollout scan canceled: %w: %w", err, errRolloutScanBudget)
+	}
+	if b.limits.timeout > 0 && !b.limits.now().Before(b.deadline) {
+		return fmt.Errorf("rollout scan deadline reached: %w", errRolloutScanBudget)
+	}
+	return nil
+}
+
+func (b *rolloutScanBudget) observeCandidate() error {
+	if err := b.check(); err != nil {
+		return err
+	}
+	b.candidates++
+	if b.limits.candidateLimit >= 0 && b.candidates > b.limits.candidateLimit {
+		return fmt.Errorf("rollout candidate limit %d exceeded: %w", b.limits.candidateLimit, errRolloutScanBudget)
+	}
+	return nil
+}
+
+func (b *rolloutScanBudget) observeBytes(count int64) error {
+	if count < 0 || count > b.limits.aggregateByteLimit-b.aggregateBytes {
+		return fmt.Errorf("aggregate rollout byte limit %d exceeded: %w", b.limits.aggregateByteLimit, errRolloutScanBudget)
+	}
+	b.aggregateBytes += count
+	return nil
+}
+
 func rolloutRegularMode(mode fs.FileMode) bool {
 	return mode.Type() == 0
 }
 
+//nolint:unused // Companion for readSessionMetaID's retained direct-path helper.
 func readRegularRollout(path string) (loadedRollout, error) {
+	return readRegularRolloutContext(context.Background(), path, rolloutBodyByteLimit, nil)
+}
+
+func readRegularRolloutContext(ctx context.Context, path string, byteLimit int64, observe func(string, int)) (loadedRollout, error) {
 	info, err := os.Lstat(path)
 	if err != nil {
 		return loadedRollout{}, fmt.Errorf("lstat rollout: %w", err)
@@ -67,22 +161,53 @@ func readRegularRollout(path string) (loadedRollout, error) {
 	if !rolloutRegularMode(opened.Mode()) || !os.SameFile(info, opened) {
 		return loadedRollout{}, errors.New("rollout changed or is not a regular file")
 	}
-	data, err := io.ReadAll(file)
+	if opened.Size() > byteLimit {
+		return loadedRollout{}, fmt.Errorf("rollout size %d exceeds limit %d", opened.Size(), byteLimit)
+	}
+	data, err := readRolloutBody(ctx, file, path, byteLimit, observe)
 	if err != nil {
 		return loadedRollout{}, fmt.Errorf("read rollout: %w", err)
 	}
 	return loadedRollout{Path: path, Data: data}, nil
 }
 
-func (c *CodexAgent) loadCandidateRollout(path string) (loadedRollout, error) {
+func readRolloutBody(ctx context.Context, file *os.File, path string, byteLimit int64, observe func(string, int)) ([]byte, error) {
+	data := make([]byte, 0)
+	buffer := make([]byte, rolloutBodyReadChunk)
+	var readBytes int64
+	for {
+		if err := ctx.Err(); err != nil {
+			return nil, fmt.Errorf("read rollout canceled: %w", err)
+		}
+		n, err := file.Read(buffer)
+		if n > 0 {
+			if observe != nil {
+				observe(path, n)
+			}
+			readBytes += int64(n)
+			if readBytes > byteLimit {
+				return nil, fmt.Errorf("rollout exceeds byte limit %d", byteLimit)
+			}
+			data = append(data, buffer[:n]...)
+		}
+		if errors.Is(err, io.EOF) {
+			return data, nil
+		}
+		if err != nil {
+			return nil, fmt.Errorf("read rollout body: %w", err)
+		}
+	}
+}
+
+func (c *CodexAgent) loadCandidateRollout(ctx context.Context, path string) (loadedRollout, error) {
 	if c.loadRollout != nil {
 		return c.loadRollout(path)
 	}
-	return readRegularRollout(path)
+	return readRegularRolloutContext(ctx, path, rolloutBodyByteLimit, c.observeRolloutRead)
 }
 
-func (c *CodexAgent) loadVerifiedRollout(path, agentID string) (loadedRollout, bool) {
-	loaded, err := c.loadCandidateRollout(path)
+func (c *CodexAgent) loadVerifiedRollout(ctx context.Context, path, agentID string) (loadedRollout, bool) {
+	loaded, err := c.loadCandidateRollout(ctx, path)
 	if err != nil {
 		return loadedRollout{}, false
 	}
@@ -114,73 +239,291 @@ func (c *CodexAgent) rolloutRoots() []string {
 	return []string{sessionDir, filepath.Join(codexHome, "archived_sessions")}
 }
 
-func (c *CodexAgent) loadDirectRollout(ref agent.SubagentReference) (loadedRollout, bool) {
+func (c *CodexAgent) loadDirectRollout(ctx context.Context, ref agent.SubagentReference) (loadedRollout, bool) {
 	for _, path := range []string{ref.DeclaredTranscriptPath, ref.ResolvedTranscriptPath} {
 		if path == "" {
 			continue
 		}
-		if loaded, ok := c.loadVerifiedRollout(path, ref.AgentID); ok {
+		if loaded, ok := c.loadVerifiedRollout(ctx, path, ref.AgentID); ok {
 			return loaded, true
 		}
 	}
 	return loadedRollout{}, false
 }
 
-func (c *CodexAgent) walkRollouts(root string, visit fs.WalkDirFunc) error {
+func (c *CodexAgent) walkRollouts(ctx context.Context, root string, budget *rolloutScanBudget, visit func(string, fs.DirEntry) error) error {
 	if c.walkDir != nil {
-		return c.walkDir(root, visit)
+		return c.walkDir(root, func(path string, entry fs.DirEntry, entryErr error) error {
+			if entryErr != nil {
+				if path == root && errors.Is(entryErr, fs.ErrNotExist) {
+					return nil
+				}
+				return entryErr
+			}
+			if err := budget.check(); err != nil {
+				return err
+			}
+			return visit(path, entry)
+		})
 	}
-	if err := filepath.WalkDir(root, visit); err != nil {
+	if err := walkRolloutsIncremental(ctx, root, budget, visit); err != nil {
 		return fmt.Errorf("walk Codex rollouts: %w", err)
 	}
 	return nil
 }
 
+func walkRolloutsIncremental(ctx context.Context, root string, budget *rolloutScanBudget, visit func(string, fs.DirEntry) error) error {
+	if err := budget.check(); err != nil {
+		return err
+	}
+	rootInfo, err := os.Lstat(root)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("lstat rollout root: %w", err)
+	}
+	if !rootInfo.IsDir() {
+		return nil
+	}
+	return walkRolloutDirectory(ctx, root, budget, visit)
+}
+
+func walkRolloutDirectory(ctx context.Context, dirPath string, budget *rolloutScanBudget, visit func(string, fs.DirEntry) error) error {
+	dir, err := os.Open(dirPath) //nolint:gosec // rollout root is user configuration or Codex's own directory
+	if err != nil {
+		return fmt.Errorf("open rollout directory: %w", err)
+	}
+	defer dir.Close()
+
+	for {
+		if err := budget.check(); err != nil {
+			return err
+		}
+		entries, readErr := dir.ReadDir(budget.limits.readDirBatch)
+		for _, entry := range entries {
+			if err := budget.check(); err != nil {
+				return err
+			}
+			path := filepath.Join(dirPath, entry.Name())
+			if entry.IsDir() {
+				if err := walkRolloutDirectory(ctx, path, budget, visit); err != nil {
+					return err
+				}
+				continue
+			}
+			if err := visit(path, entry); err != nil {
+				return err
+			}
+		}
+		if errors.Is(readErr, io.EOF) {
+			return nil
+		}
+		if readErr != nil {
+			return fmt.Errorf("read rollout directory: %w", readErr)
+		}
+		if err := ctx.Err(); err != nil {
+			return fmt.Errorf("walk rollout directory canceled: %w", err)
+		}
+	}
+}
+
+func (c *CodexAgent) inspectFallbackCandidate(
+	path string,
+	agentIDs map[string]struct{},
+	budget *rolloutScanBudget,
+) (string, loadedRollout, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return "", loadedRollout{}, fmt.Errorf("lstat rollout candidate: %w", err)
+	}
+	if !rolloutRegularMode(info.Mode()) {
+		return "", loadedRollout{}, nil
+	}
+
+	if c.loadRollout != nil {
+		loaded, loadErr := c.loadRollout(path)
+		if loadErr != nil {
+			return "", loadedRollout{}, loadErr
+		}
+		if loaded.Path == "" {
+			loaded.Path = path
+		}
+		if loaded.Path != path {
+			return "", loadedRollout{}, errors.New("rollout loader returned a different path")
+		}
+		id, metaErr := sessionMetaID(loaded.Data)
+		if metaErr != nil {
+			return "", loadedRollout{}, metaErr
+		}
+		if _, wanted := agentIDs[id]; !wanted {
+			return id, loadedRollout{}, nil
+		}
+		if int64(len(loaded.Data)) > budget.limits.bodyByteLimit {
+			return "", loadedRollout{}, errRolloutScanBudget
+		}
+		if err := budget.observeBytes(int64(len(loaded.Data))); err != nil {
+			return "", loadedRollout{}, err
+		}
+		return id, loaded, nil
+	}
+
+	file, err := os.Open(path) //nolint:gosec // Lstat and descriptor Stat below enforce a regular unchanged file
+	if err != nil {
+		return "", loadedRollout{}, fmt.Errorf("open rollout candidate: %w", err)
+	}
+	defer file.Close()
+	opened, err := file.Stat()
+	if err != nil {
+		return "", loadedRollout{}, fmt.Errorf("stat opened rollout candidate: %w", err)
+	}
+	if !rolloutRegularMode(opened.Mode()) || !os.SameFile(info, opened) {
+		return "", loadedRollout{}, errors.New("rollout candidate changed or is not a regular file")
+	}
+
+	metadata, err := c.readFallbackMetadata(file, path, budget)
+	if err != nil {
+		return "", loadedRollout{}, err
+	}
+	id, err := sessionMetaID(metadata)
+	if err != nil {
+		return "", loadedRollout{}, err
+	}
+	if _, wanted := agentIDs[id]; !wanted {
+		return id, loadedRollout{}, nil
+	}
+	if opened.Size() > budget.limits.bodyByteLimit {
+		return "", loadedRollout{}, fmt.Errorf("rollout body size %d exceeds limit %d: %w", opened.Size(), budget.limits.bodyByteLimit, errRolloutScanBudget)
+	}
+	if opened.Size() > budget.limits.aggregateByteLimit-budget.aggregateBytes {
+		return "", loadedRollout{}, fmt.Errorf("aggregate rollout size exceeds limit %d: %w", budget.limits.aggregateByteLimit, errRolloutScanBudget)
+	}
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		return "", loadedRollout{}, fmt.Errorf("seek rollout candidate: %w", err)
+	}
+	data, err := c.readFallbackBody(file, path, budget)
+	if err != nil {
+		return "", loadedRollout{}, err
+	}
+	return id, loadedRollout{Path: path, Data: data}, nil
+}
+
+func (c *CodexAgent) readFallbackMetadata(file *os.File, path string, budget *rolloutScanBudget) ([]byte, error) {
+	data := make([]byte, 0, min(rolloutMetadataChunk, int(budget.limits.metadataByteLimit)))
+	buffer := make([]byte, rolloutMetadataChunk)
+	for {
+		if err := budget.check(); err != nil {
+			return nil, err
+		}
+		remaining := budget.limits.metadataByteLimit + 1 - int64(len(data))
+		if remaining <= 0 {
+			return nil, fmt.Errorf("rollout metadata exceeds limit %d: %w", budget.limits.metadataByteLimit, errRolloutScanBudget)
+		}
+		readSize := len(buffer)
+		if int64(readSize) > remaining {
+			readSize = int(remaining)
+		}
+		n, err := file.Read(buffer[:readSize])
+		if n > 0 {
+			if budgetErr := budget.observeBytes(int64(n)); budgetErr != nil {
+				return nil, budgetErr
+			}
+			if c.observeRolloutRead != nil {
+				c.observeRolloutRead(path, n)
+			}
+			chunk := buffer[:n]
+			if newline := indexByte(chunk, '\n'); newline >= 0 {
+				data = append(data, chunk[:newline+1]...)
+				if int64(len(data)) > budget.limits.metadataByteLimit {
+					return nil, fmt.Errorf("rollout metadata exceeds limit %d: %w", budget.limits.metadataByteLimit, errRolloutScanBudget)
+				}
+				return data, nil
+			}
+			data = append(data, chunk...)
+			if int64(len(data)) > budget.limits.metadataByteLimit {
+				return nil, fmt.Errorf("rollout metadata exceeds limit %d: %w", budget.limits.metadataByteLimit, errRolloutScanBudget)
+			}
+		}
+		if errors.Is(err, io.EOF) {
+			if len(data) == 0 {
+				return nil, errors.New("rollout metadata is empty")
+			}
+			return data, nil
+		}
+		if err != nil {
+			return nil, fmt.Errorf("read rollout metadata: %w", err)
+		}
+	}
+}
+
+func (c *CodexAgent) readFallbackBody(file *os.File, path string, budget *rolloutScanBudget) ([]byte, error) {
+	data := make([]byte, 0)
+	buffer := make([]byte, rolloutBodyReadChunk)
+	for {
+		if err := budget.check(); err != nil {
+			return nil, err
+		}
+		n, err := file.Read(buffer)
+		if n > 0 {
+			if budgetErr := budget.observeBytes(int64(n)); budgetErr != nil {
+				return nil, budgetErr
+			}
+			if c.observeRolloutRead != nil {
+				c.observeRolloutRead(path, n)
+			}
+			if int64(len(data)+n) > budget.limits.bodyByteLimit {
+				return nil, errRolloutScanBudget
+			}
+			data = append(data, buffer[:n]...)
+		}
+		if errors.Is(err, io.EOF) {
+			return data, nil
+		}
+		if err != nil {
+			return nil, fmt.Errorf("read fallback rollout body: %w", err)
+		}
+	}
+}
+
+func indexByte(data []byte, target byte) int {
+	for index, value := range data {
+		if value == target {
+			return index
+		}
+	}
+	return -1
+}
+
 // scanFallbackRollouts scans every configured root once. Any traversal or
 // regular-candidate metadata failure discards all results: partial results
 // cannot prove a child ID is unique.
-func (c *CodexAgent) scanFallbackRollouts(agentIDs map[string]struct{}) map[string]loadedRollout {
+func (c *CodexAgent) scanFallbackRollouts(ctx context.Context, agentIDs map[string]struct{}) (map[string]loadedRollout, error) {
 	if len(agentIDs) == 0 {
-		return map[string]loadedRollout{}
+		return map[string]loadedRollout{}, nil
 	}
+	limits := defaultRolloutScanLimits
+	if c.scanLimits != nil {
+		limits = *c.scanLimits
+	}
+	budget := newRolloutScanBudget(ctx, limits)
 	matches := make(map[string][]loadedRollout)
 	seenPaths := make(map[string]struct{})
 	for _, root := range c.rolloutRoots() {
 		if root == "" {
 			continue
 		}
-		walkErr := c.walkRollouts(root, func(path string, entry fs.DirEntry, entryErr error) error {
-			if entryErr != nil {
-				if path == root && errors.Is(entryErr, fs.ErrNotExist) {
-					return nil // Missing configured roots are normal.
-				}
-				return fmt.Errorf("walk rollout candidate: %w", entryErr)
-			}
+		walkErr := c.walkRollouts(ctx, root, budget, func(path string, entry fs.DirEntry) error {
 			if entry.IsDir() || filepath.Ext(path) != ".jsonl" {
 				return nil
 			}
-			info, err := entry.Info()
-			if err != nil {
-				return fmt.Errorf("stat rollout candidate: %w", err)
+			if err := budget.observeCandidate(); err != nil {
+				return err
 			}
-			if !rolloutRegularMode(info.Mode()) {
-				return nil
-			}
-			loaded, err := c.loadCandidateRollout(path)
+			id, loaded, err := c.inspectFallbackCandidate(path, agentIDs, budget)
 			if err != nil {
-				return fmt.Errorf("load rollout candidate: %w", err)
+				return fmt.Errorf("inspect rollout candidate: %w", err)
 			}
 			if loaded.Path == "" {
-				loaded.Path = path
-			}
-			if loaded.Path != path {
-				return errors.New("rollout loader returned a different path")
-			}
-			id, err := sessionMetaID(loaded.Data)
-			if err != nil {
-				return fmt.Errorf("read rollout metadata: %w", err)
-			}
-			if _, wanted := agentIDs[id]; !wanted {
 				return nil
 			}
 			if _, duplicate := seenPaths[path]; !duplicate {
@@ -190,7 +533,7 @@ func (c *CodexAgent) scanFallbackRollouts(agentIDs map[string]struct{}) map[stri
 			return nil
 		})
 		if walkErr != nil {
-			return nil
+			return nil, walkErr
 		}
 	}
 	resolved := make(map[string]loadedRollout)
@@ -199,7 +542,7 @@ func (c *CodexAgent) scanFallbackRollouts(agentIDs map[string]struct{}) map[stri
 			resolved[id] = candidates[0]
 		}
 	}
-	return resolved
+	return resolved, nil
 }
 
 // resolveSubagentRollout is the path-only compatibility wrapper used by
@@ -209,10 +552,14 @@ func (c *CodexAgent) resolveSubagentRollout(ref agent.SubagentReference) string
 	if ref.AgentID == "" {
 		return ""
 	}
-	if loaded, ok := c.loadDirectRollout(ref); ok {
+	if loaded, ok := c.loadDirectRollout(context.Background(), ref); ok {
 		return loaded.Path
 	}
-	if loaded, ok := c.scanFallbackRollouts(map[string]struct{}{ref.AgentID: {}})[ref.AgentID]; ok {
+	fallback, err := c.scanFallbackRollouts(context.Background(), map[string]struct{}{ref.AgentID: {}})
+	if err != nil {
+		return ""
+	}
+	if loaded, ok := fallback[ref.AgentID]; ok {
 		return loaded.Path
 	}
 	return ""
diff --git a/cmd/entire/cli/agent/codex/lifecycle.go b/cmd/entire/cli/agent/codex/lifecycle.go
index f29ee61ab6..d008295c10 100644
--- a/cmd/entire/cli/agent/codex/lifecycle.go
+++ b/cmd/entire/cli/agent/codex/lifecycle.go
@@ -295,13 +295,18 @@ func (c *CodexAgent) parseTurnEnd(ctx context.Context, stdin io.Reader) (*agent.
 }
 
 func isRootTurnRollout(ctx context.Context, path string) bool {
-	switch classifyRollout(path) {
+	classification := classifyRolloutDetailed(path)
+	switch classification.Classification {
 	case rolloutRoot:
 		return true
 	case rolloutChild:
+		logging.Debug(ctx, "codex: skipped root lifecycle mutation for child rollout", slog.String("path", path))
 		return false
 	case rolloutUnknown:
-		logging.Warn(ctx, "codex: skipped turn lifecycle event for unclassified rollout", slog.String("path", path))
+		logging.Warn(ctx, "codex: skipped turn lifecycle event because rollout ownership is unverified",
+			slog.String("category", string(classification.Issue)),
+			slog.String("detail", classification.Detail),
+			slog.String("path", path))
 		return false
 	}
 	return false
diff --git a/cmd/entire/cli/agent/codex/lifecycle_test.go b/cmd/entire/cli/agent/codex/lifecycle_test.go
index 142bddd152..7154d1afa6 100644
--- a/cmd/entire/cli/agent/codex/lifecycle_test.go
+++ b/cmd/entire/cli/agent/codex/lifecycle_test.go
@@ -249,28 +249,80 @@ func TestParseHookEvent_UserPromptSubmitAndStopRequireRootRollout(t *testing.T)
 	}
 }
 
-func TestParseHookEvent_UnknownTurnRolloutWritesDiagnostic(t *testing.T) {
+func TestParseHookEvent_UnknownTurnRolloutWritesCategorizedDiagnostic(t *testing.T) {
 	t.Parallel()
 
-	rolloutPath := filepath.Join(t.TempDir(), "rollout.jsonl")
-	require.NoError(t, os.WriteFile(rolloutPath, []byte(`{"type":"session_meta","payload":{"source":"future-source"}}`+"\n"), 0o600))
+	tests := []struct {
+		name     string
+		path     func(*testing.T) string
+		category rolloutClassificationIssue
+		detail   string
+	}{
+		{
+			name:     "null transcript path",
+			path:     func(*testing.T) string { return "" },
+			category: rolloutIssueNullPath,
+		},
+		{
+			name: "unreadable transcript",
+			path: func(t *testing.T) string {
+				return filepath.Join(t.TempDir(), "missing.jsonl")
+			},
+			category: rolloutIssueUnreadable,
+			detail:   "open",
+		},
+		{
+			name: "malformed metadata",
+			path: func(t *testing.T) string {
+				path := filepath.Join(t.TempDir(), "rollout.jsonl")
+				require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":`), 0o600))
+				return path
+			},
+			category: rolloutIssueMalformedMetadata,
+			detail:   "first_record_json",
+		},
+		{
+			name: "future source",
+			path: func(t *testing.T) string {
+				path := filepath.Join(t.TempDir(), "rollout.jsonl")
+				require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":{"source":"future-source"}}`+"\n"), 0o600))
+				return path
+			},
+			category: rolloutIssueUnclassifiedSource,
+			detail:   "future-source",
+		},
+	}
 
-	logDir := t.TempDir()
-	logger, err := logging.New(logging.Config{Dir: logDir})
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, logger.Close()) })
-	ctx := logging.WithLogger(context.Background(), logger)
-	input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":"` + rolloutPath + `","model":"gpt-5","prompt":"do work"}`
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			rolloutPath := tt.path(t)
+			pathJSON := "null"
+			if rolloutPath != "" {
+				pathJSON = `"` + rolloutPath + `"`
+			}
+			logDir := t.TempDir()
+			logger, err := logging.New(logging.Config{Dir: logDir})
+			require.NoError(t, err)
+			ctx := logging.WithLogger(context.Background(), logger)
+			input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":` + pathJSON + `,"model":"gpt-5","prompt":"do work"}`
 
-	event, err := (&CodexAgent{}).ParseHookEvent(ctx, HookNameUserPromptSubmit, strings.NewReader(input))
-	require.NoError(t, err)
-	require.Nil(t, event)
-	require.NoError(t, logger.Close())
+			event, err := (&CodexAgent{}).ParseHookEvent(ctx, HookNameUserPromptSubmit, strings.NewReader(input))
+			require.NoError(t, err)
+			require.Nil(t, event)
+			require.NoError(t, logger.Close())
 
-	logData, err := os.ReadFile(filepath.Join(logDir, "entire.log"))
-	require.NoError(t, err)
-	require.Contains(t, string(logData), "codex: skipped turn lifecycle event for unclassified rollout")
-	require.Contains(t, string(logData), rolloutPath)
+			logData, err := os.ReadFile(filepath.Join(logDir, "entire.log"))
+			require.NoError(t, err)
+			logText := string(logData)
+			require.Contains(t, logText, "codex: skipped turn lifecycle event because rollout ownership is unverified")
+			require.Contains(t, logText, string(tt.category))
+			require.Contains(t, logText, tt.detail)
+			if rolloutPath != "" {
+				require.Contains(t, logText, rolloutPath)
+			}
+		})
+	}
 }
 
 func TestParseHookEvent_PreToolUse_ReturnsNil(t *testing.T) {
diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
index 3b9b66f0b2..f9a3f5db9d 100644
--- a/cmd/entire/cli/agent/codex/subagent_test.go
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -1,6 +1,7 @@
 package codex
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"io/fs"
@@ -8,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
 	"github.com/stretchr/testify/require"
@@ -261,7 +263,7 @@ func TestSubagentInventory_CollectsExactEvidenceAndDoesNotPartialAggregate(t *te
 	})
 	parent := rolloutData(t, "parent", []json.RawMessage{patchEvent("parent.txt")})
 
-	result, err := ag.ExtractWithSubagentInventory(parent, 0, []agent.SubagentReference{
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), parent, 0, []agent.SubagentReference{
 		{AgentID: "one", DeclaredTranscriptPath: childOne},
 		{AgentID: "two", ResolvedTranscriptPath: childTwo},
 	})
@@ -299,7 +301,7 @@ func TestSubagentInventory_AggregatesOnlyCompleteExactChildren(t *testing.T) {
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 10, "cached_input_tokens": 3, "output_tokens": 5}}),
 	})
 
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{
 		{AgentID: "first", DeclaredTranscriptPath: first},
 		{AgentID: "second", ResolvedTranscriptPath: second},
 	})
@@ -334,7 +336,7 @@ func TestSubagentInventory_EmptyInventoryIsExactWithoutChildTotal(t *testing.T)
 			return filepath.WalkDir(root, visit)
 		},
 	}
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, nil)
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, nil)
 	require.NoError(t, err)
 	require.Zero(t, walks, "an exact empty inventory has no unresolved child and must not scan rollout archives")
 	require.Empty(t, result.Children)
@@ -356,7 +358,7 @@ func TestSubagentInventory_UnresolvedChildPreventsPartialAggregate(t *testing.T)
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 2, "cached_input_tokens": 1, "output_tokens": 1}}),
 	})
 
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{
 		{AgentID: "available", DeclaredTranscriptPath: available},
 		{AgentID: "missing"},
 	})
@@ -393,7 +395,7 @@ func TestSubagentInventory_LoaderFailureFailsClosedBeforeResolution(t *testing.T
 		},
 	}
 
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{
 		AgentID:                "child",
 		DeclaredTranscriptPath: path,
 	}})
@@ -423,7 +425,7 @@ func TestSubagentInventory_RevalidatesInjectedRolloutBytes(t *testing.T) {
 		},
 	}
 
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{
 		AgentID:                "child",
 		DeclaredTranscriptPath: path,
 	}})
@@ -450,7 +452,7 @@ func TestSubagentInventory_BatchesFallbackTraversal(t *testing.T) {
 		},
 	}
 
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{AgentID: "first"}, {AgentID: "second"}})
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: "first"}, {AgentID: "second"}})
 	require.NoError(t, err)
 	require.Equal(t, 2, walks, "one traversal per configured root, not per child")
 	require.Equal(t, []string{"first", "second"}, []string{result.Children[0].AgentID, result.Children[1].AgentID})
@@ -471,13 +473,169 @@ func TestSubagentInventory_FallbackTraversalFailureDiscardsMatches(t *testing.T)
 		},
 	}
 
-	result, err := ag.ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{AgentID: "child"}})
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: "child"}})
 	require.NoError(t, err)
 	require.Empty(t, result.Children[0].ResolvedPath)
 	require.False(t, *result.TokenUsage.SubagentTokensComplete)
 	require.Nil(t, result.TokenUsage.SubagentTokens)
 }
 
+func TestRolloutScanLimits_Defaults(t *testing.T) {
+	t.Parallel()
+
+	require.Equal(t, 500*time.Millisecond, defaultRolloutScanLimits.timeout)
+	require.Equal(t, 20_000, defaultRolloutScanLimits.candidateLimit)
+	require.Equal(t, int64(64<<10), defaultRolloutScanLimits.metadataByteLimit)
+	require.Equal(t, int64(128<<20), defaultRolloutScanLimits.bodyByteLimit)
+	require.Equal(t, int64(256<<20), defaultRolloutScanLimits.aggregateByteLimit)
+	require.Equal(t, 128, defaultRolloutScanLimits.readDirBatch)
+}
+
+func TestRolloutScanBudget_DefaultBoundaries(t *testing.T) {
+	t.Parallel()
+
+	start := time.Unix(1, 0)
+	now := start
+	limits := defaultRolloutScanLimits
+	limits.now = func() time.Time { return now }
+
+	candidates := newRolloutScanBudget(t.Context(), limits)
+	for range limits.candidateLimit {
+		require.NoError(t, candidates.observeCandidate())
+	}
+	require.ErrorIs(t, candidates.observeCandidate(), errRolloutScanBudget)
+
+	bytes := newRolloutScanBudget(t.Context(), limits)
+	require.NoError(t, bytes.observeBytes(limits.aggregateByteLimit))
+	require.ErrorIs(t, bytes.observeBytes(1), errRolloutScanBudget)
+
+	deadline := newRolloutScanBudget(t.Context(), limits)
+	now = start.Add(limits.timeout - time.Nanosecond)
+	require.NoError(t, deadline.check())
+	now = start.Add(limits.timeout)
+	require.ErrorIs(t, deadline.check(), errRolloutScanBudget)
+}
+
+func TestSubagentInventory_FallbackReadsOnlyMetadataForUnrelatedRollouts(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	unrelated := writeRollout(t, root, "unrelated.jsonl", "unrelated", nil)
+	require.NoError(t, os.WriteFile(unrelated, append(mustReadFile(t, unrelated), []byte(strings.Repeat("x", 1<<20))...), 0o600))
+	writeRollout(t, root, "wanted.jsonl", "wanted", []json.RawMessage{
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 2, "cached_input_tokens": 0, "output_tokens": 1}}),
+	})
+
+	readByPath := make(map[string]int64)
+	ag := &CodexAgent{
+		RolloutRoots: []string{root},
+		observeRolloutRead: func(path string, n int) {
+			readByPath[path] += int64(n)
+		},
+	}
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: "wanted"}})
+	require.NoError(t, err)
+	require.True(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Less(t, readByPath[unrelated], int64(4<<10), "unrelated rollout must not be read beyond its metadata prefix")
+}
+
+func TestRolloutScanLimits_FailClosed(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		limits rolloutScanLimits
+		setup  func(*testing.T, string)
+		refs   []agent.SubagentReference
+	}{
+		{
+			name:   "candidate count",
+			limits: testRolloutScanLimits(1, 64<<10, 128<<20, 256<<20),
+			setup: func(t *testing.T, root string) {
+				writeRollout(t, root, "one.jsonl", "one", nil)
+				writeRollout(t, root, "two.jsonl", "two", nil)
+			},
+			refs: []agent.SubagentReference{{AgentID: "one"}, {AgentID: "two"}},
+		},
+		{
+			name:   "metadata bytes",
+			limits: testRolloutScanLimits(10, 8, 128<<20, 256<<20),
+			setup: func(t *testing.T, root string) {
+				writeRollout(t, root, "child.jsonl", "child", nil)
+			},
+			refs: []agent.SubagentReference{{AgentID: "child"}},
+		},
+		{
+			name:   "body bytes",
+			limits: testRolloutScanLimits(10, 64<<10, 80, 256<<20),
+			setup: func(t *testing.T, root string) {
+				writeRollout(t, root, "child.jsonl", "child", []json.RawMessage{patchEvent("child.txt")})
+			},
+			refs: []agent.SubagentReference{{AgentID: "child"}},
+		},
+		{
+			name:   "aggregate bytes",
+			limits: testRolloutScanLimits(10, 64<<10, 1<<20, 120),
+			setup: func(t *testing.T, root string) {
+				writeRollout(t, root, "one.jsonl", "one", []json.RawMessage{patchEvent("one.txt")})
+				writeRollout(t, root, "two.jsonl", "two", []json.RawMessage{patchEvent("two.txt")})
+			},
+			refs: []agent.SubagentReference{{AgentID: "one"}, {AgentID: "two"}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			root := t.TempDir()
+			tt.setup(t, root)
+			ag := &CodexAgent{RolloutRoots: []string{root}, scanLimits: &tt.limits}
+			result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, tt.refs)
+			require.NoError(t, err)
+			require.NotNil(t, result.TokenUsage)
+			require.Nil(t, result.TokenUsage.SubagentTokens)
+			require.NotNil(t, result.TokenUsage.SubagentTokensComplete)
+			require.False(t, *result.TokenUsage.SubagentTokensComplete)
+			for _, child := range result.Children {
+				require.Empty(t, child.ResolvedPath, "a scan breach must discard all partial fallback matches")
+			}
+		})
+	}
+}
+
+func TestSubagentInventory_IncrementalCancellation(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	writeRollout(t, root, "child.jsonl", "child", nil)
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	ag := &CodexAgent{RolloutRoots: []string{root}}
+	result, err := ag.ExtractWithSubagentInventory(ctx, nil, 0, []agent.SubagentReference{{AgentID: "child"}})
+	require.NoError(t, err)
+	require.False(t, *result.TokenUsage.SubagentTokensComplete)
+	require.Empty(t, result.Children[0].ResolvedPath)
+}
+
+func testRolloutScanLimits(candidateLimit int, metadata, body, aggregate int64) rolloutScanLimits {
+	return rolloutScanLimits{
+		timeout:            time.Hour,
+		candidateLimit:     candidateLimit,
+		metadataByteLimit:  metadata,
+		bodyByteLimit:      body,
+		aggregateByteLimit: aggregate,
+		readDirBatch:       2,
+		now:                time.Now,
+	}
+}
+
+func mustReadFile(t *testing.T, path string) []byte {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+	return data
+}
+
 func writeRollout(t *testing.T, root, name, id string, events []json.RawMessage) string {
 	t.Helper()
 	path := filepath.Join(root, name)
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index d0cd495824..ac78995f8f 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -3,6 +3,7 @@ package codex
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -89,6 +90,21 @@ const (
 	rolloutChild
 )
 
+type rolloutClassificationIssue string
+
+const (
+	rolloutIssueNullPath           rolloutClassificationIssue = "null_transcript_path"
+	rolloutIssueUnreadable         rolloutClassificationIssue = "unreadable_transcript"
+	rolloutIssueMalformedMetadata  rolloutClassificationIssue = "malformed_session_metadata"
+	rolloutIssueUnclassifiedSource rolloutClassificationIssue = "unclassified_source"
+)
+
+type rolloutClassificationResult struct {
+	Classification rolloutClassification
+	Issue          rolloutClassificationIssue
+	Detail         string
+}
+
 // sessionMetaPayload is the payload for type="session_meta" lines.
 type sessionMetaPayload struct {
 	ID           string          `json:"id"`
@@ -101,49 +117,64 @@ type sessionMetaPayload struct {
 // rollouts identify root and child threads with thread_source; older rollouts
 // encode their source as either a recognized root string or source.subagent.
 func classifyRollout(path string) rolloutClassification {
+	return classifyRolloutDetailed(path).Classification
+}
+
+func classifyRolloutDetailed(path string) rolloutClassificationResult {
 	if path == "" {
-		return rolloutUnknown
+		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueNullPath}
 	}
 
 	file, err := os.Open(path) //nolint:gosec // Path comes from agent hook input
 	if err != nil {
-		return rolloutUnknown
+		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueUnreadable, Detail: "open"}
 	}
 	defer file.Close()
 
 	lineData, err := bufio.NewReader(file).ReadBytes('\n')
 	if err != nil && !errors.Is(err, io.EOF) {
-		return rolloutUnknown
+		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueUnreadable, Detail: "read"}
 	}
 
 	var line rolloutLine
-	if json.Unmarshal(lineData, &line) != nil || line.Type != rolloutLineTypeSessionMeta {
-		return rolloutUnknown
+	if json.Unmarshal(lineData, &line) != nil {
+		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueMalformedMetadata, Detail: "first_record_json"}
+	}
+	if line.Type != rolloutLineTypeSessionMeta {
+		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueMalformedMetadata, Detail: "first_record_type"}
 	}
 
 	var meta sessionMetaPayload
 	if json.Unmarshal(line.Payload, &meta) != nil {
-		return rolloutUnknown
+		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueMalformedMetadata, Detail: "session_meta_payload"}
 	}
 
 	switch meta.ThreadSource {
 	case "user":
-		return rolloutRoot
+		return rolloutClassificationResult{Classification: rolloutRoot}
 	case "subagent":
-		return rolloutChild
+		return rolloutClassificationResult{Classification: rolloutChild}
 	case "":
 		// Fall through to the legacy source encoding.
 	default:
-		return rolloutUnknown
+		return rolloutClassificationResult{
+			Classification: rolloutUnknown,
+			Issue:          rolloutIssueUnclassifiedSource,
+			Detail:         safeRolloutSource(meta.ThreadSource),
+		}
 	}
 
 	var source string
 	if json.Unmarshal(meta.Source, &source) == nil {
 		switch source {
 		case "startup", "resume", "clear", "compact", "cli", codexExecCommand, "vscode", "mcp":
-			return rolloutRoot
+			return rolloutClassificationResult{Classification: rolloutRoot}
 		default:
-			return rolloutUnknown
+			return rolloutClassificationResult{
+				Classification: rolloutUnknown,
+				Issue:          rolloutIssueUnclassifiedSource,
+				Detail:         safeRolloutSource(source),
+			}
 		}
 	}
 
@@ -153,10 +184,19 @@ func classifyRollout(path string) rolloutClassification {
 	if json.Unmarshal(meta.Source, &structuredSource) == nil &&
 		len(structuredSource.Subagent) > 0 &&
 		!bytes.Equal(structuredSource.Subagent, []byte("null")) {
-		return rolloutChild
+		return rolloutClassificationResult{Classification: rolloutChild}
 	}
 
-	return rolloutUnknown
+	return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueUnclassifiedSource, Detail: "missing_or_structured_legacy_source"}
+}
+
+func safeRolloutSource(source string) string {
+	const maxSourceRunes = 128
+	runes := []rune(strings.ToValidUTF8(source, "�"))
+	if len(runes) > maxSourceRunes {
+		runes = runes[:maxSourceRunes]
+	}
+	return string(runes)
 }
 
 // responseItemPayload is the payload for type="response_item" lines.
@@ -560,7 +600,7 @@ func terminalTurnIDs(data []byte) []string {
 // ExtractWithSubagentInventory gathers evidence only for refs supplied by the
 // caller's authoritative ledger. It never discovers children from transcript
 // text, filenames, timestamps, or token-count events.
-func (c *CodexAgent) ExtractWithSubagentInventory(parent []byte, fromOffset int, refs []agent.SubagentReference) (agent.InventoryExtraction, error) {
+func (c *CodexAgent) ExtractWithSubagentInventory(ctx context.Context, parent []byte, fromOffset int, refs []agent.SubagentReference) (agent.InventoryExtraction, error) {
 	result := agent.InventoryExtraction{ModifiedFiles: extractFilesFromData(parent, fromOffset)}
 	parentUsage, err := c.CalculateTokenUsage(parent, fromOffset)
 	if err != nil {
@@ -571,13 +611,16 @@ func (c *CodexAgent) ExtractWithSubagentInventory(parent []byte, fromOffset int,
 	resolved := make([]loadedRollout, len(refs))
 	unresolvedIDs := make(map[string]struct{})
 	for index, ref := range refs {
-		if loaded, ok := c.loadDirectRollout(ref); ok {
+		if loaded, ok := c.loadDirectRollout(ctx, ref); ok {
 			resolved[index] = loaded
 		} else if ref.AgentID != "" {
 			unresolvedIDs[ref.AgentID] = struct{}{}
 		}
 	}
-	fallback := c.scanFallbackRollouts(unresolvedIDs)
+	fallback, fallbackErr := c.scanFallbackRollouts(ctx, unresolvedIDs)
+	if fallbackErr != nil {
+		fallback = nil
+	}
 	for index, ref := range refs {
 		if resolved[index].Path == "" {
 			resolved[index] = fallback[ref.AgentID]
diff --git a/cmd/entire/cli/agent/codex/transcript_test.go b/cmd/entire/cli/agent/codex/transcript_test.go
index 68c8fe2cc0..92cba4c889 100644
--- a/cmd/entire/cli/agent/codex/transcript_test.go
+++ b/cmd/entire/cli/agent/codex/transcript_test.go
@@ -92,6 +92,43 @@ func TestClassifyRollout(t *testing.T) {
 	})
 }
 
+func TestClassifyRolloutDetailed_ExplainsFailClosedResult(t *testing.T) {
+	t.Parallel()
+
+	t.Run("null transcript path", func(t *testing.T) {
+		t.Parallel()
+		got := classifyRolloutDetailed("")
+		require.Equal(t, rolloutUnknown, got.Classification)
+		require.Equal(t, rolloutIssueNullPath, got.Issue)
+	})
+
+	t.Run("unreadable transcript", func(t *testing.T) {
+		t.Parallel()
+		got := classifyRolloutDetailed(filepath.Join(t.TempDir(), "missing.jsonl"))
+		require.Equal(t, rolloutUnknown, got.Classification)
+		require.Equal(t, rolloutIssueUnreadable, got.Issue)
+	})
+
+	t.Run("malformed metadata", func(t *testing.T) {
+		t.Parallel()
+		path := filepath.Join(t.TempDir(), "rollout.jsonl")
+		require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":`), 0o600))
+		got := classifyRolloutDetailed(path)
+		require.Equal(t, rolloutUnknown, got.Classification)
+		require.Equal(t, rolloutIssueMalformedMetadata, got.Issue)
+	})
+
+	t.Run("future source", func(t *testing.T) {
+		t.Parallel()
+		path := filepath.Join(t.TempDir(), "rollout.jsonl")
+		require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":{"thread_source":"future-source"}}`), 0o600))
+		got := classifyRolloutDetailed(path)
+		require.Equal(t, rolloutUnknown, got.Classification)
+		require.Equal(t, rolloutIssueUnclassifiedSource, got.Issue)
+		require.Equal(t, "future-source", got.Detail)
+	})
+}
+
 func TestGetTranscriptPosition(t *testing.T) {
 	t.Parallel()
 	ag := &CodexAgent{}
diff --git a/cmd/entire/cli/agent/token_usage.go b/cmd/entire/cli/agent/token_usage.go
index 651a23cfd1..b8da829ce9 100644
--- a/cmd/entire/cli/agent/token_usage.go
+++ b/cmd/entire/cli/agent/token_usage.go
@@ -15,7 +15,7 @@ func ExtractWithSubagentInventory(ctx context.Context, ag Agent, transcriptData
 	if !ok {
 		return InventoryExtraction{}, false
 	}
-	extraction, err := extractor.ExtractWithSubagentInventory(transcriptData, transcriptLinesAtStart, refs)
+	extraction, err := extractor.ExtractWithSubagentInventory(ctx, transcriptData, transcriptLinesAtStart, refs)
 	if err != nil {
 		logging.Debug(ctx, "failed inventory-aware token extraction", slog.String("error", err.Error()))
 		return InventoryExtraction{}, false
diff --git a/cmd/entire/cli/integration_test/codex_subagent_test.go b/cmd/entire/cli/integration_test/codex_subagent_test.go
index f37716423b..e3f3a1a0a1 100644
--- a/cmd/entire/cli/integration_test/codex_subagent_test.go
+++ b/cmd/entire/cli/integration_test/codex_subagent_test.go
@@ -51,7 +51,7 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 			`{"type":"response_item","payload":{"type":"custom_tool_call","status":"completed","name":"apply_patch","input":"*** Begin Patch\n*** Add File: `+editedFile+`\n+red\n*** End Patch"}}`+"\n"+
 			`{"type":"event_msg","payload":{"type":"token_count","info":{"total_token_usage":{"input_tokens":10,"cached_input_tokens":2,"output_tokens":3}}}}`+"\n"+
 			`{"type":"event_msg","payload":{"type":"task_complete","turn_id":"turn-1"}}`+"\n"), 0o600))
-	probe, err := (&codex.CodexAgent{RolloutRoots: []string{}}).ExtractWithSubagentInventory(nil, 0, []agent.SubagentReference{{AgentID: agentID, DeclaredTranscriptPath: subagentRollout}})
+	probe, err := (&codex.CodexAgent{RolloutRoots: []string{}}).ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: agentID, DeclaredTranscriptPath: subagentRollout}})
 	require.NoError(t, err)
 	require.Equal(t, []string{"turn-1"}, probe.Children[0].TerminalTurnIDs)
 
diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 259220cb8b..bc0987c303 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1169,6 +1169,13 @@ func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
 					if record.CompletedAt.IsZero() {
 						record.CompletedAt = time.Now()
 					}
+					// refreshCodexInventory accepts this path only after loading the
+					// rollout and matching session_meta.id to AgentID. Carry that
+					// verified path into the durable task record even when this
+					// fallback has no exact terminal file/token snapshot.
+					if entry.ResolvedTranscriptPath != "" {
+						record.DeclaredTranscriptPath = entry.ResolvedTranscriptPath
+					}
 					record.Files = nil
 					record.TokenUsage = nil
 					break
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index 1b70669bce..b0b4f03f62 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -143,7 +143,7 @@ type mockInventoryAgent struct {
 
 var _ agent.InventoryAwareExtractor = (*mockInventoryAgent)(nil)
 
-func (m *mockInventoryAgent) ExtractWithSubagentInventory(_ []byte, _ int, _ []agent.SubagentReference) (agent.InventoryExtraction, error) {
+func (m *mockInventoryAgent) ExtractWithSubagentInventory(_ context.Context, _ []byte, _ int, _ []agent.SubagentReference) (agent.InventoryExtraction, error) {
 	if m.beforeReturn != nil {
 		m.beforeReturn()
 	}
@@ -223,9 +223,10 @@ func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildClearsStaleEvidence(t *
 		StartedAt: time.Now(),
 		Phase:     session.PhaseActive,
 		SubagentInventory: []session.SubagentInventoryEntry{{
-			AgentID:          agentID,
-			ObservedTurnIDs:  []string{"turn-1", "turn-2"},
-			FinalizedTurnIDs: []string{"turn-1"},
+			AgentID:                agentID,
+			ResolvedTranscriptPath: "/tmp/verified-child-1.jsonl",
+			ObservedTurnIDs:        []string{"turn-1", "turn-2"},
+			FinalizedTurnIDs:       []string{"turn-1"},
 		}},
 		TaskRecords: []session.TaskRecord{{
 			ToolUseID:   agentID,
@@ -246,6 +247,8 @@ func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildClearsStaleEvidence(t *
 	assert.Equal(t, completedAt, record.CompletedAt, "force-closing a later turn must not complete the task twice")
 	assert.Empty(t, record.Files, "files from an earlier turn are not exact evidence for an unresolved later turn")
 	assert.Nil(t, record.TokenUsage, "tokens from an earlier turn are not exact evidence for an unresolved later turn")
+	assert.Equal(t, "/tmp/verified-child-1.jsonl", record.DeclaredTranscriptPath,
+		"force-closing must retain the inventory's exact-ID-verified rollout path for condensation")
 	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
 }
 
diff --git a/cmd/entire/cli/strategy/agent_resolution_test.go b/cmd/entire/cli/strategy/agent_resolution_test.go
index 7086377b0f..7cd4b6d23f 100644
--- a/cmd/entire/cli/strategy/agent_resolution_test.go
+++ b/cmd/entire/cli/strategy/agent_resolution_test.go
@@ -3,13 +3,16 @@ package strategy
 import (
 	"context"
 	"path/filepath"
+	"strings"
 	"sync"
 	"testing"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/session"
 
 	// Register agents so AgentForTranscriptPath can resolve them.
 	_ "github.com/entireio/cli/cmd/entire/cli/agent/claudecode"
+	_ "github.com/entireio/cli/cmd/entire/cli/agent/codex"
 	_ "github.com/entireio/cli/cmd/entire/cli/agent/cursor"
 
 	"github.com/stretchr/testify/assert"
@@ -33,6 +36,150 @@ func withClaudeSessionDir(t *testing.T) string {
 	return filepath.Join(sessionDir, "abc-123.jsonl")
 }
 
+func withCodexSessionDir(t *testing.T) string {
+	t.Helper()
+	sessionDir := filepath.Join(t.TempDir(), "codex-sessions")
+	t.Setenv("ENTIRE_TEST_CODEX_SESSION_DIR", sessionDir)
+	return filepath.Join(sessionDir, "2026", "09", "02", "rollout.jsonl")
+}
+
+func TestInitializeSession_CodexCorrection_CleanKnownOwner(t *testing.T) {
+	dir := setupGitRepo(t)
+	t.Chdir(dir)
+	codexTranscript := withCodexSessionDir(t)
+
+	ctx := context.Background()
+	sessionID := "codex-clean-known"
+	s := &ManualCommitStrategy{}
+	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
+	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
+
+	state, err := s.loadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	assertCleanCodexCorrection(t, state)
+}
+
+func TestInitializeSession_CodexCorrection_CleanUnknownOwner(t *testing.T) {
+	dir := setupGitRepo(t)
+	t.Chdir(dir)
+	codexTranscript := withCodexSessionDir(t)
+
+	ctx := context.Background()
+	sessionID := "codex-clean-unknown"
+	s := &ManualCommitStrategy{}
+	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
+	state, err := s.loadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	state.AgentType = ""
+	require.NoError(t, s.saveSessionState(ctx, state))
+
+	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
+	state, err = s.loadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	assertCleanCodexCorrection(t, state)
+}
+
+func TestInitializeSession_CodexCorrection_DirtyEvidence(t *testing.T) {
+	incomplete := false
+	tests := []struct {
+		name  string
+		dirty func(*SessionState)
+	}{
+		{"inventory", func(s *SessionState) { s.SubagentInventory = []session.SubagentInventoryEntry{{AgentID: "child"}} }},
+		{"task record", func(s *SessionState) {
+			s.TaskRecords = []session.TaskRecord{{ToolUseID: "task", AgentID: "child-from-task"}}
+		}},
+		{"ledger", func(s *SessionState) { s.SubagentLedgerVersion = 4 }},
+		{"session child total", func(s *SessionState) { s.TokenUsage = &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{}} }},
+		{"checkpoint child total", func(s *SessionState) { s.CheckpointTokenUsage = &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{}} }},
+		{"baseline", func(s *SessionState) { s.SubagentTokensBaseline = &agent.TokenUsage{} }},
+		{"inventory incomplete", func(s *SessionState) { s.SubagentInventoryComplete = &incomplete }},
+		{"baseline incomplete", func(s *SessionState) { s.SubagentTokensBaselineComplete = &incomplete }},
+		{"session usage incomplete", func(s *SessionState) { s.TokenUsage = &agent.TokenUsage{SubagentTokensComplete: &incomplete} }},
+		{"checkpoint usage incomplete", func(s *SessionState) { s.CheckpointTokenUsage = &agent.TokenUsage{SubagentTokensComplete: &incomplete} }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := setupGitRepo(t)
+			t.Chdir(dir)
+			codexTranscript := withCodexSessionDir(t)
+			ctx := context.Background()
+			sessionID := "codex-dirty-" + strings.ReplaceAll(tt.name, " ", "-")
+			s := &ManualCommitStrategy{}
+			require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
+			state, err := s.loadSessionState(ctx, sessionID)
+			require.NoError(t, err)
+			tt.dirty(state)
+			require.NoError(t, s.saveSessionState(ctx, state))
+
+			require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
+			state, err = s.loadSessionState(ctx, sessionID)
+			require.NoError(t, err)
+			require.Equal(t, agent.AgentTypeCodex, state.AgentType)
+			require.NotNil(t, state.SubagentInventoryComplete)
+			require.False(t, *state.SubagentInventoryComplete)
+			require.NotNil(t, state.SubagentTokensBaselineComplete)
+			require.False(t, *state.SubagentTokensBaselineComplete)
+			require.NotNil(t, state.TokenUsage)
+			require.Nil(t, state.TokenUsage.SubagentTokens)
+			require.NotNil(t, state.TokenUsage.SubagentTokensComplete)
+			require.False(t, *state.TokenUsage.SubagentTokensComplete)
+			require.NotNil(t, state.CheckpointTokenUsage)
+			require.Nil(t, state.CheckpointTokenUsage.SubagentTokens)
+			require.NotNil(t, state.CheckpointTokenUsage.SubagentTokensComplete)
+			require.False(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+			require.Nil(t, state.SubagentTokensBaseline)
+			if tt.name == "task record" {
+				require.NotNil(t, state.FindSubagentInventory("child-from-task"))
+			}
+		})
+	}
+}
+
+func TestInitializeSession_CodexCallerWithoutTranscriptDoesNotMigrateAccounting(t *testing.T) {
+	dir := setupGitRepo(t)
+	t.Chdir(dir)
+
+	ctx := context.Background()
+	sessionID := "codex-unproven-owner"
+	s := &ManualCommitStrategy{}
+	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
+	state, err := s.loadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	state.AgentType = ""
+	state.SubagentTokensBaseline = &agent.TokenUsage{InputTokens: 7}
+	require.NoError(t, s.saveSessionState(ctx, state))
+
+	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, "", "second", ""))
+	state, err = s.loadSessionState(ctx, sessionID)
+	require.NoError(t, err)
+	require.Equal(t, agent.AgentTypeCodex, state.AgentType)
+	require.NotNil(t, state.SubagentTokensBaseline)
+	require.Equal(t, 7, state.SubagentTokensBaseline.InputTokens,
+		"the firing hook alone must not rewrite legacy accounting evidence")
+}
+
+func assertCleanCodexCorrection(t *testing.T, state *SessionState) {
+	t.Helper()
+	require.Equal(t, agent.AgentTypeCodex, state.AgentType)
+	require.Empty(t, state.SubagentInventory)
+	require.Zero(t, state.SubagentLedgerVersion)
+	require.Nil(t, state.SubagentTokensBaseline)
+	require.NotNil(t, state.SubagentInventoryComplete)
+	require.True(t, *state.SubagentInventoryComplete)
+	require.NotNil(t, state.SubagentTokensBaselineComplete)
+	require.True(t, *state.SubagentTokensBaselineComplete)
+	require.NotNil(t, state.TokenUsage)
+	require.Nil(t, state.TokenUsage.SubagentTokens)
+	require.NotNil(t, state.TokenUsage.SubagentTokensComplete)
+	require.True(t, *state.TokenUsage.SubagentTokensComplete)
+	require.NotNil(t, state.CheckpointTokenUsage)
+	require.Nil(t, state.CheckpointTokenUsage.SubagentTokens)
+	require.NotNil(t, state.CheckpointTokenUsage.SubagentTokensComplete)
+	require.True(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+}
+
 func TestResolveSessionAgentType_TranscriptPathBeatsHook(t *testing.T) {
 	dir := setupGitRepo(t)
 	t.Chdir(dir)
diff --git a/cmd/entire/cli/strategy/manual_commit_hooks.go b/cmd/entire/cli/strategy/manual_commit_hooks.go
index 066a4581ca..ab390b0ed5 100644
--- a/cmd/entire/cli/strategy/manual_commit_hooks.go
+++ b/cmd/entire/cli/strategy/manual_commit_hooks.go
@@ -2465,6 +2465,52 @@ func correctSessionAgentType(ctx context.Context, currentType types.AgentType, t
 	return owner.Type(), true
 }
 
+// transitionSessionToCodex initializes Codex child-accounting state when a
+// transcript path proves that an existing session is Codex-owned. The
+// transition deliberately happens in the same session-state mutation as the
+// AgentType correction so readers can never observe a Codex session with
+// legacy, ambiguous child-coverage markers.
+func transitionSessionToCodex(state *SessionState) {
+	dirty := hasPriorSubagentEvidence(state)
+	complete := !dirty
+
+	// Task records predate the durable Codex inventory. Preserve their child
+	// identities without calling RegisterSubagent: this is a migration of known
+	// evidence, not a new observation, so it must not advance the ledger again.
+	for _, record := range state.TaskRecords {
+		if record.AgentID == "" || state.FindSubagentInventory(record.AgentID) != nil {
+			continue
+		}
+		state.SubagentInventory = append(state.SubagentInventory, session.SubagentInventoryEntry{
+			AgentID:                record.AgentID,
+			DeclaredTranscriptPath: record.DeclaredTranscriptPath,
+		})
+	}
+
+	state.TokenUsage = types.WithClearedSubagentTokens(state.TokenUsage, complete)
+	state.CheckpointTokenUsage = types.WithClearedSubagentTokens(state.CheckpointTokenUsage, complete)
+	state.SubagentTokensBaseline = nil
+	state.SubagentInventoryComplete = &complete
+	state.SubagentTokensBaselineComplete = &complete
+}
+
+func hasPriorSubagentEvidence(state *SessionState) bool {
+	if len(state.SubagentInventory) > 0 || len(state.TaskRecords) > 0 || state.SubagentLedgerVersion != 0 || state.SubagentTokensBaseline != nil {
+		return true
+	}
+	if state.TokenUsage != nil && (state.TokenUsage.SubagentTokens != nil || explicitlyIncomplete(state.TokenUsage.SubagentTokensComplete)) {
+		return true
+	}
+	if state.CheckpointTokenUsage != nil && (state.CheckpointTokenUsage.SubagentTokens != nil || explicitlyIncomplete(state.CheckpointTokenUsage.SubagentTokensComplete)) {
+		return true
+	}
+	return explicitlyIncomplete(state.SubagentInventoryComplete) || explicitlyIncomplete(state.SubagentTokensBaselineComplete)
+}
+
+func explicitlyIncomplete(complete *bool) bool {
+	return complete != nil && !*complete
+}
+
 // InitializeSession creates session state for a new session or updates an existing one.
 // This implements the optional SessionInitializer interface.
 // Called during UserPromptSubmit to allow git hooks to detect active sessions.
@@ -2522,17 +2568,22 @@ func (s *ManualCommitStrategy) InitializeSession(ctx context.Context, sessionID
 		}
 		state.TurnID = turnID.String()
 
-		// Update AgentType when it isn't set yet, or when the transcript path
-		// proves we're a different agent than the one stored.
-		if state.AgentType == "" && resolvedAgentType != "" {
-			state.AgentType = resolvedAgentType
-		} else if corrected, changed := correctSessionAgentType(ctx, state.AgentType, transcriptPath); changed {
+		// A transcript path is stronger evidence than both a stored owner and
+		// the current hook. Apply transcript-proven corrections first, including
+		// the empty-owner case, so a Codex correction can initialize all of its
+		// child-accounting markers atomically.
+		if corrected, changed := correctSessionAgentType(ctx, state.AgentType, transcriptPath); changed {
 			logging.Info(logging.WithComponent(ctx, "hooks"), "corrected session agent type from transcript path",
 				slog.String("session_id", sessionID),
 				slog.String("from", string(state.AgentType)),
 				slog.String("to", string(corrected)),
 				slog.String("transcript_path", transcriptPath))
+			if corrected == agent.AgentTypeCodex && state.AgentType != agent.AgentTypeCodex {
+				transitionSessionToCodex(state)
+			}
 			state.AgentType = corrected
+		} else if state.AgentType == "" && resolvedAgentType != "" {
+			state.AgentType = resolvedAgentType
 		}
 		if model != "" {
 			state.ModelName = model

From 068d37470336552fb0b07122088ea4620ce62ebb Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 3 Sep 2026 13:01:56 -0700
Subject: [PATCH 10/59] refactor(codex): simplify subagent tracking

Entire-Checkpoint: 01M1MDT7FYTX9025MWBCJE3ZPQ
---
 cmd/entire/cli/agent/codex/codex.go           | 141 +++++------
 cmd/entire/cli/agent/codex/lifecycle.go       |   1 -
 cmd/entire/cli/agent/codex/lifecycle_test.go  | 118 ++--------
 cmd/entire/cli/agent/codex/subagent_test.go   | 190 +++++----------
 cmd/entire/cli/agent/codex/transcript.go      | 219 ++++++++----------
 cmd/entire/cli/agent/codex/transcript_test.go |  67 ++----
 cmd/entire/cli/agent/codex/types.go           |   1 -
 cmd/entire/cli/agent/event.go                 |   3 -
 .../integration_test/codex_subagent_test.go   |   5 -
 cmd/entire/cli/lifecycle.go                   |   2 +-
 cmd/entire/cli/session/state.go               |  43 +---
 cmd/entire/cli/session/state_test.go          | 103 +++-----
 .../cli/strategy/agent_resolution_test.go     | 126 +++++-----
 cmd/entire/cli/strategy/manual_commit_test.go |  43 +---
 14 files changed, 351 insertions(+), 711 deletions(-)

diff --git a/cmd/entire/cli/agent/codex/codex.go b/cmd/entire/cli/agent/codex/codex.go
index 7bb97f7243..64cf0665c4 100644
--- a/cmd/entire/cli/agent/codex/codex.go
+++ b/cmd/entire/cli/agent/codex/codex.go
@@ -132,61 +132,77 @@ func (b *rolloutScanBudget) observeBytes(count int64) error {
 	return nil
 }
 
-func rolloutRegularMode(mode fs.FileMode) bool {
-	return mode.Type() == 0
-}
-
-//nolint:unused // Companion for readSessionMetaID's retained direct-path helper.
-func readRegularRollout(path string) (loadedRollout, error) {
-	return readRegularRolloutContext(context.Background(), path, rolloutBodyByteLimit, nil)
-}
-
 func readRegularRolloutContext(ctx context.Context, path string, byteLimit int64, observe func(string, int)) (loadedRollout, error) {
 	info, err := os.Lstat(path)
 	if err != nil {
 		return loadedRollout{}, fmt.Errorf("lstat rollout: %w", err)
 	}
-	if !rolloutRegularMode(info.Mode()) {
+	if !info.Mode().IsRegular() {
 		return loadedRollout{}, errors.New("rollout is not a regular file")
 	}
-	file, err := os.Open(path) //nolint:gosec // Lstat above rejects known special entries; Stat below verifies the opened descriptor.
+	file, opened, err := openRolloutFile(path, info)
 	if err != nil {
-		return loadedRollout{}, fmt.Errorf("open rollout: %w", err)
+		return loadedRollout{}, err
 	}
 	defer file.Close()
-	opened, err := file.Stat()
-	if err != nil {
-		return loadedRollout{}, fmt.Errorf("stat opened rollout: %w", err)
-	}
-	if !rolloutRegularMode(opened.Mode()) || !os.SameFile(info, opened) {
-		return loadedRollout{}, errors.New("rollout changed or is not a regular file")
-	}
 	if opened.Size() > byteLimit {
 		return loadedRollout{}, fmt.Errorf("rollout size %d exceeds limit %d", opened.Size(), byteLimit)
 	}
-	data, err := readRolloutBody(ctx, file, path, byteLimit, observe)
+	data, err := readRolloutBody(file, rolloutReadOptions{
+		path: path, byteLimit: byteLimit, check: ctx.Err, observe: observe,
+		limitErr: fmt.Errorf("rollout exceeds byte limit %d", byteLimit),
+	})
 	if err != nil {
 		return loadedRollout{}, fmt.Errorf("read rollout: %w", err)
 	}
 	return loadedRollout{Path: path, Data: data}, nil
 }
 
-func readRolloutBody(ctx context.Context, file *os.File, path string, byteLimit int64, observe func(string, int)) ([]byte, error) {
+func openRolloutFile(path string, before fs.FileInfo) (*os.File, fs.FileInfo, error) {
+	file, err := os.Open(path) //nolint:gosec // Caller rejects special entries; descriptor Stat verifies the opened file.
+	if err != nil {
+		return nil, nil, fmt.Errorf("open rollout: %w", err)
+	}
+	opened, err := file.Stat()
+	if err != nil {
+		_ = file.Close()
+		return nil, nil, fmt.Errorf("stat opened rollout: %w", err)
+	}
+	if !opened.Mode().IsRegular() || !os.SameFile(before, opened) {
+		_ = file.Close()
+		return nil, nil, errors.New("rollout changed or is not a regular file")
+	}
+	return file, opened, nil
+}
+
+type rolloutReadOptions struct {
+	path      string
+	byteLimit int64
+	check     func() error
+	account   func(int64) error
+	observe   func(string, int)
+	limitErr  error
+}
+
+func readRolloutBody(file *os.File, opts rolloutReadOptions) ([]byte, error) {
 	data := make([]byte, 0)
 	buffer := make([]byte, rolloutBodyReadChunk)
-	var readBytes int64
 	for {
-		if err := ctx.Err(); err != nil {
-			return nil, fmt.Errorf("read rollout canceled: %w", err)
+		if err := opts.check(); err != nil {
+			return nil, err
 		}
 		n, err := file.Read(buffer)
 		if n > 0 {
-			if observe != nil {
-				observe(path, n)
+			if opts.account != nil {
+				if accountErr := opts.account(int64(n)); accountErr != nil {
+					return nil, accountErr
+				}
+			}
+			if opts.observe != nil {
+				opts.observe(opts.path, n)
 			}
-			readBytes += int64(n)
-			if readBytes > byteLimit {
-				return nil, fmt.Errorf("rollout exceeds byte limit %d", byteLimit)
+			if int64(len(data)+n) > opts.byteLimit {
+				return nil, opts.limitErr
 			}
 			data = append(data, buffer[:n]...)
 		}
@@ -337,7 +353,7 @@ func (c *CodexAgent) inspectFallbackCandidate(
 	if err != nil {
 		return "", loadedRollout{}, fmt.Errorf("lstat rollout candidate: %w", err)
 	}
-	if !rolloutRegularMode(info.Mode()) {
+	if !info.Mode().IsRegular() {
 		return "", loadedRollout{}, nil
 	}
 
@@ -368,18 +384,11 @@ func (c *CodexAgent) inspectFallbackCandidate(
 		return id, loaded, nil
 	}
 
-	file, err := os.Open(path) //nolint:gosec // Lstat and descriptor Stat below enforce a regular unchanged file
+	file, opened, err := openRolloutFile(path, info)
 	if err != nil {
-		return "", loadedRollout{}, fmt.Errorf("open rollout candidate: %w", err)
+		return "", loadedRollout{}, err
 	}
 	defer file.Close()
-	opened, err := file.Stat()
-	if err != nil {
-		return "", loadedRollout{}, fmt.Errorf("stat opened rollout candidate: %w", err)
-	}
-	if !rolloutRegularMode(opened.Mode()) || !os.SameFile(info, opened) {
-		return "", loadedRollout{}, errors.New("rollout candidate changed or is not a regular file")
-	}
 
 	metadata, err := c.readFallbackMetadata(file, path, budget)
 	if err != nil {
@@ -401,7 +410,10 @@ func (c *CodexAgent) inspectFallbackCandidate(
 	if _, err := file.Seek(0, io.SeekStart); err != nil {
 		return "", loadedRollout{}, fmt.Errorf("seek rollout candidate: %w", err)
 	}
-	data, err := c.readFallbackBody(file, path, budget)
+	data, err := readRolloutBody(file, rolloutReadOptions{
+		path: path, byteLimit: budget.limits.bodyByteLimit, check: budget.check,
+		account: budget.observeBytes, observe: c.observeRolloutRead, limitErr: errRolloutScanBudget,
+	})
 	if err != nil {
 		return "", loadedRollout{}, err
 	}
@@ -456,35 +468,6 @@ func (c *CodexAgent) readFallbackMetadata(file *os.File, path string, budget *ro
 	}
 }
 
-func (c *CodexAgent) readFallbackBody(file *os.File, path string, budget *rolloutScanBudget) ([]byte, error) {
-	data := make([]byte, 0)
-	buffer := make([]byte, rolloutBodyReadChunk)
-	for {
-		if err := budget.check(); err != nil {
-			return nil, err
-		}
-		n, err := file.Read(buffer)
-		if n > 0 {
-			if budgetErr := budget.observeBytes(int64(n)); budgetErr != nil {
-				return nil, budgetErr
-			}
-			if c.observeRolloutRead != nil {
-				c.observeRolloutRead(path, n)
-			}
-			if int64(len(data)+n) > budget.limits.bodyByteLimit {
-				return nil, errRolloutScanBudget
-			}
-			data = append(data, buffer[:n]...)
-		}
-		if errors.Is(err, io.EOF) {
-			return data, nil
-		}
-		if err != nil {
-			return nil, fmt.Errorf("read fallback rollout body: %w", err)
-		}
-	}
-}
-
 func indexByte(data []byte, target byte) int {
 	for index, value := range data {
 		if value == target {
@@ -545,26 +528,6 @@ func (c *CodexAgent) scanFallbackRollouts(ctx context.Context, agentIDs map[stri
 	return resolved, nil
 }
 
-// resolveSubagentRollout is the path-only compatibility wrapper used by
-// callers that need only discovery. Inventory extraction uses the verified
-// bytes returned by the same load operation instead.
-func (c *CodexAgent) resolveSubagentRollout(ref agent.SubagentReference) string {
-	if ref.AgentID == "" {
-		return ""
-	}
-	if loaded, ok := c.loadDirectRollout(context.Background(), ref); ok {
-		return loaded.Path
-	}
-	fallback, err := c.scanFallbackRollouts(context.Background(), map[string]struct{}{ref.AgentID: {}})
-	if err != nil {
-		return ""
-	}
-	if loaded, ok := fallback[ref.AgentID]; ok {
-		return loaded.Path
-	}
-	return ""
-}
-
 // NewCodexAgent creates a new Codex agent instance.
 func NewCodexAgent() agent.Agent {
 	return &CodexAgent{}
diff --git a/cmd/entire/cli/agent/codex/lifecycle.go b/cmd/entire/cli/agent/codex/lifecycle.go
index d008295c10..f25dfc84c5 100644
--- a/cmd/entire/cli/agent/codex/lifecycle.go
+++ b/cmd/entire/cli/agent/codex/lifecycle.go
@@ -175,7 +175,6 @@ func (c *CodexAgent) parseSubagentStop(stdin io.Reader) (*agent.Event, error) {
 		ToolUseID:               raw.AgentID,
 		TurnID:                  raw.TurnID,
 		SubagentID:              raw.AgentID,
-		StopHookActive:          raw.StopHookActive,
 		ProvisionalSubagentStop: true,
 		SubagentType:            raw.AgentType,
 		SubagentTranscriptPath:  derefString(raw.AgentTranscriptPath),
diff --git a/cmd/entire/cli/agent/codex/lifecycle_test.go b/cmd/entire/cli/agent/codex/lifecycle_test.go
index 7154d1afa6..13bfe0c68b 100644
--- a/cmd/entire/cli/agent/codex/lifecycle_test.go
+++ b/cmd/entire/cli/agent/codex/lifecycle_test.go
@@ -179,73 +179,16 @@ func TestParseHookEvent_Stop(t *testing.T) {
 	require.Equal(t, "gpt-4.1", event.Model)
 }
 
-func TestParseHookEvent_UserPromptSubmitAndStopRequireRootRollout(t *testing.T) {
+func TestParseHookEvent_TurnHooksIgnoreChildRollout(t *testing.T) {
 	t.Parallel()
+	path := filepath.Join(t.TempDir(), "rollout.jsonl")
+	require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":{"thread_source":"subagent"}}`+"\n"), 0o600))
+	input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":"` + path + `","model":"gpt-5","prompt":"do work","stop_hook_active":true}`
 
-	tests := []struct {
-		name      string
-		metadata  string
-		wantEvent bool
-	}{
-		{
-			name:      "root thread source",
-			metadata:  `{"type":"session_meta","payload":{"thread_source":"user"}}` + "\n",
-			wantEvent: true,
-		},
-		{
-			name:      "root legacy string source",
-			metadata:  `{"type":"session_meta","payload":{"source":"exec"}}` + "\n",
-			wantEvent: true,
-		},
-		{
-			name:     "child thread source",
-			metadata: `{"type":"session_meta","payload":{"thread_source":"subagent"}}` + "\n",
-		},
-		{
-			name:     "child legacy structured source",
-			metadata: `{"type":"session_meta","payload":{"source":{"subagent":{"thread_spawn":{"parent_thread_id":"root-thread"}}}}}` + "\n",
-		},
-		{
-			name:     "missing session metadata",
-			metadata: `{"type":"response_item","payload":{}}` + "\n",
-		},
-		{
-			name:     "malformed JSON",
-			metadata: `{"type":"session_meta","payload":` + "\n",
-		},
-		{
-			name: "missing path",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			transcriptPath := ""
-			if tt.metadata != "" {
-				transcriptPath = filepath.Join(t.TempDir(), "rollout.jsonl")
-				require.NoError(t, os.WriteFile(transcriptPath, []byte(tt.metadata), 0o600))
-			}
-
-			for _, hookName := range []string{HookNameUserPromptSubmit, HookNameStop} {
-				t.Run(hookName, func(t *testing.T) {
-					t.Parallel()
-					pathJSON := "null"
-					if transcriptPath != "" {
-						pathJSON = `"` + transcriptPath + `"`
-					}
-					input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":` + pathJSON + `,"model":"gpt-5","prompt":"do work","stop_hook_active":true}`
-
-					event, err := (&CodexAgent{}).ParseHookEvent(context.Background(), hookName, strings.NewReader(input))
-					require.NoError(t, err)
-					if tt.wantEvent {
-						require.NotNil(t, event)
-					} else {
-						require.Nil(t, event)
-					}
-				})
-			}
-		})
+	for _, hookName := range []string{HookNameUserPromptSubmit, HookNameStop} {
+		event, err := (&CodexAgent{}).ParseHookEvent(context.Background(), hookName, strings.NewReader(input))
+		require.NoError(t, err)
+		require.Nil(t, event)
 	}
 }
 
@@ -481,45 +424,6 @@ func TestCodexAgent_ContextInjector(t *testing.T) {
 // testCodexAgentID is the subagent thread id used by the subagent hook tests.
 const testCodexAgentID = "child-thread-9"
 
-func TestParseHookEvent_SubagentNormalizesHookIdentity(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name            string
-		hookName        string
-		input           string
-		stopHookActive  bool
-		provisionalStop bool
-	}{
-		{
-			name:     "start",
-			hookName: HookNameSubagentStart,
-			input:    `{"session_id":"root-session-1","turn_id":"turn-child-1","agent_id":"agent-child-1","agent_type":"reviewer"}`,
-		},
-		{
-			name:            "stop",
-			hookName:        HookNameSubagentStop,
-			input:           `{"session_id":"root-session-1","turn_id":"turn-child-1","agent_id":"agent-child-1","agent_type":"reviewer","stop_hook_active":true}`,
-			stopHookActive:  true,
-			provisionalStop: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			ev, err := (&CodexAgent{}).ParseHookEvent(context.Background(), tt.hookName, strings.NewReader(tt.input))
-			require.NoError(t, err)
-			require.NotNil(t, ev)
-			require.Equal(t, "turn-child-1", ev.TurnID)
-			require.Equal(t, "agent-child-1", ev.SubagentID)
-			require.Equal(t, tt.stopHookActive, ev.StopHookActive)
-			require.Equal(t, tt.provisionalStop, ev.ProvisionalSubagentStop)
-			require.False(t, ev.Final)
-		})
-	}
-}
-
 // TestParseHookEvent_SubagentStart pins the identity mapping, which is the part a
 // future reader is most likely to get backwards: session_id is the identity shared
 // by the root thread and all descendants (the user's session), agent_id the child
@@ -545,11 +449,14 @@ func TestParseHookEvent_SubagentStart(t *testing.T) {
 	require.NotNil(t, ev)
 	require.Equal(t, agent.SubagentStart, ev.Type)
 	require.Equal(t, "root-session-1", ev.SessionID, "the shared root session id, not the child thread")
+	require.Equal(t, "turn-3", ev.TurnID)
+	require.Equal(t, testCodexAgentID, ev.SubagentID)
 	// Codex sends no tool_use_id; agent_id is the only value correlating start with
 	// stop, and Entire keys pre-task state on ToolUseID.
 	require.Equal(t, testCodexAgentID, ev.ToolUseID)
 	require.Equal(t, "reviewer", ev.SubagentType)
 	require.Equal(t, "/rollouts/root-session-1.jsonl", ev.SessionRef, "the parent rollout")
+	require.False(t, ev.Final)
 }
 
 // TestParseHookEvent_SubagentStop covers the two transcripts SubagentStop carries:
@@ -577,11 +484,14 @@ func TestParseHookEvent_SubagentStop(t *testing.T) {
 	require.NotNil(t, ev)
 	require.Equal(t, agent.SubagentEnd, ev.Type)
 	require.Equal(t, "root-session-1", ev.SessionID, "the shared root session id")
+	require.Equal(t, "turn-3", ev.TurnID)
 	require.Equal(t, testCodexAgentID, ev.SubagentID)
 	require.Equal(t, testCodexAgentID, ev.ToolUseID, "agent_id doubles as the correlation key")
 	require.Equal(t, "/rollouts/root-session-1.jsonl", ev.SessionRef, "the PARENT rollout")
 	require.Equal(t, "/rollouts/"+testCodexAgentID+".jsonl", ev.SubagentTranscriptPath,
 		"the subagent's own rollout")
+	require.True(t, ev.ProvisionalSubagentStop)
+	require.False(t, ev.Final)
 }
 
 // TestParseHookEvent_SubagentStop_NullTranscripts covers the nullable fields: Codex
diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
index f9a3f5db9d..430bab9c19 100644
--- a/cmd/entire/cli/agent/codex/subagent_test.go
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -15,25 +15,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestResolveRollout_UsesExactMetadataID(t *testing.T) {
-	t.Parallel()
-
-	root := t.TempDir()
-	active := filepath.Join(root, "sessions")
-	archived := filepath.Join(root, "archived_sessions")
-	ag := &CodexAgent{RolloutRoots: []string{active, archived}}
-
-	activePath := writeRollout(t, active, "2026/08/31/rollout-near-child-a.jsonl", "child-a", nil)
-	archivedPath := writeRollout(t, archived, "2026/08/30/rollout-child-b.jsonl", "child-b", nil)
-	writeRollout(t, active, "2026/08/31/rollout-child-a-suffix.jsonl", "not-child-a", nil)
-
-	got := ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child-a"})
-	require.Equal(t, activePath, got)
-
-	got = ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child-b"})
-	require.Equal(t, archivedPath, got)
-}
-
 func TestResolveRollout_DefaultCodexHomeIncludesArchivedSessions(t *testing.T) {
 	// This test changes CODEX_HOME, so it must not run in parallel.
 	codexHome := t.TempDir()
@@ -46,8 +27,10 @@ func TestResolveRollout_DefaultCodexHomeIncludesArchivedSessions(t *testing.T) {
 	archivedPath := writeRollout(t, archived, "2026/08/30/rollout-archived.jsonl", "archived", nil)
 	ag := &CodexAgent{}
 
-	require.Equal(t, activePath, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "active"}))
-	require.Equal(t, archivedPath, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "archived"}))
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: "active"}, {AgentID: "archived"}})
+	require.NoError(t, err)
+	require.Equal(t, activePath, result.Children[0].ResolvedPath)
+	require.Equal(t, archivedPath, result.Children[1].ResolvedPath)
 }
 
 func TestResolveRollout_MismatchedKnownPathsFallBackOnlyToExactID(t *testing.T) {
@@ -63,28 +46,11 @@ func TestResolveRollout_MismatchedKnownPathsFallBackOnlyToExactID(t *testing.T)
 		{AgentID: "child", DeclaredTranscriptPath: mismatch},
 		{AgentID: "child", ResolvedTranscriptPath: mismatch},
 	} {
-		require.Equal(t, exact, ag.resolveSubagentRollout(ref))
+		child, _ := extractChild(t, ag, ref)
+		require.Equal(t, exact, child.ResolvedPath)
 	}
 }
 
-func TestResolveRollout_KnownExactPathsNeedNoFallbackRoot(t *testing.T) {
-	t.Parallel()
-
-	root := t.TempDir()
-	declared := writeRollout(t, root, "declared.jsonl", "declared", nil)
-	resolved := writeRollout(t, root, "resolved.jsonl", "resolved", nil)
-	ag := &CodexAgent{RolloutRoots: []string{filepath.Join(root, "no-fallback-here")}}
-
-	require.Equal(t, declared, ag.resolveSubagentRollout(agent.SubagentReference{
-		AgentID:                "declared",
-		DeclaredTranscriptPath: declared,
-	}))
-	require.Equal(t, resolved, ag.resolveSubagentRollout(agent.SubagentReference{
-		AgentID:                "resolved",
-		ResolvedTranscriptPath: resolved,
-	}))
-}
-
 func TestResolveRollout_RejectsInferredAndAmbiguousCandidates(t *testing.T) {
 	t.Parallel()
 
@@ -92,11 +58,14 @@ func TestResolveRollout_RejectsInferredAndAmbiguousCandidates(t *testing.T) {
 	active := filepath.Join(root, "sessions")
 	ag := &CodexAgent{RolloutRoots: []string{active}}
 	writeRollout(t, active, "2026/08/31/rollout-child.jsonl", "childish", nil)
-	require.Empty(t, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child"}))
+	child, usage := extractChild(t, ag, agent.SubagentReference{AgentID: "child"})
+	require.Empty(t, child.ResolvedPath)
+	require.False(t, *usage.SubagentTokensComplete)
 
 	writeRollout(t, active, "2026/08/30/rollout-child-one.jsonl", "child", nil)
 	writeRollout(t, active, "2026/08/31/rollout-child-two.jsonl", "child", nil)
-	require.Empty(t, ag.resolveSubagentRollout(agent.SubagentReference{AgentID: "child"}))
+	child, _ = extractChild(t, ag, agent.SubagentReference{AgentID: "child"})
+	require.Empty(t, child.ResolvedPath)
 }
 
 func TestResolveRollout_RejectsSymlinkHint(t *testing.T) {
@@ -108,77 +77,43 @@ func TestResolveRollout_RejectsSymlinkHint(t *testing.T) {
 	require.NoError(t, os.Symlink(target, link))
 
 	ag := &CodexAgent{RolloutRoots: []string{}}
-	require.Empty(t, ag.resolveSubagentRollout(agent.SubagentReference{
+	child, _ := extractChild(t, ag, agent.SubagentReference{
 		AgentID:                "child",
 		DeclaredTranscriptPath: link,
-	}))
-}
-
-func TestRolloutRegularMode_RejectsSpecialEntries(t *testing.T) {
-	t.Parallel()
-
-	for _, mode := range []fs.FileMode{0, fs.ModeDir, fs.ModeSymlink, fs.ModeNamedPipe, fs.ModeDevice, fs.ModeSocket} {
-		require.Equal(t, mode == 0, rolloutRegularMode(mode), "mode %v", mode)
-	}
+	})
+	require.Empty(t, child.ResolvedPath)
 }
 
 func TestTerminalTurnIDs_OnlyAcceptsUnambiguousBoundaries(t *testing.T) {
 	t.Parallel()
 
-	valid := rolloutData(t, "child", []json.RawMessage{
-		taskEvent("task_started", stringPointer("one")),
-		taskEvent("task_complete", stringPointer("one")),
-		taskEvent("task_started", stringPointer("two")),
-		taskEvent("task_complete", nil),
-	})
-	require.Equal(t, []string{"one", "two"}, terminalTurnIDs(valid))
-
-	for _, invalid := range [][]json.RawMessage{
-		{taskEvent("task_complete", stringPointer("one"))},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_started", stringPointer("two")), taskEvent("task_complete", nil)},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("two"))},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")), taskEvent("task_complete", stringPointer("one"))},
-	} {
-		require.Empty(t, terminalTurnIDs(rolloutData(t, "child", invalid)))
+	valid := []json.RawMessage{
+		taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")),
+		taskEvent("task_started", stringPointer("two")), taskEvent("task_complete", nil),
 	}
-}
-
-func TestTerminalTurnIDs_RealWireShape(t *testing.T) {
-	t.Parallel()
+	require.Equal(t, []string{"one", "two"}, analyzeRollout(rolloutData(t, "child", valid), 0).TerminalTurnIDs)
+	withUnknownEvent := append(append([]json.RawMessage(nil), valid...), json.RawMessage(`{"type":"event_msg","payload":{"type":"future_event","turn_id":7}}`))
+	require.Equal(t, []string{"one", "two"}, analyzeRollout(rolloutData(t, "child", withUnknownEvent), 0).TerminalTurnIDs)
 
-	modern := rolloutData(t, "child", []json.RawMessage{
-		taskEvent("task_started", stringPointer("modern")),
-		taskEvent("task_complete", stringPointer("modern")),
-	})
-	require.Equal(t, []string{"modern"}, terminalTurnIDs(modern))
-
-	legacy := rolloutData(t, "child", []json.RawMessage{
-		taskEvent("task_started", stringPointer("legacy")),
-		taskEvent("task_complete", nil),
-	})
-	require.Equal(t, []string{"legacy"}, terminalTurnIDs(legacy))
-}
-
-func TestTerminalTurnIDs_RejectsInvalidRealWireBoundaries(t *testing.T) {
-	t.Parallel()
-
-	validThenMalformed := []json.RawMessage{
-		taskEvent("task_started", stringPointer("one")),
-		taskEvent("task_complete", stringPointer("one")),
-		json.RawMessage(`{"type":"event_msg","payload":{"type":"task_started","turn_id":`),
+	tests := []struct {
+		name   string
+		events []json.RawMessage
+	}{
+		{"completion without start", []json.RawMessage{taskEvent("task_complete", stringPointer("one"))}},
+		{"start without id", []json.RawMessage{taskEvent("task_started", nil)}},
+		{"unclosed start", []json.RawMessage{taskEvent("task_started", stringPointer("one"))}},
+		{"overlapping starts", []json.RawMessage{taskEvent("task_started", stringPointer("one")), taskEvent("task_started", stringPointer("two"))}},
+		{"mismatched completion", []json.RawMessage{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("two"))}},
+		{"duplicate turn", []json.RawMessage{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")), taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one"))}},
+		{"duplicate completion", []json.RawMessage{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", nil), taskEvent("task_complete", nil)}},
+		{"invalid id type", []json.RawMessage{json.RawMessage(`{"type":"event_msg","payload":{"type":"task_started","turn_id":7}}`)}},
+		{"malformed tail", append(valid, json.RawMessage(`{"type":"event_msg","payload":{"type":"task_started","turn_id":`))},
 	}
-	for _, invalid := range [][]json.RawMessage{
-		{taskEvent("task_complete", stringPointer("one"))},
-		{taskEvent("task_started", nil)},
-		{taskEvent("task_started", stringPointer("one"))},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_started", stringPointer("two"))},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("two"))},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")), taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one"))},
-		{taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", nil), taskEvent("task_complete", nil)},
-		{json.RawMessage(`{"type":"event_msg","payload":{"type":"task_started","turn_id":7}}`)},
-		validThenMalformed,
-	} {
-		require.Empty(t, terminalTurnIDs(rolloutData(t, "child", invalid)))
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			require.Empty(t, analyzeRollout(rolloutData(t, "child", tt.events), 0).TerminalTurnIDs)
+		})
 	}
 }
 
@@ -189,18 +124,18 @@ func TestExactTokenUsage_UsesOnlyLastRecognizableSnapshot(t *testing.T) {
 		"input_tokens": 15, "cached_input_tokens": 12, "output_tokens": 3,
 		"reasoning_output_tokens": 2, "total_tokens": 18,
 	}})
-	usage := exactCumulativeTokenUsage(rolloutData(t, "child", []json.RawMessage{valid}))
+	usage := analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid}), 0).ExactTokenUsage
 	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 12, OutputTokens: 3}, usage)
 
 	malformedLast := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
 		"input_tokens": 10, "cached_input_tokens": 11, "output_tokens": 3,
 	}})
-	require.Nil(t, exactCumulativeTokenUsage(rolloutData(t, "child", []json.RawMessage{valid, malformedLast})))
+	require.Nil(t, analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid, malformedLast}), 0).ExactTokenUsage)
 
 	missingRequired := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
 		"input_tokens": 10, "output_tokens": 3,
 	}})
-	require.Nil(t, exactCumulativeTokenUsage(rolloutData(t, "child", []json.RawMessage{missingRequired})))
+	require.Nil(t, analyzeRollout(rolloutData(t, "child", []json.RawMessage{missingRequired}), 0).ExactTokenUsage)
 }
 
 func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testing.T) {
@@ -209,7 +144,7 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 	valid := func(values map[string]any) []byte {
 		return rolloutData(t, "child", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": values})})
 	}
-	require.Nil(t, exactCumulativeTokenUsage(rolloutData(t, "child", nil)))
+	require.Nil(t, analyzeRollout(rolloutData(t, "child", nil), 0).ExactTokenUsage)
 
 	for _, values := range []map[string]any{
 		{"cached_input_tokens": 0, "output_tokens": 1},
@@ -224,17 +159,17 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "reasoning_output_tokens": -1},
 		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "reasoning_output_tokens": 2},
 	} {
-		require.Nil(t, exactCumulativeTokenUsage(valid(values)))
+		require.Nil(t, analyzeRollout(valid(values), 0).ExactTokenUsage)
 	}
 
-	zeros := exactCumulativeTokenUsage(valid(map[string]any{"input_tokens": 0, "cached_input_tokens": 0, "output_tokens": 0}))
+	zeros := analyzeRollout(valid(map[string]any{"input_tokens": 0, "cached_input_tokens": 0, "output_tokens": 0}), 0).ExactTokenUsage
 	require.Equal(t, &agent.TokenUsage{}, zeros)
 
 	multiple := rolloutData(t, "child", []json.RawMessage{
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 9, "cached_input_tokens": 1, "output_tokens": 2}}),
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
 	})
-	usage := exactCumulativeTokenUsage(multiple)
+	usage := analyzeRollout(multiple, 0).ExactTokenUsage
 	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 1, OutputTokens: 2}, usage)
 	require.Zero(t, usage.APICallCount, "snapshot record count is not an API-call count")
 
@@ -242,7 +177,7 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
 		tokenCountEvent(map[string]any{"total_token_usage": "not-an-object"}),
 	})
-	require.Nil(t, exactCumulativeTokenUsage(malformedFinal), "must not fall back to the earlier valid snapshot")
+	require.Nil(t, analyzeRollout(malformedFinal, 0).ExactTokenUsage, "must not fall back to the earlier valid snapshot")
 }
 
 func TestSubagentInventory_CollectsExactEvidenceAndDoesNotPartialAggregate(t *testing.T) {
@@ -434,31 +369,6 @@ func TestSubagentInventory_RevalidatesInjectedRolloutBytes(t *testing.T) {
 	require.False(t, *result.TokenUsage.SubagentTokensComplete)
 }
 
-func TestSubagentInventory_BatchesFallbackTraversal(t *testing.T) {
-	t.Parallel()
-
-	firstRoot := t.TempDir()
-	secondRoot := t.TempDir()
-	first := writeRollout(t, firstRoot, "first.jsonl", "first", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1}})})
-	second := writeRollout(t, secondRoot, "second.jsonl", "second", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 2, "cached_input_tokens": 0, "output_tokens": 1}})})
-	_ = first
-	_ = second
-	walks := 0
-	ag := &CodexAgent{
-		RolloutRoots: []string{firstRoot, secondRoot},
-		walkDir: func(root string, visit fs.WalkDirFunc) error {
-			walks++
-			return filepath.WalkDir(root, visit)
-		},
-	}
-
-	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: "first"}, {AgentID: "second"}})
-	require.NoError(t, err)
-	require.Equal(t, 2, walks, "one traversal per configured root, not per child")
-	require.Equal(t, []string{"first", "second"}, []string{result.Children[0].AgentID, result.Children[1].AgentID})
-	require.True(t, *result.TokenUsage.SubagentTokensComplete)
-}
-
 func TestSubagentInventory_FallbackTraversalFailureDiscardsMatches(t *testing.T) {
 	t.Parallel()
 
@@ -636,6 +546,14 @@ func mustReadFile(t *testing.T, path string) []byte {
 	return data
 }
 
+func extractChild(t *testing.T, ag *CodexAgent, ref agent.SubagentReference) (agent.SubagentAnalysis, *agent.TokenUsage) {
+	t.Helper()
+	result, err := ag.ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{ref})
+	require.NoError(t, err)
+	require.Len(t, result.Children, 1)
+	return result.Children[0], result.TokenUsage
+}
+
 func writeRollout(t *testing.T, root, name, id string, events []json.RawMessage) string {
 	t.Helper()
 	path := filepath.Join(root, name)
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index ac78995f8f..b97d65a5b8 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -27,22 +27,6 @@ var (
 	_ agent.TranscriptSanitizer         = (*CodexAgent)(nil)
 )
 
-// readSessionMetaID reads the first record of a Codex rollout and returns its
-// non-empty native thread ID. Callers use it to prove a path belongs to a
-// supplied child rather than inferring that fact from its filename or age.
-//
-//nolint:unused // Kept as the path helper for direct internal callers; evidence uses same-byte loading instead.
-func readSessionMetaID(path string) (string, error) {
-	if path == "" {
-		return "", errors.New("empty rollout path")
-	}
-	loaded, err := readRegularRollout(path)
-	if err != nil {
-		return "", fmt.Errorf("load rollout: %w", err)
-	}
-	return sessionMetaID(loaded.Data)
-}
-
 func sessionMetaID(data []byte) (string, error) {
 	lines := splitJSONL(data)
 	if len(lines) == 0 {
@@ -113,13 +97,8 @@ type sessionMetaPayload struct {
 	Source       json.RawMessage `json:"source"`
 }
 
-// classifyRollout reads only the rollout's session_meta record. Newer Codex
-// rollouts identify root and child threads with thread_source; older rollouts
-// encode their source as either a recognized root string or source.subagent.
-func classifyRollout(path string) rolloutClassification {
-	return classifyRolloutDetailed(path).Classification
-}
-
+// classifyRolloutDetailed reads only the rollout's session_meta record. Newer
+// Codex rollouts use thread_source; older rollouts use source.
 func classifyRolloutDetailed(path string) rolloutClassificationResult {
 	if path == "" {
 		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueNullPath}
@@ -341,22 +320,7 @@ func extractFilesFromLine(lineData []byte) []string {
 	if json.Unmarshal(lineData, &line) != nil {
 		return nil
 	}
-
-	if line.Type != rolloutLineTypeResponseItem {
-		return nil
-	}
-
-	var payload responseItemPayload
-	if json.Unmarshal(line.Payload, &payload) != nil {
-		return nil
-	}
-
-	// apply_patch custom tool calls contain file paths in the input text
-	if payload.Type == "custom_tool_call" && payload.Name == "apply_patch" {
-		return extractFilesFromApplyPatch(payload.Input)
-	}
-
-	return nil
+	return extractFilesFromParsedLine(line)
 }
 
 // extractFilesFromApplyPatch returns every file path in an apply_patch envelope,
@@ -501,25 +465,106 @@ func (c *CodexAgent) CalculateTokenUsage(transcriptData []byte, fromOffset int)
 	}, nil
 }
 
-// exactCumulativeTokenUsage returns the last recognizable Codex token_count
-// snapshot exactly as reported. A malformed final snapshot makes the entire
-// result unavailable instead of silently falling back to an earlier record.
-func exactCumulativeTokenUsage(data []byte) *agent.TokenUsage {
-	var lastInfo json.RawMessage
-	found := false
-	for _, lineData := range splitJSONL(data) {
+type rolloutAnalysis struct {
+	ModifiedFiles   []string
+	TerminalTurnIDs []string
+	ExactTokenUsage *agent.TokenUsage
+}
+
+// analyzeRollout extracts every piece of child evidence in one JSONL pass.
+// Each evidence channel keeps its own validity: malformed task boundaries
+// invalidate terminal turns without discarding file paths already observed,
+// while a malformed final token snapshot makes exact usage unavailable.
+func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
+	var result rolloutAnalysis
+	terminalValid := true
+	openTurn := ""
+	seenTurns := make(map[string]struct{})
+	seenFiles := make(map[string]struct{})
+	var lastTokenInfo json.RawMessage
+	foundToken := false
+
+	for index, lineData := range splitJSONL(data) {
 		var line rolloutLine
-		if json.Unmarshal(lineData, &line) != nil || line.Type != rolloutLineTypeEventMsg {
+		if json.Unmarshal(lineData, &line) != nil {
+			terminalValid = false
+			continue
+		}
+		if index+1 > fromOffset {
+			for _, file := range extractFilesFromParsedLine(line) {
+				if _, seen := seenFiles[file]; !seen {
+					seenFiles[file] = struct{}{}
+					result.ModifiedFiles = append(result.ModifiedFiles, file)
+				}
+			}
+		}
+		if line.Type != rolloutLineTypeEventMsg {
+			continue
+		}
+
+		var header struct {
+			Type string `json:"type"`
+		}
+		if json.Unmarshal(line.Payload, &header) != nil {
+			terminalValid = false
+			continue
+		}
+		if header.Type != eventMsgTypeTokenCount && header.Type != "task_started" && header.Type != "task_complete" {
 			continue
 		}
 		var event eventMsgPayload
-		if json.Unmarshal(line.Payload, &event) != nil || event.Type != eventMsgTypeTokenCount {
+		if json.Unmarshal(line.Payload, &event) != nil {
+			if header.Type != eventMsgTypeTokenCount {
+				terminalValid = false
+			}
 			continue
 		}
-		found = true
-		lastInfo = event.Info
+		switch header.Type {
+		case eventMsgTypeTokenCount:
+			foundToken = true
+			lastTokenInfo = event.Info
+		case "task_started":
+			if openTurn != "" || event.TurnID == nil || *event.TurnID == "" {
+				terminalValid = false
+				continue
+			}
+			if _, duplicate := seenTurns[*event.TurnID]; duplicate {
+				terminalValid = false
+				continue
+			}
+			openTurn = *event.TurnID
+		case "task_complete":
+			if openTurn == "" || (event.TurnID != nil && (*event.TurnID == "" || *event.TurnID != openTurn)) {
+				terminalValid = false
+				continue
+			}
+			result.TerminalTurnIDs = append(result.TerminalTurnIDs, openTurn)
+			seenTurns[openTurn] = struct{}{}
+			openTurn = ""
+		}
+	}
+	if !terminalValid || openTurn != "" {
+		result.TerminalTurnIDs = nil
+	}
+	if foundToken {
+		result.ExactTokenUsage = exactUsageFromInfo(lastTokenInfo)
+	}
+	return result
+}
+
+func extractFilesFromParsedLine(line rolloutLine) []string {
+	if line.Type != rolloutLineTypeResponseItem {
+		return nil
+	}
+	var payload responseItemPayload
+	if json.Unmarshal(line.Payload, &payload) != nil || payload.Type != "custom_tool_call" || payload.Name != "apply_patch" {
+		return nil
 	}
-	if !found || len(lastInfo) == 0 {
+	return extractFilesFromApplyPatch(payload.Input)
+}
+
+func exactUsageFromInfo(lastInfo json.RawMessage) *agent.TokenUsage {
+	if len(lastInfo) == 0 {
 		return nil
 	}
 	var info struct {
@@ -545,63 +590,11 @@ func exactCumulativeTokenUsage(data []byte) *agent.TokenUsage {
 	return &agent.TokenUsage{InputTokens: input - cached, CacheReadTokens: cached, OutputTokens: output}
 }
 
-// terminalTurnIDs accepts only ordered, one-at-a-time task boundaries. Modern
-// records name the same turn at both ends; the legacy ID-less completion is
-// accepted only while exactly one started turn is open.
-func terminalTurnIDs(data []byte) []string {
-	var terminal []string
-	open := ""
-	seen := make(map[string]struct{})
-	for _, lineData := range splitJSONL(data) {
-		var line rolloutLine
-		if json.Unmarshal(lineData, &line) != nil {
-			return nil
-		}
-		if line.Type != rolloutLineTypeEventMsg {
-			continue
-		}
-		var rawEvent struct {
-			Type string `json:"type"`
-		}
-		if json.Unmarshal(line.Payload, &rawEvent) != nil {
-			return nil
-		}
-		if rawEvent.Type != "task_started" && rawEvent.Type != "task_complete" {
-			continue
-		}
-		var event eventMsgPayload
-		if json.Unmarshal(line.Payload, &event) != nil {
-			return nil
-		}
-		switch event.Type {
-		case "task_started":
-			if open != "" || event.TurnID == nil || *event.TurnID == "" {
-				return nil
-			}
-			if _, duplicate := seen[*event.TurnID]; duplicate {
-				return nil
-			}
-			open = *event.TurnID
-		case "task_complete":
-			if open == "" || (event.TurnID != nil && (*event.TurnID == "" || *event.TurnID != open)) {
-				return nil
-			}
-			terminal = append(terminal, open)
-			seen[open] = struct{}{}
-			open = ""
-		}
-	}
-	if open != "" {
-		return nil
-	}
-	return terminal
-}
-
 // ExtractWithSubagentInventory gathers evidence only for refs supplied by the
 // caller's authoritative ledger. It never discovers children from transcript
 // text, filenames, timestamps, or token-count events.
 func (c *CodexAgent) ExtractWithSubagentInventory(ctx context.Context, parent []byte, fromOffset int, refs []agent.SubagentReference) (agent.InventoryExtraction, error) {
-	result := agent.InventoryExtraction{ModifiedFiles: extractFilesFromData(parent, fromOffset)}
+	result := agent.InventoryExtraction{ModifiedFiles: analyzeRollout(parent, fromOffset).ModifiedFiles}
 	parentUsage, err := c.CalculateTokenUsage(parent, fromOffset)
 	if err != nil {
 		return result, err
@@ -635,9 +628,10 @@ func (c *CodexAgent) ExtractWithSubagentInventory(ctx context.Context, parent []
 			result.Children = append(result.Children, analysis)
 			continue
 		}
-		analysis.ModifiedFiles = extractFilesFromData(loaded.Data, 0)
-		analysis.TerminalTurnIDs = terminalTurnIDs(loaded.Data)
-		analysis.TokenUsage = exactCumulativeTokenUsage(loaded.Data)
+		rollout := analyzeRollout(loaded.Data, 0)
+		analysis.ModifiedFiles = rollout.ModifiedFiles
+		analysis.TerminalTurnIDs = rollout.TerminalTurnIDs
+		analysis.TokenUsage = rollout.ExactTokenUsage
 		if analysis.TokenUsage == nil {
 			complete = false
 		} else {
@@ -663,17 +657,6 @@ func withChildCoverage(usage *agent.TokenUsage, complete bool) *agent.TokenUsage
 	return &result
 }
 
-func extractFilesFromData(data []byte, fromOffset int) []string {
-	var files []string
-	for index, lineData := range splitJSONL(data) {
-		if index+1 <= fromOffset {
-			continue
-		}
-		files = appendUniqueFiles(files, extractFilesFromLine(lineData))
-	}
-	return files
-}
-
 func appendUniqueFiles(files, additions []string) []string {
 	seen := make(map[string]struct{}, len(files)+len(additions))
 	for _, file := range files {
diff --git a/cmd/entire/cli/agent/codex/transcript_test.go b/cmd/entire/cli/agent/codex/transcript_test.go
index 92cba4c889..9be16e24d5 100644
--- a/cmd/entire/cli/agent/codex/transcript_test.go
+++ b/cmd/entire/cli/agent/codex/transcript_test.go
@@ -36,9 +36,10 @@ func TestClassifyRollout(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name string
-		data string
-		want rolloutClassification
+		name      string
+		data      string
+		want      rolloutClassification
+		wantIssue rolloutClassificationIssue
 	}{
 		{
 			name: "root thread source",
@@ -61,19 +62,22 @@ func TestClassifyRollout(t *testing.T) {
 			want: rolloutChild,
 		},
 		{
-			name: "missing session metadata",
-			data: `{"type":"response_item","payload":{}}` + "\n",
-			want: rolloutUnknown,
+			name:      "missing session metadata",
+			data:      `{"type":"response_item","payload":{}}` + "\n",
+			want:      rolloutUnknown,
+			wantIssue: rolloutIssueMalformedMetadata,
 		},
 		{
-			name: "malformed JSON",
-			data: `{"type":"session_meta","payload":` + "\n",
-			want: rolloutUnknown,
+			name:      "malformed JSON",
+			data:      `{"type":"session_meta","payload":` + "\n",
+			want:      rolloutUnknown,
+			wantIssue: rolloutIssueMalformedMetadata,
 		},
 		{
-			name: "unrecognized source",
-			data: `{"type":"session_meta","payload":{"source":"other"}}` + "\n",
-			want: rolloutUnknown,
+			name:      "unrecognized source",
+			data:      `{"type":"session_meta","payload":{"source":"other"}}` + "\n",
+			want:      rolloutUnknown,
+			wantIssue: rolloutIssueUnclassifiedSource,
 		},
 	}
 
@@ -82,51 +86,18 @@ func TestClassifyRollout(t *testing.T) {
 			t.Parallel()
 			path := filepath.Join(t.TempDir(), "rollout.jsonl")
 			require.NoError(t, os.WriteFile(path, []byte(tt.data), 0o600))
-			require.Equal(t, tt.want, classifyRollout(path))
+			got := classifyRolloutDetailed(path)
+			require.Equal(t, tt.want, got.Classification)
+			require.Equal(t, tt.wantIssue, got.Issue)
 		})
 	}
 
 	t.Run("missing path", func(t *testing.T) {
-		t.Parallel()
-		require.Equal(t, rolloutUnknown, classifyRollout(filepath.Join(t.TempDir(), "missing.jsonl")))
-	})
-}
-
-func TestClassifyRolloutDetailed_ExplainsFailClosedResult(t *testing.T) {
-	t.Parallel()
-
-	t.Run("null transcript path", func(t *testing.T) {
-		t.Parallel()
-		got := classifyRolloutDetailed("")
-		require.Equal(t, rolloutUnknown, got.Classification)
-		require.Equal(t, rolloutIssueNullPath, got.Issue)
-	})
-
-	t.Run("unreadable transcript", func(t *testing.T) {
 		t.Parallel()
 		got := classifyRolloutDetailed(filepath.Join(t.TempDir(), "missing.jsonl"))
 		require.Equal(t, rolloutUnknown, got.Classification)
 		require.Equal(t, rolloutIssueUnreadable, got.Issue)
 	})
-
-	t.Run("malformed metadata", func(t *testing.T) {
-		t.Parallel()
-		path := filepath.Join(t.TempDir(), "rollout.jsonl")
-		require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":`), 0o600))
-		got := classifyRolloutDetailed(path)
-		require.Equal(t, rolloutUnknown, got.Classification)
-		require.Equal(t, rolloutIssueMalformedMetadata, got.Issue)
-	})
-
-	t.Run("future source", func(t *testing.T) {
-		t.Parallel()
-		path := filepath.Join(t.TempDir(), "rollout.jsonl")
-		require.NoError(t, os.WriteFile(path, []byte(`{"type":"session_meta","payload":{"thread_source":"future-source"}}`), 0o600))
-		got := classifyRolloutDetailed(path)
-		require.Equal(t, rolloutUnknown, got.Classification)
-		require.Equal(t, rolloutIssueUnclassifiedSource, got.Issue)
-		require.Equal(t, "future-source", got.Detail)
-	})
 }
 
 func TestGetTranscriptPosition(t *testing.T) {
diff --git a/cmd/entire/cli/agent/codex/types.go b/cmd/entire/cli/agent/codex/types.go
index 781f0b875b..1177b6ed64 100644
--- a/cmd/entire/cli/agent/codex/types.go
+++ b/cmd/entire/cli/agent/codex/types.go
@@ -135,6 +135,5 @@ type subagentStopRaw struct {
 	HookEventName        string  `json:"hook_event_name"`
 	Model                string  `json:"model"`
 	PermissionMode       string  `json:"permission_mode"`
-	StopHookActive       bool    `json:"stop_hook_active"`
 	TurnID               string  `json:"turn_id"`
 }
diff --git a/cmd/entire/cli/agent/event.go b/cmd/entire/cli/agent/event.go
index a5bf085f8c..2711d511c6 100644
--- a/cmd/entire/cli/agent/event.go
+++ b/cmd/entire/cli/agent/event.go
@@ -114,9 +114,6 @@ type Event struct {
 	// SubagentID identifies the subagent instance (for SubagentEnd events).
 	SubagentID string
 
-	// StopHookActive reports whether the agent's Stop hook remains active.
-	StopHookActive bool
-
 	// ProvisionalSubagentStop is true when a subagent-stop event may arrive
 	// before the root rollout has reached its final state.
 	ProvisionalSubagentStop bool
diff --git a/cmd/entire/cli/integration_test/codex_subagent_test.go b/cmd/entire/cli/integration_test/codex_subagent_test.go
index e3f3a1a0a1..618e8e3282 100644
--- a/cmd/entire/cli/integration_test/codex_subagent_test.go
+++ b/cmd/entire/cli/integration_test/codex_subagent_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
-	"github.com/entireio/cli/cmd/entire/cli/agent/codex"
 	"github.com/entireio/cli/cmd/entire/cli/paths"
 	"github.com/entireio/cli/cmd/entire/cli/session"
 	"github.com/stretchr/testify/require"
@@ -51,10 +50,6 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 			`{"type":"response_item","payload":{"type":"custom_tool_call","status":"completed","name":"apply_patch","input":"*** Begin Patch\n*** Add File: `+editedFile+`\n+red\n*** End Patch"}}`+"\n"+
 			`{"type":"event_msg","payload":{"type":"token_count","info":{"total_token_usage":{"input_tokens":10,"cached_input_tokens":2,"output_tokens":3}}}}`+"\n"+
 			`{"type":"event_msg","payload":{"type":"task_complete","turn_id":"turn-1"}}`+"\n"), 0o600))
-	probe, err := (&codex.CodexAgent{RolloutRoots: []string{}}).ExtractWithSubagentInventory(t.Context(), nil, 0, []agent.SubagentReference{{AgentID: agentID, DeclaredTranscriptPath: subagentRollout}})
-	require.NoError(t, err)
-	require.Equal(t, []string{"turn-1"}, probe.Children[0].TerminalTurnIDs)
-
 	hook := codexHooker(t, env.RepoDir, sessionID, parentRollout)
 	hook("subagent-start", map[string]any{
 		"hook_event_name": "SubagentStart",
diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index bc0987c303..0ffa51dfbb 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1434,7 +1434,7 @@ func handleLifecycleSubagentEnd(ctx context.Context, ag agent.Agent, event *agen
 		// still be changing. Record only the observation for later transcript
 		// reconciliation; do not capture the parent worktree or mark a task done.
 		err := strategy.MutateSessionState(logCtx, event.SessionID, func(state *strategy.SessionState) error {
-			state.RecordSubagentStop(event.SubagentID, event.TurnID, session.SubagentStopCandidate{ObservedAt: time.Now(), StopHookActive: event.StopHookActive})
+			state.RecordSubagentStop(event.SubagentID, event.TurnID)
 			state.UpdateSubagentTranscriptPaths(event.SubagentID, event.SubagentTranscriptPath, "")
 			return nil
 		})
diff --git a/cmd/entire/cli/session/state.go b/cmd/entire/cli/session/state.go
index 86f4eedb41..a89404c88e 100644
--- a/cmd/entire/cli/session/state.go
+++ b/cmd/entire/cli/session/state.go
@@ -437,18 +437,12 @@ type State struct {
 	SubagentInventoryComplete *bool `json:"subagent_inventory_complete,omitempty"`
 }
 
-type SubagentStopCandidate struct {
-	ObservedAt     time.Time `json:"observed_at"`
-	StopHookActive bool      `json:"stop_hook_active,omitempty"`
-}
-
 type SubagentInventoryEntry struct {
-	AgentID                string                           `json:"agent_id"`
-	DeclaredTranscriptPath string                           `json:"declared_transcript_path,omitempty"`
-	ResolvedTranscriptPath string                           `json:"resolved_transcript_path,omitempty"`
-	ObservedTurnIDs        []string                         `json:"observed_turn_ids,omitempty"`
-	PendingStops           map[string]SubagentStopCandidate `json:"pending_stops,omitempty"`
-	FinalizedTurnIDs       []string                         `json:"finalized_turn_ids,omitempty"`
+	AgentID                string   `json:"agent_id"`
+	DeclaredTranscriptPath string   `json:"declared_transcript_path,omitempty"`
+	ResolvedTranscriptPath string   `json:"resolved_transcript_path,omitempty"`
+	ObservedTurnIDs        []string `json:"observed_turn_ids,omitempty"`
+	FinalizedTurnIDs       []string `json:"finalized_turn_ids,omitempty"`
 }
 
 // TaskRecord is the durable pointer ledger entry for a subagent dispatched by
@@ -573,27 +567,8 @@ func (s *State) RegisterSubagent(agentID, turnID string) bool {
 
 // RecordSubagentStop records a provisional stop. Stops can arrive before
 // starts, so observing the child and turn happens in this same mutation.
-func (s *State) RecordSubagentStop(agentID, turnID string, candidate SubagentStopCandidate) bool {
-	observed := s.RegisterSubagent(agentID, turnID)
-	if agentID == "" || turnID == "" {
-		return observed
-	}
-	entry := s.FindSubagentInventory(agentID)
-	if entry == nil || containsString(entry.FinalizedTurnIDs, turnID) {
-		return observed
-	}
-	if entry.PendingStops == nil {
-		entry.PendingStops = make(map[string]SubagentStopCandidate)
-	}
-	if existing, exists := entry.PendingStops[turnID]; exists {
-		if existing == candidate {
-			return observed
-		}
-		entry.PendingStops[turnID] = candidate
-		return true
-	}
-	entry.PendingStops[turnID] = candidate
-	return true
+func (s *State) RecordSubagentStop(agentID, turnID string) bool {
+	return s.RegisterSubagent(agentID, turnID)
 }
 
 // UpdateSubagentTranscriptPaths enriches an already-observed child's path
@@ -616,8 +591,7 @@ func (s *State) UpdateSubagentTranscriptPaths(agentID, declaredPath, resolvedPat
 	return changed
 }
 
-// FinalizeSubagentTurn moves an observed turn out of PendingStops and into the
-// finalized set atomically. A finalized turn is never finalized twice.
+// FinalizeSubagentTurn marks an observed turn finalized exactly once.
 func (s *State) FinalizeSubagentTurn(agentID, turnID string) bool {
 	if agentID == "" || turnID == "" {
 		return false
@@ -626,7 +600,6 @@ func (s *State) FinalizeSubagentTurn(agentID, turnID string) bool {
 	if entry == nil || !containsString(entry.ObservedTurnIDs, turnID) || containsString(entry.FinalizedTurnIDs, turnID) {
 		return false
 	}
-	delete(entry.PendingStops, turnID)
 	entry.FinalizedTurnIDs = append(entry.FinalizedTurnIDs, turnID)
 	return true
 }
diff --git a/cmd/entire/cli/session/state_test.go b/cmd/entire/cli/session/state_test.go
index 1330a8dc5c..06730f2c33 100644
--- a/cmd/entire/cli/session/state_test.go
+++ b/cmd/entire/cli/session/state_test.go
@@ -1039,10 +1039,7 @@ func TestState_SubagentInventoryLedger(t *testing.T) {
 		t.Fatal("first child observation must be recorded")
 	}
 	assert.Equal(t, uint64(1), state.SubagentLedgerVersion)
-	assert.Nil(t, state.TokenUsage.SubagentTokens)
-	assert.False(t, *state.TokenUsage.SubagentTokensComplete)
-	assert.Nil(t, state.CheckpointTokenUsage.SubagentTokens)
-	assert.False(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+	assertIncompleteSubagentUsage(t, state)
 
 	// A later exact extraction may have refreshed both aggregates. Duplicate
 	// observations and path-only enrichment must preserve that fresh coverage.
@@ -1052,86 +1049,66 @@ func TestState_SubagentInventoryLedger(t *testing.T) {
 	state.CheckpointTokenUsage.SubagentTokens = &agent.TokenUsage{OutputTokens: 13}
 	state.CheckpointTokenUsage.SubagentTokensComplete = &refreshedComplete
 	versionBeforeDuplicate := state.SubagentLedgerVersion
-	totalBeforeDuplicate := state.TokenUsage.SubagentTokens
-	checkpointTotalBeforeDuplicate := state.CheckpointTokenUsage.SubagentTokens
-	coverageBeforeDuplicate := *state.TokenUsage.SubagentTokensComplete
-	checkpointCoverageBeforeDuplicate := *state.CheckpointTokenUsage.SubagentTokensComplete
 	if state.RegisterSubagent("child-1", "turn-1") {
 		t.Fatal("duplicate agent/turn observation must be a true no-op")
 	}
 	assert.Equal(t, versionBeforeDuplicate, state.SubagentLedgerVersion)
-	assert.Same(t, totalBeforeDuplicate, state.TokenUsage.SubagentTokens)
-	assert.Same(t, checkpointTotalBeforeDuplicate, state.CheckpointTokenUsage.SubagentTokens)
-	assert.Equal(t, coverageBeforeDuplicate, *state.TokenUsage.SubagentTokensComplete)
-	assert.Equal(t, checkpointCoverageBeforeDuplicate, *state.CheckpointTokenUsage.SubagentTokensComplete)
+	assertCompleteSubagentUsage(t, state, 21, 13)
 	versionBeforePathEnrichment := state.SubagentLedgerVersion
-	totalBeforePathEnrichment := state.TokenUsage.SubagentTokens
-	checkpointTotalBeforePathEnrichment := state.CheckpointTokenUsage.SubagentTokens
-	coverageBeforePathEnrichment := *state.TokenUsage.SubagentTokensComplete
-	checkpointCoverageBeforePathEnrichment := *state.CheckpointTokenUsage.SubagentTokensComplete
 	assert.True(t, state.UpdateSubagentTranscriptPaths("child-1", "/tmp/declared.jsonl", "/tmp/resolved.jsonl"))
 	assert.Equal(t, versionBeforePathEnrichment, state.SubagentLedgerVersion, "path enrichment must not churn the ledger generation")
-	assert.Same(t, totalBeforePathEnrichment, state.TokenUsage.SubagentTokens)
-	assert.Same(t, checkpointTotalBeforePathEnrichment, state.CheckpointTokenUsage.SubagentTokens)
-	assert.Equal(t, coverageBeforePathEnrichment, *state.TokenUsage.SubagentTokensComplete)
-	assert.Equal(t, checkpointCoverageBeforePathEnrichment, *state.CheckpointTokenUsage.SubagentTokensComplete)
-
-	stopObservedAt := time.Now().UTC().Truncate(time.Second)
-	stopCandidate := SubagentStopCandidate{ObservedAt: stopObservedAt, StopHookActive: true}
-	if !state.RecordSubagentStop("child-1", "turn-2", stopCandidate) {
+	assertCompleteSubagentUsage(t, state, 21, 13)
+
+	if !state.RecordSubagentStop("child-1", "turn-2") {
 		t.Fatal("stop-first new turn must be recorded")
 	}
 	assert.Equal(t, uint64(2), state.SubagentLedgerVersion)
-	assert.Nil(t, state.TokenUsage.SubagentTokens, "new child turn must invalidate refreshed session totals")
-	require.NotNil(t, state.TokenUsage.SubagentTokensComplete)
-	assert.False(t, *state.TokenUsage.SubagentTokensComplete)
-	assert.Nil(t, state.CheckpointTokenUsage.SubagentTokens, "new child turn must invalidate refreshed checkpoint totals")
-	require.NotNil(t, state.CheckpointTokenUsage.SubagentTokensComplete)
-	assert.False(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+	assertIncompleteSubagentUsage(t, state)
 	entry := state.FindSubagentInventory("child-1")
 	require.NotNil(t, entry)
-	require.Contains(t, entry.PendingStops, "turn-2")
+	require.Contains(t, entry.ObservedTurnIDs, "turn-2")
+	require.NotContains(t, entry.FinalizedTurnIDs, "turn-2")
 
-	// A stop retry may carry richer metadata. Both a true duplicate and the
-	// metadata refresh must leave already-calculated token coverage intact.
+	// A stop retry must leave already-calculated token coverage intact.
 	stopRefreshComplete := true
 	state.TokenUsage.SubagentTokens = &agent.TokenUsage{InputTokens: 34}
 	state.TokenUsage.SubagentTokensComplete = &stopRefreshComplete
 	state.CheckpointTokenUsage.SubagentTokens = &agent.TokenUsage{OutputTokens: 21}
 	state.CheckpointTokenUsage.SubagentTokensComplete = &stopRefreshComplete
 	versionBeforeStopRefresh := state.SubagentLedgerVersion
-	totalBeforeStopRefresh := state.TokenUsage.SubagentTokens
-	checkpointTotalBeforeStopRefresh := state.CheckpointTokenUsage.SubagentTokens
-	coverageBeforeStopRefresh := *state.TokenUsage.SubagentTokensComplete
-	checkpointCoverageBeforeStopRefresh := *state.CheckpointTokenUsage.SubagentTokensComplete
-	assert.False(t, state.RecordSubagentStop("child-1", "turn-2", stopCandidate), "exact duplicate stop must be a no-op")
-	assert.Equal(t, versionBeforeStopRefresh, state.SubagentLedgerVersion)
-	assert.Same(t, totalBeforeStopRefresh, state.TokenUsage.SubagentTokens)
-	assert.Same(t, checkpointTotalBeforeStopRefresh, state.CheckpointTokenUsage.SubagentTokens)
-	assert.Equal(t, coverageBeforeStopRefresh, *state.TokenUsage.SubagentTokensComplete)
-	assert.Equal(t, checkpointCoverageBeforeStopRefresh, *state.CheckpointTokenUsage.SubagentTokensComplete)
-
-	refreshedCandidate := SubagentStopCandidate{ObservedAt: stopObservedAt.Add(time.Second), StopHookActive: false}
-	assert.True(t, state.RecordSubagentStop("child-1", "turn-2", refreshedCandidate), "changed stop metadata must upsert")
-	assert.Equal(t, refreshedCandidate, entry.PendingStops["turn-2"])
+	assert.False(t, state.RecordSubagentStop("child-1", "turn-2"), "duplicate stop must be a no-op")
 	assert.Equal(t, versionBeforeStopRefresh, state.SubagentLedgerVersion)
-	assert.Same(t, totalBeforeStopRefresh, state.TokenUsage.SubagentTokens)
-	assert.Same(t, checkpointTotalBeforeStopRefresh, state.CheckpointTokenUsage.SubagentTokens)
-	assert.Equal(t, coverageBeforeStopRefresh, *state.TokenUsage.SubagentTokensComplete)
-	assert.Equal(t, checkpointCoverageBeforeStopRefresh, *state.CheckpointTokenUsage.SubagentTokensComplete)
+	assertCompleteSubagentUsage(t, state, 34, 21)
 
-	state.RecordSubagentStop("child-1", "turn-3", SubagentStopCandidate{ObservedAt: time.Now()})
-	require.Len(t, entry.PendingStops, 2, "several pending stops must coexist")
+	state.RecordSubagentStop("child-1", "turn-3")
+	require.Contains(t, entry.ObservedTurnIDs, "turn-3", "several pending turns must coexist")
 	if !state.FinalizeSubagentTurn("child-1", "turn-2") {
 		t.Fatal("pending turn must finalize")
 	}
-	assert.NotContains(t, entry.PendingStops, "turn-2")
 	assert.Contains(t, entry.FinalizedTurnIDs, "turn-2")
 	if state.FinalizeSubagentTurn("child-1", "turn-2") {
 		t.Fatal("finalized turn must be exactly once")
 	}
 }
 
+func assertIncompleteSubagentUsage(t *testing.T, state *State) {
+	t.Helper()
+	for _, usage := range []*agent.TokenUsage{state.TokenUsage, state.CheckpointTokenUsage} {
+		require.NotNil(t, usage)
+		assert.Nil(t, usage.SubagentTokens)
+		require.NotNil(t, usage.SubagentTokensComplete)
+		assert.False(t, *usage.SubagentTokensComplete)
+	}
+}
+
+func assertCompleteSubagentUsage(t *testing.T, state *State, sessionInput, checkpointOutput int) {
+	t.Helper()
+	assert.Equal(t, &agent.TokenUsage{InputTokens: sessionInput}, state.TokenUsage.SubagentTokens)
+	assert.Equal(t, &agent.TokenUsage{OutputTokens: checkpointOutput}, state.CheckpointTokenUsage.SubagentTokens)
+	assert.True(t, *state.TokenUsage.SubagentTokensComplete)
+	assert.True(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
+}
+
 func TestState_SubagentInventoryRoundTripAndTaskRecordRecovery(t *testing.T) {
 	t.Parallel()
 	now := time.Now().UTC().Truncate(time.Second)
@@ -1146,7 +1123,6 @@ func TestState_SubagentInventoryRoundTripAndTaskRecordRecovery(t *testing.T) {
 			DeclaredTranscriptPath: "/tmp/child.jsonl",
 			ResolvedTranscriptPath: "/tmp/resolved.jsonl",
 			ObservedTurnIDs:        []string{"turn-1"},
-			PendingStops:           map[string]SubagentStopCandidate{"turn-1": {ObservedAt: now, StopHookActive: true}},
 			FinalizedTurnIDs:       []string{"turn-0"},
 		}},
 	}
@@ -1159,17 +1135,7 @@ func TestState_SubagentInventoryRoundTripAndTaskRecordRecovery(t *testing.T) {
 	require.NotNil(t, got.SubagentTokensBaselineComplete)
 	assert.True(t, *got.SubagentTokensBaselineComplete)
 	assert.Equal(t, uint64(7), got.SubagentLedgerVersion)
-	require.Len(t, got.SubagentInventory, 1)
-	entry := got.SubagentInventory[0]
-	assert.Equal(t, "child-1", entry.AgentID)
-	assert.Equal(t, "/tmp/child.jsonl", entry.DeclaredTranscriptPath)
-	assert.Equal(t, "/tmp/resolved.jsonl", entry.ResolvedTranscriptPath)
-	assert.Equal(t, []string{"turn-1"}, entry.ObservedTurnIDs)
-	require.Contains(t, entry.PendingStops, "turn-1")
-	pending := entry.PendingStops["turn-1"]
-	assert.True(t, now.Equal(pending.ObservedAt))
-	assert.True(t, pending.StopHookActive)
-	assert.Equal(t, []string{"turn-0"}, entry.FinalizedTurnIDs)
+	assert.Equal(t, state.SubagentInventory, got.SubagentInventory)
 
 	materialized := TaskRecord{ToolUseID: "child-1", AgentID: "child-1", StartedAt: now, CompletedAt: now}
 	got.AddTaskRecord(materialized)
@@ -1192,10 +1158,7 @@ func TestState_NormalizeAfterLoad_CodexInventoryMigration(t *testing.T) {
 	assert.False(t, *legacy.SubagentInventoryComplete)
 	require.NotNil(t, legacy.SubagentTokensBaselineComplete)
 	assert.False(t, *legacy.SubagentTokensBaselineComplete)
-	assert.Nil(t, legacy.TokenUsage.SubagentTokens)
-	assert.False(t, *legacy.TokenUsage.SubagentTokensComplete)
-	assert.Nil(t, legacy.CheckpointTokenUsage.SubagentTokens)
-	assert.False(t, *legacy.CheckpointTokenUsage.SubagentTokensComplete)
+	assertIncompleteSubagentUsage(t, legacy)
 	require.Len(t, legacy.SubagentInventory, 1)
 	assert.Equal(t, "child-1", legacy.SubagentInventory[0].AgentID)
 
diff --git a/cmd/entire/cli/strategy/agent_resolution_test.go b/cmd/entire/cli/strategy/agent_resolution_test.go
index 7cd4b6d23f..e129b7b815 100644
--- a/cmd/entire/cli/strategy/agent_resolution_test.go
+++ b/cmd/entire/cli/strategy/agent_resolution_test.go
@@ -3,11 +3,11 @@ package strategy
 import (
 	"context"
 	"path/filepath"
-	"strings"
 	"sync"
 	"testing"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/agent/types"
 	"github.com/entireio/cli/cmd/entire/cli/session"
 
 	// Register agents so AgentForTranscriptPath can resolve them.
@@ -43,47 +43,40 @@ func withCodexSessionDir(t *testing.T) string {
 	return filepath.Join(sessionDir, "2026", "09", "02", "rollout.jsonl")
 }
 
-func TestInitializeSession_CodexCorrection_CleanKnownOwner(t *testing.T) {
+func TestInitializeSession_CodexCorrection_CleanOwners(t *testing.T) {
 	dir := setupGitRepo(t)
 	t.Chdir(dir)
 	codexTranscript := withCodexSessionDir(t)
-
 	ctx := context.Background()
-	sessionID := "codex-clean-known"
 	s := &ManualCommitStrategy{}
-	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
-	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
-
-	state, err := s.loadSessionState(ctx, sessionID)
-	require.NoError(t, err)
-	assertCleanCodexCorrection(t, state)
+	for _, owner := range []struct {
+		name      string
+		agentType types.AgentType
+	}{
+		{name: "known", agentType: agent.AgentTypeClaudeCode},
+		{name: "unknown"},
+	} {
+		sessionID := "codex-clean-" + owner.name
+		require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
+		state, err := s.loadSessionState(ctx, sessionID)
+		require.NoError(t, err)
+		state.AgentType = owner.agentType
+		require.NoError(t, s.saveSessionState(ctx, state))
+
+		require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
+		state, err = s.loadSessionState(ctx, sessionID)
+		require.NoError(t, err)
+		assertCleanCodexCorrection(t, state)
+	}
 }
 
-func TestInitializeSession_CodexCorrection_CleanUnknownOwner(t *testing.T) {
-	dir := setupGitRepo(t)
-	t.Chdir(dir)
-	codexTranscript := withCodexSessionDir(t)
-
-	ctx := context.Background()
-	sessionID := "codex-clean-unknown"
-	s := &ManualCommitStrategy{}
-	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
-	state, err := s.loadSessionState(ctx, sessionID)
-	require.NoError(t, err)
-	state.AgentType = ""
-	require.NoError(t, s.saveSessionState(ctx, state))
-
-	require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
-	state, err = s.loadSessionState(ctx, sessionID)
-	require.NoError(t, err)
-	assertCleanCodexCorrection(t, state)
-}
+func TestHasPriorSubagentEvidence(t *testing.T) {
+	t.Parallel()
 
-func TestInitializeSession_CodexCorrection_DirtyEvidence(t *testing.T) {
 	incomplete := false
 	tests := []struct {
-		name  string
-		dirty func(*SessionState)
+		name string
+		set  func(*SessionState)
 	}{
 		{"inventory", func(s *SessionState) { s.SubagentInventory = []session.SubagentInventoryEntry{{AgentID: "child"}} }},
 		{"task record", func(s *SessionState) {
@@ -101,40 +94,45 @@ func TestInitializeSession_CodexCorrection_DirtyEvidence(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			dir := setupGitRepo(t)
-			t.Chdir(dir)
-			codexTranscript := withCodexSessionDir(t)
-			ctx := context.Background()
-			sessionID := "codex-dirty-" + strings.ReplaceAll(tt.name, " ", "-")
-			s := &ManualCommitStrategy{}
-			require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeClaudeCode, "", "first", ""))
-			state, err := s.loadSessionState(ctx, sessionID)
-			require.NoError(t, err)
-			tt.dirty(state)
-			require.NoError(t, s.saveSessionState(ctx, state))
-
-			require.NoError(t, s.InitializeSession(ctx, sessionID, agent.AgentTypeCodex, codexTranscript, "second", ""))
-			state, err = s.loadSessionState(ctx, sessionID)
-			require.NoError(t, err)
-			require.Equal(t, agent.AgentTypeCodex, state.AgentType)
-			require.NotNil(t, state.SubagentInventoryComplete)
-			require.False(t, *state.SubagentInventoryComplete)
-			require.NotNil(t, state.SubagentTokensBaselineComplete)
-			require.False(t, *state.SubagentTokensBaselineComplete)
-			require.NotNil(t, state.TokenUsage)
-			require.Nil(t, state.TokenUsage.SubagentTokens)
-			require.NotNil(t, state.TokenUsage.SubagentTokensComplete)
-			require.False(t, *state.TokenUsage.SubagentTokensComplete)
-			require.NotNil(t, state.CheckpointTokenUsage)
-			require.Nil(t, state.CheckpointTokenUsage.SubagentTokens)
-			require.NotNil(t, state.CheckpointTokenUsage.SubagentTokensComplete)
-			require.False(t, *state.CheckpointTokenUsage.SubagentTokensComplete)
-			require.Nil(t, state.SubagentTokensBaseline)
-			if tt.name == "task record" {
-				require.NotNil(t, state.FindSubagentInventory("child-from-task"))
-			}
+			t.Parallel()
+			state := &SessionState{}
+			tt.set(state)
+			require.True(t, hasPriorSubagentEvidence(state))
 		})
 	}
+	require.False(t, hasPriorSubagentEvidence(&SessionState{}))
+}
+
+func TestTransitionSessionToCodex_PreservesDirtyEvidence(t *testing.T) {
+	t.Parallel()
+
+	incomplete := false
+	state := &SessionState{
+		TaskRecords:                    []session.TaskRecord{{ToolUseID: "task", AgentID: "child"}},
+		SubagentLedgerVersion:          4,
+		SubagentTokensBaseline:         &agent.TokenUsage{InputTokens: 3},
+		TokenUsage:                     &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 1}},
+		CheckpointTokenUsage:           &agent.TokenUsage{SubagentTokens: &agent.TokenUsage{InputTokens: 2}},
+		SubagentInventoryComplete:      &incomplete,
+		SubagentTokensBaselineComplete: &incomplete,
+	}
+
+	transitionSessionToCodex(state)
+	require.Equal(t, uint64(4), state.SubagentLedgerVersion)
+	require.NotNil(t, state.FindSubagentInventory("child"))
+	require.Nil(t, state.SubagentTokensBaseline)
+	assertIncompleteUsage(t, state.TokenUsage)
+	assertIncompleteUsage(t, state.CheckpointTokenUsage)
+	require.False(t, *state.SubagentInventoryComplete)
+	require.False(t, *state.SubagentTokensBaselineComplete)
+}
+
+func assertIncompleteUsage(t *testing.T, usage *agent.TokenUsage) {
+	t.Helper()
+	require.NotNil(t, usage)
+	require.Nil(t, usage.SubagentTokens)
+	require.NotNil(t, usage.SubagentTokensComplete)
+	require.False(t, *usage.SubagentTokensComplete)
 }
 
 func TestInitializeSession_CodexCallerWithoutTranscriptDoesNotMigrateAccounting(t *testing.T) {
diff --git a/cmd/entire/cli/strategy/manual_commit_test.go b/cmd/entire/cli/strategy/manual_commit_test.go
index 782403060f..37b93a8465 100644
--- a/cmd/entire/cli/strategy/manual_commit_test.go
+++ b/cmd/entire/cli/strategy/manual_commit_test.go
@@ -51,11 +51,8 @@ func TestCodexInventoryInitialization(t *testing.T) {
 	incomplete := false
 	pendingAt := time.Now().UTC().Truncate(time.Second)
 	partialInventory := []session.SubagentInventoryEntry{{
-		AgentID:         "child-observed-before-parent",
-		ObservedTurnIDs: []string{"turn-pending", "turn-finalized"},
-		PendingStops: map[string]session.SubagentStopCandidate{
-			"turn-pending": {ObservedAt: pendingAt, StopHookActive: true},
-		},
+		AgentID:          "child-observed-before-parent",
+		ObservedTurnIDs:  []string{"turn-pending", "turn-finalized"},
 		FinalizedTurnIDs: []string{"turn-finalized"},
 	}}
 	partialTokenUsage := &agent.TokenUsage{InputTokens: 100, SubagentTokens: &agent.TokenUsage{InputTokens: 60}, SubagentTokensComplete: &incomplete}
@@ -78,44 +75,18 @@ func TestCodexInventoryInitialization(t *testing.T) {
 		SubagentTokensBaseline:         partialBaseline,
 		TaskRecords:                    partialRecords,
 	}))
-	beforeRepair, err := s.loadSessionState(context.Background(), "codex-inventory-partial")
-	require.NoError(t, err)
-	assert.Empty(t, beforeRepair.BaseCommit)
-	require.NotNil(t, beforeRepair.SubagentInventoryComplete)
-	assert.False(t, *beforeRepair.SubagentInventoryComplete)
-	assert.Equal(t, uint64(9), beforeRepair.SubagentLedgerVersion)
-	require.Len(t, beforeRepair.SubagentInventory, 1)
 	require.NoError(t, s.initializeSession(context.Background(), repo, "codex-inventory-partial", agent.AgentTypeCodex, "", "", ""))
 	partial, err := s.loadSessionState(context.Background(), "codex-inventory-partial")
 	require.NoError(t, err)
-	require.NotNil(t, partial.SubagentInventoryComplete)
 	assert.False(t, *partial.SubagentInventoryComplete, "partial-state repair must not promote unknown inventory coverage")
-	require.NotNil(t, partial.SubagentTokensBaselineComplete)
 	assert.False(t, *partial.SubagentTokensBaselineComplete)
 	assert.Equal(t, uint64(9), partial.SubagentLedgerVersion)
-	require.Len(t, partial.SubagentInventory, 1)
-	entry := partial.SubagentInventory[0]
-	assert.Equal(t, "child-observed-before-parent", entry.AgentID)
-	assert.Equal(t, []string{"turn-pending", "turn-finalized"}, entry.ObservedTurnIDs)
-	require.Contains(t, entry.PendingStops, "turn-pending")
-	assert.True(t, pendingAt.Equal(entry.PendingStops["turn-pending"].ObservedAt))
-	assert.True(t, entry.PendingStops["turn-pending"].StopHookActive)
-	assert.Equal(t, []string{"turn-finalized"}, entry.FinalizedTurnIDs)
+	assert.Equal(t, partialInventory, partial.SubagentInventory)
 	assert.True(t, partial.HasTaskContent(), "repair must retain both live and completed-unmaterialized task content")
-	require.Len(t, partial.TaskRecords, 2)
-	assert.Equal(t, "child-live", partial.TaskRecords[0].ToolUseID)
-	assert.True(t, partial.TaskRecords[1].CompletedAt.Equal(pendingAt.Add(time.Second)))
-	require.NotNil(t, partial.TokenUsage)
-	assert.Equal(t, 100, partial.TokenUsage.InputTokens)
-	require.NotNil(t, partial.TokenUsage.SubagentTokens)
-	assert.Equal(t, 60, partial.TokenUsage.SubagentTokens.InputTokens)
-	require.NotNil(t, partial.CheckpointTokenUsage)
-	assert.Equal(t, 50, partial.CheckpointTokenUsage.OutputTokens)
-	require.NotNil(t, partial.CheckpointTokenUsage.SubagentTokens)
-	assert.Equal(t, 30, partial.CheckpointTokenUsage.SubagentTokens.OutputTokens)
-	require.NotNil(t, partial.SubagentTokensBaseline)
-	require.NotNil(t, partial.SubagentTokensBaseline.SubagentTokens)
-	assert.Equal(t, 40, partial.SubagentTokensBaseline.SubagentTokens.InputTokens)
+	assert.Equal(t, partialRecords, partial.TaskRecords)
+	assert.Equal(t, partialTokenUsage, partial.TokenUsage)
+	assert.Equal(t, partialCheckpointUsage, partial.CheckpointTokenUsage)
+	assert.Equal(t, partialBaseline, partial.SubagentTokensBaseline)
 }
 
 // testTranscriptPromptResponse is a minimal transcript used across strategy tests.

From edc128933d8ff648176d10a1d3e4758dcd36a297 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 3 Sep 2026 13:27:20 -0700
Subject: [PATCH 11/59] fix(codex): preserve concurrent child evidence

Entire-Checkpoint: 01M1MF8R024N9A0FHGZK7M45PR
---
 cmd/entire/cli/lifecycle.go                   | 10 +++---
 cmd/entire/cli/lifecycle_test.go              |  6 ++--
 cmd/entire/cli/session/state.go               | 32 ++++++++++++++++---
 cmd/entire/cli/session/state_test.go          | 20 ++++++++++++
 cmd/entire/cli/strategy/manual_commit_git.go  | 16 +++++++---
 cmd/entire/cli/strategy/strategy.go           |  5 +--
 .../cli/strategy/subagent_tokens_test.go      | 22 +++++++++++++
 7 files changed, 93 insertions(+), 18 deletions(-)

diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 0ffa51dfbb..31839811b5 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -938,7 +938,7 @@ func handleLifecycleTurnEnd(ctx context.Context, ag agent.Agent, event *agent.Ev
 	// no-files gate: a read-only child can finish without producing a shadow
 	// checkpoint, but its exact availability still must replace stale coverage.
 	var codexInventoryUsage *agent.TokenUsage
-	var codexLedgerVersion uint64
+	var codexLedgerVersion *uint64
 	if ag.Type() == agent.AgentTypeCodex {
 		inventoryOffset := 0
 		if preState != nil {
@@ -1192,10 +1192,10 @@ func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
 // potentially slow filesystem analysis outside its lock, then applies only
 // path enrichment and terminal evidence if no new child observation raced it.
 // It never manufactures an exact-empty result for an unknown/legacy ledger.
-func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string, parent []byte, fromOffset int) (*agent.TokenUsage, uint64) {
+func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string, parent []byte, fromOffset int) (*agent.TokenUsage, *uint64) {
 	state, err := strategy.LoadSessionState(ctx, sessionID)
 	if err != nil || state == nil || state.SubagentInventoryComplete == nil {
-		return nil, 0
+		return nil, nil
 	}
 	refs := make([]agent.SubagentReference, 0, len(state.SubagentInventory))
 	for _, entry := range state.SubagentInventory {
@@ -1204,7 +1204,7 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 	version := state.SubagentLedgerVersion
 	extraction, ok := agent.ExtractWithSubagentInventory(ctx, ag, parent, fromOffset, refs)
 	if !ok {
-		return nil, version
+		return nil, &version
 	}
 
 	usage := extraction.TokenUsage
@@ -1259,7 +1259,7 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 	}); err != nil && !errors.Is(err, strategy.ErrStateNotFound) {
 		logging.Debug(ctx, "failed to persist codex inventory evidence", slog.String("error", err.Error()))
 	}
-	return usage, version
+	return usage, &version
 }
 
 // processStart approximates when this hook process began. Package
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index b0b4f03f62..f8411670f1 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -194,7 +194,8 @@ func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *tes
 	}
 
 	_, version := refreshCodexInventory(ctx, ag, sessionID, nil, 0)
-	require.Equal(t, uint64(2), version)
+	require.NotNil(t, version)
+	require.Equal(t, uint64(2), *version)
 
 	state, err := strategy.LoadSessionState(ctx, sessionID)
 	require.NoError(t, err)
@@ -283,7 +284,8 @@ func TestRefreshCodexInventory_UsesCurrentCompletenessWhenPersistingUsage(t *tes
 	}
 
 	usage, version := refreshCodexInventory(ctx, ag, sessionID, nil, 0)
-	assert.Equal(t, uint64(2), version)
+	require.NotNil(t, version)
+	assert.Equal(t, uint64(2), *version)
 	require.NotNil(t, usage)
 	require.NotNil(t, usage.SubagentTokensComplete)
 	assert.False(t, *usage.SubagentTokensComplete)
diff --git a/cmd/entire/cli/session/state.go b/cmd/entire/cli/session/state.go
index a89404c88e..e112ea96c2 100644
--- a/cmd/entire/cli/session/state.go
+++ b/cmd/entire/cli/session/state.go
@@ -522,9 +522,28 @@ func (s *State) AddTaskRecord(task TaskRecord) {
 }
 
 // EnsureTaskRecord adds a follow-up record only after an earlier completed
-// record was materialized and removed. Existing unmaterialized content wins.
+// record was materialized and removed. Existing unmaterialized content wins,
+// but missing launch metadata is enriched for stop-before-start delivery.
 func (s *State) EnsureTaskRecord(task TaskRecord) bool {
-	if task.ToolUseID == "" || s.FindTaskRecord(task.ToolUseID) != nil {
+	if task.ToolUseID == "" {
+		return false
+	}
+	if existing := s.FindTaskRecord(task.ToolUseID); existing != nil {
+		if existing.AgentID == "" {
+			existing.AgentID = task.AgentID
+		}
+		if existing.StartedAt.IsZero() {
+			existing.StartedAt = task.StartedAt
+		}
+		if existing.SubagentType == "" {
+			existing.SubagentType = task.SubagentType
+		}
+		if existing.TaskDescription == "" {
+			existing.TaskDescription = task.TaskDescription
+		}
+		if existing.DeclaredTranscriptPath == "" {
+			existing.DeclaredTranscriptPath = task.DeclaredTranscriptPath
+		}
 		return false
 	}
 	s.AddTaskRecord(task)
@@ -566,9 +585,14 @@ func (s *State) RegisterSubagent(agentID, turnID string) bool {
 }
 
 // RecordSubagentStop records a provisional stop. Stops can arrive before
-// starts, so observing the child and turn happens in this same mutation.
+// starts, so the same mutation also preserves a pending task record. A late
+// start enriches that placeholder through EnsureTaskRecord.
 func (s *State) RecordSubagentStop(agentID, turnID string) bool {
-	return s.RegisterSubagent(agentID, turnID)
+	newObservation := s.RegisterSubagent(agentID, turnID)
+	if newObservation {
+		s.EnsureTaskRecord(TaskRecord{ToolUseID: agentID, AgentID: agentID})
+	}
+	return newObservation
 }
 
 // UpdateSubagentTranscriptPaths enriches an already-observed child's path
diff --git a/cmd/entire/cli/session/state_test.go b/cmd/entire/cli/session/state_test.go
index 06730f2c33..905cc5e035 100644
--- a/cmd/entire/cli/session/state_test.go
+++ b/cmd/entire/cli/session/state_test.go
@@ -1030,6 +1030,26 @@ func TestState_LiveTaskRecords(t *testing.T) {
 func TestState_SubagentInventoryLedger(t *testing.T) {
 	t.Parallel()
 
+	stopFirst := &State{}
+	if !stopFirst.RecordSubagentStop("child-stop-first", "turn-stop-first") {
+		t.Fatal("stop-before-start observation must be recorded")
+	}
+	record := stopFirst.FindTaskRecord("child-stop-first")
+	require.NotNil(t, record, "a stop-before-start observation must preserve pending task content")
+	assert.Equal(t, "child-stop-first", record.AgentID)
+	assert.True(t, stopFirst.HasTaskContent())
+	startedAt := time.Now().UTC()
+	assert.False(t, stopFirst.EnsureTaskRecord(TaskRecord{
+		ToolUseID:       "child-stop-first",
+		AgentID:         "child-stop-first",
+		StartedAt:       startedAt,
+		SubagentType:    "default",
+		TaskDescription: "late start metadata",
+	}), "the late start must enrich, not replace, the pending record")
+	assert.Equal(t, startedAt, record.StartedAt)
+	assert.Equal(t, "default", record.SubagentType)
+	assert.Equal(t, "late start metadata", record.TaskDescription)
+
 	complete := true
 	state := &State{
 		TokenUsage:           &agent.TokenUsage{InputTokens: 5, SubagentTokens: &agent.TokenUsage{InputTokens: 3}, SubagentTokensComplete: &complete},
diff --git a/cmd/entire/cli/strategy/manual_commit_git.go b/cmd/entire/cli/strategy/manual_commit_git.go
index bcd76babfa..ae8f19edc9 100644
--- a/cmd/entire/cli/strategy/manual_commit_git.go
+++ b/cmd/entire/cli/strategy/manual_commit_git.go
@@ -46,11 +46,7 @@ func (s *ManualCommitStrategy) SaveStep(ctx context.Context, step StepContext) e
 	}
 
 	mutErr := MutateSessionState(ctx, sessionID, func(state *SessionState) error {
-		if step.SubagentLedgerVersion != 0 && state.SubagentLedgerVersion != step.SubagentLedgerVersion && step.TokenUsage != nil {
-			// Keep valid main-agent deltas but never persist a child aggregate
-			// computed against an older authoritative inventory.
-			step.TokenUsage = types.WithClearedSubagentTokens(step.TokenUsage, false)
-		}
+		invalidateStaleSubagentSnapshot(&step, state)
 		_, migrateSpan := perf.Start(ctx, "migrate_shadow_branch")
 		if _, _, err := s.migrateShadowBranchIfNeeded(ctx, repo, state); err != nil {
 			migrateSpan.RecordError(err)
@@ -200,6 +196,16 @@ func (s *ManualCommitStrategy) SaveStep(ctx context.Context, step StepContext) e
 	return mutErr
 }
 
+func invalidateStaleSubagentSnapshot(step *StepContext, state *SessionState) {
+	if step.SubagentLedgerVersion == nil || step.TokenUsage == nil ||
+		state.SubagentLedgerVersion == *step.SubagentLedgerVersion {
+		return
+	}
+	// Keep valid main-agent deltas but never persist a child aggregate
+	// computed against an older authoritative inventory.
+	step.TokenUsage = types.WithClearedSubagentTokens(step.TokenUsage, false)
+}
+
 // ensureSessionInitialized creates the session state file if it doesn't yet
 // exist (or has empty BaseCommit). Idempotent: the existence check and the
 // create both happen inside initializeSession's session gate so a concurrent
diff --git a/cmd/entire/cli/strategy/strategy.go b/cmd/entire/cli/strategy/strategy.go
index d9304158db..8e8131d409 100644
--- a/cmd/entire/cli/strategy/strategy.go
+++ b/cmd/entire/cli/strategy/strategy.go
@@ -163,8 +163,9 @@ type StepContext struct {
 	TokenUsage *agent.TokenUsage
 
 	// SubagentLedgerVersion is the authoritative inventory version observed
-	// while token evidence was extracted. Zero means no inventory snapshot.
-	SubagentLedgerVersion uint64
+	// while token evidence was extracted. nil means no inventory snapshot;
+	// a pointer to zero is a valid snapshot before the first child is observed.
+	SubagentLedgerVersion *uint64
 }
 
 // TaskStepContext contains all information needed for saving a task step checkpoint.
diff --git a/cmd/entire/cli/strategy/subagent_tokens_test.go b/cmd/entire/cli/strategy/subagent_tokens_test.go
index 9c5e731831..587d4629a4 100644
--- a/cmd/entire/cli/strategy/subagent_tokens_test.go
+++ b/cmd/entire/cli/strategy/subagent_tokens_test.go
@@ -73,6 +73,28 @@ func TestAccumulateTokenUsage_ExplicitEmptyReplacesPriorChildTotal(t *testing.T)
 	require.True(t, *got.SubagentTokensComplete)
 }
 
+func TestInvalidateStaleSubagentSnapshot_ZeroVersion(t *testing.T) {
+	t.Parallel()
+	complete := true
+	zero := uint64(0)
+	step := StepContext{
+		SubagentLedgerVersion: &zero,
+		TokenUsage: &agent.TokenUsage{
+			InputTokens:            11,
+			SubagentTokens:         &agent.TokenUsage{InputTokens: 7},
+			SubagentTokensComplete: &complete,
+		},
+	}
+
+	invalidateStaleSubagentSnapshot(&step, &SessionState{SubagentLedgerVersion: 1})
+
+	require.NotNil(t, step.TokenUsage)
+	require.Equal(t, 11, step.TokenUsage.InputTokens, "main-agent evidence must survive invalidation")
+	require.Nil(t, step.TokenUsage.SubagentTokens)
+	require.NotNil(t, step.TokenUsage.SubagentTokensComplete)
+	require.False(t, *step.TokenUsage.SubagentTokensComplete)
+}
+
 // TestSaveStep_SubagentTokensNotDoubleCountedAcrossCheckpoints exercises the
 // real SaveStep path for both Claude Code and Factory AI Droid (the two
 // agents whose CalculateTotalTokenUsage implementations discover subagent IDs

From f586632fd4b750a9b5f808d3f36e9cfb00546b46 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 3 Sep 2026 16:07:40 -0700
Subject: [PATCH 12/59] fix(codex): track current subagent rollout evidence

Entire-Checkpoint: 01M1MREADV8D9JS18B5CJA253E
---
 cmd/entire/cli/agent/codex/subagent_test.go | 34 +++++++++
 cmd/entire/cli/agent/codex/transcript.go    | 77 ++++++++++++++++++---
 cmd/entire/cli/lifecycle.go                 |  5 +-
 cmd/entire/cli/lifecycle_test.go            |  5 +-
 4 files changed, 107 insertions(+), 14 deletions(-)

diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
index 430bab9c19..c4c7e4c0b0 100644
--- a/cmd/entire/cli/agent/codex/subagent_test.go
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -117,6 +117,40 @@ func TestTerminalTurnIDs_OnlyAcceptsUnambiguousBoundaries(t *testing.T) {
 	}
 }
 
+func TestAnalyzeRollout_PaginatedSubagentIgnoresInheritedParentHistory(t *testing.T) {
+	t.Parallel()
+
+	lines := []map[string]any{
+		{
+			"ordinal": 0,
+			"type":    "session_meta",
+			"payload": map[string]any{
+				"id":                             "child",
+				"thread_source":                  "subagent",
+				"subagent_history_start_ordinal": 10,
+			},
+		},
+		{"ordinal": 2, "type": "event_msg", "payload": map[string]any{"type": "task_started", "turn_id": "parent-turn"}},
+		{"ordinal": 3, "type": "event_msg", "payload": map[string]any{"type": "item_completed", "item": map[string]any{"type": "FileChange", "status": "completed", "changes": map[string]any{"/repo/parent.txt": map[string]any{"type": "update"}}}}},
+		{"ordinal": 4, "type": "event_msg", "payload": map[string]any{"type": "token_count", "info": map[string]any{"total_token_usage": map[string]any{"input_tokens": 99, "cached_input_tokens": 50, "output_tokens": 9}}}},
+		{"ordinal": 11, "type": "event_msg", "payload": map[string]any{"type": "task_started", "turn_id": "child-turn"}},
+		{"ordinal": 12, "type": "event_msg", "payload": map[string]any{"type": "item_completed", "item": map[string]any{"type": "FileChange", "status": "completed", "changes": map[string]any{"/repo/child.txt": map[string]any{"type": "update"}}}}},
+		{"ordinal": 13, "type": "event_msg", "payload": map[string]any{"type": "token_count", "info": map[string]any{"total_token_usage": map[string]any{"input_tokens": 5, "cached_input_tokens": 2, "output_tokens": 1}}}},
+		{"ordinal": 14, "type": "event_msg", "payload": map[string]any{"type": "task_complete", "turn_id": "child-turn"}},
+	}
+	encoded := make([][]byte, 0, len(lines))
+	for _, line := range lines {
+		data, err := json.Marshal(line)
+		require.NoError(t, err)
+		encoded = append(encoded, data)
+	}
+
+	result := analyzeRollout(append([]byte(joinLines(encoded)), '\n'), 0)
+	require.Equal(t, []string{"/repo/child.txt"}, result.ModifiedFiles)
+	require.Equal(t, []string{"child-turn"}, result.TerminalTurnIDs)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1}, result.ExactTokenUsage)
+}
+
 func TestExactTokenUsage_UsesOnlyLastRecognizableSnapshot(t *testing.T) {
 	t.Parallel()
 
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index b97d65a5b8..3d8e36e23f 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -52,6 +52,7 @@ func sessionMetaID(data []byte) (string, error) {
 // rolloutLine is the top-level JSONL line structure in Codex rollout files.
 type rolloutLine struct {
 	Timestamp string          `json:"timestamp"`
+	Ordinal   *int            `json:"ordinal,omitempty"`
 	Type      string          `json:"type"` // "session_meta", "response_item", "event_msg", "turn_context"
 	Payload   json.RawMessage `json:"payload"`
 }
@@ -91,10 +92,11 @@ type rolloutClassificationResult struct {
 
 // sessionMetaPayload is the payload for type="session_meta" lines.
 type sessionMetaPayload struct {
-	ID           string          `json:"id"`
-	Timestamp    string          `json:"timestamp"`
-	ThreadSource string          `json:"thread_source"`
-	Source       json.RawMessage `json:"source"`
+	ID                          string          `json:"id"`
+	Timestamp                   string          `json:"timestamp"`
+	ThreadSource                string          `json:"thread_source"`
+	Source                      json.RawMessage `json:"source"`
+	SubagentHistoryStartOrdinal *int            `json:"subagent_history_start_ordinal,omitempty"`
 }
 
 // classifyRolloutDetailed reads only the rollout's session_meta record. Newer
@@ -198,6 +200,13 @@ type eventMsgPayload struct {
 	Type   string          `json:"type"` // "token_count", "task_started", "user_message", "agent_message", "task_complete"
 	TurnID *string         `json:"turn_id,omitempty"`
 	Info   json.RawMessage `json:"info,omitempty"`
+	Item   json.RawMessage `json:"item,omitempty"`
+}
+
+type fileChangeItem struct {
+	Type    string                     `json:"type"`
+	Status  string                     `json:"status"`
+	Changes map[string]json.RawMessage `json:"changes"`
 }
 
 // tokenCountInfo contains token usage data from event_msg.token_count.
@@ -478,18 +487,42 @@ type rolloutAnalysis struct {
 func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 	var result rolloutAnalysis
 	terminalValid := true
+	scopeValid := true
 	openTurn := ""
 	seenTurns := make(map[string]struct{})
 	seenFiles := make(map[string]struct{})
 	var lastTokenInfo json.RawMessage
 	foundToken := false
+	lines := splitJSONL(data)
+	var localStartOrdinal *int
+	if len(lines) > 0 {
+		var first rolloutLine
+		if json.Unmarshal(lines[0], &first) == nil && first.Type == rolloutLineTypeSessionMeta {
+			var meta sessionMetaPayload
+			if json.Unmarshal(first.Payload, &meta) == nil && meta.SubagentHistoryStartOrdinal != nil && *meta.SubagentHistoryStartOrdinal >= 0 {
+				localStartOrdinal = meta.SubagentHistoryStartOrdinal
+			}
+		}
+	}
 
-	for index, lineData := range splitJSONL(data) {
+	for index, lineData := range lines {
 		var line rolloutLine
 		if json.Unmarshal(lineData, &line) != nil {
 			terminalValid = false
+			if localStartOrdinal != nil {
+				scopeValid = false
+			}
 			continue
 		}
+		if localStartOrdinal != nil {
+			if line.Ordinal == nil {
+				scopeValid = false
+				continue
+			}
+			if *line.Ordinal < *localStartOrdinal {
+				continue
+			}
+		}
 		if index+1 > fromOffset {
 			for _, file := range extractFilesFromParsedLine(line) {
 				if _, seen := seenFiles[file]; !seen {
@@ -543,6 +576,9 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 			openTurn = ""
 		}
 	}
+	if !scopeValid {
+		return rolloutAnalysis{}
+	}
 	if !terminalValid || openTurn != "" {
 		result.TerminalTurnIDs = nil
 	}
@@ -553,14 +589,33 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 }
 
 func extractFilesFromParsedLine(line rolloutLine) []string {
-	if line.Type != rolloutLineTypeResponseItem {
-		return nil
-	}
-	var payload responseItemPayload
-	if json.Unmarshal(line.Payload, &payload) != nil || payload.Type != "custom_tool_call" || payload.Name != "apply_patch" {
+	switch line.Type {
+	case rolloutLineTypeResponseItem:
+		var payload responseItemPayload
+		if json.Unmarshal(line.Payload, &payload) != nil || payload.Type != "custom_tool_call" || payload.Name != "apply_patch" {
+			return nil
+		}
+		return extractFilesFromApplyPatch(payload.Input)
+	case rolloutLineTypeEventMsg:
+		var event eventMsgPayload
+		if json.Unmarshal(line.Payload, &event) != nil || event.Type != "item_completed" {
+			return nil
+		}
+		var item fileChangeItem
+		if json.Unmarshal(event.Item, &item) != nil || item.Type != "FileChange" || item.Status != "completed" {
+			return nil
+		}
+		files := make([]string, 0, len(item.Changes))
+		for path := range item.Changes {
+			if path != "" {
+				files = append(files, path)
+			}
+		}
+		sort.Strings(files)
+		return files
+	default:
 		return nil
 	}
-	return extractFilesFromApplyPatch(payload.Input)
 }
 
 func exactUsageFromInfo(lastInfo json.RawMessage) *agent.TokenUsage {
diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 31839811b5..0af68db726 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1219,6 +1219,7 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 			usage = types.WithClearedSubagentTokens(usage, false)
 		}
 		for _, child := range extraction.Children {
+			childFiles := FilterAndNormalizePaths(child.ModifiedFiles, current.WorktreePath)
 			current.UpdateSubagentTranscriptPaths(child.AgentID, "", child.ResolvedPath)
 			for _, turnID := range child.TerminalTurnIDs {
 				if !current.FinalizeSubagentTurn(child.AgentID, turnID) {
@@ -1232,12 +1233,12 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 					if record.CompletedAt.IsZero() {
 						record.CompletedAt = time.Now()
 					}
-					record.Files = child.ModifiedFiles
+					record.Files = childFiles
 					record.DeclaredTranscriptPath = child.ResolvedPath
 					// nil is evidence too: a newer terminal snapshot without exact
 					// usage must clear, never preserve, an earlier total.
 					record.TokenUsage = child.TokenUsage
-					current.FilesTouched = mergeUnique(current.FilesTouched, child.ModifiedFiles)
+					current.FilesTouched = mergeUnique(current.FilesTouched, childFiles)
 					break
 				}
 			}
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index f8411670f1..06c5b2b69f 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -158,10 +158,13 @@ func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *tes
 		sessionID = "codex-multi-turn-child"
 		agentID   = "child-1"
 	)
+	repoRoot, err := os.Getwd()
+	require.NoError(t, err)
 	completedAt := time.Now().UTC().Truncate(time.Microsecond)
 	complete := true
 	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{
 		SessionID:                 sessionID,
+		WorktreePath:              repoRoot,
 		StartedAt:                 time.Now(),
 		Phase:                     session.PhaseActive,
 		SubagentInventoryComplete: &complete,
@@ -187,7 +190,7 @@ func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *tes
 		extraction: agent.InventoryExtraction{Children: []agent.SubagentAnalysis{{
 			AgentID:         agentID,
 			ResolvedPath:    "/tmp/child-1.jsonl",
-			ModifiedFiles:   []string{"first.go", "second.go"},
+			ModifiedFiles:   []string{filepath.Join(repoRoot, "first.go"), filepath.Join(repoRoot, "second.go")},
 			TokenUsage:      &agent.TokenUsage{InputTokens: 25},
 			TerminalTurnIDs: []string{"turn-2"},
 		}}},

From db899722d056e1a1584327ed0848a13c072970e9 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 3 Sep 2026 17:32:40 -0700
Subject: [PATCH 13/59] fix(codex): close subagent tracking edge cases

Entire-Checkpoint: 01M1MX9YXDDG0H204M6XN4WB63
---
 cmd/entire/cli/agent/codex/AGENT.md           | 17 ++++++++---------
 cmd/entire/cli/agent/codex/lifecycle.go       |  8 ++++----
 cmd/entire/cli/agent/codex/lifecycle_test.go  | 19 ++++++++++++++-----
 cmd/entire/cli/agent/codex/transcript.go      |  4 ++--
 cmd/entire/cli/agent/types/token_usage.go     | 16 ++++++++++++----
 .../cli/agent/types/token_usage_test.go       | 12 +++++++++++-
 6 files changed, 51 insertions(+), 25 deletions(-)

diff --git a/cmd/entire/cli/agent/codex/AGENT.md b/cmd/entire/cli/agent/codex/AGENT.md
index b38b3ef178..5bd8f4cc23 100644
--- a/cmd/entire/cli/agent/codex/AGENT.md
+++ b/cmd/entire/cli/agent/codex/AGENT.md
@@ -312,7 +312,8 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - Format: JSONL (line-delimited JSON)
 - Session ID extraction: `session_id` field from hook payload (UUID format)
 - Transcript may be null in `--ephemeral` mode; root ownership cannot be
-  verified, so Entire skips turn lifecycle mutation and checkpoint capture.
+  verified, so Entire preserves the turn lifecycle event while logging that
+  transcript-derived evidence may be unavailable.
 
 **Note:** Codex's primary storage is SQLite (`~/.codex/state`), but the JSONL rollout file is the file-based transcript we can read. The `transcript_path` in hook payloads points to this file.
 
@@ -343,14 +344,12 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - **A pre-SessionEnd install still counts as installed:** `AreHooksInstalled` gates on the core events only, so adding an event does not retroactively drop Codex out of `entire status` and the agent pickers for everyone who enabled it earlier. The stale install is reported as drift through `InspectHookConfig(...).Missing` instead, with `entire enable` as the fix.
 - **`reason` carries no information:** always `"other"`, so a session ended by `/clear` is indistinguishable from one ended by quitting.
 - **Transcript may be null:** In `--ephemeral` mode, `transcript_path` is null.
-  Entire fails closed: it emits a categorized diagnostic and skips TurnStart /
-  TurnEnd state mutation and checkpoint capture because the root rollout cannot
-  be verified. Ephemeral Codex sessions therefore are not tracked.
-- **Unreadable, malformed, or future rollout metadata also fails closed:** the
-  turn hook emits a diagnostic categorized as `unreadable_transcript`,
-  `malformed_session_metadata`, or `unclassified_source`, then performs no root
-  lifecycle mutation. This prevents a child or unknown future rollout shape
-  from being attributed to the root session.
+  Entire emits a categorized diagnostic and preserves TurnStart / TurnEnd state
+  mutation; only a rollout positively identified as a child is skipped.
+- **Unreadable, malformed, or future rollout metadata is treated as unknown:**
+  the turn hook emits a diagnostic categorized as `unreadable_transcript`,
+  `malformed_session_metadata`, or `unclassified_source`, then preserves the
+  lifecycle event so a root session is not silently left active.
 - **No hooks fire under `-s read-only`:** verified against 0.147.0 — a `codex exec -s read-only` run produces no hook invocations at all, so no session is tracked. `-s workspace-write` fires the full set.
 - **Subagent identity fields are inverted from their names:** `SubagentStart` / `SubagentStop` (schemas at `codex-rs/hooks/schema/generated/subagent-{start,stop}.command.input.schema.json`) send `session_id` = the identity shared by the root thread *and every descendant*, i.e. the user's session, which maps straight to Entire's SessionID; `agent_id` = the subagent thread's own id. Codex sends no `tool_use_id`, so `agent_id` doubles as Entire's ToolUseID — it is the only value correlating a start with its stop, and Entire keys pre-task state and the task metadata directory on it. Getting this backwards attributes subagent work to a session Entire has never seen.
 - **`SubagentStop` is provisional, not authoritative completion.** It carries two transcripts: `transcript_path` is the *parent* rollout and `agent_transcript_path` the child rollout. Entire retains the child identity and declared path, then accepts a rollout only after its first `session_meta.id` exactly matches `agent_id`, it is a regular file, and the same verified bytes are analyzed. A hook-supplied filename is never trusted by itself.
diff --git a/cmd/entire/cli/agent/codex/lifecycle.go b/cmd/entire/cli/agent/codex/lifecycle.go
index f25dfc84c5..b765d782ee 100644
--- a/cmd/entire/cli/agent/codex/lifecycle.go
+++ b/cmd/entire/cli/agent/codex/lifecycle.go
@@ -208,7 +208,7 @@ func (c *CodexAgent) parseTurnStart(ctx context.Context, stdin io.Reader) (*agen
 		return nil, err
 	}
 	if !isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
-		return nil, nil //nolint:nilnil // only proven root rollouts mutate lifecycle state
+		return nil, nil //nolint:nilnil // only confirmed child rollouts are skipped
 	}
 	return &agent.Event{
 		Type:       agent.TurnStart,
@@ -282,7 +282,7 @@ func (c *CodexAgent) parseTurnEnd(ctx context.Context, stdin io.Reader) (*agent.
 		return nil, err
 	}
 	if !isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
-		return nil, nil //nolint:nilnil // only proven root rollouts mutate lifecycle state
+		return nil, nil //nolint:nilnil // only confirmed child rollouts are skipped
 	}
 	return &agent.Event{
 		Type:       agent.TurnEnd,
@@ -302,11 +302,11 @@ func isRootTurnRollout(ctx context.Context, path string) bool {
 		logging.Debug(ctx, "codex: skipped root lifecycle mutation for child rollout", slog.String("path", path))
 		return false
 	case rolloutUnknown:
-		logging.Warn(ctx, "codex: skipped turn lifecycle event because rollout ownership is unverified",
+		logging.Warn(ctx, "codex: preserved root lifecycle event because rollout ownership is unverified",
 			slog.String("category", string(classification.Issue)),
 			slog.String("detail", classification.Detail),
 			slog.String("path", path))
-		return false
+		return true
 	}
 	return false
 }
diff --git a/cmd/entire/cli/agent/codex/lifecycle_test.go b/cmd/entire/cli/agent/codex/lifecycle_test.go
index 13bfe0c68b..a91b25d863 100644
--- a/cmd/entire/cli/agent/codex/lifecycle_test.go
+++ b/cmd/entire/cli/agent/codex/lifecycle_test.go
@@ -192,7 +192,7 @@ func TestParseHookEvent_TurnHooksIgnoreChildRollout(t *testing.T) {
 	}
 }
 
-func TestParseHookEvent_UnknownTurnRolloutWritesCategorizedDiagnostic(t *testing.T) {
+func TestParseHookEvent_UnknownTurnRolloutPreservesRootLifecycle(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
@@ -250,15 +250,24 @@ func TestParseHookEvent_UnknownTurnRolloutWritesCategorizedDiagnostic(t *testing
 			ctx := logging.WithLogger(context.Background(), logger)
 			input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":` + pathJSON + `,"model":"gpt-5","prompt":"do work"}`
 
-			event, err := (&CodexAgent{}).ParseHookEvent(ctx, HookNameUserPromptSubmit, strings.NewReader(input))
-			require.NoError(t, err)
-			require.Nil(t, event)
+			for _, hook := range []struct {
+				name string
+				want agent.EventType
+			}{
+				{HookNameUserPromptSubmit, agent.TurnStart},
+				{HookNameStop, agent.TurnEnd},
+			} {
+				event, err := (&CodexAgent{}).ParseHookEvent(ctx, hook.name, strings.NewReader(input))
+				require.NoError(t, err)
+				require.NotNil(t, event)
+				require.Equal(t, hook.want, event.Type)
+			}
 			require.NoError(t, logger.Close())
 
 			logData, err := os.ReadFile(filepath.Join(logDir, "entire.log"))
 			require.NoError(t, err)
 			logText := string(logData)
-			require.Contains(t, logText, "codex: skipped turn lifecycle event because rollout ownership is unverified")
+			require.Contains(t, logText, "codex: preserved root lifecycle event because rollout ownership is unverified")
 			require.Contains(t, logText, string(tt.category))
 			require.Contains(t, logText, tt.detail)
 			if rolloutPath != "" {
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index 3d8e36e23f..2d146eeccd 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -65,8 +65,8 @@ const (
 )
 
 // rolloutClassification identifies whether a rollout belongs to a root thread
-// or a child thread. Lifecycle hooks mutate the root session, so uncertainty is
-// intentionally distinct from root and must not be treated as a root rollout.
+// or a child thread. Uncertainty remains distinct so callers can diagnose it;
+// root lifecycle hooks preserve their event unless the rollout is a confirmed child.
 type rolloutClassification uint8
 
 const (
diff --git a/cmd/entire/cli/agent/types/token_usage.go b/cmd/entire/cli/agent/types/token_usage.go
index a04bc01fc3..9c1f6d4368 100644
--- a/cmd/entire/cli/agent/types/token_usage.go
+++ b/cmd/entire/cli/agent/types/token_usage.go
@@ -89,18 +89,26 @@ func addTokenUsageAtDepth(a, b *TokenUsage, depth int) *TokenUsage {
 }
 
 func tokenCompleteness(a, b *TokenUsage) *bool {
-	seen := false
+	seenComplete := false
+	seenUnknown := false
 	for _, usage := range []*TokenUsage{a, b} {
-		if usage == nil || usage.SubagentTokensComplete == nil {
+		if usage == nil {
+			continue
+		}
+		if usage.SubagentTokensComplete == nil {
+			seenUnknown = true
 			continue
 		}
-		seen = true
 		if !*usage.SubagentTokensComplete {
 			incomplete := false
 			return &incomplete
 		}
+		seenComplete = true
+	}
+	if seenUnknown {
+		return nil
 	}
-	if seen {
+	if seenComplete {
 		complete := true
 		return &complete
 	}
diff --git a/cmd/entire/cli/agent/types/token_usage_test.go b/cmd/entire/cli/agent/types/token_usage_test.go
index d62e72e4e2..a506152aec 100644
--- a/cmd/entire/cli/agent/types/token_usage_test.go
+++ b/cmd/entire/cli/agent/types/token_usage_test.go
@@ -69,7 +69,7 @@ func TestAddTokenUsage(t *testing.T) {
 	}
 }
 
-func TestAddTokenUsage_ExplicitIncompleteDominatesComplete(t *testing.T) {
+func TestAddTokenUsage_CompletenessCombination(t *testing.T) {
 	t.Parallel()
 
 	complete := true
@@ -83,6 +83,16 @@ func TestAddTokenUsage_ExplicitIncompleteDominatesComplete(t *testing.T) {
 			t.Fatalf("AddTokenUsage(%v, %v) completeness = %v, want false", *operands[0].SubagentTokensComplete, *operands[1].SubagentTokensComplete, got.SubagentTokensComplete)
 		}
 	}
+
+	unknown := &TokenUsage{}
+	for _, operands := range [][2]*TokenUsage{
+		{{SubagentTokensComplete: &complete}, unknown},
+		{unknown, {SubagentTokensComplete: &complete}},
+	} {
+		if got := AddTokenUsage(operands[0], operands[1]); got.SubagentTokensComplete != nil {
+			t.Fatalf("AddTokenUsage with unknown coverage = %v, want nil", *got.SubagentTokensComplete)
+		}
+	}
 }
 
 // TestAddTokenUsage_TruncatesDeepSubagentChains pins MaxSubagentDepth. Token usage

From 99268bb2584f1363ca14cfd52bb4a1c44e3c4de6 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 3 Sep 2026 18:09:22 -0700
Subject: [PATCH 14/59] fix(codex): make rollout byte guard overflow-safe

Entire-Checkpoint: 01M1MZD5TNZTQGX5W9Z02YDW9Z
---
 cmd/entire/cli/agent/codex/codex.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/entire/cli/agent/codex/codex.go b/cmd/entire/cli/agent/codex/codex.go
index 64cf0665c4..40aa189322 100644
--- a/cmd/entire/cli/agent/codex/codex.go
+++ b/cmd/entire/cli/agent/codex/codex.go
@@ -125,7 +125,7 @@ func (b *rolloutScanBudget) observeCandidate() error {
 }
 
 func (b *rolloutScanBudget) observeBytes(count int64) error {
-	if count < 0 || count > b.limits.aggregateByteLimit-b.aggregateBytes {
+	if count < 0 || count > b.limits.aggregateByteLimit || b.aggregateBytes > b.limits.aggregateByteLimit-count {
 		return fmt.Errorf("aggregate rollout byte limit %d exceeded: %w", b.limits.aggregateByteLimit, errRolloutScanBudget)
 	}
 	b.aggregateBytes += count

From 5c185dd48511f5cc48bcd9d05abd12a80b84d062 Mon Sep 17 00:00:00 2001
From: Thomas Dohmke <thomas@dohmke.de>
Date: Tue, 8 Sep 2026 19:41:48 +0200
Subject: [PATCH 15/59] feat: install missing Graph plugin on demand

Show installation progress and announce the forwarded command. Update the terminal renderer so completed confirmation prompts are cleared, with regression coverage for terminal cleanup and plugin install/dispatch behavior.

Entire-Checkpoint: 01M211S73J1V1YPNB123826DE8
---
 cmd/entire/cli/plugin.go                      |  18 +++
 cmd/entire/cli/plugin_fetch.go                |  12 ++
 cmd/entire/cli/plugin_group.go                |   5 +
 cmd/entire/cli/plugin_install_remote.go       |   6 +
 cmd/entire/cli/plugin_on_demand.go            |  57 ++++++++
 cmd/entire/cli/plugin_on_demand_test.go       | 133 ++++++++++++++++++
 cmd/entire/cli/plugin_progress.go             |  36 +++++
 cmd/entire/cli/plugin_progress_test.go        |  52 +++++++
 cmd/entire/cli/uiform/prompt_terminal_test.go |  72 ++++++++++
 docs/architecture/external-commands.md        |   4 +
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 12 files changed, 398 insertions(+), 3 deletions(-)
 create mode 100644 cmd/entire/cli/plugin_on_demand.go
 create mode 100644 cmd/entire/cli/plugin_on_demand_test.go
 create mode 100644 cmd/entire/cli/plugin_progress.go
 create mode 100644 cmd/entire/cli/plugin_progress_test.go
 create mode 100644 cmd/entire/cli/uiform/prompt_terminal_test.go

diff --git a/cmd/entire/cli/plugin.go b/cmd/entire/cli/plugin.go
index 449091395f..8afcb3fb33 100644
--- a/cmd/entire/cli/plugin.go
+++ b/cmd/entire/cli/plugin.go
@@ -53,6 +53,19 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 		return false, 0
 	}
 	pluginName := args[0]
+	if binPath == "" {
+		var err error
+		binPath, err = installMissingPlugin(ctx, rootCmd, pluginName)
+		if err != nil {
+			fmt.Fprintln(rootCmd.ErrOrStderr(), RenderUserFacingError(err))
+			return true, 1
+		}
+		if binPath == "" {
+			// The command was not executed because installation was declined.
+			return true, 1
+		}
+		fmt.Fprintf(rootCmd.ErrOrStderr(), "Running plugin with command: %s\n", strings.Join(pluginArgs, " "))
+	}
 	exitCode = runPlugin(ctx, pluginName, binPath, pluginArgs)
 	if exitCode == 0 {
 		maybeTrackPluginInvocation(ctx, pluginName)
@@ -86,6 +99,8 @@ func maybeTrackPluginInvocation(ctx context.Context, pluginName string) {
 	telemetry.TrackPluginDetached(pluginName, s.Enabled, versioninfo.Version)
 }
 
+// resolvePlugin returns an empty binary path for a missing graph plugin so
+// the dispatcher can offer installation. Other missing names fall through.
 func resolvePlugin(rootCmd *cobra.Command, args []string) (binPath string, pluginArgs []string, ok bool) {
 	if len(args) == 0 {
 		return "", nil, false
@@ -115,6 +130,9 @@ func resolvePlugin(rootCmd *cobra.Command, args []string) (binPath string, plugi
 		if p, found := findInaccessiblePlugin(binName); found {
 			return p, args[1:], true
 		}
+		if name == "graph" && errors.Is(err, exec.ErrNotFound) {
+			return "", args[1:], true
+		}
 		return "", nil, false
 	}
 	if isAgentProtocolBinary(binPath) {
diff --git a/cmd/entire/cli/plugin_fetch.go b/cmd/entire/cli/plugin_fetch.go
index 2da3d10a29..2b3971d273 100644
--- a/cmd/entire/cli/plugin_fetch.go
+++ b/cmd/entire/cli/plugin_fetch.go
@@ -276,6 +276,8 @@ type fetchedAsset struct {
 // one is published. Returns errAssetNotFound (possibly wrapped) when the
 // tag has no asset for this platform.
 func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, name, tag, stagingDir string, allowUnverified bool) (*fetchedAsset, error) {
+	stopLocate := startPluginStep(ctx, "Locating plugin release files...")
+	defer stopLocate()
 	// Resolve the prefix once. It does not depend on the asset name, so
 	// deriving it per candidate meant re-parsing the repo URL ~36 times in the
 	// probe loop and carrying an error return through three call sites for a
@@ -302,6 +304,7 @@ func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, nam
 				errUnverifiedAsset, pluginMetadataFileName, checksumsFileName)
 		}
 		u := expandDownloadTemplate(meta.DownloadURL, name, tag, "")
+		stopLocate()
 		return fetchAndVerify(ctx, u, assetNameFromURL(u), "", stagingDir)
 	}
 
@@ -323,6 +326,7 @@ func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, nam
 			// directly.
 			continue
 		}
+		stopLocate()
 		return fetchAndVerify(ctx, assetURL(asset), asset, digest, stagingDir)
 	}
 
@@ -337,6 +341,7 @@ func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, nam
 	// wrong would report a missing release for a plugin that simply doesn't
 	// ship checksums.
 	for _, asset := range assetCandidates(name, tag) {
+		stopLocate()
 		fa, err := fetchAndVerify(ctx, assetURL(asset), asset, "", stagingDir)
 		switch {
 		case errors.Is(err, errAssetNotFound):
@@ -409,6 +414,8 @@ func httpGetSmall(ctx context.Context, rawURL string) ([]byte, error) {
 // command errors to stderr and a download failure is an ordinary event
 // (network hiccup, 5xx, checksum mismatch), not an exceptional one.
 func fetchAndVerify(ctx context.Context, rawURL, asset, wantDigest, stagingDir string) (*fetchedAsset, error) {
+	stopDownload := startPluginStep(ctx, "Downloading plugin archive...")
+	defer stopDownload()
 	stagingRoot, err := osroot.Shared(stagingDir)
 	if err != nil {
 		return nil, fmt.Errorf("open staging dir: %w", err)
@@ -469,6 +476,11 @@ func fetchAndVerify(ctx context.Context, rawURL, asset, wantDigest, stagingDir s
 		_ = osroot.RemoveNoSymlinks(stagingRoot, asset) //nolint:errcheck // best-effort cleanup of a staging file we are already abandoning
 		return nil, fmt.Errorf("download %s: exceeds %d byte limit", redactURL(rawURL), int64(maxPluginAssetSize))
 	}
+	stopDownload()
+	if wantDigest != "" {
+		stopVerify := startPluginStep(ctx, "Verifying plugin checksum...")
+		defer stopVerify()
+	}
 	got := hex.EncodeToString(h.Sum(nil))
 	if wantDigest != "" && !strings.EqualFold(got, wantDigest) {
 		_ = osroot.RemoveNoSymlinks(stagingRoot, asset) //nolint:errcheck // best-effort cleanup of a staging file we are already abandoning
diff --git a/cmd/entire/cli/plugin_group.go b/cmd/entire/cli/plugin_group.go
index 9fdb29daa5..8338397466 100644
--- a/cmd/entire/cli/plugin_group.go
+++ b/cmd/entire/cli/plugin_group.go
@@ -202,6 +202,7 @@ type remoteInstallFlags struct {
 
 func runRemoteInstall(ctx context.Context, cmd *cobra.Command, src installSource, flags remoteInstallFlags) error {
 	out, errOut := cmd.OutOrStdout(), cmd.ErrOrStderr()
+	ctx = withPluginProgress(ctx, errOut)
 
 	repoURL := src.Ref
 	var trusted bool
@@ -210,7 +211,9 @@ func runRemoteInstall(ctx context.Context, cmd *cobra.Command, src installSource
 	// Both paths need the catalog: one to resolve a name, the other for the
 	// trust check. Sync once. An unreachable index is fatal only for the
 	// name-resolution path; a URL install degrades to "not listed".
+	stopIndex := startPluginStep(ctx, "Checking plugin index...")
 	idx, idxErr := SyncPluginIndex(ctx, resolvePluginIndexURL(flags.index), false)
+	stopIndex()
 
 	if src.Kind == installFromIndex {
 		if idxErr != nil {
@@ -300,7 +303,9 @@ func runRemoteInstall(ctx context.Context, cmd *cobra.Command, src installSource
 // error — doctor reports the gap afterwards.
 func installPlannedDeps(ctx context.Context, cmd *cobra.Command, reqs []PluginRequirement, idx *PluginIndex, flags remoteInstallFlags) error {
 	out, errOut := cmd.OutOrStdout(), cmd.ErrOrStderr()
+	stopPlan := startPluginStep(ctx, "Checking plugin dependencies...")
 	plan, err := PlanDependencyInstalls(ctx, reqs, idx)
+	stopPlan()
 	if err != nil {
 		return fmt.Errorf("resolve dependencies: %w", err)
 	}
diff --git a/cmd/entire/cli/plugin_install_remote.go b/cmd/entire/cli/plugin_install_remote.go
index 9016a6dcc9..16ae051d0e 100644
--- a/cmd/entire/cli/plugin_install_remote.go
+++ b/cmd/entire/cli/plugin_install_remote.go
@@ -81,7 +81,9 @@ func InstallPluginFromRepo(ctx context.Context, repoURL, expectedName string, op
 		tags = []string{opts.Pin}
 	} else {
 		var err error
+		stopTags := startPluginStep(ctx, "Finding latest plugin release...")
 		tags, err = listRemoteSemverTags(ctx, repoURL)
+		stopTags()
 		if err != nil {
 			return nil, err
 		}
@@ -109,7 +111,9 @@ func InstallPluginFromRepo(ctx context.Context, repoURL, expectedName string, op
 }
 
 func installRepoAtTag(ctx context.Context, repoURL, expectedName, tag string, opts RemoteInstallOptions) (*RemoteInstallResult, error) {
+	stopMetadata := startPluginStep(ctx, fmt.Sprintf("Fetching plugin metadata for %s...", tag))
 	meta, err := fetchPluginMetadataAtTag(ctx, repoURL, tag)
+	stopMetadata()
 	if err != nil {
 		return nil, err
 	}
@@ -190,6 +194,8 @@ func installRepoAtTag(ctx context.Context, repoURL, expectedName, tag string, op
 		return nil, err
 	}
 
+	stopInstall := startPluginStep(ctx, fmt.Sprintf("Installing entire-%s %s...", name, tag))
+	defer stopInstall()
 	binBase := pluginBinaryName(name)
 	stagedName := "extracted-" + binBase
 	if err := extractPluginBinary(asset.Path, name, stagingRoot, stagedName); err != nil {
diff --git a/cmd/entire/cli/plugin_on_demand.go b/cmd/entire/cli/plugin_on_demand.go
new file mode 100644
index 0000000000..ef604c791a
--- /dev/null
+++ b/cmd/entire/cli/plugin_on_demand.go
@@ -0,0 +1,57 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	"charm.land/huh/v2"
+	"github.com/entireio/cli/cmd/entire/cli/interactive"
+	"github.com/spf13/cobra"
+)
+
+// onDemandPluginInstall shares the normal install workflow, including index
+// overrides, name/checksum validation and dependency confirmation. Tests replace
+// it to exercise the prompt and dispatch without downloading real releases.
+var onDemandPluginInstall = runRemoteInstall
+
+func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name string) (string, error) {
+	if !interactive.CanPromptInteractively() {
+		return "", fmt.Errorf("the entire-%s plugin is not installed; run 'entire plugin install %s' and retry", name, name)
+	}
+	if err := ctx.Err(); err != nil {
+		return "", fmt.Errorf("install plugin: %w", err)
+	}
+	confirmed := true
+	form := NewAccessibleForm(huh.NewGroup(
+		huh.NewConfirm().Title(fmt.Sprintf("Install the entire-%s plugin?", name)).Value(&confirmed),
+	)).WithInput(rootCmd.InOrStdin()).WithOutput(rootCmd.ErrOrStderr())
+	if err := form.RunWithContext(ctx); err != nil {
+		return "", handleFormCancellation(rootCmd.ErrOrStderr(), "Install", err)
+	}
+	if !confirmed {
+		fmt.Fprintln(rootCmd.ErrOrStderr(), "Install cancelled.")
+		return "", nil
+	}
+	if err := ctx.Err(); err != nil {
+		return "", fmt.Errorf("install plugin: %w", err)
+	}
+
+	// Keep install progress off stdout: the original command may emit JSON or
+	// be piped to another tool. Do not parse any of the plugin's arguments.
+	cmd := newPluginInstallCmd()
+	cmd.SetOut(rootCmd.ErrOrStderr())
+	cmd.SetErr(rootCmd.ErrOrStderr())
+	if err := onDemandPluginInstall(ctx, cmd, installSource{Kind: installFromIndex, Ref: name}, remoteInstallFlags{}); err != nil {
+		return "", err
+	}
+	installed, err := FindInstalledPlugin(name)
+	if err != nil {
+		return "", err
+	}
+	if installed == nil {
+		return "", fmt.Errorf("the entire-%s plugin was not installed; run 'entire plugin install %s' and retry", name, name)
+	}
+	// Execute the managed entry directly, even if the managed directory could
+	// not be prepended to PATH at startup.
+	return installed.Path, nil
+}
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
new file mode 100644
index 0000000000..44ca1deaed
--- /dev/null
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -0,0 +1,133 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+func TestMaybeRunPlugin_MissingGraphNonInteractive(t *testing.T) { //nolint:paralleltest // isolates PATH and terminal detection
+	t.Setenv("PATH", t.TempDir())
+	t.Setenv("ENTIRE_TEST_TTY", "0")
+	root := newTestRoot()
+	var stderr bytes.Buffer
+	root.SetErr(&stderr)
+	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "search", "hello"})
+	if !handled || code != 1 {
+		t.Fatalf("handled=%v code=%d, want true, 1", handled, code)
+	}
+	if !strings.Contains(stderr.String(), "entire plugin install graph") {
+		t.Fatalf("missing installation hint: %q", stderr.String())
+	}
+}
+
+func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest // isolates environment and installer seam
+	for _, tc := range []struct {
+		name        string
+		answer      string
+		installErr  error
+		pluginCode  int
+		wantCode    int
+		wantInstall bool
+		wantRun     bool
+	}{
+		{name: "enter accepts default yes", answer: "\n", wantInstall: true, wantRun: true},
+		{name: "explicit yes preserves exit code", answer: "y\n", pluginCode: 42, wantCode: 42, wantInstall: true, wantRun: true},
+		{name: "no cancels", answer: "n\n", wantCode: 1},
+		{name: "failed install does not run", answer: "\n", installErr: errors.New("download failed"), wantCode: 1, wantInstall: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			t.Setenv("PATH", dir)
+			t.Setenv("ENTIRE_PLUGIN_DIR", filepath.Join(dir, "managed"))
+			t.Setenv("ENTIRE_TEST_TTY", "1")
+			t.Setenv("ACCESSIBLE", "1")
+			t.Setenv("ENTIRE_TELEMETRY_OPTOUT", "1")
+			interceptVersionCheck(t)
+			argFile := filepath.Join(dir, "args.txt")
+			sourceDir := t.TempDir()
+			source := writePluginBinary(t, sourceDir, "entire-graph", argFile, tc.pluginCode)
+			installCalls := 0
+			original := onDemandPluginInstall
+			onDemandPluginInstall = func(_ context.Context, cmd *cobra.Command, src installSource, flags remoteInstallFlags) error {
+				installCalls++
+				if src.Kind != installFromIndex || src.Ref != "graph" || flags != (remoteInstallFlags{}) {
+					t.Fatalf("unexpected install request: %+v %+v", src, flags)
+				}
+				if tc.installErr != nil {
+					return tc.installErr
+				}
+				_, err := InstallPluginFromPath(InstallPluginOptions{SourcePath: source})
+				fmt.Fprintln(cmd.OutOrStdout(), "Installed graph")
+				return err
+			}
+			t.Cleanup(func() { onDemandPluginInstall = original })
+			root := newTestRoot()
+			var stdout, stderr bytes.Buffer
+			root.SetOut(&stdout)
+			root.SetErr(&stderr)
+			root.SetIn(strings.NewReader(tc.answer))
+			args := []string{"graph", "search", "two words", "--json", "--", "$(untouched)", ""}
+			handled, code := MaybeRunPlugin(t.Context(), root, args)
+			if !handled || code != tc.wantCode {
+				t.Fatalf("handled=%v code=%d, want true, %d; stderr=%s", handled, code, tc.wantCode, &stderr)
+			}
+			if (installCalls == 1) != tc.wantInstall {
+				t.Errorf("install calls=%d, want install=%v", installCalls, tc.wantInstall)
+			}
+			if !strings.Contains(stderr.String(), "Install the entire-graph plugin?") || !strings.Contains(stderr.String(), "[Y/n]") {
+				t.Errorf("missing Yes-default prompt: %q", stderr.String())
+			}
+			if stdout.Len() != 0 {
+				t.Errorf("installation polluted stdout: %q", stdout.String())
+			}
+			got, err := os.ReadFile(argFile)
+			if tc.wantRun {
+				if err != nil || string(got) != strings.Join(args[1:], "\n")+"\n" {
+					t.Errorf("forwarded args=%q err=%v", got, err)
+				}
+			} else if !os.IsNotExist(err) {
+				t.Errorf("plugin unexpectedly ran: args=%q err=%v", got, err)
+			}
+			if tc.installErr != nil && !strings.Contains(stderr.String(), tc.installErr.Error()) {
+				t.Errorf("missing install failure: %q", stderr.String())
+			}
+		})
+	}
+}
+
+func TestMaybeRunPlugin_GraphInstalledSkipsPrompt(t *testing.T) { //nolint:paralleltest // isolates PATH and version check
+	dir := t.TempDir()
+	argFile := filepath.Join(dir, "args.txt")
+	writePluginBinary(t, dir, "entire-graph", argFile, 0)
+	t.Setenv("PATH", dir)
+	interceptVersionCheck(t)
+	root := newTestRoot()
+	var stderr bytes.Buffer
+	root.SetErr(&stderr)
+	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "--help"})
+	if !handled || code != 0 || stderr.Len() != 0 {
+		t.Fatalf("handled=%v code=%d stderr=%q", handled, code, stderr.String())
+	}
+}
+
+func TestResolvePlugin_OnDemandEligibility(t *testing.T) { //nolint:paralleltest // isolates PATH
+	t.Setenv("PATH", t.TempDir())
+	for _, args := range [][]string{nil, {"--help"}, {"other-plugin"}, {"Graph"}, {"agent-graph"}, {"session", "graph"}} {
+		if _, _, ok := resolvePlugin(newTestRoot(), args); ok {
+			t.Errorf("unexpected plugin resolution for %q", args)
+		}
+	}
+	root := newTestRoot()
+	root.AddCommand(&cobra.Command{Use: "graph"})
+	if _, _, ok := resolvePlugin(root, []string{"graph", "search"}); ok {
+		t.Fatal("built-in graph must take precedence over on-demand installation")
+	}
+}
diff --git a/cmd/entire/cli/plugin_progress.go b/cmd/entire/cli/plugin_progress.go
new file mode 100644
index 0000000000..9b4bb9a7fe
--- /dev/null
+++ b/cmd/entire/cli/plugin_progress.go
@@ -0,0 +1,36 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/entireio/cli/cmd/entire/cli/interactive"
+)
+
+type pluginProgressKey struct{}
+
+// withPluginProgress opts the command into progress reporting. The context
+// carries the writer through dependency installs without making library callers
+// print to the process's terminal.
+func withPluginProgress(ctx context.Context, out io.Writer) context.Context {
+	return context.WithValue(ctx, pluginProgressKey{}, out)
+}
+
+// startPluginStep reports work before it starts. Stop the spinner before any
+// prompt, warning or result is printed. The returned stop is idempotent so a
+// deferred cleanup can also cover early returns.
+func startPluginStep(ctx context.Context, message string) func() {
+	out, ok := ctx.Value(pluginProgressKey{}).(io.Writer)
+	if !ok {
+		return func() {}
+	}
+	if IsAccessibleMode() || !interactive.ShouldStyle(out) {
+		fmt.Fprintln(out, message)
+		return func() {}
+	}
+	stop := startSpinner(out, message)
+	var once sync.Once
+	return func() { once.Do(func() { stop(false) }) }
+}
diff --git a/cmd/entire/cli/plugin_progress_test.go b/cmd/entire/cli/plugin_progress_test.go
new file mode 100644
index 0000000000..2c4a9fffd8
--- /dev/null
+++ b/cmd/entire/cli/plugin_progress_test.go
@@ -0,0 +1,52 @@
+package cli
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestPluginStepPlainOutputIsImmediate(t *testing.T) {
+	t.Parallel()
+	var out bytes.Buffer
+	stop := startPluginStep(withPluginProgress(t.Context(), &out), "Downloading plugin archive...")
+	if got := out.String(); got != "Downloading plugin archive...\n" {
+		t.Fatalf("status must be visible before work completes, got %q", got)
+	}
+	stop()
+	stop()
+	if strings.Count(out.String(), "Downloading") != 1 || strings.Contains(out.String(), "\x1b") {
+		t.Fatalf("plain progress duplicated output or wrote terminal escapes: %q", out.String())
+	}
+}
+
+func TestPluginInstallReportsStagesOnStderr(t *testing.T) { //nolint:paralleltest // isolates managed plugins and index cache
+	withIsolatedPluginEnv(t)
+	withIndexCache(t)
+	repoURL, _ := newDemoPluginRepo(t, []string{remoteTestTagOld}, "0.1.0")
+	indexURL, _ := newIndexRepo(t, fmt.Sprintf(`{"version":1,"plugins":[{"name":"demo","repo_url":%q}]}`, repoURL))
+	cmd := newPluginInstallCmd()
+	var out, errOut bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&errOut)
+	err := runRemoteInstall(t.Context(), cmd, installSource{Kind: installFromIndex, Ref: "demo"}, remoteInstallFlags{index: indexURL})
+	if err != nil {
+		t.Fatal(err)
+	}
+	stages := []string{
+		"Checking plugin index...",
+		"Finding latest plugin release...",
+		"Fetching plugin metadata for v0.1.0...",
+		"Locating plugin release files...",
+		"Downloading plugin archive...",
+		"Verifying plugin checksum...",
+		"Installing entire-demo v0.1.0...",
+	}
+	if got, want := errOut.String(), strings.Join(stages, "\n")+"\n"; got != want {
+		t.Fatalf("install progress:\ngot %q\nwant %q", got, want)
+	}
+	if !strings.HasPrefix(out.String(), `Installed plugin "demo" v0.1.0 from `) || strings.Count(out.String(), "\n") != 1 {
+		t.Fatalf("stdout should contain only the install result: %q", out.String())
+	}
+}
diff --git a/cmd/entire/cli/uiform/prompt_terminal_test.go b/cmd/entire/cli/uiform/prompt_terminal_test.go
new file mode 100644
index 0000000000..8b4e70bc3e
--- /dev/null
+++ b/cmd/entire/cli/uiform/prompt_terminal_test.go
@@ -0,0 +1,72 @@
+//go:build !windows
+
+package uiform
+
+import (
+	"context"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	tea "charm.land/bubbletea/v2"
+	"charm.land/huh/v2"
+	"github.com/creack/pty"
+)
+
+// An empty Form.View is not enough: the renderer must move back over the
+// question before erasing it. Exercise the actual terminal output, because
+// accessible-mode tests bypass the renderer that left answered prompts behind.
+func TestConfirmationClearsPromptAfterAnswer(t *testing.T) {
+	t.Parallel()
+	terminal, input, err := pty.Open()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = terminal.Close() })
+	t.Cleanup(func() { _ = input.Close() })
+	if err := pty.Setsize(terminal, &pty.Winsize{Rows: 24, Cols: 100}); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+	const question = "Install the entire-graph plugin?"
+	output := make(chan string, 1)
+	go func() {
+		var transcript strings.Builder
+		answered := false
+		buf := make([]byte, 4096)
+		for {
+			n, readErr := terminal.Read(buf)
+			transcript.Write(buf[:n])
+			if !answered && strings.Contains(transcript.String(), question) {
+				answered = true
+				if _, writeErr := io.WriteString(terminal, "\r"); writeErr != nil {
+					cancel()
+				}
+			}
+			if readErr != nil {
+				output <- transcript.String()
+				return
+			}
+		}
+	}()
+	answer := true
+	form := New(huh.NewGroup(huh.NewConfirm().Title(question).Value(&answer))).
+		WithProgramOptions(tea.WithEnvironment([]string{"TERM=xterm-256color"})).
+		WithAccessible(false).WithInput(input).WithOutput(input)
+	err = form.RunWithContext(ctx)
+	_ = input.Close() // End the reader after the final render has been flushed.
+	if err != nil {
+		t.Fatal(err)
+	}
+	transcript := <-output
+	// This fixed-width, five-row form ends with the cursor on its help row.
+	// Clearing from that row alone leaves the question and choices visible.
+	if !strings.Contains(transcript, "\x1b[4A\x1b[J") {
+		t.Fatalf("completed prompt was not erased from its first row: %q", transcript)
+	}
+	if !answer {
+		t.Fatal("Enter did not retain the default Yes answer")
+	}
+}
diff --git a/docs/architecture/external-commands.md b/docs/architecture/external-commands.md
index 1ca23b77d4..15f144100d 100644
--- a/docs/architecture/external-commands.md
+++ b/docs/architecture/external-commands.md
@@ -16,9 +16,12 @@ Rules, in order:
 2. **Reserved names are skipped.** Names beginning with `agent-` are reserved for the [agent protocol](external-agent-protocol.md). The resolver refuses to invoke them as external commands.
 3. **Path-traversal candidates are rejected.** Names containing `/` or `\` never resolve.
 4. **Found-but-not-executable surfaces as a launch error.** If `entire-<name>` exists on `$PATH` but lacks the executable bit, the resolver reports `Failed to run plugin entire-<name>` with exit code 1, rather than falling through to Cobra's "unknown command" path.
+5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` asks `Install the entire-graph plugin?` with Yes selected by default. Accepting installs `graph` through the configured plugin index using the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr. Declining, cancelling, or failing installation exits nonzero without running the command. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
 
 ### Managed install directory
 
+Remote installs report index lookup, release metadata, download, checksum verification, and installation progress on stderr. Styled terminals show a spinner; non-terminal and accessibility output prints plain status lines as each step starts. Progress stops before confirmations and results, including when installation fails. The same reporting applies when `entire graph` offers to install its missing plugin and when installing dependencies.
+
 Users can drop binaries anywhere on `$PATH`, but a per-user managed directory is also automatically discovered:
 
 - **Default:** `$XDG_DATA_HOME/entire/plugins/bin` (Linux/macOS) or `%LOCALAPPDATA%\entire\plugins\bin` (Windows).
@@ -279,6 +282,7 @@ The resolver lives in `cmd/entire/cli/plugin.go`. The entry point is `MaybeRunPl
 Key files:
 
 - `cmd/entire/cli/plugin.go` — entry point, `resolvePlugin`, `runPlugin`
+- `cmd/entire/cli/plugin_on_demand.go` — missing Graph installation prompt and managed-install handoff
 - `cmd/entire/cli/plugin_env.go` — `pluginEnv`, the allowlist, and `ENTIRE_PLUGIN_ENV` parsing
 - `cmd/entire/cli/plugin_official.go` — `officialPlugins` allowlist, `IsOfficialPlugin`
 - `cmd/entire/cli/plugin_store.go` — managed install directory, `PluginBinDir`, `PluginDataDir`, `InstallPluginFromPath`, `ListInstalledPlugins`, `RemoveInstalledPlugin`, `PrependPluginBinDirToPATH`
diff --git a/go.mod b/go.mod
index 31b5ed4856..0bbfc1f5dc 100644
--- a/go.mod
+++ b/go.mod
@@ -68,7 +68,7 @@ require (
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/charlievieth/fastwalk v1.0.14 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260906173415-0277a179edd9 // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
 	github.com/charmbracelet/x/exp/slice v0.0.0-20250327172914-2fdc97757edf // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
diff --git a/go.sum b/go.sum
index 29f725e194..76ec28d8e7 100644
--- a/go.sum
+++ b/go.sum
@@ -54,8 +54,8 @@ github.com/charlievieth/fastwalk v1.0.14 h1:3Eh5uaFGwHZd8EGwTjJnSpBkfwfsak9h6ICg
 github.com/charlievieth/fastwalk v1.0.14/go.mod h1:diVcUreiU1aQ4/Wu3NbxxH4/KYdKpLDojrQ1Bb2KgNY=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/ultraviolet v0.0.0-20260906173415-0277a179edd9 h1:tYBWVoMfQHTwp88mWeWH7o0uJFZqRJeEGJmeHpIR8Ms=
+github.com/charmbracelet/ultraviolet v0.0.0-20260906173415-0277a179edd9/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
 github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
 github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/conpty v0.1.1 h1:s1bUxjoi7EpqiXysVtC+a8RrvPPNcNvAjfi4jxsAuEs=

From 7b26295d79632a38329b2bf91db72115f850a876 Mon Sep 17 00:00:00 2001
From: Thomas Dohmke <thomas@dohmke.de>
Date: Wed, 9 Sep 2026 14:12:46 +0200
Subject: [PATCH 16/59] fix: preserve plugin prompt streams and cancellation

Entire-Checkpoint: 01M231BF0DXEPSR8G9AWF7NCMC
---
 cmd/entire/cli/plugin.go                      |  5 +-
 cmd/entire/cli/plugin_confirm.go              | 96 +++++++++++++++++++
 .../cli/plugin_confirm_terminal_test.go       | 78 +++++++++++++++
 cmd/entire/cli/plugin_confirm_test.go         | 74 ++++++++++++++
 cmd/entire/cli/plugin_fetch.go                | 12 +--
 cmd/entire/cli/plugin_fetch_test.go           |  9 +-
 cmd/entire/cli/plugin_group.go                | 18 ++--
 cmd/entire/cli/plugin_on_demand.go            | 14 +--
 cmd/entire/cli/plugin_on_demand_test.go       | 40 ++++++--
 cmd/entire/cli/plugin_progress_test.go        |  1 -
 cmd/entire/main.go                            |  3 +
 docs/architecture/external-commands.md        |  2 +-
 go.mod                                        |  6 +-
 13 files changed, 316 insertions(+), 42 deletions(-)
 create mode 100644 cmd/entire/cli/plugin_confirm.go
 create mode 100644 cmd/entire/cli/plugin_confirm_terminal_test.go
 create mode 100644 cmd/entire/cli/plugin_confirm_test.go

diff --git a/cmd/entire/cli/plugin.go b/cmd/entire/cli/plugin.go
index 8afcb3fb33..d84655b629 100644
--- a/cmd/entire/cli/plugin.go
+++ b/cmd/entire/cli/plugin.go
@@ -57,7 +57,10 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 		var err error
 		binPath, err = installMissingPlugin(ctx, rootCmd, pluginName)
 		if err != nil {
-			fmt.Fprintln(rootCmd.ErrOrStderr(), RenderUserFacingError(err))
+			var silent *SilentError
+			if !errors.As(silencePluginCancel(ctx, err), &silent) {
+				fmt.Fprintln(rootCmd.ErrOrStderr(), RenderUserFacingError(err))
+			}
 			return true, 1
 		}
 		if binPath == "" {
diff --git a/cmd/entire/cli/plugin_confirm.go b/cmd/entire/cli/plugin_confirm.go
new file mode 100644
index 0000000000..15920963a8
--- /dev/null
+++ b/cmd/entire/cli/plugin_confirm.go
@@ -0,0 +1,96 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+
+	tea "charm.land/bubbletea/v2"
+	"charm.land/huh/v2"
+	"github.com/muesli/cancelreader"
+)
+
+// A separate terminal keeps confirmation from consuming the plugin's stdin.
+// Tests replace the opener rather than redirecting the command's data stream.
+var openPluginPromptInput = func() (io.ReadCloser, error) {
+	in, out, err := tea.OpenTTY()
+	if err != nil {
+		return nil, fmt.Errorf("open confirmation terminal: %w", err)
+	}
+	if out != in {
+		_ = out.Close()
+	}
+	return in, nil
+}
+
+func runPluginConfirm(ctx context.Context, out io.Writer, prompt string, defaultYes bool) (bool, error) {
+	if err := ctx.Err(); err != nil {
+		return false, fmt.Errorf("confirmation cancelled: %w", err)
+	}
+	input, err := openPluginPromptInput()
+	if err != nil {
+		return false, err
+	}
+	defer input.Close()
+	answer := defaultYes
+	form := NewAccessibleForm(huh.NewGroup(huh.NewConfirm().Title(prompt).Value(&answer))).WithOutput(out).WithInput(input)
+	if IsAccessibleMode() {
+		// Huh's accessible scanner ignores context and treats EOF as the default.
+		// Make the read cancellable and retain EOF so it cannot authorize an install.
+		reader, readErr := cancelreader.NewReader(input)
+		if readErr != nil {
+			return false, fmt.Errorf("confirmation input: %w", readErr)
+		}
+		defer reader.Close()
+		cancelled := make(chan struct{})
+		stop := context.AfterFunc(ctx, func() {
+			if !reader.Cancel() {
+				// Some platforms cannot cancel reads on a separately opened
+				// terminal. This descriptor belongs to the prompt, so closing
+				// it is safe and also releases a blocked read.
+				_ = input.Close()
+			}
+			close(cancelled)
+		})
+		defer func() {
+			if !stop() {
+				<-cancelled
+			}
+		}()
+		checked := &pluginConfirmReader{Reader: reader}
+		err = form.WithInput(checked).RunWithContext(ctx)
+		if ctx.Err() != nil {
+			return false, fmt.Errorf("confirmation cancelled: %w", ctx.Err())
+		}
+		if checked.err != nil {
+			if errors.Is(checked.err, io.EOF) {
+				return false, nil
+			}
+			return false, fmt.Errorf("confirmation input: %w", checked.err)
+		}
+	} else {
+		err = form.RunWithContext(ctx)
+	}
+	if ctx.Err() != nil {
+		return false, fmt.Errorf("confirmation cancelled: %w", ctx.Err())
+	}
+	if err != nil {
+		return false, fmt.Errorf("confirmation form: %w", err)
+	}
+	return answer, nil
+}
+
+type pluginConfirmReader struct {
+	io.Reader
+
+	err error
+}
+
+func (r *pluginConfirmReader) Read(p []byte) (int, error) {
+	n, err := r.Reader.Read(p)
+	if n == 0 {
+		r.err = err
+	}
+	return n, err //nolint:wrapcheck // preserve io.Reader EOF semantics for the scanner
+}
diff --git a/cmd/entire/cli/plugin_confirm_terminal_test.go b/cmd/entire/cli/plugin_confirm_terminal_test.go
new file mode 100644
index 0000000000..2dd779bc80
--- /dev/null
+++ b/cmd/entire/cli/plugin_confirm_terminal_test.go
@@ -0,0 +1,78 @@
+//go:build !windows
+
+package cli
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/creack/pty"
+)
+
+// The child has a controlling terminal but piped stdin. Both prompt modes must
+// read the terminal answer and leave every byte of the plugin's input intact.
+func TestPluginConfirmationRedirectedInput(t *testing.T) {
+	t.Parallel()
+	const marker = "ENTIRE_TEST_PLUGIN_CONFIRM_CHILD"
+	const question = "Install test plugin?"
+	const payload = "plugin input that must survive\n"
+	if os.Getenv(marker) == "1" {
+		answer, err := runPluginConfirm(t.Context(), os.Stderr, question, true)
+		if err != nil || !answer {
+			t.Fatalf("confirmation: answer=%v err=%v", answer, err)
+		}
+		data, err := io.ReadAll(os.Stdin)
+		if err != nil || string(data) != payload {
+			t.Fatalf("plugin stdin=%q err=%v", data, err)
+		}
+		fmt.Fprintln(os.Stderr, "INPUT_PRESERVED")
+		return
+	}
+	for _, accessible := range []string{"", "1"} {
+		t.Run("accessible="+accessible, func(t *testing.T) {
+			t.Parallel()
+			ctx, cancel := context.WithTimeout(t.Context(), 15*time.Second)
+			defer cancel()
+			cmd := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestPluginConfirmationRedirectedInput$")
+			cmd.Env = append(os.Environ(), marker+"=1", "ACCESSIBLE="+accessible, "TERM=xterm-256color")
+			cmd.Stdin = strings.NewReader(payload)
+			terminal, err := pty.StartWithAttrs(cmd, &pty.Winsize{Rows: 24, Cols: 100}, &syscall.SysProcAttr{Setsid: true, Setctty: true, Ctty: 1})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer terminal.Close()
+			output := make(chan string, 1)
+			go func() {
+				var transcript strings.Builder
+				answered := false
+				buf := make([]byte, 4096)
+				for {
+					n, readErr := terminal.Read(buf)
+					transcript.Write(buf[:n])
+					if !answered && strings.Contains(transcript.String(), question) {
+						answered = true
+						if _, err := io.WriteString(terminal, "\r"); err != nil {
+							cancel()
+						}
+					}
+					if readErr != nil {
+						output <- transcript.String()
+						return
+					}
+				}
+			}()
+			err = cmd.Wait()
+			transcript := <-output
+			if err != nil || !strings.Contains(transcript, "INPUT_PRESERVED") {
+				t.Fatalf("child: %v\n%s", err, transcript)
+			}
+		})
+	}
+}
diff --git a/cmd/entire/cli/plugin_confirm_test.go b/cmd/entire/cli/plugin_confirm_test.go
new file mode 100644
index 0000000000..fd8badb721
--- /dev/null
+++ b/cmd/entire/cli/plugin_confirm_test.go
@@ -0,0 +1,74 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestPluginDependencyConfirmationUsesWriter(t *testing.T) { //nolint:paralleltest // isolates terminal opener and accessibility
+	t.Setenv("ACCESSIBLE", "1")
+	t.Setenv("ENTIRE_TEST_TTY", "1")
+	original := openPluginPromptInput
+	openPluginPromptInput = func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("y\n")), nil }
+	t.Cleanup(func() { openPluginPromptInput = original })
+	var stderr bytes.Buffer
+	ok, err := confirmPluginAction(t.Context(), &stderr, "Install them now?", false)
+	if err != nil || !ok {
+		t.Fatalf("answer=%v err=%v", ok, err)
+	}
+	if !strings.Contains(stderr.String(), "Install them now? [y/N]") {
+		t.Fatalf("missing prompt on stderr: %q", stderr.String())
+	}
+}
+
+func TestPluginAccessibleConfirmationCancellation(t *testing.T) { //nolint:paralleltest // isolates terminal opener and accessibility
+	t.Setenv("ACCESSIBLE", "1")
+	input, writer, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer writer.Close()
+	original := openPluginPromptInput
+	openPluginPromptInput = func() (io.ReadCloser, error) { return input, nil }
+	t.Cleanup(func() { openPluginPromptInput = original })
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	ready := make(chan struct{}, 1)
+	result := make(chan error, 1)
+	go func() {
+		_, promptErr := runPluginConfirm(ctx, pluginPromptNotifyWriter{ready}, "Install?", true)
+		result <- promptErr
+	}()
+	select {
+	case <-ready:
+	case <-time.After(5 * time.Second):
+		t.Fatal("prompt did not start")
+	}
+	cancel()
+	select {
+	case err := <-result:
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("got %v, want cancellation", err)
+		}
+	case <-time.After(5 * time.Second):
+		_ = writer.Close()
+		<-result
+		t.Fatal("accessible prompt did not stop on cancellation")
+	}
+}
+
+type pluginPromptNotifyWriter struct{ ready chan<- struct{} }
+
+func (w pluginPromptNotifyWriter) Write(p []byte) (int, error) {
+	select {
+	case w.ready <- struct{}{}:
+	default:
+	}
+	return len(p), nil
+}
diff --git a/cmd/entire/cli/plugin_fetch.go b/cmd/entire/cli/plugin_fetch.go
index 2b3971d273..8c4ed9fe72 100644
--- a/cmd/entire/cli/plugin_fetch.go
+++ b/cmd/entire/cli/plugin_fetch.go
@@ -305,6 +305,7 @@ func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, nam
 		}
 		u := expandDownloadTemplate(meta.DownloadURL, name, tag, "")
 		stopLocate()
+		defer startPluginStep(ctx, "Downloading plugin archive...")()
 		return fetchAndVerify(ctx, u, assetNameFromURL(u), "", stagingDir)
 	}
 
@@ -327,6 +328,7 @@ func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, nam
 			continue
 		}
 		stopLocate()
+		defer startPluginStep(ctx, "Downloading plugin archive...")()
 		return fetchAndVerify(ctx, assetURL(asset), asset, digest, stagingDir)
 	}
 
@@ -340,8 +342,9 @@ func downloadPluginAsset(ctx context.Context, meta *PluginMetadata, repoURL, nam
 	// (errUnverifiedAsset, which an older tag wouldn't fix). Getting that
 	// wrong would report a missing release for a plugin that simply doesn't
 	// ship checksums.
+	stopLocate()
+	defer startPluginStep(ctx, "Downloading plugin archive...")()
 	for _, asset := range assetCandidates(name, tag) {
-		stopLocate()
 		fa, err := fetchAndVerify(ctx, assetURL(asset), asset, "", stagingDir)
 		switch {
 		case errors.Is(err, errAssetNotFound):
@@ -414,8 +417,6 @@ func httpGetSmall(ctx context.Context, rawURL string) ([]byte, error) {
 // command errors to stderr and a download failure is an ordinary event
 // (network hiccup, 5xx, checksum mismatch), not an exceptional one.
 func fetchAndVerify(ctx context.Context, rawURL, asset, wantDigest, stagingDir string) (*fetchedAsset, error) {
-	stopDownload := startPluginStep(ctx, "Downloading plugin archive...")
-	defer stopDownload()
 	stagingRoot, err := osroot.Shared(stagingDir)
 	if err != nil {
 		return nil, fmt.Errorf("open staging dir: %w", err)
@@ -476,11 +477,6 @@ func fetchAndVerify(ctx context.Context, rawURL, asset, wantDigest, stagingDir s
 		_ = osroot.RemoveNoSymlinks(stagingRoot, asset) //nolint:errcheck // best-effort cleanup of a staging file we are already abandoning
 		return nil, fmt.Errorf("download %s: exceeds %d byte limit", redactURL(rawURL), int64(maxPluginAssetSize))
 	}
-	stopDownload()
-	if wantDigest != "" {
-		stopVerify := startPluginStep(ctx, "Verifying plugin checksum...")
-		defer stopVerify()
-	}
 	got := hex.EncodeToString(h.Sum(nil))
 	if wantDigest != "" && !strings.EqualFold(got, wantDigest) {
 		_ = osroot.RemoveNoSymlinks(stagingRoot, asset) //nolint:errcheck // best-effort cleanup of a staging file we are already abandoning
diff --git a/cmd/entire/cli/plugin_fetch_test.go b/cmd/entire/cli/plugin_fetch_test.go
index 1221f9c22c..5cd9bcad33 100644
--- a/cmd/entire/cli/plugin_fetch_test.go
+++ b/cmd/entire/cli/plugin_fetch_test.go
@@ -472,17 +472,22 @@ func TestDownloadPluginAsset_ViaChecksumManifest(t *testing.T) {
 func TestDownloadPluginAsset_ProbeFallbackWithoutChecksums(t *testing.T) {
 	t.Parallel()
 	payload := makeTarGz(t, map[string][]byte{"entire-run": []byte("bin")})
-	asset := fmt.Sprintf("entire-run_1.0.0_%s_%s.tar.gz", runtime.GOOS, runtime.GOARCH)
+	candidates := assetCandidates("run", "v1.0.0")
+	asset := candidates[len(candidates)-1]
 	srv := assetServer(t, asset, payload, "")
 
 	meta := &PluginMetadata{DownloadURL: srv.URL + "/dl/{asset}"}
-	fa, err := downloadPluginAsset(context.Background(), meta, "https://example.invalid/entire-run", "run", "v1.0.0", t.TempDir(), true)
+	var progress bytes.Buffer
+	fa, err := downloadPluginAsset(withPluginProgress(t.Context(), &progress), meta, "https://example.invalid/entire-run", "run", "v1.0.0", t.TempDir(), true)
 	if err != nil {
 		t.Fatalf("downloadPluginAsset: %v", err)
 	}
 	if fa.Asset != asset {
 		t.Errorf("Asset = %q, want %q", fa.Asset, asset)
 	}
+	if got := strings.Count(progress.String(), "Downloading plugin archive..."); got != 1 {
+		t.Fatalf("download phase reported %d times: %s", got, &progress)
+	}
 }
 
 // allowUnverified stays false here on purpose: with verification required,
diff --git a/cmd/entire/cli/plugin_group.go b/cmd/entire/cli/plugin_group.go
index 8338397466..508541b5fa 100644
--- a/cmd/entire/cli/plugin_group.go
+++ b/cmd/entire/cli/plugin_group.go
@@ -253,7 +253,7 @@ func runRemoteInstall(ctx context.Context, cmd *cobra.Command, src installSource
 		// An untrusted source cannot proceed unconfirmed: automation never
 		// reaches this prompt, because the non-interactive path fails above
 		// with the --yes hint.
-		proceed, err := confirmInstallOrCancel(ctx, out,
+		proceed, err := confirmInstallOrCancel(ctx, errOut,
 			fmt.Sprintf("Install from %s? The repository is not listed in the plugin index.", redactURL(repoURL)),
 			flags.yes)
 		if err != nil || !proceed {
@@ -330,7 +330,7 @@ func installPlannedDeps(ctx context.Context, cmd *cobra.Command, reqs []PluginRe
 			fmt.Fprintf(out, "  %s  (%s)\n", a.Name, redactURL(a.RepoURL))
 		}
 	}
-	ok, err := confirmPluginAction(ctx, "Install them now?", flags.yes)
+	ok, err := confirmPluginAction(ctx, errOut, "Install them now?", flags.yes)
 	switch {
 	case errors.Is(err, errConfirmNeedsTerminal):
 		// Non-interactive without --yes: the main install already
@@ -380,19 +380,15 @@ var errConfirmNeedsTerminal = errors.New("confirmation required but no terminal
 // non-interactive runs without --yes return errConfirmNeedsTerminal rather
 // than guessing. Prompt errors (including huh.ErrUserAborted on Ctrl+C/Esc)
 // are returned raw for callers to map via handleFormCancellation.
-func confirmPluginAction(ctx context.Context, prompt string, assumeYes bool) (bool, error) {
+func confirmPluginAction(ctx context.Context, out io.Writer, prompt string, assumeYes bool) (bool, error) {
 	if assumeYes {
 		return true, nil
 	}
 	if !interactive.CanPromptInteractively() {
 		return false, fmt.Errorf("%w (%s)", errConfirmNeedsTerminal, prompt)
 	}
-	confirmed := false
-	form := NewAccessibleForm(huh.NewGroup(
-		huh.NewConfirm().Title(prompt).Value(&confirmed),
-	))
-	if err := form.RunWithContext(ctx); err != nil {
-		// %w keeps huh.ErrUserAborted reachable for handleFormCancellation.
+	confirmed, err := runPluginConfirm(ctx, out, prompt, false)
+	if err != nil {
 		return false, fmt.Errorf("confirm: %w", err)
 	}
 	return confirmed, nil
@@ -405,7 +401,7 @@ func confirmPluginAction(ctx context.Context, prompt string, assumeYes bool) (bo
 // wrapped, and errConfirmNeedsTerminal propagates unchanged so the caller
 // decides whether an unattended run may proceed without an answer.
 func confirmInstallOrCancel(ctx context.Context, out io.Writer, prompt string, assumeYes bool) (bool, error) {
-	ok, err := confirmPluginAction(ctx, prompt, assumeYes)
+	ok, err := confirmPluginAction(ctx, out, prompt, assumeYes)
 	switch {
 	case errors.Is(err, errConfirmNeedsTerminal):
 		return false, err
@@ -755,7 +751,7 @@ in scripts and non-interactive runs.`,
 			// binary and links it onto PATH in one keystroke. The picker also
 			// only shows name and description, so the repository the binary
 			// actually comes from is named here for the first time.
-			out := cmd.OutOrStdout()
+			out := cmd.ErrOrStderr()
 			prompt := fmt.Sprintf("Install %q?", choice)
 			if entry := idx.Find(choice); entry != nil {
 				prompt = fmt.Sprintf("Install %q from %s?", choice, redactURL(entry.RepoURL))
diff --git a/cmd/entire/cli/plugin_on_demand.go b/cmd/entire/cli/plugin_on_demand.go
index ef604c791a..3468373146 100644
--- a/cmd/entire/cli/plugin_on_demand.go
+++ b/cmd/entire/cli/plugin_on_demand.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	"charm.land/huh/v2"
 	"github.com/entireio/cli/cmd/entire/cli/interactive"
 	"github.com/spf13/cobra"
 )
@@ -21,11 +20,11 @@ func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name stri
 	if err := ctx.Err(); err != nil {
 		return "", fmt.Errorf("install plugin: %w", err)
 	}
-	confirmed := true
-	form := NewAccessibleForm(huh.NewGroup(
-		huh.NewConfirm().Title(fmt.Sprintf("Install the entire-%s plugin?", name)).Value(&confirmed),
-	)).WithInput(rootCmd.InOrStdin()).WithOutput(rootCmd.ErrOrStderr())
-	if err := form.RunWithContext(ctx); err != nil {
+	confirmed, err := runPluginConfirm(ctx, rootCmd.ErrOrStderr(), fmt.Sprintf("Install the entire-%s plugin?", name), true)
+	if err != nil {
+		if ctx.Err() != nil {
+			return "", err
+		}
 		return "", handleFormCancellation(rootCmd.ErrOrStderr(), "Install", err)
 	}
 	if !confirmed {
@@ -44,6 +43,9 @@ func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name stri
 	if err := onDemandPluginInstall(ctx, cmd, installSource{Kind: installFromIndex, Ref: name}, remoteInstallFlags{}); err != nil {
 		return "", err
 	}
+	if err := ctx.Err(); err != nil {
+		return "", fmt.Errorf("install plugin: %w", err)
+	}
 	installed, err := FindInstalledPlugin(name)
 	if err != nil {
 		return "", err
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
index 44ca1deaed..a12bc9387b 100644
--- a/cmd/entire/cli/plugin_on_demand_test.go
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -30,16 +31,20 @@ func TestMaybeRunPlugin_MissingGraphNonInteractive(t *testing.T) { //nolint:para
 
 func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest // isolates environment and installer seam
 	for _, tc := range []struct {
-		name        string
-		answer      string
-		installErr  error
-		pluginCode  int
-		wantCode    int
-		wantInstall bool
-		wantRun     bool
+		name          string
+		answer        string
+		installErr    error
+		cancelInstall bool
+		pluginCode    int
+		wantCode      int
+		wantInstall   bool
+		wantRun       bool
 	}{
 		{name: "enter accepts default yes", answer: "\n", wantInstall: true, wantRun: true},
 		{name: "explicit yes preserves exit code", answer: "y\n", pluginCode: 42, wantCode: 42, wantInstall: true, wantRun: true},
+		{name: "cancelled install stays quiet", answer: "y\n", cancelInstall: true, installErr: context.Canceled, wantCode: 1, wantInstall: true},
+		{name: "cancelled dependency confirmation does not run", answer: "y\n", cancelInstall: true, wantCode: 1, wantInstall: true},
+		{name: "EOF declines", answer: "", wantCode: 1},
 		{name: "no cancels", answer: "n\n", wantCode: 1},
 		{name: "failed install does not run", answer: "\n", installErr: errors.New("download failed"), wantCode: 1, wantInstall: true},
 	} {
@@ -54,10 +59,15 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			argFile := filepath.Join(dir, "args.txt")
 			sourceDir := t.TempDir()
 			source := writePluginBinary(t, sourceDir, "entire-graph", argFile, tc.pluginCode)
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
 			installCalls := 0
 			original := onDemandPluginInstall
 			onDemandPluginInstall = func(_ context.Context, cmd *cobra.Command, src installSource, flags remoteInstallFlags) error {
 				installCalls++
+				if tc.cancelInstall {
+					cancel()
+				}
 				if src.Kind != installFromIndex || src.Ref != "graph" || flags != (remoteInstallFlags{}) {
 					t.Fatalf("unexpected install request: %+v %+v", src, flags)
 				}
@@ -73,9 +83,13 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			var stdout, stderr bytes.Buffer
 			root.SetOut(&stdout)
 			root.SetErr(&stderr)
-			root.SetIn(strings.NewReader(tc.answer))
+			originalInput := openPluginPromptInput
+			openPluginPromptInput = func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader(tc.answer)), nil }
+			t.Cleanup(func() { openPluginPromptInput = originalInput })
+			data := strings.NewReader("plugin data\n")
+			root.SetIn(data)
 			args := []string{"graph", "search", "two words", "--json", "--", "$(untouched)", ""}
-			handled, code := MaybeRunPlugin(t.Context(), root, args)
+			handled, code := MaybeRunPlugin(ctx, root, args)
 			if !handled || code != tc.wantCode {
 				t.Fatalf("handled=%v code=%d, want true, %d; stderr=%s", handled, code, tc.wantCode, &stderr)
 			}
@@ -85,6 +99,9 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			if !strings.Contains(stderr.String(), "Install the entire-graph plugin?") || !strings.Contains(stderr.String(), "[Y/n]") {
 				t.Errorf("missing Yes-default prompt: %q", stderr.String())
 			}
+			if data.Len() != len("plugin data\n") {
+				t.Error("confirmation consumed plugin stdin")
+			}
 			if stdout.Len() != 0 {
 				t.Errorf("installation polluted stdout: %q", stdout.String())
 			}
@@ -96,7 +113,10 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			} else if !os.IsNotExist(err) {
 				t.Errorf("plugin unexpectedly ran: args=%q err=%v", got, err)
 			}
-			if tc.installErr != nil && !strings.Contains(stderr.String(), tc.installErr.Error()) {
+			if tc.cancelInstall && strings.Contains(stderr.String(), "context canceled") {
+				t.Errorf("raw cancellation: %s", &stderr)
+			}
+			if tc.installErr != nil && !tc.cancelInstall && !strings.Contains(stderr.String(), tc.installErr.Error()) {
 				t.Errorf("missing install failure: %q", stderr.String())
 			}
 		})
diff --git a/cmd/entire/cli/plugin_progress_test.go b/cmd/entire/cli/plugin_progress_test.go
index 2c4a9fffd8..a8ab439484 100644
--- a/cmd/entire/cli/plugin_progress_test.go
+++ b/cmd/entire/cli/plugin_progress_test.go
@@ -40,7 +40,6 @@ func TestPluginInstallReportsStagesOnStderr(t *testing.T) { //nolint:paralleltes
 		"Fetching plugin metadata for v0.1.0...",
 		"Locating plugin release files...",
 		"Downloading plugin archive...",
-		"Verifying plugin checksum...",
 		"Installing entire-demo v0.1.0...",
 	}
 	if got, want := errOut.String(), strings.Join(stages, "\n")+"\n"; got != want {
diff --git a/cmd/entire/main.go b/cmd/entire/main.go
index 4c48b34887..cd53940eda 100644
--- a/cmd/entire/main.go
+++ b/cmd/entire/main.go
@@ -81,6 +81,9 @@ func main() {
 	restorePATH := cli.PrependPluginBinDirToPATH(ctx)
 
 	if handled, code := cli.MaybeRunPlugin(ctx, rootCmd, os.Args[1:]); handled {
+		if ctx.Err() != nil && procsignal.Load() != nil {
+			dieFromSignal(terminatingSignal())
+		}
 		cancel()
 		os.Exit(code)
 	}
diff --git a/docs/architecture/external-commands.md b/docs/architecture/external-commands.md
index 15f144100d..ae11ddcbba 100644
--- a/docs/architecture/external-commands.md
+++ b/docs/architecture/external-commands.md
@@ -20,7 +20,7 @@ Rules, in order:
 
 ### Managed install directory
 
-Remote installs report index lookup, release metadata, download, checksum verification, and installation progress on stderr. Styled terminals show a spinner; non-terminal and accessibility output prints plain status lines as each step starts. Progress stops before confirmations and results, including when installation fails. The same reporting applies when `entire graph` offers to install its missing plugin and when installing dependencies.
+Remote installs report index lookup, release metadata, download (including checksum verification), and installation progress on stderr. Styled terminals show a spinner; non-terminal and accessibility output prints plain status lines as each step starts. Progress stops before confirmations and results, including when installation fails. The same reporting applies when `entire graph` offers to install its missing plugin and when installing dependencies. Asset-name probes share one download status per release. Confirmations read from the controlling terminal and render to the supplied output writer (stderr for on-demand installs and dependency prompts), preserving piped plugin input and output. EOF declines installation; cancellation stops the prompt and preserves signal termination.
 
 Users can drop binaries anywhere on `$PATH`, but a per-user managed directory is also automatically discovered:
 
diff --git a/go.mod b/go.mod
index 0bbfc1f5dc..b1bae8ac82 100644
--- a/go.mod
+++ b/go.mod
@@ -50,7 +50,10 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 )
 
-require github.com/lastpersonlabs/goredact v0.1.0
+require (
+	github.com/lastpersonlabs/goredact v0.1.0
+	github.com/muesli/cancelreader v0.2.2
+)
 
 require (
 	dario.cat/mergo v1.0.2 // indirect
@@ -116,7 +119,6 @@ require (
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/nwaples/rardecode/v2 v2.2.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/pierrec/lz4/v4 v4.1.26 // indirect

From 270d17b54eab45ddb0704a415b44a08c493de0b1 Mon Sep 17 00:00:00 2001
From: Thomas Dohmke <thomas@dohmke.de>
Date: Wed, 9 Sep 2026 17:48:06 +0200
Subject: [PATCH 17/59] fix: close plugin confirmation input exactly once

Entire-Checkpoint: 01M23DNRDKQ7Z7SYTXZ4PBT5SB
---
 cmd/entire/cli/plugin_confirm.go      |  6 +-
 cmd/entire/cli/plugin_confirm_test.go | 92 ++++++++++++++++++---------
 2 files changed, 65 insertions(+), 33 deletions(-)

diff --git a/cmd/entire/cli/plugin_confirm.go b/cmd/entire/cli/plugin_confirm.go
index 15920963a8..6b274c442c 100644
--- a/cmd/entire/cli/plugin_confirm.go
+++ b/cmd/entire/cli/plugin_confirm.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"sync"
 
 	tea "charm.land/bubbletea/v2"
 	"charm.land/huh/v2"
@@ -32,7 +33,8 @@ func runPluginConfirm(ctx context.Context, out io.Writer, prompt string, default
 	if err != nil {
 		return false, err
 	}
-	defer input.Close()
+	closeInput := sync.OnceFunc(func() { _ = input.Close() })
+	defer closeInput()
 	answer := defaultYes
 	form := NewAccessibleForm(huh.NewGroup(huh.NewConfirm().Title(prompt).Value(&answer))).WithOutput(out).WithInput(input)
 	if IsAccessibleMode() {
@@ -49,7 +51,7 @@ func runPluginConfirm(ctx context.Context, out io.Writer, prompt string, default
 				// Some platforms cannot cancel reads on a separately opened
 				// terminal. This descriptor belongs to the prompt, so closing
 				// it is safe and also releases a blocked read.
-				_ = input.Close()
+				closeInput()
 			}
 			close(cancelled)
 		})
diff --git a/cmd/entire/cli/plugin_confirm_test.go b/cmd/entire/cli/plugin_confirm_test.go
index fd8badb721..2946f29981 100644
--- a/cmd/entire/cli/plugin_confirm_test.go
+++ b/cmd/entire/cli/plugin_confirm_test.go
@@ -28,38 +28,55 @@ func TestPluginDependencyConfirmationUsesWriter(t *testing.T) { //nolint:paralle
 }
 
 func TestPluginAccessibleConfirmationCancellation(t *testing.T) { //nolint:paralleltest // isolates terminal opener and accessibility
-	t.Setenv("ACCESSIBLE", "1")
-	input, writer, err := os.Pipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer writer.Close()
-	original := openPluginPromptInput
-	openPluginPromptInput = func() (io.ReadCloser, error) { return input, nil }
-	t.Cleanup(func() { openPluginPromptInput = original })
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-	ready := make(chan struct{}, 1)
-	result := make(chan error, 1)
-	go func() {
-		_, promptErr := runPluginConfirm(ctx, pluginPromptNotifyWriter{ready}, "Install?", true)
-		result <- promptErr
-	}()
-	select {
-	case <-ready:
-	case <-time.After(5 * time.Second):
-		t.Fatal("prompt did not start")
-	}
-	cancel()
-	select {
-	case err := <-result:
-		if !errors.Is(err, context.Canceled) {
-			t.Fatalf("got %v, want cancellation", err)
+	for _, fallback := range []bool{false, true} {
+		name := "pollable input"
+		if fallback {
+			name = "fallback input"
 		}
-	case <-time.After(5 * time.Second):
-		_ = writer.Close()
-		<-result
-		t.Fatal("accessible prompt did not stop on cancellation")
+		t.Run(name, func(t *testing.T) {
+			t.Setenv("ACCESSIBLE", "1")
+			input, writer, err := os.Pipe()
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer writer.Close()
+			tracked := &pluginPromptCloseTracker{ReadCloser: input}
+			original := openPluginPromptInput
+			openPluginPromptInput = func() (io.ReadCloser, error) {
+				if fallback {
+					return tracked, nil
+				}
+				return input, nil
+			}
+			t.Cleanup(func() { openPluginPromptInput = original })
+			ctx, cancel := context.WithCancel(t.Context())
+			defer cancel()
+			ready := make(chan struct{}, 1)
+			result := make(chan error, 1)
+			go func() {
+				_, promptErr := runPluginConfirm(ctx, pluginPromptNotifyWriter{ready}, "Install?", true)
+				result <- promptErr
+			}()
+			select {
+			case <-ready:
+			case <-time.After(5 * time.Second):
+				t.Fatal("prompt did not start")
+			}
+			cancel()
+			select {
+			case err := <-result:
+				if !errors.Is(err, context.Canceled) {
+					t.Fatalf("got %v, want cancellation", err)
+				}
+			case <-time.After(5 * time.Second):
+				_ = writer.Close()
+				<-result
+				t.Fatal("accessible prompt did not stop on cancellation")
+			}
+			if fallback && tracked.closes != 1 {
+				t.Fatalf("input closed %d times, want exactly once", tracked.closes)
+			}
+		})
 	}
 }
 
@@ -72,3 +89,16 @@ func (w pluginPromptNotifyWriter) Write(p []byte) (int, error) {
 	}
 	return len(p), nil
 }
+
+// Hiding the file descriptor forces cancelreader's non-pollable fallback:
+// Cancel returns false, so closing the input must unblock the prompt.
+type pluginPromptCloseTracker struct {
+	io.ReadCloser
+
+	closes int
+}
+
+func (r *pluginPromptCloseTracker) Close() error {
+	r.closes++
+	return r.ReadCloser.Close()
+}

From 6cd08c498c5f93f59debe4460c88f9f51228c3a5 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Wed, 9 Sep 2026 12:07:03 -0700
Subject: [PATCH 18/59] fix(status): report disabled checkpoint pushing

---
 cmd/entire/cli/status.go      |  27 ++++-
 cmd/entire/cli/status_test.go | 203 ++++++++++++++++++++++++++++++++++
 2 files changed, 224 insertions(+), 6 deletions(-)

diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index 5150d2bee0..76ec9a8dec 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -332,9 +332,12 @@ const checkpointSyncSourceDedicated = "dedicated"
 // drift. Everything here reads local state only (settings, .git/config, local
 // refs, the push queue) — status must stay network-free.
 type checkpointSyncInfo struct {
+	// PushDisabled reflects the explicit automatic-push setting, not every
+	// possible reason checkpoint sync might fail.
+	PushDisabled bool
 	// Remote is the elected git remote name, or the org/repo slug in
-	// dedicated checkpoint_remote mode. Empty when nothing resolved (no
-	// remotes configured, or the fail-closed case).
+	// dedicated checkpoint_remote mode. Empty when pushing is disabled or
+	// nothing resolved (no remotes configured, or the fail-closed case).
 	Remote string
 	// Source is config|observed|default|sole|first (resolver values) or
 	// "dedicated".
@@ -354,6 +357,10 @@ type checkpointSyncInfo struct {
 }
 
 func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpointSyncInfo {
+	if s.IsPushSessionsDisabled() {
+		return checkpointSyncInfo{PushDisabled: true}
+	}
+
 	elected, err := strategy.ResolveCheckpointSyncRemote(ctx)
 	if err != nil {
 		// Fail-closed: checkpoint_push_remote names a remote that does not
@@ -426,13 +433,15 @@ func countUnpushedCheckpointsForStatus(ctx context.Context, remoteName string) i
 	return n
 }
 
-// writeCheckpointSyncLines appends the checkpoint sync destination line (and
-// the unpushed counter, when non-zero) to the enabled status block. Rendered
-// whenever something resolved: an elected remote, a dedicated store, or the
-// fail-closed misconfiguration. No remotes configured -> no lines.
+// writeCheckpointSyncLines reports disabled automatic pushing or the checkpoint
+// sync destination (and the unpushed counter, when non-zero) in the enabled status
+// block. With pushing enabled, no remotes configured means no lines.
 func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *EntireSettings, sty statusStyles) {
 	info := computeCheckpointSyncInfo(ctx, s)
 	switch {
+	case info.PushDisabled:
+		b.WriteString("\n  Automatic checkpoint pushing: disabled (push_sessions=false)")
+		return
 	case info.Err != "":
 		b.WriteString("\n")
 		b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
@@ -851,6 +860,11 @@ type statusJSON struct {
 	// CodexHooks reports effective discovery/trust warnings separately from
 	// current-checkout installation and freshness semantics.
 	CodexHooks *codexHooksStatusJSON `json:"codex_hooks,omitempty"`
+	// CheckpointPushDisabled is emitted only when Entire is enabled and the
+	// effective push_sessions setting is false. Its absence does not guarantee
+	// that a push can succeed. Sync destination, error, and count fields are
+	// omitted while pushing is disabled.
+	CheckpointPushDisabled bool `json:"checkpoint_push_disabled,omitempty"`
 	// CheckpointSyncRemote is the elected checkpoint sync remote name, or the
 	// org/repo slug in dedicated checkpoint_remote mode. Deliberately not named
 	// checkpoint_remote, which is the existing GitHub-coupled setting.
@@ -947,6 +961,7 @@ func runStatusJSON(ctx context.Context, w io.Writer) error {
 		// Same computation as the text path (writeCheckpointSyncLines);
 		// empty fields drop out via omitempty when nothing resolved.
 		syncInfo := computeCheckpointSyncInfo(ctx, s)
+		result.CheckpointPushDisabled = syncInfo.PushDisabled
 		result.CheckpointSyncRemote = syncInfo.Remote
 		result.CheckpointSyncRemoteSource = syncInfo.Source
 		result.CheckpointSyncError = syncInfo.Err
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index 8500458185..b38a6eec1e 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -26,6 +26,7 @@ import (
 	"github.com/entireio/cli/redact"
 
 	"github.com/go-git/go-git/v6"
+	"github.com/go-git/go-git/v6/plumbing"
 	"github.com/go-git/go-git/v6/plumbing/object"
 )
 
@@ -2288,6 +2289,208 @@ func TestRunStatus_PrintsBothReviewAndInvestigation(t *testing.T) {
 
 // --- Checkpoint sync visibility (single-remote gate observability) ---
 
+func TestRunStatus_CheckpointPushDisabled(t *testing.T) {
+	testCheckpointPushDisabledFork(t, false)
+}
+
+func TestRunStatusJSON_CheckpointPushDisabled(t *testing.T) {
+	testCheckpointPushDisabledFork(t, true)
+}
+
+func testCheckpointPushDisabledFork(t *testing.T, jsonOutput bool) {
+	t.Helper()
+	// setupTestRepo changes CWD and git-config isolation changes process env.
+	testutil.IsolateGitConfigEnv(t)
+	setupTestRepo(t)
+	writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false,"checkpoint_push_remote":"fork"}}`)
+	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+	testutil.AddRemote(t, ".", "fork", "https://github.com/user/repo.git")
+	head := checkpointSyncTestCommit(t, "a.txt", "one")
+	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
+	assertCheckpointPushDisabledStatus(t, jsonOutput, false)
+}
+
+func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool) {
+	t.Helper()
+	var stdout bytes.Buffer
+	if err := runStatus(context.Background(), &stdout, detailed, jsonOutput); err != nil {
+		t.Fatalf("runStatus() error = %v", err)
+	}
+	t.Logf("status output:\n%s", stdout.String())
+	if jsonOutput {
+		var result map[string]json.RawMessage
+		if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
+			t.Fatalf("json.Unmarshal() error = %v", err)
+		}
+		for _, key := range []string{"enabled", "checkpoint_push_disabled"} {
+			raw, exists := result[key]
+			if !exists {
+				t.Errorf("missing %s", key)
+				continue
+			}
+			var value bool
+			if err := json.Unmarshal(raw, &value); err != nil || !value {
+				t.Errorf("%s = %s, want true (decode error: %v)", key, raw, err)
+			}
+		}
+		for _, key := range []string{"checkpoint_sync_remote", "checkpoint_sync_remote_source", "checkpoint_sync_error", "unpushed_checkpoints", "checkpoint_remote_ignored", "checkpoint_remote_ignored_reason"} {
+			if value, exists := result[key]; exists {
+				t.Errorf("disabled pushing must omit %s, got %s", key, value)
+			}
+		}
+		return
+	}
+	if !strings.Contains(stdout.String(), "Automatic checkpoint pushing: disabled (push_sessions=false)") {
+		t.Error("missing automatic checkpoint pushing disabled message")
+	}
+	for _, unwanted := range []string{"Checkpoints sync to:", "Checkpoints NOT syncing:", "not yet", "next 'git push", "is not in use:"} {
+		if strings.Contains(stdout.String(), unwanted) {
+			t.Errorf("disabled pushing must not show %q", unwanted)
+		}
+	}
+}
+
+func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
+	// These subtests mutate CWD and environment and cannot run in parallel.
+	for _, backend := range []string{"git-branch", "git-refs"} {
+		for _, tc := range []struct {
+			name    string
+			options string
+			origin  string
+		}{
+			{"origin", "", "https://github.com/org/repo.git"},
+			{"explicit_fork", `,"checkpoint_push_remote":"fork"`, "https://github.com/org/repo.git"},
+			{"dedicated", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/org/repo.git"},
+			{"inherited_dedicated_rejected", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/other/repo.git"},
+			{"no_remotes", "", ""},
+			{"missing_configured_remote", `,"checkpoint_push_remote":"gone"`, "https://github.com/org/repo.git"},
+		} {
+			t.Run(backend+"/"+tc.name, func(t *testing.T) {
+				testutil.IsolateGitConfigEnv(t)
+				setupTestRepo(t)
+				writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false`+tc.options+`},"checkpoints":{"primary":{"type":"`+backend+`"}}}`)
+				if tc.origin != "" {
+					testutil.AddRemote(t, ".", "origin", tc.origin)
+				}
+				if tc.name == "explicit_fork" {
+					testutil.AddRemote(t, ".", "fork", "https://github.com/user/repo.git")
+				}
+				head := checkpointSyncTestCommit(t, "a.txt", "one")
+				testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
+				cwd, err := os.Getwd()
+				if err != nil {
+					t.Fatal(err)
+				}
+				queue := checkpoint.NewPushQueue(filepath.Join(cwd, ".git"))
+				if backend == "git-refs" {
+					for _, ref := range []string{"refs/entire/checkpoints/aa/bb0000000001", "refs/entire/checkpoints/aa/bb0000000002"} {
+						if err := queue.Enqueue(plumbing.ReferenceName(ref)); err != nil {
+							t.Fatal(err)
+						}
+					}
+				}
+				before, err := queue.Peek()
+				if err != nil {
+					t.Fatal(err)
+				}
+				for _, jsonOutput := range []bool{false, true} {
+					assertCheckpointPushDisabledStatus(t, jsonOutput, false)
+					after, err := queue.Peek()
+					if err != nil {
+						t.Fatal(err)
+					}
+					if !slices.Equal(before, after) {
+						t.Errorf("status changed pending queue: before=%v after=%v", before, after)
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestRunStatus_CheckpointPushDisabledSettingsPrecedence(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		shared   string
+		local    string
+		disabled bool
+	}{
+		{"local_false_overrides_shared_true", `{"enabled":true,"strategy_options":{"push_sessions":true}}`, `{"strategy_options":{"push_sessions":false}}`, true},
+		{"local_true_overrides_shared_false", `{"enabled":true,"strategy_options":{"push_sessions":false}}`, `{"strategy_options":{"push_sessions":true}}`, false},
+		{"absent", `{"enabled":true}`, "", false},
+		{"explicit_true", `{"enabled":true,"strategy_options":{"push_sessions":true}}`, "", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			testutil.IsolateGitConfigEnv(t)
+			setupTestRepo(t)
+			writeSettings(t, tc.shared)
+			if tc.local != "" {
+				testutil.WriteFile(t, ".", ".entire/settings.local.json", tc.local)
+			}
+			testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+			head := checkpointSyncTestCommit(t, "a.txt", "one")
+			testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
+			for _, jsonOutput := range []bool{false, true} {
+				if tc.disabled {
+					assertCheckpointPushDisabledStatus(t, jsonOutput, true)
+					continue
+				}
+				var stdout bytes.Buffer
+				if err := runStatus(context.Background(), &stdout, false, jsonOutput); err != nil {
+					t.Fatal(err)
+				}
+				if jsonOutput {
+					var result map[string]json.RawMessage
+					if err := json.Unmarshal(stdout.Bytes(), &result); err != nil {
+						t.Fatal(err)
+					}
+					if _, exists := result["checkpoint_push_disabled"]; exists {
+						t.Errorf("enabled pushing must omit checkpoint_push_disabled: %s", stdout.String())
+					}
+					if string(result["checkpoint_sync_remote"]) != `"origin"` || string(result["checkpoint_sync_remote_source"]) != `"default"` || string(result["unpushed_checkpoints"]) != "1" {
+						t.Errorf("enabled pushing lost existing destination/counter fields: %s", stdout.String())
+					}
+				} else if strings.Contains(stdout.String(), "Automatic checkpoint pushing:") || !strings.Contains(stdout.String(), "Checkpoints sync to: origin") || !strings.Contains(stdout.String(), "next 'git push origin'") {
+					t.Errorf("enabled pushing changed existing output: %s", stdout.String())
+				}
+			}
+		})
+	}
+}
+
+func TestRunStatus_CheckpointPushDisabledAbsentWithoutEnabledEntire(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		settings string
+	}{
+		{"entire_disabled", `{"enabled":false,"strategy_options":{"push_sessions":false}}`},
+		{"not_set_up", ""},
+		{"invalid_settings", `{"enabled":true,"strategy_options":{"push_sessions":false},`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			testutil.IsolateGitConfigEnv(t)
+			setupTestRepo(t)
+			if tc.settings != "" {
+				writeSettings(t, tc.settings)
+			}
+			for _, jsonOutput := range []bool{false, true} {
+				var stdout bytes.Buffer
+				err := runStatus(context.Background(), &stdout, false, jsonOutput)
+				if tc.name == "invalid_settings" && !jsonOutput {
+					if err == nil || !strings.Contains(err.Error(), "failed to load settings") {
+						t.Fatalf("invalid text settings error = %v", err)
+					}
+				} else if err != nil {
+					t.Fatal(err)
+				}
+				if strings.Contains(stdout.String(), "checkpoint_push_disabled") || strings.Contains(stdout.String(), "Automatic checkpoint pushing:") {
+					t.Errorf("inactive Entire must omit disabled-pushing status: %s", stdout.String())
+				}
+			}
+		})
+	}
+}
+
 // checkpointSyncTestCommit creates a commit in the cwd test repo and returns
 // its hash. setupTestRepo leaves the repo without commits, and both the v1
 // counter and ref updates need at least one.

From 69af387481b5b8219af4c3c4c3ed584c98f15ed5 Mon Sep 17 00:00:00 2001
From: Kai Ramuenke <kai@entire.io>
Date: Thu, 10 Sep 2026 10:26:00 +1000
Subject: [PATCH 19/59] coreapi: regenerate the client from the current core
 spec

The control plane gained the branch-protection resource and several new
operations since the last refresh. Two spec changes needed normalizer
support before ogen would consume it: every operation now lists the
interactive oauth2/oidc login schemes, which ogen cannot generate, and the
repo read models gained required enum fields the CLI never reads. The
normalizer drops the interactive schemes, loosens the new provider enums,
and makes Repo.provider and Repo.capabilities optional, so the generated
SecuritySource and the decoding tolerance stay as they were.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 internal/coreapi/UPSTREAM.md                  |    33 +
 internal/coreapi/client_test.go               |     5 +-
 internal/coreapi/oas_cfg_gen.go               |     1 +
 internal/coreapi/oas_client_gen.go            |  5733 +++-
 internal/coreapi/oas_json_gen.go              | 24303 +++++++++++-----
 internal/coreapi/oas_operations_gen.go        |   152 +-
 internal/coreapi/oas_parameters_gen.go        |   171 +-
 internal/coreapi/oas_request_encoders_gen.go  |   102 +-
 internal/coreapi/oas_response_decoders_gen.go |  2691 +-
 internal/coreapi/oas_schemas_gen.go           | 12926 +++++---
 internal/coreapi/oas_security_gen.go          |   298 +-
 internal/coreapi/oas_validators_gen.go        |  1463 +-
 internal/coreapi/spec/core.gen.json           |  7175 +++--
 internal/coreapi/spec/core.openapi.json       | 10782 +++++--
 internal/coreapi/spec/normalize.go            |   142 +-
 15 files changed, 46461 insertions(+), 19516 deletions(-)

diff --git a/internal/coreapi/UPSTREAM.md b/internal/coreapi/UPSTREAM.md
index bf2dd04f41..4d370d8a34 100644
--- a/internal/coreapi/UPSTREAM.md
+++ b/internal/coreapi/UPSTREAM.md
@@ -51,6 +51,39 @@ loosened; request-body enums stay strict. Locked in by
 `TestListProjectRepos_UnknownEnumValuesPassThrough` in `client_test.go`.
 Retire the allowlist entries as upstream loosens the corresponding fields.
 
+## 2b. New read-model fields ship as `required`
+
+**Symptom:** `Repo.provider` and `Repo.capabilities` were added as
+`required`. ogen's decoder then fails the whole response when a field is
+absent, so a core that predates the field, or a mixed-version roll, breaks
+every `repo list` and repo-get call in a client that never reads either
+field.
+
+**Fix upstream:** add read-model fields as optional until every deployment
+sends them, then tighten.
+
+**Workaround:** `spec/normalize.go` (`loosenReadModelRequired`, allowlist
+`readModelOptionalFields`) drops the listed fields from `required`.
+`Repo.provider` is also in `readModelEnumFields`, since it is a display-only
+enum. Remove an entry when the CLI starts reading the field.
+
+## 3. Every operation advertises the interactive login schemes
+
+**Symptom:** the spec lists four security alternatives on every operation
+(`oauth2`, `oidc`, `bearerAuth`, `sessionAuth`). `oauth2` and `oidc`
+describe how a browser or device obtains a token; a client that already
+holds a bearer never drives them. ogen has no generator for `openIdConnect`
+and aborts on it, so the spec cannot be consumed as published.
+
+**Fix upstream:** advertise `oauth2`/`oidc` in `components.securitySchemes`
+for documentation, but list only `bearerAuth` and `sessionAuth` as the
+per-operation requirements, since those are what a request actually carries.
+
+**Workaround:** `spec/normalize.go` (`dropInteractiveSecurity`,
+`interactiveSecuritySchemes`) removes the two schemes from the components
+and from every security list, so the generated `SecuritySource` keeps the
+`BearerAuth` and `SessionAuth` methods the client implements.
+
 <!-- Resolved upstream and removed:
   - Nullable arrays (`"type": ["array","null"]`) — entiredb now emits
     non-nullable arrays (`"type": "array"`, absent ⇒ `[]`), so the
diff --git a/internal/coreapi/client_test.go b/internal/coreapi/client_test.go
index a49361c2bc..5b69b81d58 100644
--- a/internal/coreapi/client_test.go
+++ b/internal/coreapi/client_test.go
@@ -263,8 +263,9 @@ func TestListProjectRepos_UnknownEnumValuesPassThrough(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		// Values the current spec's enums did NOT allow.
-		if _, err := w.Write([]byte(`{"repos":[{"id":"01H000000000000000000000A1","owningProjectId":"01H000000000000000000000P1","name":"demo","state":"archiving","visibility":"internal","objectFormat":"sha512"}]}`)); err != nil {
+		// Values the current spec's enums did NOT allow, and no
+		// "capabilities": a required-but-unread field must not be needed.
+		if _, err := w.Write([]byte(`{"repos":[{"id":"01H000000000000000000000A1","owningProjectId":"01H000000000000000000000P1","name":"demo","state":"archiving","visibility":"internal","objectFormat":"sha512","provider":"gitlab"}]}`)); err != nil {
 			t.Errorf("writing test response: %v", err)
 		}
 	}))
diff --git a/internal/coreapi/oas_cfg_gen.go b/internal/coreapi/oas_cfg_gen.go
index d4e3f83ed6..fb6c9dade2 100644
--- a/internal/coreapi/oas_cfg_gen.go
+++ b/internal/coreapi/oas_cfg_gen.go
@@ -11,6 +11,7 @@ import (
 
 var regexMap = map[string]ogenregex.Regexp{
 	"^[0-9A-HJKMNP-TV-Z]{26}$": ogenregex.MustCompile("^[0-9A-HJKMNP-TV-Z]{26}$"),
+	"^[a-z0-9][a-z0-9-]*$":     ogenregex.MustCompile("^[a-z0-9][a-z0-9-]*$"),
 }
 
 type (
diff --git a/internal/coreapi/oas_client_gen.go b/internal/coreapi/oas_client_gen.go
index c97f1c3512..4c007c8092 100644
--- a/internal/coreapi/oas_client_gen.go
+++ b/internal/coreapi/oas_client_gen.go
@@ -27,12 +27,6 @@ type Invoker interface {
 	//
 	// POST /orgs/{orgId}/members
 	AddOrgMember(ctx context.Context, request *AddOrgMemberInputBody, params AddOrgMemberParams) (*Membership, error)
-	// BatchLookup invokes batchLookup operation.
-	//
-	// Batch-resolve (type, id) refs to enriched records.
-	//
-	// POST /lookup
-	BatchLookup(ctx context.Context, request *BatchLookupInputBody) (*BatchLookupOutputBody, error)
 	// CancelDeletion invokes cancelDeletion operation.
 	//
 	// Cancel a pending deletion request for the calling account.
@@ -45,6 +39,12 @@ type Invoker interface {
 	//
 	// POST /me/onboarding/complete
 	CompleteOnboarding(ctx context.Context) (*CompleteOnboardingOutputBody, error)
+	// ConnectOrgCIBuildkiteCredential invokes connectOrgCIBuildkiteCredential operation.
+	//
+	// Connect or rotate an org's Buildkite API credential.
+	//
+	// POST /orgs/{orgId}/ci/buildkite/credential
+	ConnectOrgCIBuildkiteCredential(ctx context.Context, request *ConnectOrgCIBuildkiteCredentialInputBody, params ConnectOrgCIBuildkiteCredentialParams) (*OrgCIBuildkiteCredentialView, error)
 	// CreateBinding invokes createBinding operation.
 	//
 	// Create OIDC binding.
@@ -64,6 +64,12 @@ type Invoker interface {
 	//
 	// POST /mirror-requests
 	CreateMirrorRequest(ctx context.Context, request *CreateMirrorRequestInputBody) (*MirrorRequestHeaders, error)
+	// CreateNativeMirror invokes createNativeMirror operation.
+	//
+	// Create a native-mirror placement.
+	//
+	// POST /repos/{repoId}/native-mirrors
+	CreateNativeMirror(ctx context.Context, request *CreateNativeMirrorInputBody, params CreateNativeMirrorParams) (*NativeMirrorPlacement, error)
 	// CreateOrg invokes createOrg operation.
 	//
 	// Create organization.
@@ -87,7 +93,7 @@ type Invoker interface {
 	// Enroll a repo into a CI webhook (Buildkite).
 	//
 	// POST /repos/{repoId}/ci-webhooks
-	CreateRepoCIWebhook(ctx context.Context, request *CreateRepoCIWebhookInputBody, params CreateRepoCIWebhookParams) (*CIWebhookView, error)
+	CreateRepoCIWebhook(ctx context.Context, request *CreateRepoCIWebhookInputBody, params CreateRepoCIWebhookParams) (*CreateRepoCIWebhookBody, error)
 	// CreateServiceAccount invokes createServiceAccount operation.
 	//
 	// Create service account.
@@ -112,12 +118,30 @@ type Invoker interface {
 	//
 	// DELETE /mirrors
 	DeleteMirror(ctx context.Context, params DeleteMirrorParams) error
+	// DeleteNativeMirror invokes deleteNativeMirror operation.
+	//
+	// Delete a native-mirror placement.
+	//
+	// DELETE /repos/{repoId}/native-mirrors/{clusterSlug}
+	DeleteNativeMirror(ctx context.Context, params DeleteNativeMirrorParams) (*NativeMirrorPlacement, error)
 	// DeleteOrg invokes deleteOrg operation.
 	//
 	// Delete an organization.
 	//
 	// DELETE /orgs/{orgId}
 	DeleteOrg(ctx context.Context, params DeleteOrgParams) error
+	// DeleteOrgCIBuildkiteCluster invokes deleteOrgCIBuildkiteCluster operation.
+	//
+	// Remove a registered Buildkite cluster from an org.
+	//
+	// DELETE /orgs/{orgId}/ci/buildkite/clusters/{bkOrg}/{bkClusterId}
+	DeleteOrgCIBuildkiteCluster(ctx context.Context, params DeleteOrgCIBuildkiteClusterParams) error
+	// DeleteOrgCIBuildkiteCredential invokes deleteOrgCIBuildkiteCredential operation.
+	//
+	// Delete an org's connected Buildkite credential.
+	//
+	// DELETE /orgs/{orgId}/ci/buildkite/credential/{bkOrg}
+	DeleteOrgCIBuildkiteCredential(ctx context.Context, params DeleteOrgCIBuildkiteCredentialParams) error
 	// DeleteProject invokes deleteProject operation.
 	//
 	// Delete a project.
@@ -132,7 +156,15 @@ type Invoker interface {
 	DeleteRepo(ctx context.Context, params DeleteRepoParams) error
 	// DeleteRepoCIWebhook invokes deleteRepoCIWebhook operation.
 	//
-	// Delete a repo's CI webhook.
+	// Deletes the subscription AND tears down its enrollment identity: the automation row (when no
+	// sibling repo shares it), its expiring repo grant, and its Buildkite OIDC binding. The Buildkite
+	// pipeline itself is always kept. Pass keep_identity=true to delete only the subscription — for an
+	// immediate re-enroll that must preserve automation_id, since teardown retires it and a re-enroll
+	// declares a new one that only bk_force_rescaffold pushes into the pipeline. A retained identity
+	// holds read access on this repo until its grant lapses. A subscription enrolled before the
+	// automation principal has no automation to retire: the delete succeeds and removes only the
+	// subscription, reported as identity_retired=false on the ci_webhook_deleted audit event — the
+	// list an operator queries to hand-delete the leftover service accounts.
 	//
 	// DELETE /repos/{repoId}/ci-webhooks/{id}
 	DeleteRepoCIWebhook(ctx context.Context, params DeleteRepoCIWebhookParams) error
@@ -142,6 +174,12 @@ type Invoker interface {
 	//
 	// DELETE /service-accounts/{accountId}
 	DeleteServiceAccount(ctx context.Context, params DeleteServiceAccountParams) error
+	// GetBranchProtection invokes getBranchProtection operation.
+	//
+	// Get repository branch protection.
+	//
+	// GET /repos/{repoId}/branch-protection
+	GetBranchProtection(ctx context.Context, params GetBranchProtectionParams) (*BranchProtection, error)
 	// GetDeletionPreview invokes getDeletionPreview operation.
 	//
 	// Preview what deleting the calling account will erase, unlink, and block on.
@@ -274,12 +312,30 @@ type Invoker interface {
 	//
 	// GET /mirrors
 	ListMirrors(ctx context.Context, params ListMirrorsParams) (*ListMirrorsOutputBody, error)
+	// ListNativeMirrors invokes listNativeMirrors operation.
+	//
+	// List native-mirror placement status.
+	//
+	// GET /repos/{repoId}/native-mirrors
+	ListNativeMirrors(ctx context.Context, params ListNativeMirrorsParams) (*ListNativeMirrorsOutputBody, error)
 	// ListOIDCProviders invokes listOIDCProviders operation.
 	//
 	// List federated OIDC identity providers.
 	//
 	// GET /oidc-providers
 	ListOIDCProviders(ctx context.Context, params ListOIDCProvidersParams) (*ListOIDCProvidersOutputBody, error)
+	// ListOrgCIBuildkiteClusters invokes listOrgCIBuildkiteClusters operation.
+	//
+	// List an org's registered Buildkite clusters.
+	//
+	// GET /orgs/{orgId}/ci/buildkite/clusters
+	ListOrgCIBuildkiteClusters(ctx context.Context, params ListOrgCIBuildkiteClustersParams) (*ListOrgCIBuildkiteClustersOutputBody, error)
+	// ListOrgCIBuildkiteCredentials invokes listOrgCIBuildkiteCredentials operation.
+	//
+	// List an org's connected Buildkite credentials.
+	//
+	// GET /orgs/{orgId}/ci/buildkite/credentials
+	ListOrgCIBuildkiteCredentials(ctx context.Context, params ListOrgCIBuildkiteCredentialsParams) (*ListOrgCIBuildkiteCredentialsOutputBody, error)
 	// ListOrgMembers invokes listOrgMembers operation.
 	//
 	// List members of an organization.
@@ -316,18 +372,62 @@ type Invoker interface {
 	//
 	// GET /projects
 	ListProjects(ctx context.Context, params ListProjectsParams) (*ListProjectsOutputBody, error)
+	// ListRepoCIBuilds invokes listRepoCIBuilds operation.
+	//
+	// List a repo's CI build statuses.
+	//
+	// GET /repos/{repoId}/ci-builds
+	ListRepoCIBuilds(ctx context.Context, params ListRepoCIBuildsParams) (*ListRepoCIBuildsOutputBody, error)
+	// ListRepoCIProviders invokes listRepoCIProviders operation.
+	//
+	// Returns each provider's enrolment form AS DATA: its modes, its fields, and the select options
+	// drawn from this repo's owning org's connected credentials and registered clusters. A client
+	// renders what it is handed and posts back provider/provider_account/target_ref/mode/config, so it
+	// never names a CI vendor in its own source. A provider the org cannot enrol into yet comes back
+	// enrollable=false with a reason a customer can act on, rather than being omitted. Authz:
+	// repo#manage_ci, the same gate as enrolling.
+	//
+	// GET /repos/{repoId}/ci-webhooks/providers
+	ListRepoCIProviders(ctx context.Context, params ListRepoCIProvidersParams) (*ListRepoCIProvidersOutputBody, error)
+	// ListRepoCIWebhookAudit invokes listRepoCIWebhookAudit operation.
+	//
+	// Audited ci_webhook_enrolled / _updated / _deleted / _identity_rolled_back / _identity_orphaned
+	// events for this repo, newest first, from core's domain audit log. The entire-ci-webhooks
+	// subscription row records no actor, so this is the only way to attribute an enrollment — and it
+	// covers subscriptions created before this endpoint existed. Authz: repo#manage_ci.
+	//
+	// GET /repos/{repoId}/ci-webhooks/audit
+	ListRepoCIWebhookAudit(ctx context.Context, params ListRepoCIWebhookAuditParams) (*ListRepoCIWebhookAuditOutputBody, error)
 	// ListRepoCIWebhooks invokes listRepoCIWebhooks operation.
 	//
 	// List a repo's CI webhooks.
 	//
 	// GET /repos/{repoId}/ci-webhooks
 	ListRepoCIWebhooks(ctx context.Context, params ListRepoCIWebhooksParams) (*ListRepoCIWebhooksOutputBody, error)
+	// ListRepoCollaborators invokes listRepoCollaborators operation.
+	//
+	// List repo collaborators.
+	//
+	// GET /repos/{repoId}/collaborators
+	ListRepoCollaborators(ctx context.Context, params ListRepoCollaboratorsParams) (*ListRepoCollaboratorsOutputBody, error)
 	// ListRepoGrants invokes listRepoGrants operation.
 	//
 	// List repo grants.
 	//
 	// GET /repos/{repoId}/grants
 	ListRepoGrants(ctx context.Context, params ListRepoGrantsParams) (*ListRepoGrantsOutputBody, error)
+	// ListRepoLanguageFacets invokes listRepoLanguageFacets operation.
+	//
+	// List repository language facets.
+	//
+	// GET /repos/facets/languages
+	ListRepoLanguageFacets(ctx context.Context, params ListRepoLanguageFacetsParams) (*RepoFacetPage, error)
+	// ListRepoOrgFacets invokes listRepoOrgFacets operation.
+	//
+	// List repository org facets.
+	//
+	// GET /repos/facets/orgs
+	ListRepoOrgFacets(ctx context.Context, params ListRepoOrgFacetsParams) (*RepoFacetPage, error)
 	// ListRepos invokes listRepos operation.
 	//
 	// List the caller's readable repositories (placement index).
@@ -352,18 +452,29 @@ type Invoker interface {
 	//
 	// GET /repos/lookup-by-slug
 	LookupRepoBySlug(ctx context.Context, params LookupRepoBySlugParams) (*LookupBySlugOutputBody, error)
-	// LookupResources invokes lookupResources operation.
+	// MintOrgCIGitHubActionsCredential invokes mintOrgCIGitHubActionsCredential operation.
 	//
-	// List resources of a type the caller can access.
+	// Operator-only: requires platform#admin, unlike the Buildkite routes beside it, because GitHub
+	// Actions has no enrolment path yet and a credential minted here cannot be used. Mints the inbound
+	// webhook credential for one GitHub account: a fresh webhook secret (returned once, in this 201) and
+	// the endpoint URL to configure the GitHub webhook with, plus optionally the outbound dispatch
+	// api_token (write-only, never returned; has_api_token confirms storage). With api_token, an
+	// already-minted github-actions row gets the token stored/rotated instead (200, no secret re-issued).
 	//
-	// GET /access/{resourceType}
-	LookupResources(ctx context.Context, params LookupResourcesParams) (*LookupResourcesOutputBody, error)
+	// POST /orgs/{orgId}/ci/github-actions/credential
+	MintOrgCIGitHubActionsCredential(ctx context.Context, request *MintOrgCIGitHubActionsCredentialInputBody, params MintOrgCIGitHubActionsCredentialParams) (*OrgCIGitHubActionsCredentialView, error)
 	// PatchRepoCIWebhook invokes patchRepoCIWebhook operation.
 	//
 	// Update a repo's CI webhook.
 	//
 	// PATCH /repos/{repoId}/ci-webhooks/{id}
 	PatchRepoCIWebhook(ctx context.Context, request *PatchRepoCIWebhookInputBody, params PatchRepoCIWebhookParams) (*CIWebhookView, error)
+	// RegisterOrgCIBuildkiteCluster invokes registerOrgCIBuildkiteCluster operation.
+	//
+	// Register or update a Buildkite hosted cluster for an org.
+	//
+	// POST /orgs/{orgId}/ci/buildkite/clusters
+	RegisterOrgCIBuildkiteCluster(ctx context.Context, request *RegisterOrgCIBuildkiteClusterInputBody, params RegisterOrgCIBuildkiteClusterParams) (*OrgCIBuildkiteClusterView, error)
 	// RemoveOrgMember invokes removeOrgMember operation.
 	//
 	// Remove a member from an organization.
@@ -382,6 +493,18 @@ type Invoker interface {
 	//
 	// GET /mirrors/placements
 	ResolveMirrorPlacements(ctx context.Context, params ResolveMirrorPlacementsParams) (*ResolvePlacementsOutputBody, error)
+	// ResolveRepoIDs invokes resolveRepoIDs operation.
+	//
+	// Resolve repository ids to full name and provider.
+	//
+	// POST /repos/resolve-ids
+	ResolveRepoIDs(ctx context.Context, request *ResolveRepoIDsInputBody) (*ResolveRepoIDsResponse, error)
+	// ResolveRepos invokes resolveRepos operation.
+	//
+	// Resolve provider-qualified repository lifecycle states.
+	//
+	// POST /repos/resolve
+	ResolveRepos(ctx context.Context, request *ResolveReposInputBody) (*ResolveReposResponse, error)
 	// RevokeProjectAccess invokes revokeProjectAccess operation.
 	//
 	// Revoke project access by grantee id.
@@ -412,12 +535,30 @@ type Invoker interface {
 	//
 	// DELETE /service-accounts/{accountId}/grants/{resourceType}/{resourceId}
 	RevokeServiceAccountAccess(ctx context.Context, params RevokeServiceAccountAccessParams) error
+	// RotateOrgCIBuildkiteInboundSecret invokes rotateOrgCIBuildkiteInboundSecret operation.
+	//
+	// Rotate an org's inbound Buildkite webhook secret.
+	//
+	// PUT /orgs/{orgId}/ci/buildkite/credential/{bkOrg}/inbound-secret
+	RotateOrgCIBuildkiteInboundSecret(ctx context.Context, params RotateOrgCIBuildkiteInboundSecretParams) (*OrgCIBuildkiteCredentialView, error)
+	// SetBranchProtection invokes setBranchProtection operation.
+	//
+	// Set repository branch protection.
+	//
+	// PUT /repos/{repoId}/branch-protection
+	SetBranchProtection(ctx context.Context, request *BranchProtection, params SetBranchProtectionParams) (*BranchProtection, error)
 	// SetRepoVisibility invokes setRepoVisibility operation.
 	//
 	// Set repository visibility.
 	//
 	// PUT /repos/{repoId}/visibility
 	SetRepoVisibility(ctx context.Context, request *SetRepoVisibilityInputBody, params SetRepoVisibilityParams) (*SetRepoVisibilityOutputBody, error)
+	// UpdateBranchProtection invokes updateBranchProtection operation.
+	//
+	// Add or remove protected branches.
+	//
+	// PATCH /repos/{repoId}/branch-protection
+	UpdateBranchProtection(ctx context.Context, request *UpdateBranchProtectionInputBody, params UpdateBranchProtectionParams) (*BranchProtection, error)
 }
 
 // Client implements OAS client.
@@ -565,37 +706,34 @@ func (c *Client) sendAddOrgMember(ctx context.Context, request *AddOrgMemberInpu
 	return result, nil
 }
 
-// BatchLookup invokes batchLookup operation.
+// CancelDeletion invokes cancelDeletion operation.
 //
-// Batch-resolve (type, id) refs to enriched records.
+// Cancel a pending deletion request for the calling account.
 //
-// POST /lookup
-func (c *Client) BatchLookup(ctx context.Context, request *BatchLookupInputBody) (*BatchLookupOutputBody, error) {
-	res, err := c.sendBatchLookup(ctx, request)
-	return res, err
+// POST /me/cancel-deletion
+func (c *Client) CancelDeletion(ctx context.Context) error {
+	_, err := c.sendCancelDeletion(ctx)
+	return err
 }
 
-func (c *Client) sendBatchLookup(ctx context.Context, request *BatchLookupInputBody) (res *BatchLookupOutputBody, err error) {
+func (c *Client) sendCancelDeletion(ctx context.Context) (res *CancelDeletionOK, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/lookup"
+	pathParts[0] = "/me/cancel-deletion"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "POST", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
-	if err := encodeBatchLookupRequest(request, r); err != nil {
-		return res, errors.Wrap(err, "encode request")
-	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, BatchLookupOperation, r); {
+			switch err := c.securityBearerAuth(ctx, CancelDeletionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -606,7 +744,7 @@ func (c *Client) sendBatchLookup(ctx context.Context, request *BatchLookupInputB
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, BatchLookupOperation, r); {
+			switch err := c.securitySessionAuth(ctx, CancelDeletionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -642,7 +780,7 @@ func (c *Client) sendBatchLookup(ctx context.Context, request *BatchLookupInputB
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeBatchLookupResponse(resp)
+	result, err := decodeCancelDeletionResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -650,21 +788,21 @@ func (c *Client) sendBatchLookup(ctx context.Context, request *BatchLookupInputB
 	return result, nil
 }
 
-// CancelDeletion invokes cancelDeletion operation.
+// CompleteOnboarding invokes completeOnboarding operation.
 //
-// Cancel a pending deletion request for the calling account.
+// Record that the calling account completed web onboarding.
 //
-// POST /me/cancel-deletion
-func (c *Client) CancelDeletion(ctx context.Context) error {
-	_, err := c.sendCancelDeletion(ctx)
-	return err
+// POST /me/onboarding/complete
+func (c *Client) CompleteOnboarding(ctx context.Context) (*CompleteOnboardingOutputBody, error) {
+	res, err := c.sendCompleteOnboarding(ctx)
+	return res, err
 }
 
-func (c *Client) sendCancelDeletion(ctx context.Context) (res *CancelDeletionOK, err error) {
+func (c *Client) sendCompleteOnboarding(ctx context.Context) (res *CompleteOnboardingOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/me/cancel-deletion"
+	pathParts[0] = "/me/onboarding/complete"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "POST", u)
@@ -677,7 +815,7 @@ func (c *Client) sendCancelDeletion(ctx context.Context) (res *CancelDeletionOK,
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, CancelDeletionOperation, r); {
+			switch err := c.securityBearerAuth(ctx, CompleteOnboardingOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -688,7 +826,7 @@ func (c *Client) sendCancelDeletion(ctx context.Context) (res *CancelDeletionOK,
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, CancelDeletionOperation, r); {
+			switch err := c.securitySessionAuth(ctx, CompleteOnboardingOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -724,7 +862,7 @@ func (c *Client) sendCancelDeletion(ctx context.Context) (res *CancelDeletionOK,
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeCancelDeletionResponse(resp)
+	result, err := decodeCompleteOnboardingResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -732,34 +870,56 @@ func (c *Client) sendCancelDeletion(ctx context.Context) (res *CancelDeletionOK,
 	return result, nil
 }
 
-// CompleteOnboarding invokes completeOnboarding operation.
+// ConnectOrgCIBuildkiteCredential invokes connectOrgCIBuildkiteCredential operation.
 //
-// Record that the calling account completed web onboarding.
+// Connect or rotate an org's Buildkite API credential.
 //
-// POST /me/onboarding/complete
-func (c *Client) CompleteOnboarding(ctx context.Context) (*CompleteOnboardingOutputBody, error) {
-	res, err := c.sendCompleteOnboarding(ctx)
+// POST /orgs/{orgId}/ci/buildkite/credential
+func (c *Client) ConnectOrgCIBuildkiteCredential(ctx context.Context, request *ConnectOrgCIBuildkiteCredentialInputBody, params ConnectOrgCIBuildkiteCredentialParams) (*OrgCIBuildkiteCredentialView, error) {
+	res, err := c.sendConnectOrgCIBuildkiteCredential(ctx, request, params)
 	return res, err
 }
 
-func (c *Client) sendCompleteOnboarding(ctx context.Context) (res *CompleteOnboardingOutputBody, err error) {
+func (c *Client) sendConnectOrgCIBuildkiteCredential(ctx context.Context, request *ConnectOrgCIBuildkiteCredentialInputBody, params ConnectOrgCIBuildkiteCredentialParams) (res *OrgCIBuildkiteCredentialView, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/me/onboarding/complete"
+	var pathParts [3]string
+	pathParts[0] = "/orgs/"
+	{
+		// Encode "orgId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "orgId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci/buildkite/credential"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "POST", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
+	if err := encodeConnectOrgCIBuildkiteCredentialRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, CompleteOnboardingOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ConnectOrgCIBuildkiteCredentialOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -770,7 +930,7 @@ func (c *Client) sendCompleteOnboarding(ctx context.Context) (res *CompleteOnboa
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, CompleteOnboardingOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ConnectOrgCIBuildkiteCredentialOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -806,7 +966,7 @@ func (c *Client) sendCompleteOnboarding(ctx context.Context) (res *CompleteOnboa
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeCompleteOnboardingResponse(resp)
+	result, err := decodeConnectOrgCIBuildkiteCredentialResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -1089,6 +1249,110 @@ func (c *Client) sendCreateMirrorRequest(ctx context.Context, request *CreateMir
 	return result, nil
 }
 
+// CreateNativeMirror invokes createNativeMirror operation.
+//
+// Create a native-mirror placement.
+//
+// POST /repos/{repoId}/native-mirrors
+func (c *Client) CreateNativeMirror(ctx context.Context, request *CreateNativeMirrorInputBody, params CreateNativeMirrorParams) (*NativeMirrorPlacement, error) {
+	res, err := c.sendCreateNativeMirror(ctx, request, params)
+	return res, err
+}
+
+func (c *Client) sendCreateNativeMirror(ctx context.Context, request *CreateNativeMirrorInputBody, params CreateNativeMirrorParams) (res *NativeMirrorPlacement, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/native-mirrors"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "POST", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+	if err := encodeCreateNativeMirrorRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, CreateNativeMirrorOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, CreateNativeMirrorOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeCreateNativeMirrorResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
 // CreateOrg invokes createOrg operation.
 //
 // Create organization.
@@ -1349,12 +1613,12 @@ func (c *Client) sendCreateRepo(ctx context.Context, request *CreateRepoInputBod
 // Enroll a repo into a CI webhook (Buildkite).
 //
 // POST /repos/{repoId}/ci-webhooks
-func (c *Client) CreateRepoCIWebhook(ctx context.Context, request *CreateRepoCIWebhookInputBody, params CreateRepoCIWebhookParams) (*CIWebhookView, error) {
+func (c *Client) CreateRepoCIWebhook(ctx context.Context, request *CreateRepoCIWebhookInputBody, params CreateRepoCIWebhookParams) (*CreateRepoCIWebhookBody, error) {
 	res, err := c.sendCreateRepoCIWebhook(ctx, request, params)
 	return res, err
 }
 
-func (c *Client) sendCreateRepoCIWebhook(ctx context.Context, request *CreateRepoCIWebhookInputBody, params CreateRepoCIWebhookParams) (res *CIWebhookView, err error) {
+func (c *Client) sendCreateRepoCIWebhook(ctx context.Context, request *CreateRepoCIWebhookInputBody, params CreateRepoCIWebhookParams) (res *CreateRepoCIWebhookBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
@@ -1875,30 +2139,30 @@ func (c *Client) sendDeleteMirror(ctx context.Context, params DeleteMirrorParams
 	return result, nil
 }
 
-// DeleteOrg invokes deleteOrg operation.
+// DeleteNativeMirror invokes deleteNativeMirror operation.
 //
-// Delete an organization.
+// Delete a native-mirror placement.
 //
-// DELETE /orgs/{orgId}
-func (c *Client) DeleteOrg(ctx context.Context, params DeleteOrgParams) error {
-	_, err := c.sendDeleteOrg(ctx, params)
-	return err
+// DELETE /repos/{repoId}/native-mirrors/{clusterSlug}
+func (c *Client) DeleteNativeMirror(ctx context.Context, params DeleteNativeMirrorParams) (*NativeMirrorPlacement, error) {
+	res, err := c.sendDeleteNativeMirror(ctx, params)
+	return res, err
 }
 
-func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res *DeleteOrgNoContent, err error) {
+func (c *Client) sendDeleteNativeMirror(ctx context.Context, params DeleteNativeMirrorParams) (res *NativeMirrorPlacement, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/orgs/"
+	var pathParts [4]string
+	pathParts[0] = "/repos/"
 	{
-		// Encode "orgId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "orgId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.OrgId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -1908,6 +2172,25 @@ func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res
 		}
 		pathParts[1] = encoded
 	}
+	pathParts[2] = "/native-mirrors/"
+	{
+		// Encode "clusterSlug" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "clusterSlug",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ClusterSlug))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "DELETE", u)
@@ -1920,7 +2203,7 @@ func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, DeleteOrgOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteNativeMirrorOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -1931,7 +2214,7 @@ func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, DeleteOrgOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteNativeMirrorOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -1967,7 +2250,7 @@ func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeDeleteOrgResponse(resp)
+	result, err := decodeDeleteNativeMirrorResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -1975,30 +2258,30 @@ func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res
 	return result, nil
 }
 
-// DeleteProject invokes deleteProject operation.
+// DeleteOrg invokes deleteOrg operation.
 //
-// Delete a project.
+// Delete an organization.
 //
-// DELETE /projects/{projectId}
-func (c *Client) DeleteProject(ctx context.Context, params DeleteProjectParams) error {
-	_, err := c.sendDeleteProject(ctx, params)
+// DELETE /orgs/{orgId}
+func (c *Client) DeleteOrg(ctx context.Context, params DeleteOrgParams) error {
+	_, err := c.sendDeleteOrg(ctx, params)
 	return err
 }
 
-func (c *Client) sendDeleteProject(ctx context.Context, params DeleteProjectParams) (res *DeleteProjectNoContent, err error) {
+func (c *Client) sendDeleteOrg(ctx context.Context, params DeleteOrgParams) (res *DeleteOrgNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [2]string
-	pathParts[0] = "/projects/"
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "projectId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2020,7 +2303,7 @@ func (c *Client) sendDeleteProject(ctx context.Context, params DeleteProjectPara
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, DeleteProjectOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteOrgOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2031,7 +2314,7 @@ func (c *Client) sendDeleteProject(ctx context.Context, params DeleteProjectPara
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, DeleteProjectOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteOrgOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2067,7 +2350,7 @@ func (c *Client) sendDeleteProject(ctx context.Context, params DeleteProjectPara
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeDeleteProjectResponse(resp)
+	result, err := decodeDeleteOrgResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2075,30 +2358,30 @@ func (c *Client) sendDeleteProject(ctx context.Context, params DeleteProjectPara
 	return result, nil
 }
 
-// DeleteRepo invokes deleteRepo operation.
+// DeleteOrgCIBuildkiteCluster invokes deleteOrgCIBuildkiteCluster operation.
 //
-// Delete repository.
+// Remove a registered Buildkite cluster from an org.
 //
-// DELETE /repos/{repoId}
-func (c *Client) DeleteRepo(ctx context.Context, params DeleteRepoParams) error {
-	_, err := c.sendDeleteRepo(ctx, params)
+// DELETE /orgs/{orgId}/ci/buildkite/clusters/{bkOrg}/{bkClusterId}
+func (c *Client) DeleteOrgCIBuildkiteCluster(ctx context.Context, params DeleteOrgCIBuildkiteClusterParams) error {
+	_, err := c.sendDeleteOrgCIBuildkiteCluster(ctx, params)
 	return err
 }
 
-func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (res *DeleteRepoNoContent, err error) {
+func (c *Client) sendDeleteOrgCIBuildkiteCluster(ctx context.Context, params DeleteOrgCIBuildkiteClusterParams) (res *DeleteOrgCIBuildkiteClusterNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/repos/"
+	var pathParts [6]string
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "repoId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2108,6 +2391,44 @@ func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (r
 		}
 		pathParts[1] = encoded
 	}
+	pathParts[2] = "/ci/buildkite/clusters/"
+	{
+		// Encode "bkOrg" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "bkOrg",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.BkOrg))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
+	pathParts[4] = "/"
+	{
+		// Encode "bkClusterId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "bkClusterId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.BkClusterId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[5] = encoded
+	}
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "DELETE", u)
@@ -2120,7 +2441,7 @@ func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (r
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, DeleteRepoOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteOrgCIBuildkiteClusterOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2131,7 +2452,7 @@ func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (r
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, DeleteRepoOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteOrgCIBuildkiteClusterOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2167,7 +2488,7 @@ func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (r
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeDeleteRepoResponse(resp)
+	result, err := decodeDeleteOrgCIBuildkiteClusterResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2175,30 +2496,30 @@ func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (r
 	return result, nil
 }
 
-// DeleteRepoCIWebhook invokes deleteRepoCIWebhook operation.
+// DeleteOrgCIBuildkiteCredential invokes deleteOrgCIBuildkiteCredential operation.
 //
-// Delete a repo's CI webhook.
+// Delete an org's connected Buildkite credential.
 //
-// DELETE /repos/{repoId}/ci-webhooks/{id}
-func (c *Client) DeleteRepoCIWebhook(ctx context.Context, params DeleteRepoCIWebhookParams) error {
-	_, err := c.sendDeleteRepoCIWebhook(ctx, params)
+// DELETE /orgs/{orgId}/ci/buildkite/credential/{bkOrg}
+func (c *Client) DeleteOrgCIBuildkiteCredential(ctx context.Context, params DeleteOrgCIBuildkiteCredentialParams) error {
+	_, err := c.sendDeleteOrgCIBuildkiteCredential(ctx, params)
 	return err
 }
 
-func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoCIWebhookParams) (res *DeleteRepoCIWebhookNoContent, err error) {
+func (c *Client) sendDeleteOrgCIBuildkiteCredential(ctx context.Context, params DeleteOrgCIBuildkiteCredentialParams) (res *DeleteOrgCIBuildkiteCredentialNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [4]string
-	pathParts[0] = "/repos/"
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "repoId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2208,16 +2529,16 @@ func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoC
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/ci-webhooks/"
+	pathParts[2] = "/ci/buildkite/credential/"
 	{
-		// Encode "id" parameter.
+		// Encode "bkOrg" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "id",
+			Param:   "bkOrg",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ID))
+			return e.EncodeValue(conv.StringToString(params.BkOrg))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2229,26 +2550,6 @@ func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoC
 	}
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
-	{
-		// Encode "teardown" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "teardown",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Teardown.Get(); ok {
-				return e.EncodeValue(conv.BoolToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
 	r, err := ht.NewRequest(ctx, "DELETE", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
@@ -2259,7 +2560,7 @@ func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoC
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, DeleteRepoCIWebhookOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteOrgCIBuildkiteCredentialOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2270,7 +2571,7 @@ func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoC
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, DeleteRepoCIWebhookOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteOrgCIBuildkiteCredentialOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2306,7 +2607,7 @@ func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoC
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeDeleteRepoCIWebhookResponse(resp)
+	result, err := decodeDeleteOrgCIBuildkiteCredentialResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2314,30 +2615,30 @@ func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoC
 	return result, nil
 }
 
-// DeleteServiceAccount invokes deleteServiceAccount operation.
+// DeleteProject invokes deleteProject operation.
 //
-// Delete service account.
+// Delete a project.
 //
-// DELETE /service-accounts/{accountId}
-func (c *Client) DeleteServiceAccount(ctx context.Context, params DeleteServiceAccountParams) error {
-	_, err := c.sendDeleteServiceAccount(ctx, params)
+// DELETE /projects/{projectId}
+func (c *Client) DeleteProject(ctx context.Context, params DeleteProjectParams) error {
+	_, err := c.sendDeleteProject(ctx, params)
 	return err
 }
 
-func (c *Client) sendDeleteServiceAccount(ctx context.Context, params DeleteServiceAccountParams) (res *DeleteServiceAccountNoContent, err error) {
+func (c *Client) sendDeleteProject(ctx context.Context, params DeleteProjectParams) (res *DeleteProjectNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [2]string
-	pathParts[0] = "/service-accounts/"
+	pathParts[0] = "/projects/"
 	{
-		// Encode "accountId" parameter.
+		// Encode "projectId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "accountId",
+			Param:   "projectId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.AccountId))
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2359,7 +2660,7 @@ func (c *Client) sendDeleteServiceAccount(ctx context.Context, params DeleteServ
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, DeleteServiceAccountOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteProjectOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2370,7 +2671,7 @@ func (c *Client) sendDeleteServiceAccount(ctx context.Context, params DeleteServ
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, DeleteServiceAccountOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteProjectOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2406,7 +2707,7 @@ func (c *Client) sendDeleteServiceAccount(ctx context.Context, params DeleteServ
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeDeleteServiceAccountResponse(resp)
+	result, err := decodeDeleteProjectResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2414,24 +2715,42 @@ func (c *Client) sendDeleteServiceAccount(ctx context.Context, params DeleteServ
 	return result, nil
 }
 
-// GetDeletionPreview invokes getDeletionPreview operation.
+// DeleteRepo invokes deleteRepo operation.
 //
-// Preview what deleting the calling account will erase, unlink, and block on.
+// Delete repository.
 //
-// GET /me/deletion-preview
-func (c *Client) GetDeletionPreview(ctx context.Context) (*GetDeletionPreviewOutputBody, error) {
-	res, err := c.sendGetDeletionPreview(ctx)
-	return res, err
+// DELETE /repos/{repoId}
+func (c *Client) DeleteRepo(ctx context.Context, params DeleteRepoParams) error {
+	_, err := c.sendDeleteRepo(ctx, params)
+	return err
 }
 
-func (c *Client) sendGetDeletionPreview(ctx context.Context) (res *GetDeletionPreviewOutputBody, err error) {
+func (c *Client) sendDeleteRepo(ctx context.Context, params DeleteRepoParams) (res *DeleteRepoNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/me/deletion-preview"
+	var pathParts [2]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "DELETE", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
@@ -2441,7 +2760,7 @@ func (c *Client) sendGetDeletionPreview(ctx context.Context) (res *GetDeletionPr
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetDeletionPreviewOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteRepoOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2452,7 +2771,7 @@ func (c *Client) sendGetDeletionPreview(ctx context.Context) (res *GetDeletionPr
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetDeletionPreviewOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteRepoOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2488,7 +2807,7 @@ func (c *Client) sendGetDeletionPreview(ctx context.Context) (res *GetDeletionPr
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetDeletionPreviewResponse(resp)
+	result, err := decodeDeleteRepoResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2496,24 +2815,89 @@ func (c *Client) sendGetDeletionPreview(ctx context.Context) (res *GetDeletionPr
 	return result, nil
 }
 
-// GetMe invokes getMe operation.
+// DeleteRepoCIWebhook invokes deleteRepoCIWebhook operation.
 //
-// Get the calling account's identity and profile.
+// Deletes the subscription AND tears down its enrollment identity: the automation row (when no
+// sibling repo shares it), its expiring repo grant, and its Buildkite OIDC binding. The Buildkite
+// pipeline itself is always kept. Pass keep_identity=true to delete only the subscription — for an
+// immediate re-enroll that must preserve automation_id, since teardown retires it and a re-enroll
+// declares a new one that only bk_force_rescaffold pushes into the pipeline. A retained identity
+// holds read access on this repo until its grant lapses. A subscription enrolled before the
+// automation principal has no automation to retire: the delete succeeds and removes only the
+// subscription, reported as identity_retired=false on the ci_webhook_deleted audit event — the
+// list an operator queries to hand-delete the leftover service accounts.
 //
-// GET /me
-func (c *Client) GetMe(ctx context.Context) (*GetMeOutputBody, error) {
-	res, err := c.sendGetMe(ctx)
-	return res, err
+// DELETE /repos/{repoId}/ci-webhooks/{id}
+func (c *Client) DeleteRepoCIWebhook(ctx context.Context, params DeleteRepoCIWebhookParams) error {
+	_, err := c.sendDeleteRepoCIWebhook(ctx, params)
+	return err
 }
 
-func (c *Client) sendGetMe(ctx context.Context) (res *GetMeOutputBody, err error) {
+func (c *Client) sendDeleteRepoCIWebhook(ctx context.Context, params DeleteRepoCIWebhookParams) (res *DeleteRepoCIWebhookNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/me"
+	var pathParts [4]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci-webhooks/"
+	{
+		// Encode "id" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "id",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ID))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "keep_identity" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "keep_identity",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.KeepIdentity.Get(); ok {
+				return e.EncodeValue(conv.BoolToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "DELETE", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
@@ -2523,7 +2907,7 @@ func (c *Client) sendGetMe(ctx context.Context) (res *GetMeOutputBody, err error
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetMeOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteRepoCIWebhookOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2534,7 +2918,7 @@ func (c *Client) sendGetMe(ctx context.Context) (res *GetMeOutputBody, err error
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetMeOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteRepoCIWebhookOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2570,7 +2954,7 @@ func (c *Client) sendGetMe(ctx context.Context) (res *GetMeOutputBody, err error
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetMeResponse(resp)
+	result, err := decodeDeleteRepoCIWebhookResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2578,30 +2962,30 @@ func (c *Client) sendGetMe(ctx context.Context) (res *GetMeOutputBody, err error
 	return result, nil
 }
 
-// GetMirror invokes getMirror operation.
+// DeleteServiceAccount invokes deleteServiceAccount operation.
 //
-// Get mirror by id.
+// Delete service account.
 //
-// GET /mirrors/{mirrorId}
-func (c *Client) GetMirror(ctx context.Context, params GetMirrorParams) (*Mirror, error) {
-	res, err := c.sendGetMirror(ctx, params)
-	return res, err
+// DELETE /service-accounts/{accountId}
+func (c *Client) DeleteServiceAccount(ctx context.Context, params DeleteServiceAccountParams) error {
+	_, err := c.sendDeleteServiceAccount(ctx, params)
+	return err
 }
 
-func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res *Mirror, err error) {
+func (c *Client) sendDeleteServiceAccount(ctx context.Context, params DeleteServiceAccountParams) (res *DeleteServiceAccountNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [2]string
-	pathParts[0] = "/mirrors/"
+	pathParts[0] = "/service-accounts/"
 	{
-		// Encode "mirrorId" parameter.
+		// Encode "accountId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "mirrorId",
+			Param:   "accountId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.MirrorId))
+			return e.EncodeValue(conv.StringToString(params.AccountId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2613,7 +2997,7 @@ func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res
 	}
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "DELETE", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
@@ -2623,7 +3007,7 @@ func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetMirrorOperation, r); {
+			switch err := c.securityBearerAuth(ctx, DeleteServiceAccountOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2634,7 +3018,7 @@ func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetMirrorOperation, r); {
+			switch err := c.securitySessionAuth(ctx, DeleteServiceAccountOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2670,7 +3054,7 @@ func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetMirrorResponse(resp)
+	result, err := decodeDeleteServiceAccountResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2678,30 +3062,30 @@ func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res
 	return result, nil
 }
 
-// GetMirrorRequest invokes getMirrorRequest operation.
+// GetBranchProtection invokes getBranchProtection operation.
 //
-// Unknown failure codes must be treated as a generic terminal failure.
+// Get repository branch protection.
 //
-// GET /mirror-requests/{requestId}
-func (c *Client) GetMirrorRequest(ctx context.Context, params GetMirrorRequestParams) (*MirrorRequest, error) {
-	res, err := c.sendGetMirrorRequest(ctx, params)
+// GET /repos/{repoId}/branch-protection
+func (c *Client) GetBranchProtection(ctx context.Context, params GetBranchProtectionParams) (*BranchProtection, error) {
+	res, err := c.sendGetBranchProtection(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorRequestParams) (res *MirrorRequest, err error) {
+func (c *Client) sendGetBranchProtection(ctx context.Context, params GetBranchProtectionParams) (res *BranchProtection, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/mirror-requests/"
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
 	{
-		// Encode "requestId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "requestId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.UUIDToString(params.RequestId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2711,6 +3095,7 @@ func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorReque
 		}
 		pathParts[1] = encoded
 	}
+	pathParts[2] = "/branch-protection"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -2723,7 +3108,7 @@ func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorReque
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetMirrorRequestOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetBranchProtectionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2734,7 +3119,7 @@ func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorReque
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetMirrorRequestOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetBranchProtectionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2770,7 +3155,7 @@ func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorReque
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetMirrorRequestResponse(resp)
+	result, err := decodeGetBranchProtectionResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2778,21 +3163,21 @@ func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorReque
 	return result, nil
 }
 
-// GetOnboardingStatus invokes getOnboardingStatus operation.
+// GetDeletionPreview invokes getDeletionPreview operation.
 //
-// Report whether the calling account still needs to complete onboarding.
+// Preview what deleting the calling account will erase, unlink, and block on.
 //
-// GET /me/onboarding
-func (c *Client) GetOnboardingStatus(ctx context.Context) (*GetOnboardingStatusOutputBody, error) {
-	res, err := c.sendGetOnboardingStatus(ctx)
+// GET /me/deletion-preview
+func (c *Client) GetDeletionPreview(ctx context.Context) (*GetDeletionPreviewOutputBody, error) {
+	res, err := c.sendGetDeletionPreview(ctx)
 	return res, err
 }
 
-func (c *Client) sendGetOnboardingStatus(ctx context.Context) (res *GetOnboardingStatusOutputBody, err error) {
+func (c *Client) sendGetDeletionPreview(ctx context.Context) (res *GetDeletionPreviewOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/me/onboarding"
+	pathParts[0] = "/me/deletion-preview"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -2805,7 +3190,7 @@ func (c *Client) sendGetOnboardingStatus(ctx context.Context) (res *GetOnboardin
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetOnboardingStatusOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetDeletionPreviewOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2816,7 +3201,7 @@ func (c *Client) sendGetOnboardingStatus(ctx context.Context) (res *GetOnboardin
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetOnboardingStatusOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetDeletionPreviewOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2852,7 +3237,7 @@ func (c *Client) sendGetOnboardingStatus(ctx context.Context) (res *GetOnboardin
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetOnboardingStatusResponse(resp)
+	result, err := decodeGetDeletionPreviewResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2860,39 +3245,21 @@ func (c *Client) sendGetOnboardingStatus(ctx context.Context) (res *GetOnboardin
 	return result, nil
 }
 
-// GetOrg invokes getOrg operation.
+// GetMe invokes getMe operation.
 //
-// Get an organization.
+// Get the calling account's identity and profile.
 //
-// GET /orgs/{orgId}
-func (c *Client) GetOrg(ctx context.Context, params GetOrgParams) (*Org, error) {
-	res, err := c.sendGetOrg(ctx, params)
+// GET /me
+func (c *Client) GetMe(ctx context.Context) (*GetMeOutputBody, error) {
+	res, err := c.sendGetMe(ctx)
 	return res, err
 }
 
-func (c *Client) sendGetOrg(ctx context.Context, params GetOrgParams) (res *Org, err error) {
+func (c *Client) sendGetMe(ctx context.Context) (res *GetMeOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/orgs/"
-	{
-		// Encode "orgId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "orgId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.OrgId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[1] = encoded
-	}
+	var pathParts [1]string
+	pathParts[0] = "/me"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -2905,7 +3272,7 @@ func (c *Client) sendGetOrg(ctx context.Context, params GetOrgParams) (res *Org,
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetOrgOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetMeOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2916,7 +3283,7 @@ func (c *Client) sendGetOrg(ctx context.Context, params GetOrgParams) (res *Org,
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetOrgOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetMeOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -2952,7 +3319,7 @@ func (c *Client) sendGetOrg(ctx context.Context, params GetOrgParams) (res *Org,
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetOrgResponse(resp)
+	result, err := decodeGetMeResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -2960,30 +3327,30 @@ func (c *Client) sendGetOrg(ctx context.Context, params GetOrgParams) (res *Org,
 	return result, nil
 }
 
-// GetPermissions invokes getPermissions operation.
+// GetMirror invokes getMirror operation.
 //
-// List the caller's permissions on a single resource.
+// Get mirror by id.
 //
-// GET /access/{resourceType}/{resourceId}
-func (c *Client) GetPermissions(ctx context.Context, params GetPermissionsParams) (*GetPermissionsOutputBody, error) {
-	res, err := c.sendGetPermissions(ctx, params)
+// GET /mirrors/{mirrorId}
+func (c *Client) GetMirror(ctx context.Context, params GetMirrorParams) (*Mirror, error) {
+	res, err := c.sendGetMirror(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsParams) (res *GetPermissionsOutputBody, err error) {
+func (c *Client) sendGetMirror(ctx context.Context, params GetMirrorParams) (res *Mirror, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [4]string
-	pathParts[0] = "/access/"
+	var pathParts [2]string
+	pathParts[0] = "/mirrors/"
 	{
-		// Encode "resourceType" parameter.
+		// Encode "mirrorId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "resourceType",
+			Param:   "mirrorId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ResourceType))
+			return e.EncodeValue(conv.StringToString(params.MirrorId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -2993,47 +3360,8 @@ func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsPa
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/"
-	{
-		// Encode "resourceId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "resourceId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ResourceId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[3] = encoded
-	}
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
-	{
-		// Encode "explain" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "explain",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Explain.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
 	r, err := ht.NewRequest(ctx, "GET", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
@@ -3044,7 +3372,7 @@ func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsPa
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetPermissionsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetMirrorOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3055,7 +3383,7 @@ func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsPa
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetPermissionsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetMirrorOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3091,7 +3419,7 @@ func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsPa
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetPermissionsResponse(resp)
+	result, err := decodeGetMirrorResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3099,30 +3427,30 @@ func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsPa
 	return result, nil
 }
 
-// GetProject invokes getProject operation.
+// GetMirrorRequest invokes getMirrorRequest operation.
 //
-// Get a project by id.
+// Unknown failure codes must be treated as a generic terminal failure.
 //
-// GET /projects/{projectId}
-func (c *Client) GetProject(ctx context.Context, params GetProjectParams) (*Project, error) {
-	res, err := c.sendGetProject(ctx, params)
+// GET /mirror-requests/{requestId}
+func (c *Client) GetMirrorRequest(ctx context.Context, params GetMirrorRequestParams) (*MirrorRequest, error) {
+	res, err := c.sendGetMirrorRequest(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGetProject(ctx context.Context, params GetProjectParams) (res *Project, err error) {
+func (c *Client) sendGetMirrorRequest(ctx context.Context, params GetMirrorRequestParams) (res *MirrorRequest, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [2]string
-	pathParts[0] = "/projects/"
+	pathParts[0] = "/mirror-requests/"
 	{
-		// Encode "projectId" parameter.
+		// Encode "requestId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
+			Param:   "requestId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
+			return e.EncodeValue(conv.UUIDToString(params.RequestId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -3144,7 +3472,7 @@ func (c *Client) sendGetProject(ctx context.Context, params GetProjectParams) (r
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetProjectOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetMirrorRequestOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3155,7 +3483,7 @@ func (c *Client) sendGetProject(ctx context.Context, params GetProjectParams) (r
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetProjectOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetMirrorRequestOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3191,7 +3519,7 @@ func (c *Client) sendGetProject(ctx context.Context, params GetProjectParams) (r
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetProjectResponse(resp)
+	result, err := decodeGetMirrorRequestResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3199,39 +3527,21 @@ func (c *Client) sendGetProject(ctx context.Context, params GetProjectParams) (r
 	return result, nil
 }
 
-// GetRepo invokes getRepo operation.
+// GetOnboardingStatus invokes getOnboardingStatus operation.
 //
-// Get repository.
+// Report whether the calling account still needs to complete onboarding.
 //
-// GET /repos/{repoId}
-func (c *Client) GetRepo(ctx context.Context, params GetRepoParams) (*Repo, error) {
-	res, err := c.sendGetRepo(ctx, params)
+// GET /me/onboarding
+func (c *Client) GetOnboardingStatus(ctx context.Context) (*GetOnboardingStatusOutputBody, error) {
+	res, err := c.sendGetOnboardingStatus(ctx)
 	return res, err
 }
 
-func (c *Client) sendGetRepo(ctx context.Context, params GetRepoParams) (res *Repo, err error) {
+func (c *Client) sendGetOnboardingStatus(ctx context.Context) (res *GetOnboardingStatusOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/repos/"
-	{
-		// Encode "repoId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[1] = encoded
-	}
+	var pathParts [1]string
+	pathParts[0] = "/me/onboarding"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -3244,7 +3554,7 @@ func (c *Client) sendGetRepo(ctx context.Context, params GetRepoParams) (res *Re
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetRepoOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetOnboardingStatusOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3255,7 +3565,7 @@ func (c *Client) sendGetRepo(ctx context.Context, params GetRepoParams) (res *Re
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetRepoOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetOnboardingStatusOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3291,7 +3601,7 @@ func (c *Client) sendGetRepo(ctx context.Context, params GetRepoParams) (res *Re
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetRepoResponse(resp)
+	result, err := decodeGetOnboardingStatusResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3299,30 +3609,30 @@ func (c *Client) sendGetRepo(ctx context.Context, params GetRepoParams) (res *Re
 	return result, nil
 }
 
-// GetRepoVisibility invokes getRepoVisibility operation.
+// GetOrg invokes getOrg operation.
 //
-// Get repository visibility.
+// Get an organization.
 //
-// GET /repos/{repoId}/visibility
-func (c *Client) GetRepoVisibility(ctx context.Context, params GetRepoVisibilityParams) (*GetRepoVisibilityOutputBody, error) {
-	res, err := c.sendGetRepoVisibility(ctx, params)
+// GET /orgs/{orgId}
+func (c *Client) GetOrg(ctx context.Context, params GetOrgParams) (*Org, error) {
+	res, err := c.sendGetOrg(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibilityParams) (res *GetRepoVisibilityOutputBody, err error) {
+func (c *Client) sendGetOrg(ctx context.Context, params GetOrgParams) (res *Org, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
-	pathParts[0] = "/repos/"
+	var pathParts [2]string
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "repoId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -3332,7 +3642,6 @@ func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibi
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/visibility"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -3345,7 +3654,7 @@ func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibi
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetRepoVisibilityOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetOrgOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3356,7 +3665,7 @@ func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibi
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetRepoVisibilityOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetOrgOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3392,7 +3701,7 @@ func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibi
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetRepoVisibilityResponse(resp)
+	result, err := decodeGetOrgResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3400,30 +3709,30 @@ func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibi
 	return result, nil
 }
 
-// GetServiceAccount invokes getServiceAccount operation.
+// GetPermissions invokes getPermissions operation.
 //
-// Get service account.
+// List the caller's permissions on a single resource.
 //
-// GET /service-accounts/{accountId}
-func (c *Client) GetServiceAccount(ctx context.Context, params GetServiceAccountParams) (*ServiceAccount, error) {
-	res, err := c.sendGetServiceAccount(ctx, params)
+// GET /access/{resourceType}/{resourceId}
+func (c *Client) GetPermissions(ctx context.Context, params GetPermissionsParams) (*GetPermissionsOutputBody, error) {
+	res, err := c.sendGetPermissions(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAccountParams) (res *ServiceAccount, err error) {
+func (c *Client) sendGetPermissions(ctx context.Context, params GetPermissionsParams) (res *GetPermissionsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/service-accounts/"
+	var pathParts [4]string
+	pathParts[0] = "/access/"
 	{
-		// Encode "accountId" parameter.
+		// Encode "resourceType" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "accountId",
+			Param:   "resourceType",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.AccountId))
+			return e.EncodeValue(conv.StringToString(params.ResourceType))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -3433,8 +3742,47 @@ func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAcc
 		}
 		pathParts[1] = encoded
 	}
+	pathParts[2] = "/"
+	{
+		// Encode "resourceId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "resourceId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ResourceId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
 	uri.AddPathParts(u, pathParts[:]...)
 
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "explain" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "explain",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Explain.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
 	r, err := ht.NewRequest(ctx, "GET", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
@@ -3445,7 +3793,7 @@ func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAcc
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetServiceAccountOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetPermissionsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3456,7 +3804,7 @@ func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAcc
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetServiceAccountOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetPermissionsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3492,7 +3840,7 @@ func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAcc
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetServiceAccountResponse(resp)
+	result, err := decodeGetPermissionsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3500,21 +3848,39 @@ func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAcc
 	return result, nil
 }
 
-// GetTopology invokes getTopology operation.
+// GetProject invokes getProject operation.
 //
-// Get the cluster topology as a jurisdiction → region → cluster tree.
+// Get a project by id.
 //
-// GET /topology
-func (c *Client) GetTopology(ctx context.Context) (*GetTopologyOutputBody, error) {
-	res, err := c.sendGetTopology(ctx)
+// GET /projects/{projectId}
+func (c *Client) GetProject(ctx context.Context, params GetProjectParams) (*Project, error) {
+	res, err := c.sendGetProject(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGetTopology(ctx context.Context) (res *GetTopologyOutputBody, err error) {
+func (c *Client) sendGetProject(ctx context.Context, params GetProjectParams) (res *Project, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/topology"
+	var pathParts [2]string
+	pathParts[0] = "/projects/"
+	{
+		// Encode "projectId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "projectId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -3527,7 +3893,7 @@ func (c *Client) sendGetTopology(ctx context.Context) (res *GetTopologyOutputBod
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GetTopologyOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetProjectOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3538,7 +3904,7 @@ func (c *Client) sendGetTopology(ctx context.Context) (res *GetTopologyOutputBod
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GetTopologyOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetProjectOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3574,44 +3940,7 @@ func (c *Client) sendGetTopology(ctx context.Context) (res *GetTopologyOutputBod
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGetTopologyResponse(resp)
-	if err != nil {
-		return res, errors.Wrap(err, "decode response")
-	}
-
-	return result, nil
-}
-
-// GetVersion invokes getVersion operation.
-//
-// Get the server version and mode.
-//
-// GET /version
-func (c *Client) GetVersion(ctx context.Context) (*GetVersionOutputBody, error) {
-	res, err := c.sendGetVersion(ctx)
-	return res, err
-}
-
-func (c *Client) sendGetVersion(ctx context.Context) (res *GetVersionOutputBody, err error) {
-
-	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/version"
-	uri.AddPathParts(u, pathParts[:]...)
-
-	r, err := ht.NewRequest(ctx, "GET", u)
-	if err != nil {
-		return res, errors.Wrap(err, "create request")
-	}
-
-	resp, err := c.cfg.Client.Do(r)
-	if err != nil {
-		return res, errors.Wrap(err, "do request")
-	}
-	body := resp.Body
-	defer body.Close()
-
-	result, err := decodeGetVersionResponse(resp)
+	result, err := decodeGetProjectResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3619,30 +3948,30 @@ func (c *Client) sendGetVersion(ctx context.Context) (res *GetVersionOutputBody,
 	return result, nil
 }
 
-// GrantProjectAccess invokes grantProjectAccess operation.
+// GetRepo invokes getRepo operation.
 //
-// Grant project access to an identity.
+// Get repository.
 //
-// POST /projects/{projectId}/grants
-func (c *Client) GrantProjectAccess(ctx context.Context, request *GrantProjectAccessInputBody, params GrantProjectAccessParams) (*GrantProjectAccessOutputBody, error) {
-	res, err := c.sendGrantProjectAccess(ctx, request, params)
+// GET /repos/{repoId}
+func (c *Client) GetRepo(ctx context.Context, params GetRepoParams) (*Repo, error) {
+	res, err := c.sendGetRepo(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGrantProjectAccess(ctx context.Context, request *GrantProjectAccessInputBody, params GrantProjectAccessParams) (res *GrantProjectAccessOutputBody, err error) {
+func (c *Client) sendGetRepo(ctx context.Context, params GetRepoParams) (res *Repo, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
-	pathParts[0] = "/projects/"
+	var pathParts [2]string
+	pathParts[0] = "/repos/"
 	{
-		// Encode "projectId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -3652,23 +3981,19 @@ func (c *Client) sendGrantProjectAccess(ctx context.Context, request *GrantProje
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "POST", u)
+	r, err := ht.NewRequest(ctx, "GET", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
-	if err := encodeGrantProjectAccessRequest(request, r); err != nil {
-		return res, errors.Wrap(err, "encode request")
-	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GrantProjectAccessOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetRepoOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3679,7 +4004,7 @@ func (c *Client) sendGrantProjectAccess(ctx context.Context, request *GrantProje
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GrantProjectAccessOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetRepoOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3715,7 +4040,7 @@ func (c *Client) sendGrantProjectAccess(ctx context.Context, request *GrantProje
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGrantProjectAccessResponse(resp)
+	result, err := decodeGetRepoResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3723,17 +4048,17 @@ func (c *Client) sendGrantProjectAccess(ctx context.Context, request *GrantProje
 	return result, nil
 }
 
-// GrantRepoAccess invokes grantRepoAccess operation.
+// GetRepoVisibility invokes getRepoVisibility operation.
 //
-// Grant repo access to an identity.
+// Get repository visibility.
 //
-// POST /repos/{repoId}/grants
-func (c *Client) GrantRepoAccess(ctx context.Context, request *GrantRepoAccessInputBody, params GrantRepoAccessParams) (*GrantRepoAccessOutputBody, error) {
-	res, err := c.sendGrantRepoAccess(ctx, request, params)
+// GET /repos/{repoId}/visibility
+func (c *Client) GetRepoVisibility(ctx context.Context, params GetRepoVisibilityParams) (*GetRepoVisibilityOutputBody, error) {
+	res, err := c.sendGetRepoVisibility(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGrantRepoAccess(ctx context.Context, request *GrantRepoAccessInputBody, params GrantRepoAccessParams) (res *GrantRepoAccessOutputBody, err error) {
+func (c *Client) sendGetRepoVisibility(ctx context.Context, params GetRepoVisibilityParams) (res *GetRepoVisibilityOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
@@ -3756,23 +4081,20 @@ func (c *Client) sendGrantRepoAccess(ctx context.Context, request *GrantRepoAcce
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants"
+	pathParts[2] = "/visibility"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "POST", u)
+	r, err := ht.NewRequest(ctx, "GET", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
-	if err := encodeGrantRepoAccessRequest(request, r); err != nil {
-		return res, errors.Wrap(err, "encode request")
-	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GrantRepoAccessOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetRepoVisibilityOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3783,7 +4105,7 @@ func (c *Client) sendGrantRepoAccess(ctx context.Context, request *GrantRepoAcce
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GrantRepoAccessOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetRepoVisibilityOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3819,7 +4141,7 @@ func (c *Client) sendGrantRepoAccess(ctx context.Context, request *GrantRepoAcce
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGrantRepoAccessResponse(resp)
+	result, err := decodeGetRepoVisibilityResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3827,20 +4149,20 @@ func (c *Client) sendGrantRepoAccess(ctx context.Context, request *GrantRepoAcce
 	return result, nil
 }
 
-// GrantServiceAccountAccess invokes grantServiceAccountAccess operation.
+// GetServiceAccount invokes getServiceAccount operation.
 //
-// Grant service account access on a repo or project.
+// Get service account.
 //
-// POST /service-accounts/{accountId}/grants
-func (c *Client) GrantServiceAccountAccess(ctx context.Context, request *GrantServiceAccountAccessInputBody, params GrantServiceAccountAccessParams) (*GrantServiceAccountAccessOutputBody, error) {
-	res, err := c.sendGrantServiceAccountAccess(ctx, request, params)
+// GET /service-accounts/{accountId}
+func (c *Client) GetServiceAccount(ctx context.Context, params GetServiceAccountParams) (*ServiceAccount, error) {
+	res, err := c.sendGetServiceAccount(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendGrantServiceAccountAccess(ctx context.Context, request *GrantServiceAccountAccessInputBody, params GrantServiceAccountAccessParams) (res *GrantServiceAccountAccessOutputBody, err error) {
+func (c *Client) sendGetServiceAccount(ctx context.Context, params GetServiceAccountParams) (res *ServiceAccount, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
+	var pathParts [2]string
 	pathParts[0] = "/service-accounts/"
 	{
 		// Encode "accountId" parameter.
@@ -3860,23 +4182,19 @@ func (c *Client) sendGrantServiceAccountAccess(ctx context.Context, request *Gra
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "POST", u)
+	r, err := ht.NewRequest(ctx, "GET", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
-	if err := encodeGrantServiceAccountAccessRequest(request, r); err != nil {
-		return res, errors.Wrap(err, "encode request")
-	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, GrantServiceAccountAccessOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetServiceAccountOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3887,7 +4205,7 @@ func (c *Client) sendGrantServiceAccountAccess(ctx context.Context, request *Gra
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, GrantServiceAccountAccessOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetServiceAccountOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -3923,7 +4241,7 @@ func (c *Client) sendGrantServiceAccountAccess(ctx context.Context, request *Gra
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeGrantServiceAccountAccessResponse(resp)
+	result, err := decodeGetServiceAccountResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -3931,71 +4249,34 @@ func (c *Client) sendGrantServiceAccountAccess(ctx context.Context, request *Gra
 	return result, nil
 }
 
-// ListAuditEvents invokes listAuditEvents operation.
+// GetTopology invokes getTopology operation.
 //
-// List the calling account's recent audit events.
+// Get the cluster topology as a jurisdiction → region → cluster tree.
 //
-// GET /audit
-func (c *Client) ListAuditEvents(ctx context.Context, params ListAuditEventsParams) (*ListAuditEventsOutputBody, error) {
-	res, err := c.sendListAuditEvents(ctx, params)
+// GET /topology
+func (c *Client) GetTopology(ctx context.Context) (*GetTopologyOutputBody, error) {
+	res, err := c.sendGetTopology(ctx)
 	return res, err
 }
 
-func (c *Client) sendListAuditEvents(ctx context.Context, params ListAuditEventsParams) (res *ListAuditEventsOutputBody, err error) {
+func (c *Client) sendGetTopology(ctx context.Context) (res *GetTopologyOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/audit"
+	pathParts[0] = "/topology"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
-	{
-		// Encode "pageSize" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "pageToken" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
-	r, err := ht.NewRequest(ctx, "GET", u)
-	if err != nil {
-		return res, errors.Wrap(err, "create request")
-	}
-
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListAuditEventsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GetTopologyOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4006,7 +4287,7 @@ func (c *Client) sendListAuditEvents(ctx context.Context, params ListAuditEvents
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListAuditEventsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GetTopologyOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4042,7 +4323,7 @@ func (c *Client) sendListAuditEvents(ctx context.Context, params ListAuditEvents
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListAuditEventsResponse(resp)
+	result, err := decodeGetTopologyResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4050,54 +4331,93 @@ func (c *Client) sendListAuditEvents(ctx context.Context, params ListAuditEvents
 	return result, nil
 }
 
-// ListAvailableMirrors invokes listAvailableMirrors operation.
+// GetVersion invokes getVersion operation.
 //
-// List GitHub repos the caller could onboard as mirrors.
+// Get the server version and mode.
 //
-// GET /mirrors/available
-func (c *Client) ListAvailableMirrors(ctx context.Context, params ListAvailableMirrorsParams) (*ListAvailableMirrorsOutputBody, error) {
-	res, err := c.sendListAvailableMirrors(ctx, params)
+// GET /version
+func (c *Client) GetVersion(ctx context.Context) (*GetVersionOutputBody, error) {
+	res, err := c.sendGetVersion(ctx)
 	return res, err
 }
 
-func (c *Client) sendListAvailableMirrors(ctx context.Context, params ListAvailableMirrorsParams) (res *ListAvailableMirrorsOutputBody, err error) {
+func (c *Client) sendGetVersion(ctx context.Context) (res *GetVersionOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/mirrors/available"
+	pathParts[0] = "/version"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeGetVersionResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// GrantProjectAccess invokes grantProjectAccess operation.
+//
+// Grant project access to an identity.
+//
+// POST /projects/{projectId}/grants
+func (c *Client) GrantProjectAccess(ctx context.Context, request *GrantProjectAccessInputBody, params GrantProjectAccessParams) (*GrantProjectAccessOutputBody, error) {
+	res, err := c.sendGrantProjectAccess(ctx, request, params)
+	return res, err
+}
+
+func (c *Client) sendGrantProjectAccess(ctx context.Context, request *GrantProjectAccessInputBody, params GrantProjectAccessParams) (res *GrantProjectAccessOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/projects/"
 	{
-		// Encode "owner" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "owner",
-			Style:   uri.QueryStyleForm,
+		// Encode "projectId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "projectId",
+			Style:   uri.PathStyleSimple,
 			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Owner.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
+		pathParts[1] = encoded
 	}
-	u.RawQuery = q.Values().Encode()
+	pathParts[2] = "/grants"
+	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "POST", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
+	if err := encodeGrantProjectAccessRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListAvailableMirrorsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GrantProjectAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4108,7 +4428,7 @@ func (c *Client) sendListAvailableMirrors(ctx context.Context, params ListAvaila
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListAvailableMirrorsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GrantProjectAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4144,7 +4464,7 @@ func (c *Client) sendListAvailableMirrors(ctx context.Context, params ListAvaila
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListAvailableMirrorsResponse(resp)
+	result, err := decodeGrantProjectAccessResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4152,30 +4472,30 @@ func (c *Client) sendListAvailableMirrors(ctx context.Context, params ListAvaila
 	return result, nil
 }
 
-// ListBindings invokes listBindings operation.
+// GrantRepoAccess invokes grantRepoAccess operation.
 //
-// List OIDC bindings.
+// Grant repo access to an identity.
 //
-// GET /service-accounts/{accountId}/bindings
-func (c *Client) ListBindings(ctx context.Context, params ListBindingsParams) (*ListBindingsOutputBody, error) {
-	res, err := c.sendListBindings(ctx, params)
+// POST /repos/{repoId}/grants
+func (c *Client) GrantRepoAccess(ctx context.Context, request *GrantRepoAccessInputBody, params GrantRepoAccessParams) (*GrantRepoAccessOutputBody, error) {
+	res, err := c.sendGrantRepoAccess(ctx, request, params)
 	return res, err
 }
 
-func (c *Client) sendListBindings(ctx context.Context, params ListBindingsParams) (res *ListBindingsOutputBody, err error) {
+func (c *Client) sendGrantRepoAccess(ctx context.Context, request *GrantRepoAccessInputBody, params GrantRepoAccessParams) (res *GrantRepoAccessOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
-	pathParts[0] = "/service-accounts/"
+	pathParts[0] = "/repos/"
 	{
-		// Encode "accountId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "accountId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.AccountId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -4185,57 +4505,23 @@ func (c *Client) sendListBindings(ctx context.Context, params ListBindingsParams
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/bindings"
+	pathParts[2] = "/grants"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
-	{
-		// Encode "pageSize" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "pageToken" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "POST", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
+	if err := encodeGrantRepoAccessRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListBindingsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GrantRepoAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4246,7 +4532,7 @@ func (c *Client) sendListBindings(ctx context.Context, params ListBindingsParams
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListBindingsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GrantRepoAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4282,7 +4568,7 @@ func (c *Client) sendListBindings(ctx context.Context, params ListBindingsParams
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListBindingsResponse(resp)
+	result, err := decodeGrantRepoAccessResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4290,34 +4576,56 @@ func (c *Client) sendListBindings(ctx context.Context, params ListBindingsParams
 	return result, nil
 }
 
-// ListClusters invokes listClusters operation.
+// GrantServiceAccountAccess invokes grantServiceAccountAccess operation.
 //
-// List data-plane clusters attached to this control plane.
+// Grant service account access on a repo or project.
 //
-// GET /clusters
-func (c *Client) ListClusters(ctx context.Context) (*ListClustersOutputBody, error) {
-	res, err := c.sendListClusters(ctx)
+// POST /service-accounts/{accountId}/grants
+func (c *Client) GrantServiceAccountAccess(ctx context.Context, request *GrantServiceAccountAccessInputBody, params GrantServiceAccountAccessParams) (*GrantServiceAccountAccessOutputBody, error) {
+	res, err := c.sendGrantServiceAccountAccess(ctx, request, params)
 	return res, err
 }
 
-func (c *Client) sendListClusters(ctx context.Context) (res *ListClustersOutputBody, err error) {
+func (c *Client) sendGrantServiceAccountAccess(ctx context.Context, request *GrantServiceAccountAccessInputBody, params GrantServiceAccountAccessParams) (res *GrantServiceAccountAccessOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/clusters"
+	var pathParts [3]string
+	pathParts[0] = "/service-accounts/"
+	{
+		// Encode "accountId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "accountId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.AccountId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/grants"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "POST", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
+	if err := encodeGrantServiceAccountAccessRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListClustersOperation, r); {
+			switch err := c.securityBearerAuth(ctx, GrantServiceAccountAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4328,7 +4636,7 @@ func (c *Client) sendListClusters(ctx context.Context) (res *ListClustersOutputB
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListClustersOperation, r); {
+			switch err := c.securitySessionAuth(ctx, GrantServiceAccountAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4364,7 +4672,7 @@ func (c *Client) sendListClusters(ctx context.Context) (res *ListClustersOutputB
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListClustersResponse(resp)
+	result, err := decodeGrantServiceAccountAccessResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4372,76 +4680,54 @@ func (c *Client) sendListClusters(ctx context.Context) (res *ListClustersOutputB
 	return result, nil
 }
 
-// ListMirrorCollaborators invokes listMirrorCollaborators operation.
+// ListAuditEvents invokes listAuditEvents operation.
 //
-// List the principals with access to a mirror (live GitHub-admin gated).
+// List the calling account's recent audit events.
 //
-// GET /mirrors/collaborators
-func (c *Client) ListMirrorCollaborators(ctx context.Context, params ListMirrorCollaboratorsParams) (*ListMirrorCollaboratorsOutputBody, error) {
-	res, err := c.sendListMirrorCollaborators(ctx, params)
+// GET /audit
+func (c *Client) ListAuditEvents(ctx context.Context, params ListAuditEventsParams) (*ListAuditEventsOutputBody, error) {
+	res, err := c.sendListAuditEvents(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListMirrorCollaborators(ctx context.Context, params ListMirrorCollaboratorsParams) (res *ListMirrorCollaboratorsOutputBody, err error) {
+func (c *Client) sendListAuditEvents(ctx context.Context, params ListAuditEventsParams) (res *ListAuditEventsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/mirrors/collaborators"
+	pathParts[0] = "/audit"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
 	{
-		// Encode "provider" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "provider",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(string(params.Provider)))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "owner" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "owner",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.Owner))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "repo" parameter.
+		// Encode "pageSize" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "repo",
+			Name:    "pageSize",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.Repo))
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
 		}); err != nil {
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
 	{
-		// Encode "clusterHost" parameter.
+		// Encode "pageToken" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "clusterHost",
+			Name:    "pageToken",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.ClusterHost))
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
 		}); err != nil {
 			return res, errors.Wrap(err, "encode query")
 		}
@@ -4458,7 +4744,7 @@ func (c *Client) sendListMirrorCollaborators(ctx context.Context, params ListMir
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListMirrorCollaboratorsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListAuditEventsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4469,7 +4755,7 @@ func (c *Client) sendListMirrorCollaborators(ctx context.Context, params ListMir
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListMirrorCollaboratorsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListAuditEventsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4505,7 +4791,7 @@ func (c *Client) sendListMirrorCollaborators(ctx context.Context, params ListMir
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListMirrorCollaboratorsResponse(resp)
+	result, err := decodeListAuditEventsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4513,92 +4799,24 @@ func (c *Client) sendListMirrorCollaborators(ctx context.Context, params ListMir
 	return result, nil
 }
 
-// ListMirrors invokes listMirrors operation.
+// ListAvailableMirrors invokes listAvailableMirrors operation.
 //
-// List mirrors visible to the caller.
+// List GitHub repos the caller could onboard as mirrors.
 //
-// GET /mirrors
-func (c *Client) ListMirrors(ctx context.Context, params ListMirrorsParams) (*ListMirrorsOutputBody, error) {
-	res, err := c.sendListMirrors(ctx, params)
+// GET /mirrors/available
+func (c *Client) ListAvailableMirrors(ctx context.Context, params ListAvailableMirrorsParams) (*ListAvailableMirrorsOutputBody, error) {
+	res, err := c.sendListAvailableMirrors(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListMirrors(ctx context.Context, params ListMirrorsParams) (res *ListMirrorsOutputBody, err error) {
+func (c *Client) sendListAvailableMirrors(ctx context.Context, params ListAvailableMirrorsParams) (res *ListAvailableMirrorsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/mirrors"
+	pathParts[0] = "/mirrors/available"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
-	{
-		// Encode "pageSize" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "pageToken" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "cluster" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "cluster",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Cluster.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "provider" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "provider",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Provider.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
 	{
 		// Encode "owner" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
@@ -4628,7 +4846,7 @@ func (c *Client) sendListMirrors(ctx context.Context, params ListMirrorsParams)
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListMirrorsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListAvailableMirrorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4639,7 +4857,7 @@ func (c *Client) sendListMirrors(ctx context.Context, params ListMirrorsParams)
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListMirrorsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListAvailableMirrorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4675,7 +4893,7 @@ func (c *Client) sendListMirrors(ctx context.Context, params ListMirrorsParams)
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListMirrorsResponse(resp)
+	result, err := decodeListAvailableMirrorsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4683,21 +4901,40 @@ func (c *Client) sendListMirrors(ctx context.Context, params ListMirrorsParams)
 	return result, nil
 }
 
-// ListOIDCProviders invokes listOIDCProviders operation.
+// ListBindings invokes listBindings operation.
 //
-// List federated OIDC identity providers.
+// List OIDC bindings.
 //
-// GET /oidc-providers
-func (c *Client) ListOIDCProviders(ctx context.Context, params ListOIDCProvidersParams) (*ListOIDCProvidersOutputBody, error) {
-	res, err := c.sendListOIDCProviders(ctx, params)
+// GET /service-accounts/{accountId}/bindings
+func (c *Client) ListBindings(ctx context.Context, params ListBindingsParams) (*ListBindingsOutputBody, error) {
+	res, err := c.sendListBindings(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListOIDCProviders(ctx context.Context, params ListOIDCProvidersParams) (res *ListOIDCProvidersOutputBody, err error) {
+func (c *Client) sendListBindings(ctx context.Context, params ListBindingsParams) (res *ListBindingsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/oidc-providers"
+	var pathParts [3]string
+	pathParts[0] = "/service-accounts/"
+	{
+		// Encode "accountId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "accountId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.AccountId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/bindings"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -4747,7 +4984,7 @@ func (c *Client) sendListOIDCProviders(ctx context.Context, params ListOIDCProvi
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListOIDCProvidersOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListBindingsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4758,7 +4995,7 @@ func (c *Client) sendListOIDCProviders(ctx context.Context, params ListOIDCProvi
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListOIDCProvidersOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListBindingsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4794,7 +5031,7 @@ func (c *Client) sendListOIDCProviders(ctx context.Context, params ListOIDCProvi
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListOIDCProvidersResponse(resp)
+	result, err := decodeListBindingsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4802,101 +5039,45 @@ func (c *Client) sendListOIDCProviders(ctx context.Context, params ListOIDCProvi
 	return result, nil
 }
 
-// ListOrgMembers invokes listOrgMembers operation.
+// ListClusters invokes listClusters operation.
 //
-// List members of an organization.
+// List data-plane clusters attached to this control plane.
 //
-// GET /orgs/{orgId}/members
-func (c *Client) ListOrgMembers(ctx context.Context, params ListOrgMembersParams) (*ListOrgMembersOutputBody, error) {
-	res, err := c.sendListOrgMembers(ctx, params)
+// GET /clusters
+func (c *Client) ListClusters(ctx context.Context) (*ListClustersOutputBody, error) {
+	res, err := c.sendListClusters(ctx)
 	return res, err
 }
 
-func (c *Client) sendListOrgMembers(ctx context.Context, params ListOrgMembersParams) (res *ListOrgMembersOutputBody, err error) {
+func (c *Client) sendListClusters(ctx context.Context) (res *ListClustersOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
-	pathParts[0] = "/orgs/"
-	{
-		// Encode "orgId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "orgId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.OrgId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[1] = encoded
-	}
-	pathParts[2] = "/members"
+	var pathParts [1]string
+	pathParts[0] = "/clusters"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
 	{
-		// Encode "pageSize" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
 
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "pageToken" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
-	r, err := ht.NewRequest(ctx, "GET", u)
-	if err != nil {
-		return res, errors.Wrap(err, "create request")
-	}
-
-	{
-		type bitset = [1]uint8
-		var satisfied bitset
-		{
-
-			switch err := c.securityBearerAuth(ctx, ListOrgMembersOperation, r); {
-			case err == nil: // if NO error
-				satisfied[0] |= 1 << 0
-			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
-				// Skip this security.
-			default:
-				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			switch err := c.securityBearerAuth(ctx, ListClustersOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
 			}
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListOrgMembersOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListClustersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -4932,7 +5113,7 @@ func (c *Client) sendListOrgMembers(ctx context.Context, params ListOrgMembersPa
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListOrgMembersResponse(resp)
+	result, err := decodeListClustersResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -4940,90 +5121,76 @@ func (c *Client) sendListOrgMembers(ctx context.Context, params ListOrgMembersPa
 	return result, nil
 }
 
-// ListOrgProjects invokes listOrgProjects operation.
+// ListMirrorCollaborators invokes listMirrorCollaborators operation.
 //
-// List projects owned by an organization.
+// List the principals with access to a mirror (live GitHub-admin gated).
 //
-// GET /orgs/{orgId}/projects
-func (c *Client) ListOrgProjects(ctx context.Context, params ListOrgProjectsParams) (*ListOrgProjectsOutputBody, error) {
-	res, err := c.sendListOrgProjects(ctx, params)
+// GET /mirrors/collaborators
+func (c *Client) ListMirrorCollaborators(ctx context.Context, params ListMirrorCollaboratorsParams) (*ListMirrorCollaboratorsOutputBody, error) {
+	res, err := c.sendListMirrorCollaborators(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListOrgProjects(ctx context.Context, params ListOrgProjectsParams) (res *ListOrgProjectsOutputBody, err error) {
+func (c *Client) sendListMirrorCollaborators(ctx context.Context, params ListMirrorCollaboratorsParams) (res *ListMirrorCollaboratorsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
-	pathParts[0] = "/orgs/"
+	var pathParts [1]string
+	pathParts[0] = "/mirrors/collaborators"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
 	{
-		// Encode "orgId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "orgId",
-			Style:   uri.PathStyleSimple,
+		// Encode "provider" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "provider",
+			Style:   uri.QueryStyleForm,
 			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.OrgId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
 		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			return e.EncodeValue(conv.StringToString(string(params.Provider)))
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
 		}
-		pathParts[1] = encoded
 	}
-	pathParts[2] = "/projects"
-	uri.AddPathParts(u, pathParts[:]...)
-
-	q := uri.NewQueryEncoder()
 	{
-		// Encode "pageSize" parameter.
+		// Encode "owner" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
+			Name:    "owner",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
+			return e.EncodeValue(conv.StringToString(params.Owner))
 		}); err != nil {
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
 	{
-		// Encode "pageToken" parameter.
+		// Encode "repo" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
+			Name:    "repo",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
+			return e.EncodeValue(conv.StringToString(params.Repo))
 		}); err != nil {
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
 	{
-		// Encode "name" parameter.
+		// Encode "clusterHost" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "name",
+			Name:    "clusterHost",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Name.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
+			return e.EncodeValue(conv.StringToString(params.ClusterHost))
 		}); err != nil {
 			return res, errors.Wrap(err, "encode query")
 		}
@@ -5040,7 +5207,7 @@ func (c *Client) sendListOrgProjects(ctx context.Context, params ListOrgProjects
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListOrgProjectsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListMirrorCollaboratorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5051,7 +5218,7 @@ func (c *Client) sendListOrgProjects(ctx context.Context, params ListOrgProjects
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListOrgProjectsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListMirrorCollaboratorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5087,7 +5254,7 @@ func (c *Client) sendListOrgProjects(ctx context.Context, params ListOrgProjects
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListOrgProjectsResponse(resp)
+	result, err := decodeListMirrorCollaboratorsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5095,21 +5262,21 @@ func (c *Client) sendListOrgProjects(ctx context.Context, params ListOrgProjects
 	return result, nil
 }
 
-// ListOrgs invokes listOrgs operation.
+// ListMirrors invokes listMirrors operation.
 //
-// List organizations the caller can see (or one by name).
+// List mirrors visible to the caller.
 //
-// GET /orgs
-func (c *Client) ListOrgs(ctx context.Context, params ListOrgsParams) (*ListOrgsOutputBodyHeaders, error) {
-	res, err := c.sendListOrgs(ctx, params)
+// GET /mirrors
+func (c *Client) ListMirrors(ctx context.Context, params ListMirrorsParams) (*ListMirrorsOutputBody, error) {
+	res, err := c.sendListMirrors(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *ListOrgsOutputBodyHeaders, err error) {
+func (c *Client) sendListMirrors(ctx context.Context, params ListMirrorsParams) (res *ListMirrorsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [1]string
-	pathParts[0] = "/orgs"
+	pathParts[0] = "/mirrors"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -5148,15 +5315,15 @@ func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *
 		}
 	}
 	{
-		// Encode "name" parameter.
+		// Encode "cluster" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "name",
+			Name:    "cluster",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Name.Get(); ok {
+			if val, ok := params.Cluster.Get(); ok {
 				return e.EncodeValue(conv.StringToString(val))
 			}
 			return nil
@@ -5164,35 +5331,53 @@ func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
-	u.RawQuery = q.Values().Encode()
+	{
+		// Encode "provider" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "provider",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
 
-	r, err := ht.NewRequest(ctx, "GET", u)
-	if err != nil {
-		return res, errors.Wrap(err, "create request")
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Provider.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
 	}
-
-	h := uri.NewHeaderEncoder(r.Header)
 	{
-		cfg := uri.HeaderParameterEncodingConfig{
-			Name:    "If-None-Match",
+		// Encode "owner" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "owner",
+			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
-		if err := h.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.IfNoneMatch.Get(); ok {
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Owner.Get(); ok {
 				return e.EncodeValue(conv.StringToString(val))
 			}
 			return nil
 		}); err != nil {
-			return res, errors.Wrap(err, "encode header")
+			return res, errors.Wrap(err, "encode query")
 		}
 	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListOrgsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListMirrorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5203,7 +5388,7 @@ func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListOrgsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListMirrorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5239,7 +5424,7 @@ func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListOrgsResponse(resp)
+	result, err := decodeListMirrorsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5247,30 +5432,30 @@ func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *
 	return result, nil
 }
 
-// ListProjectMembers invokes listProjectMembers operation.
+// ListNativeMirrors invokes listNativeMirrors operation.
 //
-// List project members and their roles.
+// List native-mirror placement status.
 //
-// GET /projects/{projectId}/members
-func (c *Client) ListProjectMembers(ctx context.Context, params ListProjectMembersParams) (*ListProjectMembersOutputBody, error) {
-	res, err := c.sendListProjectMembers(ctx, params)
+// GET /repos/{repoId}/native-mirrors
+func (c *Client) ListNativeMirrors(ctx context.Context, params ListNativeMirrorsParams) (*ListNativeMirrorsOutputBody, error) {
+	res, err := c.sendListNativeMirrors(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectMembersParams) (res *ListProjectMembersOutputBody, err error) {
+func (c *Client) sendListNativeMirrors(ctx context.Context, params ListNativeMirrorsParams) (res *ListNativeMirrorsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
-	pathParts[0] = "/projects/"
+	pathParts[0] = "/repos/"
 	{
-		// Encode "projectId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -5280,46 +5465,9 @@ func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectM
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/members"
+	pathParts[2] = "/native-mirrors"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	q := uri.NewQueryEncoder()
-	{
-		// Encode "pageSize" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "pageToken" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
 	r, err := ht.NewRequest(ctx, "GET", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
@@ -5330,7 +5478,7 @@ func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectM
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListProjectMembersOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListNativeMirrorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5341,7 +5489,7 @@ func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectM
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListProjectMembersOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListNativeMirrorsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5377,7 +5525,7 @@ func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectM
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListProjectMembersResponse(resp)
+	result, err := decodeListNativeMirrorsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5385,40 +5533,21 @@ func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectM
 	return result, nil
 }
 
-// ListProjectRepos invokes listProjectRepos operation.
+// ListOIDCProviders invokes listOIDCProviders operation.
 //
-// List repositories in a project (or one by name).
+// List federated OIDC identity providers.
 //
-// GET /projects/{projectId}/repos
-func (c *Client) ListProjectRepos(ctx context.Context, params ListProjectReposParams) (*ListProjectReposOutputBody, error) {
-	res, err := c.sendListProjectRepos(ctx, params)
+// GET /oidc-providers
+func (c *Client) ListOIDCProviders(ctx context.Context, params ListOIDCProvidersParams) (*ListOIDCProvidersOutputBody, error) {
+	res, err := c.sendListOIDCProviders(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectReposParams) (res *ListProjectReposOutputBody, err error) {
+func (c *Client) sendListOIDCProviders(ctx context.Context, params ListOIDCProvidersParams) (res *ListOIDCProvidersOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
-	pathParts[0] = "/projects/"
-	{
-		// Encode "projectId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[1] = encoded
-	}
-	pathParts[2] = "/repos"
+	var pathParts [1]string
+	pathParts[0] = "/oidc-providers"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -5456,23 +5585,6 @@ func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectRep
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
-	{
-		// Encode "name" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "name",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Name.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
 	u.RawQuery = q.Values().Encode()
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -5485,7 +5597,7 @@ func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectRep
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListProjectReposOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListOIDCProvidersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5496,7 +5608,7 @@ func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectRep
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListProjectReposOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListOIDCProvidersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5532,7 +5644,7 @@ func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectRep
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListProjectReposResponse(resp)
+	result, err := decodeListOIDCProvidersResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5540,68 +5652,53 @@ func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectRep
 	return result, nil
 }
 
-// ListProjects invokes listProjects operation.
+// ListOrgCIBuildkiteClusters invokes listOrgCIBuildkiteClusters operation.
 //
-// List projects accessible to the caller (or one by name).
+// List an org's registered Buildkite clusters.
 //
-// GET /projects
-func (c *Client) ListProjects(ctx context.Context, params ListProjectsParams) (*ListProjectsOutputBody, error) {
-	res, err := c.sendListProjects(ctx, params)
+// GET /orgs/{orgId}/ci/buildkite/clusters
+func (c *Client) ListOrgCIBuildkiteClusters(ctx context.Context, params ListOrgCIBuildkiteClustersParams) (*ListOrgCIBuildkiteClustersOutputBody, error) {
+	res, err := c.sendListOrgCIBuildkiteClusters(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListProjects(ctx context.Context, params ListProjectsParams) (res *ListProjectsOutputBody, err error) {
+func (c *Client) sendListOrgCIBuildkiteClusters(ctx context.Context, params ListOrgCIBuildkiteClustersParams) (res *ListOrgCIBuildkiteClustersOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/projects"
-	uri.AddPathParts(u, pathParts[:]...)
-
-	q := uri.NewQueryEncoder()
+	var pathParts [3]string
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "pageSize" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageSize",
-			Style:   uri.QueryStyleForm,
+		// Encode "orgId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "orgId",
+			Style:   uri.PathStyleSimple,
 			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageSize.Get(); ok {
-				return e.EncodeValue(conv.Int32ToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
+		pathParts[1] = encoded
 	}
-	{
-		// Encode "pageToken" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "pageToken",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
+	pathParts[2] = "/ci/buildkite/clusters"
+	uri.AddPathParts(u, pathParts[:]...)
 
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.PageToken.Get(); ok {
-				return e.EncodeValue(conv.StringToString(val))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
+	q := uri.NewQueryEncoder()
 	{
-		// Encode "name" parameter.
+		// Encode "bk_organization" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "name",
+			Name:    "bk_organization",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Name.Get(); ok {
+			if val, ok := params.BkOrganization.Get(); ok {
 				return e.EncodeValue(conv.StringToString(val))
 			}
 			return nil
@@ -5621,7 +5718,7 @@ func (c *Client) sendListProjects(ctx context.Context, params ListProjectsParams
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListProjectsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListOrgCIBuildkiteClustersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5632,7 +5729,7 @@ func (c *Client) sendListProjects(ctx context.Context, params ListProjectsParams
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListProjectsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListOrgCIBuildkiteClustersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5668,7 +5765,7 @@ func (c *Client) sendListProjects(ctx context.Context, params ListProjectsParams
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListProjectsResponse(resp)
+	result, err := decodeListOrgCIBuildkiteClustersResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5676,30 +5773,30 @@ func (c *Client) sendListProjects(ctx context.Context, params ListProjectsParams
 	return result, nil
 }
 
-// ListRepoCIWebhooks invokes listRepoCIWebhooks operation.
+// ListOrgCIBuildkiteCredentials invokes listOrgCIBuildkiteCredentials operation.
 //
-// List a repo's CI webhooks.
+// List an org's connected Buildkite credentials.
 //
-// GET /repos/{repoId}/ci-webhooks
-func (c *Client) ListRepoCIWebhooks(ctx context.Context, params ListRepoCIWebhooksParams) (*ListRepoCIWebhooksOutputBody, error) {
-	res, err := c.sendListRepoCIWebhooks(ctx, params)
+// GET /orgs/{orgId}/ci/buildkite/credentials
+func (c *Client) ListOrgCIBuildkiteCredentials(ctx context.Context, params ListOrgCIBuildkiteCredentialsParams) (*ListOrgCIBuildkiteCredentialsOutputBody, error) {
+	res, err := c.sendListOrgCIBuildkiteCredentials(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWebhooksParams) (res *ListRepoCIWebhooksOutputBody, err error) {
+func (c *Client) sendListOrgCIBuildkiteCredentials(ctx context.Context, params ListOrgCIBuildkiteCredentialsParams) (res *ListOrgCIBuildkiteCredentialsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
-	pathParts[0] = "/repos/"
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "repoId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -5709,7 +5806,7 @@ func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWe
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/ci-webhooks"
+	pathParts[2] = "/ci/buildkite/credentials"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -5722,7 +5819,7 @@ func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWe
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListRepoCIWebhooksOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListOrgCIBuildkiteCredentialsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5733,7 +5830,7 @@ func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWe
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListRepoCIWebhooksOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListOrgCIBuildkiteCredentialsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5769,7 +5866,7 @@ func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWe
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListRepoCIWebhooksResponse(resp)
+	result, err := decodeListOrgCIBuildkiteCredentialsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5777,30 +5874,30 @@ func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWe
 	return result, nil
 }
 
-// ListRepoGrants invokes listRepoGrants operation.
+// ListOrgMembers invokes listOrgMembers operation.
 //
-// List repo grants.
+// List members of an organization.
 //
-// GET /repos/{repoId}/grants
-func (c *Client) ListRepoGrants(ctx context.Context, params ListRepoGrantsParams) (*ListRepoGrantsOutputBody, error) {
-	res, err := c.sendListRepoGrants(ctx, params)
+// GET /orgs/{orgId}/members
+func (c *Client) ListOrgMembers(ctx context.Context, params ListOrgMembersParams) (*ListOrgMembersOutputBody, error) {
+	res, err := c.sendListOrgMembers(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsParams) (res *ListRepoGrantsOutputBody, err error) {
+func (c *Client) sendListOrgMembers(ctx context.Context, params ListOrgMembersParams) (res *ListOrgMembersOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
-	pathParts[0] = "/repos/"
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "repoId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -5810,7 +5907,7 @@ func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsPa
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants"
+	pathParts[2] = "/members"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -5860,7 +5957,7 @@ func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsPa
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListRepoGrantsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListOrgMembersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5871,7 +5968,7 @@ func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsPa
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListRepoGrantsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListOrgMembersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -5907,7 +6004,7 @@ func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsPa
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListRepoGrantsResponse(resp)
+	result, err := decodeListOrgMembersResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -5915,21 +6012,40 @@ func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsPa
 	return result, nil
 }
 
-// ListRepos invokes listRepos operation.
+// ListOrgProjects invokes listOrgProjects operation.
 //
-// List the caller's readable repositories (placement index).
+// List projects owned by an organization.
 //
-// GET /repos
-func (c *Client) ListRepos(ctx context.Context, params ListReposParams) (*ListReposOutputBody, error) {
-	res, err := c.sendListRepos(ctx, params)
+// GET /orgs/{orgId}/projects
+func (c *Client) ListOrgProjects(ctx context.Context, params ListOrgProjectsParams) (*ListOrgProjectsOutputBody, error) {
+	res, err := c.sendListOrgProjects(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res *ListReposOutputBody, err error) {
+func (c *Client) sendListOrgProjects(ctx context.Context, params ListOrgProjectsParams) (res *ListOrgProjectsOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/repos"
+	var pathParts [3]string
+	pathParts[0] = "/orgs/"
+	{
+		// Encode "orgId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "orgId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/projects"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -5968,32 +6084,15 @@ func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res
 		}
 	}
 	{
-		// Encode "scope" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "scope",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Scope.Get(); ok {
-				return e.EncodeValue(conv.StringToString(string(val)))
-			}
-			return nil
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	{
-		// Encode "filter" parameter.
+		// Encode "name" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "filter",
+			Name:    "name",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Filter.Get(); ok {
+			if val, ok := params.Name.Get(); ok {
 				return e.EncodeValue(conv.StringToString(val))
 			}
 			return nil
@@ -6013,7 +6112,7 @@ func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListReposOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListOrgProjectsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6024,7 +6123,7 @@ func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListReposOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListOrgProjectsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6060,7 +6159,7 @@ func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListReposResponse(resp)
+	result, err := decodeListOrgProjectsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6068,40 +6167,21 @@ func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res
 	return result, nil
 }
 
-// ListServiceAccountGrants invokes listServiceAccountGrants operation.
+// ListOrgs invokes listOrgs operation.
 //
-// List service account grants.
+// List organizations the caller can see (or one by name).
 //
-// GET /service-accounts/{accountId}/grants
-func (c *Client) ListServiceAccountGrants(ctx context.Context, params ListServiceAccountGrantsParams) (*ListServiceAccountGrantsOutputBody, error) {
-	res, err := c.sendListServiceAccountGrants(ctx, params)
+// GET /orgs
+func (c *Client) ListOrgs(ctx context.Context, params ListOrgsParams) (*ListOrgsOutputBodyHeaders, error) {
+	res, err := c.sendListOrgs(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListServiceAccountGrants(ctx context.Context, params ListServiceAccountGrantsParams) (res *ListServiceAccountGrantsOutputBody, err error) {
+func (c *Client) sendListOrgs(ctx context.Context, params ListOrgsParams) (res *ListOrgsOutputBodyHeaders, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [3]string
-	pathParts[0] = "/service-accounts/"
-	{
-		// Encode "accountId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "accountId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.AccountId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[1] = encoded
-	}
-	pathParts[2] = "/grants"
+	var pathParts [1]string
+	pathParts[0] = "/orgs"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -6139,19 +6219,52 @@ func (c *Client) sendListServiceAccountGrants(ctx context.Context, params ListSe
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
-	u.RawQuery = q.Values().Encode()
-
-	r, err := ht.NewRequest(ctx, "GET", u)
-	if err != nil {
-		return res, errors.Wrap(err, "create request")
-	}
-
+	{
+		// Encode "name" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "name",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Name.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	h := uri.NewHeaderEncoder(r.Header)
+	{
+		cfg := uri.HeaderParameterEncodingConfig{
+			Name:    "If-None-Match",
+			Explode: false,
+		}
+		if err := h.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.IfNoneMatch.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode header")
+		}
+	}
+
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListServiceAccountGrantsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListOrgsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6162,7 +6275,7 @@ func (c *Client) sendListServiceAccountGrants(ctx context.Context, params ListSe
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListServiceAccountGrantsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListOrgsOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6198,7 +6311,7 @@ func (c *Client) sendListServiceAccountGrants(ctx context.Context, params ListSe
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListServiceAccountGrantsResponse(resp)
+	result, err := decodeListOrgsResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6206,21 +6319,40 @@ func (c *Client) sendListServiceAccountGrants(ctx context.Context, params ListSe
 	return result, nil
 }
 
-// ListServiceAccounts invokes listServiceAccounts operation.
+// ListProjectMembers invokes listProjectMembers operation.
 //
-// List service accounts in an org.
+// List project members and their roles.
 //
-// GET /service-accounts
-func (c *Client) ListServiceAccounts(ctx context.Context, params ListServiceAccountsParams) (*ListServiceAccountsOutputBody, error) {
-	res, err := c.sendListServiceAccounts(ctx, params)
+// GET /projects/{projectId}/members
+func (c *Client) ListProjectMembers(ctx context.Context, params ListProjectMembersParams) (*ListProjectMembersOutputBody, error) {
+	res, err := c.sendListProjectMembers(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendListServiceAccounts(ctx context.Context, params ListServiceAccountsParams) (res *ListServiceAccountsOutputBody, err error) {
+func (c *Client) sendListProjectMembers(ctx context.Context, params ListProjectMembersParams) (res *ListProjectMembersOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/service-accounts"
+	var pathParts [3]string
+	pathParts[0] = "/projects/"
+	{
+		// Encode "projectId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "projectId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/members"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -6258,20 +6390,6 @@ func (c *Client) sendListServiceAccounts(ctx context.Context, params ListService
 			return res, errors.Wrap(err, "encode query")
 		}
 	}
-	{
-		// Encode "orgId" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "orgId",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.OrgId))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
 	u.RawQuery = q.Values().Encode()
 
 	r, err := ht.NewRequest(ctx, "GET", u)
@@ -6284,7 +6402,7 @@ func (c *Client) sendListServiceAccounts(ctx context.Context, params ListService
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ListServiceAccountsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListProjectMembersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6295,7 +6413,7 @@ func (c *Client) sendListServiceAccounts(ctx context.Context, params ListService
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ListServiceAccountsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListProjectMembersOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6331,61 +6449,7 @@ func (c *Client) sendListServiceAccounts(ctx context.Context, params ListService
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeListServiceAccountsResponse(resp)
-	if err != nil {
-		return res, errors.Wrap(err, "decode response")
-	}
-
-	return result, nil
-}
-
-// LookupRepoBySlug invokes lookupRepoBySlug operation.
-//
-// Resolve a repo slug to routing info (unauthenticated).
-//
-// GET /repos/lookup-by-slug
-func (c *Client) LookupRepoBySlug(ctx context.Context, params LookupRepoBySlugParams) (*LookupBySlugOutputBody, error) {
-	res, err := c.sendLookupRepoBySlug(ctx, params)
-	return res, err
-}
-
-func (c *Client) sendLookupRepoBySlug(ctx context.Context, params LookupRepoBySlugParams) (res *LookupBySlugOutputBody, err error) {
-
-	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/repos/lookup-by-slug"
-	uri.AddPathParts(u, pathParts[:]...)
-
-	q := uri.NewQueryEncoder()
-	{
-		// Encode "slug" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "slug",
-			Style:   uri.QueryStyleForm,
-			Explode: false,
-		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.Slug))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
-		}
-	}
-	u.RawQuery = q.Values().Encode()
-
-	r, err := ht.NewRequest(ctx, "GET", u)
-	if err != nil {
-		return res, errors.Wrap(err, "create request")
-	}
-
-	resp, err := c.cfg.Client.Do(r)
-	if err != nil {
-		return res, errors.Wrap(err, "do request")
-	}
-	body := resp.Body
-	defer body.Close()
-
-	result, err := decodeLookupRepoBySlugResponse(resp)
+	result, err := decodeListProjectMembersResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6393,30 +6457,30 @@ func (c *Client) sendLookupRepoBySlug(ctx context.Context, params LookupRepoBySl
 	return result, nil
 }
 
-// LookupResources invokes lookupResources operation.
+// ListProjectRepos invokes listProjectRepos operation.
 //
-// List resources of a type the caller can access.
+// List repositories in a project (or one by name).
 //
-// GET /access/{resourceType}
-func (c *Client) LookupResources(ctx context.Context, params LookupResourcesParams) (*LookupResourcesOutputBody, error) {
-	res, err := c.sendLookupResources(ctx, params)
+// GET /projects/{projectId}/repos
+func (c *Client) ListProjectRepos(ctx context.Context, params ListProjectReposParams) (*ListProjectReposOutputBody, error) {
+	res, err := c.sendListProjectRepos(ctx, params)
 	return res, err
 }
 
-func (c *Client) sendLookupResources(ctx context.Context, params LookupResourcesParams) (res *LookupResourcesOutputBody, err error) {
+func (c *Client) sendListProjectRepos(ctx context.Context, params ListProjectReposParams) (res *ListProjectReposOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [2]string
-	pathParts[0] = "/access/"
+	var pathParts [3]string
+	pathParts[0] = "/projects/"
 	{
-		// Encode "resourceType" parameter.
+		// Encode "projectId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "resourceType",
+			Param:   "projectId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ResourceType))
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -6426,6 +6490,7 @@ func (c *Client) sendLookupResources(ctx context.Context, params LookupResources
 		}
 		pathParts[1] = encoded
 	}
+	pathParts[2] = "/repos"
 	uri.AddPathParts(u, pathParts[:]...)
 
 	q := uri.NewQueryEncoder()
@@ -6464,15 +6529,15 @@ func (c *Client) sendLookupResources(ctx context.Context, params LookupResources
 		}
 	}
 	{
-		// Encode "permission" parameter.
+		// Encode "name" parameter.
 		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "permission",
+			Name:    "name",
 			Style:   uri.QueryStyleForm,
 			Explode: false,
 		}
 
 		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			if val, ok := params.Permission.Get(); ok {
+			if val, ok := params.Name.Get(); ok {
 				return e.EncodeValue(conv.StringToString(val))
 			}
 			return nil
@@ -6492,7 +6557,7 @@ func (c *Client) sendLookupResources(ctx context.Context, params LookupResources
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, LookupResourcesOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ListProjectReposOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6503,7 +6568,7 @@ func (c *Client) sendLookupResources(ctx context.Context, params LookupResources
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, LookupResourcesOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ListProjectReposOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6539,7 +6604,7 @@ func (c *Client) sendLookupResources(ctx context.Context, params LookupResources
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeLookupResourcesResponse(resp)
+	result, err := decodeListProjectReposResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6547,65 +6612,2701 @@ func (c *Client) sendLookupResources(ctx context.Context, params LookupResources
 	return result, nil
 }
 
-// PatchRepoCIWebhook invokes patchRepoCIWebhook operation.
+// ListProjects invokes listProjects operation.
 //
-// Update a repo's CI webhook.
+// List projects accessible to the caller (or one by name).
 //
-// PATCH /repos/{repoId}/ci-webhooks/{id}
-func (c *Client) PatchRepoCIWebhook(ctx context.Context, request *PatchRepoCIWebhookInputBody, params PatchRepoCIWebhookParams) (*CIWebhookView, error) {
-	res, err := c.sendPatchRepoCIWebhook(ctx, request, params)
+// GET /projects
+func (c *Client) ListProjects(ctx context.Context, params ListProjectsParams) (*ListProjectsOutputBody, error) {
+	res, err := c.sendListProjects(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListProjects(ctx context.Context, params ListProjectsParams) (res *ListProjectsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/projects"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "name" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "name",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Name.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListProjectsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListProjectsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListProjectsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoCIBuilds invokes listRepoCIBuilds operation.
+//
+// List a repo's CI build statuses.
+//
+// GET /repos/{repoId}/ci-builds
+func (c *Client) ListRepoCIBuilds(ctx context.Context, params ListRepoCIBuildsParams) (*ListRepoCIBuildsOutputBody, error) {
+	res, err := c.sendListRepoCIBuilds(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoCIBuilds(ctx context.Context, params ListRepoCIBuildsParams) (res *ListRepoCIBuildsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci-builds"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "commit" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "commit",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Commit.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pipeline" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pipeline",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Pipeline.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "build_number" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "build_number",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.BuildNumber.Get(); ok {
+				return e.EncodeValue(conv.Int64ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "limit" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "limit",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Limit.Get(); ok {
+				return e.EncodeValue(conv.Int64ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoCIBuildsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoCIBuildsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoCIBuildsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoCIProviders invokes listRepoCIProviders operation.
+//
+// Returns each provider's enrolment form AS DATA: its modes, its fields, and the select options
+// drawn from this repo's owning org's connected credentials and registered clusters. A client
+// renders what it is handed and posts back provider/provider_account/target_ref/mode/config, so it
+// never names a CI vendor in its own source. A provider the org cannot enrol into yet comes back
+// enrollable=false with a reason a customer can act on, rather than being omitted. Authz:
+// repo#manage_ci, the same gate as enrolling.
+//
+// GET /repos/{repoId}/ci-webhooks/providers
+func (c *Client) ListRepoCIProviders(ctx context.Context, params ListRepoCIProvidersParams) (*ListRepoCIProvidersOutputBody, error) {
+	res, err := c.sendListRepoCIProviders(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoCIProviders(ctx context.Context, params ListRepoCIProvidersParams) (res *ListRepoCIProvidersOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci-webhooks/providers"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoCIProvidersOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoCIProvidersOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoCIProvidersResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoCIWebhookAudit invokes listRepoCIWebhookAudit operation.
+//
+// Audited ci_webhook_enrolled / _updated / _deleted / _identity_rolled_back / _identity_orphaned
+// events for this repo, newest first, from core's domain audit log. The entire-ci-webhooks
+// subscription row records no actor, so this is the only way to attribute an enrollment — and it
+// covers subscriptions created before this endpoint existed. Authz: repo#manage_ci.
+//
+// GET /repos/{repoId}/ci-webhooks/audit
+func (c *Client) ListRepoCIWebhookAudit(ctx context.Context, params ListRepoCIWebhookAuditParams) (*ListRepoCIWebhookAuditOutputBody, error) {
+	res, err := c.sendListRepoCIWebhookAudit(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoCIWebhookAudit(ctx context.Context, params ListRepoCIWebhookAuditParams) (res *ListRepoCIWebhookAuditOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci-webhooks/audit"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "event_type" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "event_type",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.EventType.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "limit" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "limit",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Limit.Get(); ok {
+				return e.EncodeValue(conv.Int64ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "offset" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "offset",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Offset.Get(); ok {
+				return e.EncodeValue(conv.Int64ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoCIWebhookAuditOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoCIWebhookAuditOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoCIWebhookAuditResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoCIWebhooks invokes listRepoCIWebhooks operation.
+//
+// List a repo's CI webhooks.
+//
+// GET /repos/{repoId}/ci-webhooks
+func (c *Client) ListRepoCIWebhooks(ctx context.Context, params ListRepoCIWebhooksParams) (*ListRepoCIWebhooksOutputBody, error) {
+	res, err := c.sendListRepoCIWebhooks(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoCIWebhooks(ctx context.Context, params ListRepoCIWebhooksParams) (res *ListRepoCIWebhooksOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci-webhooks"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoCIWebhooksOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoCIWebhooksOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoCIWebhooksResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoCollaborators invokes listRepoCollaborators operation.
+//
+// List repo collaborators.
+//
+// GET /repos/{repoId}/collaborators
+func (c *Client) ListRepoCollaborators(ctx context.Context, params ListRepoCollaboratorsParams) (*ListRepoCollaboratorsOutputBody, error) {
+	res, err := c.sendListRepoCollaborators(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoCollaborators(ctx context.Context, params ListRepoCollaboratorsParams) (res *ListRepoCollaboratorsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/collaborators"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoCollaboratorsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoCollaboratorsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoCollaboratorsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoGrants invokes listRepoGrants operation.
+//
+// List repo grants.
+//
+// GET /repos/{repoId}/grants
+func (c *Client) ListRepoGrants(ctx context.Context, params ListRepoGrantsParams) (*ListRepoGrantsOutputBody, error) {
+	res, err := c.sendListRepoGrants(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoGrants(ctx context.Context, params ListRepoGrantsParams) (res *ListRepoGrantsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/grants"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoGrantsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoGrantsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoGrantsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoLanguageFacets invokes listRepoLanguageFacets operation.
+//
+// List repository language facets.
+//
+// GET /repos/facets/languages
+func (c *Client) ListRepoLanguageFacets(ctx context.Context, params ListRepoLanguageFacetsParams) (*RepoFacetPage, error) {
+	res, err := c.sendListRepoLanguageFacets(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoLanguageFacets(ctx context.Context, params ListRepoLanguageFacetsParams) (res *RepoFacetPage, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/repos/facets/languages"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "q" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "q",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Q.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoLanguageFacetsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoLanguageFacetsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoLanguageFacetsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepoOrgFacets invokes listRepoOrgFacets operation.
+//
+// List repository org facets.
+//
+// GET /repos/facets/orgs
+func (c *Client) ListRepoOrgFacets(ctx context.Context, params ListRepoOrgFacetsParams) (*RepoFacetPage, error) {
+	res, err := c.sendListRepoOrgFacets(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepoOrgFacets(ctx context.Context, params ListRepoOrgFacetsParams) (res *RepoFacetPage, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/repos/facets/orgs"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "q" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "q",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Q.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListRepoOrgFacetsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListRepoOrgFacetsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListRepoOrgFacetsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListRepos invokes listRepos operation.
+//
+// List the caller's readable repositories (placement index).
+//
+// GET /repos
+func (c *Client) ListRepos(ctx context.Context, params ListReposParams) (*ListReposOutputBody, error) {
+	res, err := c.sendListRepos(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListRepos(ctx context.Context, params ListReposParams) (res *ListReposOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/repos"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "scope" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "scope",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Scope.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "filter" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "filter",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Filter.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "sort" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "sort",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Sort.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "order" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "order",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Order.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "language" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "language",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Language.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "visibility" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "visibility",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Visibility.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "archived" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "archived",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Archived.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "hasCheckpoints" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "hasCheckpoints",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.HasCheckpoints.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "org" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "org",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Org.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "q" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "q",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Q.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "status" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "status",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Status.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "permission" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "permission",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.Permission.Get(); ok {
+				return e.EncodeValue(conv.StringToString(string(val)))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListReposOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListReposOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListReposResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListServiceAccountGrants invokes listServiceAccountGrants operation.
+//
+// List service account grants.
+//
+// GET /service-accounts/{accountId}/grants
+func (c *Client) ListServiceAccountGrants(ctx context.Context, params ListServiceAccountGrantsParams) (*ListServiceAccountGrantsOutputBody, error) {
+	res, err := c.sendListServiceAccountGrants(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListServiceAccountGrants(ctx context.Context, params ListServiceAccountGrantsParams) (res *ListServiceAccountGrantsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/service-accounts/"
+	{
+		// Encode "accountId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "accountId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.AccountId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/grants"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListServiceAccountGrantsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListServiceAccountGrantsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListServiceAccountGrantsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ListServiceAccounts invokes listServiceAccounts operation.
+//
+// List service accounts in an org.
+//
+// GET /service-accounts
+func (c *Client) ListServiceAccounts(ctx context.Context, params ListServiceAccountsParams) (*ListServiceAccountsOutputBody, error) {
+	res, err := c.sendListServiceAccounts(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendListServiceAccounts(ctx context.Context, params ListServiceAccountsParams) (res *ListServiceAccountsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/service-accounts"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "pageSize" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageSize",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageSize.Get(); ok {
+				return e.EncodeValue(conv.Int32ToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "pageToken" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "pageToken",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			if val, ok := params.PageToken.Get(); ok {
+				return e.EncodeValue(conv.StringToString(val))
+			}
+			return nil
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "orgId" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "orgId",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ListServiceAccountsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ListServiceAccountsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeListServiceAccountsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// LookupRepoBySlug invokes lookupRepoBySlug operation.
+//
+// Resolve a repo slug to routing info (unauthenticated).
+//
+// GET /repos/lookup-by-slug
+func (c *Client) LookupRepoBySlug(ctx context.Context, params LookupRepoBySlugParams) (*LookupBySlugOutputBody, error) {
+	res, err := c.sendLookupRepoBySlug(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendLookupRepoBySlug(ctx context.Context, params LookupRepoBySlugParams) (res *LookupBySlugOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/repos/lookup-by-slug"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "slug" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "slug",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			return e.EncodeValue(conv.StringToString(params.Slug))
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeLookupRepoBySlugResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// MintOrgCIGitHubActionsCredential invokes mintOrgCIGitHubActionsCredential operation.
+//
+// Operator-only: requires platform#admin, unlike the Buildkite routes beside it, because GitHub
+// Actions has no enrolment path yet and a credential minted here cannot be used. Mints the inbound
+// webhook credential for one GitHub account: a fresh webhook secret (returned once, in this 201) and
+// the endpoint URL to configure the GitHub webhook with, plus optionally the outbound dispatch
+// api_token (write-only, never returned; has_api_token confirms storage). With api_token, an
+// already-minted github-actions row gets the token stored/rotated instead (200, no secret re-issued).
+//
+// POST /orgs/{orgId}/ci/github-actions/credential
+func (c *Client) MintOrgCIGitHubActionsCredential(ctx context.Context, request *MintOrgCIGitHubActionsCredentialInputBody, params MintOrgCIGitHubActionsCredentialParams) (*OrgCIGitHubActionsCredentialView, error) {
+	res, err := c.sendMintOrgCIGitHubActionsCredential(ctx, request, params)
+	return res, err
+}
+
+func (c *Client) sendMintOrgCIGitHubActionsCredential(ctx context.Context, request *MintOrgCIGitHubActionsCredentialInputBody, params MintOrgCIGitHubActionsCredentialParams) (res *OrgCIGitHubActionsCredentialView, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/orgs/"
+	{
+		// Encode "orgId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "orgId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci/github-actions/credential"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "POST", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+	if err := encodeMintOrgCIGitHubActionsCredentialRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, MintOrgCIGitHubActionsCredentialOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, MintOrgCIGitHubActionsCredentialOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeMintOrgCIGitHubActionsCredentialResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// PatchRepoCIWebhook invokes patchRepoCIWebhook operation.
+//
+// Update a repo's CI webhook.
+//
+// PATCH /repos/{repoId}/ci-webhooks/{id}
+func (c *Client) PatchRepoCIWebhook(ctx context.Context, request *PatchRepoCIWebhookInputBody, params PatchRepoCIWebhookParams) (*CIWebhookView, error) {
+	res, err := c.sendPatchRepoCIWebhook(ctx, request, params)
+	return res, err
+}
+
+func (c *Client) sendPatchRepoCIWebhook(ctx context.Context, request *PatchRepoCIWebhookInputBody, params PatchRepoCIWebhookParams) (res *CIWebhookView, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [4]string
+	pathParts[0] = "/repos/"
+	{
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci-webhooks/"
+	{
+		// Encode "id" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "id",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ID))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "PATCH", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+	if err := encodePatchRepoCIWebhookRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, PatchRepoCIWebhookOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, PatchRepoCIWebhookOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodePatchRepoCIWebhookResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// RegisterOrgCIBuildkiteCluster invokes registerOrgCIBuildkiteCluster operation.
+//
+// Register or update a Buildkite hosted cluster for an org.
+//
+// POST /orgs/{orgId}/ci/buildkite/clusters
+func (c *Client) RegisterOrgCIBuildkiteCluster(ctx context.Context, request *RegisterOrgCIBuildkiteClusterInputBody, params RegisterOrgCIBuildkiteClusterParams) (*OrgCIBuildkiteClusterView, error) {
+	res, err := c.sendRegisterOrgCIBuildkiteCluster(ctx, request, params)
+	return res, err
+}
+
+func (c *Client) sendRegisterOrgCIBuildkiteCluster(ctx context.Context, request *RegisterOrgCIBuildkiteClusterInputBody, params RegisterOrgCIBuildkiteClusterParams) (res *OrgCIBuildkiteClusterView, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [3]string
+	pathParts[0] = "/orgs/"
+	{
+		// Encode "orgId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "orgId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/ci/buildkite/clusters"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "POST", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+	if err := encodeRegisterOrgCIBuildkiteClusterRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, RegisterOrgCIBuildkiteClusterOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, RegisterOrgCIBuildkiteClusterOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeRegisterOrgCIBuildkiteClusterResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// RemoveOrgMember invokes removeOrgMember operation.
+//
+// Remove a member from an organization.
+//
+// DELETE /orgs/{orgId}/members/{provider}/{providerUserId}
+func (c *Client) RemoveOrgMember(ctx context.Context, params RemoveOrgMemberParams) error {
+	_, err := c.sendRemoveOrgMember(ctx, params)
+	return err
+}
+
+func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMemberParams) (res *RemoveOrgMemberNoContent, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [6]string
+	pathParts[0] = "/orgs/"
+	{
+		// Encode "orgId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "orgId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.OrgId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/members/"
+	{
+		// Encode "provider" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "provider",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.Provider))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
+	pathParts[4] = "/"
+	{
+		// Encode "providerUserId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "providerUserId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ProviderUserId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[5] = encoded
+	}
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "DELETE", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, RemoveOrgMemberOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, RemoveOrgMemberOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeRemoveOrgMemberResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ResolveHandle invokes resolveHandle operation.
+//
+// Resolve account by external provider handle.
+//
+// GET /identity/handles/{provider}/{handle}
+func (c *Client) ResolveHandle(ctx context.Context, params ResolveHandleParams) (*ResolvedIdentity, error) {
+	res, err := c.sendResolveHandle(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandleParams) (res *ResolvedIdentity, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [4]string
+	pathParts[0] = "/identity/handles/"
+	{
+		// Encode "provider" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "provider",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.Provider))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/"
+	{
+		// Encode "handle" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "handle",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.Handle))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[3] = encoded
+	}
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ResolveHandleOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ResolveHandleOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeResolveHandleResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ResolveMirrorPlacements invokes resolveMirrorPlacements operation.
+//
+// Resolve the pullable cluster placements of a mirrored upstream (clone discovery).
+//
+// GET /mirrors/placements
+func (c *Client) ResolveMirrorPlacements(ctx context.Context, params ResolveMirrorPlacementsParams) (*ResolvePlacementsOutputBody, error) {
+	res, err := c.sendResolveMirrorPlacements(ctx, params)
+	return res, err
+}
+
+func (c *Client) sendResolveMirrorPlacements(ctx context.Context, params ResolveMirrorPlacementsParams) (res *ResolvePlacementsOutputBody, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/mirrors/placements"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	q := uri.NewQueryEncoder()
+	{
+		// Encode "provider" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "provider",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			return e.EncodeValue(conv.StringToString(string(params.Provider)))
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "owner" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "owner",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			return e.EncodeValue(conv.StringToString(params.Owner))
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	{
+		// Encode "repo" parameter.
+		cfg := uri.QueryParameterEncodingConfig{
+			Name:    "repo",
+			Style:   uri.QueryStyleForm,
+			Explode: false,
+		}
+
+		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
+			return e.EncodeValue(conv.StringToString(params.Repo))
+		}); err != nil {
+			return res, errors.Wrap(err, "encode query")
+		}
+	}
+	u.RawQuery = q.Values().Encode()
+
+	r, err := ht.NewRequest(ctx, "GET", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ResolveMirrorPlacementsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ResolveMirrorPlacementsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeResolveMirrorPlacementsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ResolveRepoIDs invokes resolveRepoIDs operation.
+//
+// Resolve repository ids to full name and provider.
+//
+// POST /repos/resolve-ids
+func (c *Client) ResolveRepoIDs(ctx context.Context, request *ResolveRepoIDsInputBody) (*ResolveRepoIDsResponse, error) {
+	res, err := c.sendResolveRepoIDs(ctx, request)
+	return res, err
+}
+
+func (c *Client) sendResolveRepoIDs(ctx context.Context, request *ResolveRepoIDsInputBody) (res *ResolveRepoIDsResponse, err error) {
+
+	u := uri.Clone(c.requestURL(ctx))
+	var pathParts [1]string
+	pathParts[0] = "/repos/resolve-ids"
+	uri.AddPathParts(u, pathParts[:]...)
+
+	r, err := ht.NewRequest(ctx, "POST", u)
+	if err != nil {
+		return res, errors.Wrap(err, "create request")
+	}
+	if err := encodeResolveRepoIDsRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
+
+	{
+		type bitset = [1]uint8
+		var satisfied bitset
+		{
+
+			switch err := c.securityBearerAuth(ctx, ResolveRepoIDsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 0
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"BearerAuth\"")
+			}
+		}
+		{
+
+			switch err := c.securitySessionAuth(ctx, ResolveRepoIDsOperation, r); {
+			case err == nil: // if NO error
+				satisfied[0] |= 1 << 1
+			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
+				// Skip this security.
+			default:
+				return res, errors.Wrap(err, "security \"SessionAuth\"")
+			}
+		}
+
+		if ok := func() bool {
+		nextRequirement:
+			for _, requirement := range []bitset{
+				{0b00000001},
+				{0b00000010},
+			} {
+				for i, mask := range requirement {
+					if satisfied[i]&mask != mask {
+						continue nextRequirement
+					}
+				}
+				return true
+			}
+			return false
+		}(); !ok {
+			return res, ogenerrors.ErrSecurityRequirementIsNotSatisfied
+		}
+	}
+
+	resp, err := c.cfg.Client.Do(r)
+	if err != nil {
+		return res, errors.Wrap(err, "do request")
+	}
+	body := resp.Body
+	defer body.Close()
+
+	result, err := decodeResolveRepoIDsResponse(resp)
+	if err != nil {
+		return res, errors.Wrap(err, "decode response")
+	}
+
+	return result, nil
+}
+
+// ResolveRepos invokes resolveRepos operation.
+//
+// Resolve provider-qualified repository lifecycle states.
+//
+// POST /repos/resolve
+func (c *Client) ResolveRepos(ctx context.Context, request *ResolveReposInputBody) (*ResolveReposResponse, error) {
+	res, err := c.sendResolveRepos(ctx, request)
 	return res, err
 }
 
-func (c *Client) sendPatchRepoCIWebhook(ctx context.Context, request *PatchRepoCIWebhookInputBody, params PatchRepoCIWebhookParams) (res *CIWebhookView, err error) {
+func (c *Client) sendResolveRepos(ctx context.Context, request *ResolveReposInputBody) (res *ResolveReposResponse, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [4]string
-	pathParts[0] = "/repos/"
-	{
-		// Encode "repoId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[1] = encoded
-	}
-	pathParts[2] = "/ci-webhooks/"
-	{
-		// Encode "id" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "id",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ID))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[3] = encoded
-	}
+	var pathParts [1]string
+	pathParts[0] = "/repos/resolve"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "PATCH", u)
+	r, err := ht.NewRequest(ctx, "POST", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
-	if err := encodePatchRepoCIWebhookRequest(request, r); err != nil {
+	if err := encodeResolveReposRequest(request, r); err != nil {
 		return res, errors.Wrap(err, "encode request")
 	}
 
@@ -6614,7 +9315,7 @@ func (c *Client) sendPatchRepoCIWebhook(ctx context.Context, request *PatchRepoC
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, PatchRepoCIWebhookOperation, r); {
+			switch err := c.securityBearerAuth(ctx, ResolveReposOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6625,7 +9326,7 @@ func (c *Client) sendPatchRepoCIWebhook(ctx context.Context, request *PatchRepoC
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, PatchRepoCIWebhookOperation, r); {
+			switch err := c.securitySessionAuth(ctx, ResolveReposOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6661,7 +9362,7 @@ func (c *Client) sendPatchRepoCIWebhook(ctx context.Context, request *PatchRepoC
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodePatchRepoCIWebhookResponse(resp)
+	result, err := decodeResolveReposResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6669,30 +9370,30 @@ func (c *Client) sendPatchRepoCIWebhook(ctx context.Context, request *PatchRepoC
 	return result, nil
 }
 
-// RemoveOrgMember invokes removeOrgMember operation.
+// RevokeProjectAccess invokes revokeProjectAccess operation.
 //
-// Remove a member from an organization.
+// Revoke project access by grantee id.
 //
-// DELETE /orgs/{orgId}/members/{provider}/{providerUserId}
-func (c *Client) RemoveOrgMember(ctx context.Context, params RemoveOrgMemberParams) error {
-	_, err := c.sendRemoveOrgMember(ctx, params)
+// DELETE /projects/{projectId}/grants/{granteeType}/{granteeId}
+func (c *Client) RevokeProjectAccess(ctx context.Context, params RevokeProjectAccessParams) error {
+	_, err := c.sendRevokeProjectAccess(ctx, params)
 	return err
 }
 
-func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMemberParams) (res *RemoveOrgMemberNoContent, err error) {
+func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProjectAccessParams) (res *RevokeProjectAccessNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [6]string
-	pathParts[0] = "/orgs/"
+	pathParts[0] = "/projects/"
 	{
-		// Encode "orgId" parameter.
+		// Encode "projectId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "orgId",
+			Param:   "projectId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.OrgId))
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -6702,16 +9403,16 @@ func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMember
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/members/"
+	pathParts[2] = "/grants/"
 	{
-		// Encode "provider" parameter.
+		// Encode "granteeType" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "provider",
+			Param:   "granteeType",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.Provider))
+			return e.EncodeValue(conv.StringToString(params.GranteeType))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -6723,14 +9424,14 @@ func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMember
 	}
 	pathParts[4] = "/"
 	{
-		// Encode "providerUserId" parameter.
+		// Encode "granteeId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "providerUserId",
+			Param:   "granteeId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProviderUserId))
+			return e.EncodeValue(conv.StringToString(params.GranteeId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -6752,7 +9453,7 @@ func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMember
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, RemoveOrgMemberOperation, r); {
+			switch err := c.securityBearerAuth(ctx, RevokeProjectAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6763,7 +9464,7 @@ func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMember
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, RemoveOrgMemberOperation, r); {
+			switch err := c.securitySessionAuth(ctx, RevokeProjectAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6799,7 +9500,7 @@ func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMember
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeRemoveOrgMemberResponse(resp)
+	result, err := decodeRevokeProjectAccessResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6807,21 +9508,40 @@ func (c *Client) sendRemoveOrgMember(ctx context.Context, params RemoveOrgMember
 	return result, nil
 }
 
-// ResolveHandle invokes resolveHandle operation.
+// RevokeProjectAccessByProvider invokes revokeProjectAccessByProvider operation.
 //
-// Resolve account by external provider handle.
+// Revoke project access by provider identity.
 //
-// GET /identity/handles/{provider}/{handle}
-func (c *Client) ResolveHandle(ctx context.Context, params ResolveHandleParams) (*ResolvedIdentity, error) {
-	res, err := c.sendResolveHandle(ctx, params)
-	return res, err
+// DELETE /projects/{projectId}/grants/account/{provider}/{providerUserId}
+func (c *Client) RevokeProjectAccessByProvider(ctx context.Context, params RevokeProjectAccessByProviderParams) error {
+	_, err := c.sendRevokeProjectAccessByProvider(ctx, params)
+	return err
 }
 
-func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandleParams) (res *ResolvedIdentity, err error) {
+func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params RevokeProjectAccessByProviderParams) (res *RevokeProjectAccessByProviderNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [4]string
-	pathParts[0] = "/identity/handles/"
+	var pathParts [6]string
+	pathParts[0] = "/projects/"
+	{
+		// Encode "projectId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "projectId",
+			Style:   uri.PathStyleSimple,
+			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.ProjectId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
+		}
+		pathParts[1] = encoded
+	}
+	pathParts[2] = "/grants/account/"
 	{
 		// Encode "provider" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
@@ -6838,18 +9558,18 @@ func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandlePara
 		if err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
-		pathParts[1] = encoded
+		pathParts[3] = encoded
 	}
-	pathParts[2] = "/"
+	pathParts[4] = "/"
 	{
-		// Encode "handle" parameter.
+		// Encode "providerUserId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "handle",
+			Param:   "providerUserId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.Handle))
+			return e.EncodeValue(conv.StringToString(params.ProviderUserId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -6857,11 +9577,11 @@ func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandlePara
 		if err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
-		pathParts[3] = encoded
+		pathParts[5] = encoded
 	}
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "DELETE", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
@@ -6871,7 +9591,7 @@ func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandlePara
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ResolveHandleOperation, r); {
+			switch err := c.securityBearerAuth(ctx, RevokeProjectAccessByProviderOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6882,7 +9602,7 @@ func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandlePara
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ResolveHandleOperation, r); {
+			switch err := c.securitySessionAuth(ctx, RevokeProjectAccessByProviderOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -6918,7 +9638,7 @@ func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandlePara
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeResolveHandleResponse(resp)
+	result, err := decodeRevokeProjectAccessByProviderResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -6926,69 +9646,80 @@ func (c *Client) sendResolveHandle(ctx context.Context, params ResolveHandlePara
 	return result, nil
 }
 
-// ResolveMirrorPlacements invokes resolveMirrorPlacements operation.
+// RevokeRepoAccess invokes revokeRepoAccess operation.
 //
-// Resolve the pullable cluster placements of a mirrored upstream (clone discovery).
+// Revoke repo access by grantee id.
 //
-// GET /mirrors/placements
-func (c *Client) ResolveMirrorPlacements(ctx context.Context, params ResolveMirrorPlacementsParams) (*ResolvePlacementsOutputBody, error) {
-	res, err := c.sendResolveMirrorPlacements(ctx, params)
-	return res, err
+// DELETE /repos/{repoId}/grants/{granteeType}/{granteeId}
+func (c *Client) RevokeRepoAccess(ctx context.Context, params RevokeRepoAccessParams) error {
+	_, err := c.sendRevokeRepoAccess(ctx, params)
+	return err
 }
 
-func (c *Client) sendResolveMirrorPlacements(ctx context.Context, params ResolveMirrorPlacementsParams) (res *ResolvePlacementsOutputBody, err error) {
+func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAccessParams) (res *RevokeRepoAccessNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [1]string
-	pathParts[0] = "/mirrors/placements"
-	uri.AddPathParts(u, pathParts[:]...)
-
-	q := uri.NewQueryEncoder()
+	var pathParts [6]string
+	pathParts[0] = "/repos/"
 	{
-		// Encode "provider" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "provider",
-			Style:   uri.QueryStyleForm,
+		// Encode "repoId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "repoId",
+			Style:   uri.PathStyleSimple,
 			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.RepoId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(string(params.Provider)))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
+		pathParts[1] = encoded
 	}
+	pathParts[2] = "/grants/"
 	{
-		// Encode "owner" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "owner",
-			Style:   uri.QueryStyleForm,
+		// Encode "granteeType" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "granteeType",
+			Style:   uri.PathStyleSimple,
 			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.GranteeType))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.Owner))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
+		pathParts[3] = encoded
 	}
+	pathParts[4] = "/"
 	{
-		// Encode "repo" parameter.
-		cfg := uri.QueryParameterEncodingConfig{
-			Name:    "repo",
-			Style:   uri.QueryStyleForm,
+		// Encode "granteeId" parameter.
+		e := uri.NewPathEncoder(uri.PathEncoderConfig{
+			Param:   "granteeId",
+			Style:   uri.PathStyleSimple,
 			Explode: false,
+		})
+		if err := func() error {
+			return e.EncodeValue(conv.StringToString(params.GranteeId))
+		}(); err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
-
-		if err := q.EncodeParam(cfg, func(e uri.Encoder) error {
-			return e.EncodeValue(conv.StringToString(params.Repo))
-		}); err != nil {
-			return res, errors.Wrap(err, "encode query")
+		encoded, err := e.Result()
+		if err != nil {
+			return res, errors.Wrap(err, "encode path")
 		}
+		pathParts[5] = encoded
 	}
-	u.RawQuery = q.Values().Encode()
+	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "GET", u)
+	r, err := ht.NewRequest(ctx, "DELETE", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
@@ -6998,7 +9729,7 @@ func (c *Client) sendResolveMirrorPlacements(ctx context.Context, params Resolve
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, ResolveMirrorPlacementsOperation, r); {
+			switch err := c.securityBearerAuth(ctx, RevokeRepoAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7009,7 +9740,7 @@ func (c *Client) sendResolveMirrorPlacements(ctx context.Context, params Resolve
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, ResolveMirrorPlacementsOperation, r); {
+			switch err := c.securitySessionAuth(ctx, RevokeRepoAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7045,7 +9776,7 @@ func (c *Client) sendResolveMirrorPlacements(ctx context.Context, params Resolve
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeResolveMirrorPlacementsResponse(resp)
+	result, err := decodeRevokeRepoAccessResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -7053,30 +9784,30 @@ func (c *Client) sendResolveMirrorPlacements(ctx context.Context, params Resolve
 	return result, nil
 }
 
-// RevokeProjectAccess invokes revokeProjectAccess operation.
+// RevokeRepoAccessByProvider invokes revokeRepoAccessByProvider operation.
 //
-// Revoke project access by grantee id.
+// Revoke repo access by provider identity.
 //
-// DELETE /projects/{projectId}/grants/{granteeType}/{granteeId}
-func (c *Client) RevokeProjectAccess(ctx context.Context, params RevokeProjectAccessParams) error {
-	_, err := c.sendRevokeProjectAccess(ctx, params)
+// DELETE /repos/{repoId}/grants/account/{provider}/{providerUserId}
+func (c *Client) RevokeRepoAccessByProvider(ctx context.Context, params RevokeRepoAccessByProviderParams) error {
+	_, err := c.sendRevokeRepoAccessByProvider(ctx, params)
 	return err
 }
 
-func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProjectAccessParams) (res *RevokeProjectAccessNoContent, err error) {
+func (c *Client) sendRevokeRepoAccessByProvider(ctx context.Context, params RevokeRepoAccessByProviderParams) (res *RevokeRepoAccessByProviderNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [6]string
-	pathParts[0] = "/projects/"
+	pathParts[0] = "/repos/"
 	{
-		// Encode "projectId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7086,16 +9817,16 @@ func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProje
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants/"
+	pathParts[2] = "/grants/account/"
 	{
-		// Encode "granteeType" parameter.
+		// Encode "provider" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "granteeType",
+			Param:   "provider",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.GranteeType))
+			return e.EncodeValue(conv.StringToString(params.Provider))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7107,14 +9838,14 @@ func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProje
 	}
 	pathParts[4] = "/"
 	{
-		// Encode "granteeId" parameter.
+		// Encode "providerUserId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "granteeId",
+			Param:   "providerUserId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.GranteeId))
+			return e.EncodeValue(conv.StringToString(params.ProviderUserId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7136,7 +9867,7 @@ func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProje
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, RevokeProjectAccessOperation, r); {
+			switch err := c.securityBearerAuth(ctx, RevokeRepoAccessByProviderOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7147,7 +9878,7 @@ func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProje
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, RevokeProjectAccessOperation, r); {
+			switch err := c.securitySessionAuth(ctx, RevokeRepoAccessByProviderOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7183,7 +9914,7 @@ func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProje
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeRevokeProjectAccessResponse(resp)
+	result, err := decodeRevokeRepoAccessByProviderResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -7191,30 +9922,30 @@ func (c *Client) sendRevokeProjectAccess(ctx context.Context, params RevokeProje
 	return result, nil
 }
 
-// RevokeProjectAccessByProvider invokes revokeProjectAccessByProvider operation.
+// RevokeServiceAccountAccess invokes revokeServiceAccountAccess operation.
 //
-// Revoke project access by provider identity.
+// Revoke service account access.
 //
-// DELETE /projects/{projectId}/grants/account/{provider}/{providerUserId}
-func (c *Client) RevokeProjectAccessByProvider(ctx context.Context, params RevokeProjectAccessByProviderParams) error {
-	_, err := c.sendRevokeProjectAccessByProvider(ctx, params)
+// DELETE /service-accounts/{accountId}/grants/{resourceType}/{resourceId}
+func (c *Client) RevokeServiceAccountAccess(ctx context.Context, params RevokeServiceAccountAccessParams) error {
+	_, err := c.sendRevokeServiceAccountAccess(ctx, params)
 	return err
 }
 
-func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params RevokeProjectAccessByProviderParams) (res *RevokeProjectAccessByProviderNoContent, err error) {
+func (c *Client) sendRevokeServiceAccountAccess(ctx context.Context, params RevokeServiceAccountAccessParams) (res *RevokeServiceAccountAccessNoContent, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [6]string
-	pathParts[0] = "/projects/"
+	pathParts[0] = "/service-accounts/"
 	{
-		// Encode "projectId" parameter.
+		// Encode "accountId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "projectId",
+			Param:   "accountId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProjectId))
+			return e.EncodeValue(conv.StringToString(params.AccountId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7224,16 +9955,16 @@ func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params R
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants/account/"
+	pathParts[2] = "/grants/"
 	{
-		// Encode "provider" parameter.
+		// Encode "resourceType" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "provider",
+			Param:   "resourceType",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.Provider))
+			return e.EncodeValue(conv.StringToString(string(params.ResourceType)))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7245,14 +9976,14 @@ func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params R
 	}
 	pathParts[4] = "/"
 	{
-		// Encode "providerUserId" parameter.
+		// Encode "resourceId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "providerUserId",
+			Param:   "resourceId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProviderUserId))
+			return e.EncodeValue(conv.StringToString(params.ResourceId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7274,7 +10005,7 @@ func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params R
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, RevokeProjectAccessByProviderOperation, r); {
+			switch err := c.securityBearerAuth(ctx, RevokeServiceAccountAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7285,7 +10016,7 @@ func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params R
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, RevokeProjectAccessByProviderOperation, r); {
+			switch err := c.securitySessionAuth(ctx, RevokeServiceAccountAccessOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7321,7 +10052,7 @@ func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params R
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeRevokeProjectAccessByProviderResponse(resp)
+	result, err := decodeRevokeServiceAccountAccessResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -7329,30 +10060,30 @@ func (c *Client) sendRevokeProjectAccessByProvider(ctx context.Context, params R
 	return result, nil
 }
 
-// RevokeRepoAccess invokes revokeRepoAccess operation.
+// RotateOrgCIBuildkiteInboundSecret invokes rotateOrgCIBuildkiteInboundSecret operation.
 //
-// Revoke repo access by grantee id.
+// Rotate an org's inbound Buildkite webhook secret.
 //
-// DELETE /repos/{repoId}/grants/{granteeType}/{granteeId}
-func (c *Client) RevokeRepoAccess(ctx context.Context, params RevokeRepoAccessParams) error {
-	_, err := c.sendRevokeRepoAccess(ctx, params)
-	return err
+// PUT /orgs/{orgId}/ci/buildkite/credential/{bkOrg}/inbound-secret
+func (c *Client) RotateOrgCIBuildkiteInboundSecret(ctx context.Context, params RotateOrgCIBuildkiteInboundSecretParams) (*OrgCIBuildkiteCredentialView, error) {
+	res, err := c.sendRotateOrgCIBuildkiteInboundSecret(ctx, params)
+	return res, err
 }
 
-func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAccessParams) (res *RevokeRepoAccessNoContent, err error) {
+func (c *Client) sendRotateOrgCIBuildkiteInboundSecret(ctx context.Context, params RotateOrgCIBuildkiteInboundSecretParams) (res *OrgCIBuildkiteCredentialView, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [6]string
-	pathParts[0] = "/repos/"
+	var pathParts [5]string
+	pathParts[0] = "/orgs/"
 	{
-		// Encode "repoId" parameter.
+		// Encode "orgId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "repoId",
+			Param:   "orgId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.RepoId))
+			return e.EncodeValue(conv.StringToString(params.OrgId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7362,16 +10093,16 @@ func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAcce
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants/"
+	pathParts[2] = "/ci/buildkite/credential/"
 	{
-		// Encode "granteeType" parameter.
+		// Encode "bkOrg" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "granteeType",
+			Param:   "bkOrg",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.GranteeType))
+			return e.EncodeValue(conv.StringToString(params.BkOrg))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7381,28 +10112,10 @@ func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAcce
 		}
 		pathParts[3] = encoded
 	}
-	pathParts[4] = "/"
-	{
-		// Encode "granteeId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "granteeId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.GranteeId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[5] = encoded
-	}
+	pathParts[4] = "/inbound-secret"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "DELETE", u)
+	r, err := ht.NewRequest(ctx, "PUT", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
@@ -7412,7 +10125,7 @@ func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAcce
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, RevokeRepoAccessOperation, r); {
+			switch err := c.securityBearerAuth(ctx, RotateOrgCIBuildkiteInboundSecretOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7423,7 +10136,7 @@ func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAcce
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, RevokeRepoAccessOperation, r); {
+			switch err := c.securitySessionAuth(ctx, RotateOrgCIBuildkiteInboundSecretOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7459,7 +10172,7 @@ func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAcce
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeRevokeRepoAccessResponse(resp)
+	result, err := decodeRotateOrgCIBuildkiteInboundSecretResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -7467,20 +10180,20 @@ func (c *Client) sendRevokeRepoAccess(ctx context.Context, params RevokeRepoAcce
 	return result, nil
 }
 
-// RevokeRepoAccessByProvider invokes revokeRepoAccessByProvider operation.
+// SetBranchProtection invokes setBranchProtection operation.
 //
-// Revoke repo access by provider identity.
+// Set repository branch protection.
 //
-// DELETE /repos/{repoId}/grants/account/{provider}/{providerUserId}
-func (c *Client) RevokeRepoAccessByProvider(ctx context.Context, params RevokeRepoAccessByProviderParams) error {
-	_, err := c.sendRevokeRepoAccessByProvider(ctx, params)
-	return err
+// PUT /repos/{repoId}/branch-protection
+func (c *Client) SetBranchProtection(ctx context.Context, request *BranchProtection, params SetBranchProtectionParams) (*BranchProtection, error) {
+	res, err := c.sendSetBranchProtection(ctx, request, params)
+	return res, err
 }
 
-func (c *Client) sendRevokeRepoAccessByProvider(ctx context.Context, params RevokeRepoAccessByProviderParams) (res *RevokeRepoAccessByProviderNoContent, err error) {
+func (c *Client) sendSetBranchProtection(ctx context.Context, request *BranchProtection, params SetBranchProtectionParams) (res *BranchProtection, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [6]string
+	var pathParts [3]string
 	pathParts[0] = "/repos/"
 	{
 		// Encode "repoId" parameter.
@@ -7500,57 +10213,23 @@ func (c *Client) sendRevokeRepoAccessByProvider(ctx context.Context, params Revo
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants/account/"
-	{
-		// Encode "provider" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "provider",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.Provider))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[3] = encoded
-	}
-	pathParts[4] = "/"
-	{
-		// Encode "providerUserId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "providerUserId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ProviderUserId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[5] = encoded
-	}
+	pathParts[2] = "/branch-protection"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "DELETE", u)
+	r, err := ht.NewRequest(ctx, "PUT", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
+	if err := encodeSetBranchProtectionRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, RevokeRepoAccessByProviderOperation, r); {
+			switch err := c.securityBearerAuth(ctx, SetBranchProtectionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7561,7 +10240,7 @@ func (c *Client) sendRevokeRepoAccessByProvider(ctx context.Context, params Revo
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, RevokeRepoAccessByProviderOperation, r); {
+			switch err := c.securitySessionAuth(ctx, SetBranchProtectionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7597,7 +10276,7 @@ func (c *Client) sendRevokeRepoAccessByProvider(ctx context.Context, params Revo
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeRevokeRepoAccessByProviderResponse(resp)
+	result, err := decodeSetBranchProtectionResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -7605,30 +10284,30 @@ func (c *Client) sendRevokeRepoAccessByProvider(ctx context.Context, params Revo
 	return result, nil
 }
 
-// RevokeServiceAccountAccess invokes revokeServiceAccountAccess operation.
+// SetRepoVisibility invokes setRepoVisibility operation.
 //
-// Revoke service account access.
+// Set repository visibility.
 //
-// DELETE /service-accounts/{accountId}/grants/{resourceType}/{resourceId}
-func (c *Client) RevokeServiceAccountAccess(ctx context.Context, params RevokeServiceAccountAccessParams) error {
-	_, err := c.sendRevokeServiceAccountAccess(ctx, params)
-	return err
+// PUT /repos/{repoId}/visibility
+func (c *Client) SetRepoVisibility(ctx context.Context, request *SetRepoVisibilityInputBody, params SetRepoVisibilityParams) (*SetRepoVisibilityOutputBody, error) {
+	res, err := c.sendSetRepoVisibility(ctx, request, params)
+	return res, err
 }
 
-func (c *Client) sendRevokeServiceAccountAccess(ctx context.Context, params RevokeServiceAccountAccessParams) (res *RevokeServiceAccountAccessNoContent, err error) {
+func (c *Client) sendSetRepoVisibility(ctx context.Context, request *SetRepoVisibilityInputBody, params SetRepoVisibilityParams) (res *SetRepoVisibilityOutputBody, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
-	var pathParts [6]string
-	pathParts[0] = "/service-accounts/"
+	var pathParts [3]string
+	pathParts[0] = "/repos/"
 	{
-		// Encode "accountId" parameter.
+		// Encode "repoId" parameter.
 		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "accountId",
+			Param:   "repoId",
 			Style:   uri.PathStyleSimple,
 			Explode: false,
 		})
 		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.AccountId))
+			return e.EncodeValue(conv.StringToString(params.RepoId))
 		}(); err != nil {
 			return res, errors.Wrap(err, "encode path")
 		}
@@ -7638,57 +10317,23 @@ func (c *Client) sendRevokeServiceAccountAccess(ctx context.Context, params Revo
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/grants/"
-	{
-		// Encode "resourceType" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "resourceType",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(string(params.ResourceType)))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[3] = encoded
-	}
-	pathParts[4] = "/"
-	{
-		// Encode "resourceId" parameter.
-		e := uri.NewPathEncoder(uri.PathEncoderConfig{
-			Param:   "resourceId",
-			Style:   uri.PathStyleSimple,
-			Explode: false,
-		})
-		if err := func() error {
-			return e.EncodeValue(conv.StringToString(params.ResourceId))
-		}(); err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		encoded, err := e.Result()
-		if err != nil {
-			return res, errors.Wrap(err, "encode path")
-		}
-		pathParts[5] = encoded
-	}
+	pathParts[2] = "/visibility"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "DELETE", u)
+	r, err := ht.NewRequest(ctx, "PUT", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
+	if err := encodeSetRepoVisibilityRequest(request, r); err != nil {
+		return res, errors.Wrap(err, "encode request")
+	}
 
 	{
 		type bitset = [1]uint8
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, RevokeServiceAccountAccessOperation, r); {
+			switch err := c.securityBearerAuth(ctx, SetRepoVisibilityOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7699,7 +10344,7 @@ func (c *Client) sendRevokeServiceAccountAccess(ctx context.Context, params Revo
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, RevokeServiceAccountAccessOperation, r); {
+			switch err := c.securitySessionAuth(ctx, SetRepoVisibilityOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7735,7 +10380,7 @@ func (c *Client) sendRevokeServiceAccountAccess(ctx context.Context, params Revo
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeRevokeServiceAccountAccessResponse(resp)
+	result, err := decodeSetRepoVisibilityResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
@@ -7743,17 +10388,17 @@ func (c *Client) sendRevokeServiceAccountAccess(ctx context.Context, params Revo
 	return result, nil
 }
 
-// SetRepoVisibility invokes setRepoVisibility operation.
+// UpdateBranchProtection invokes updateBranchProtection operation.
 //
-// Set repository visibility.
+// Add or remove protected branches.
 //
-// PUT /repos/{repoId}/visibility
-func (c *Client) SetRepoVisibility(ctx context.Context, request *SetRepoVisibilityInputBody, params SetRepoVisibilityParams) (*SetRepoVisibilityOutputBody, error) {
-	res, err := c.sendSetRepoVisibility(ctx, request, params)
+// PATCH /repos/{repoId}/branch-protection
+func (c *Client) UpdateBranchProtection(ctx context.Context, request *UpdateBranchProtectionInputBody, params UpdateBranchProtectionParams) (*BranchProtection, error) {
+	res, err := c.sendUpdateBranchProtection(ctx, request, params)
 	return res, err
 }
 
-func (c *Client) sendSetRepoVisibility(ctx context.Context, request *SetRepoVisibilityInputBody, params SetRepoVisibilityParams) (res *SetRepoVisibilityOutputBody, err error) {
+func (c *Client) sendUpdateBranchProtection(ctx context.Context, request *UpdateBranchProtectionInputBody, params UpdateBranchProtectionParams) (res *BranchProtection, err error) {
 
 	u := uri.Clone(c.requestURL(ctx))
 	var pathParts [3]string
@@ -7776,14 +10421,14 @@ func (c *Client) sendSetRepoVisibility(ctx context.Context, request *SetRepoVisi
 		}
 		pathParts[1] = encoded
 	}
-	pathParts[2] = "/visibility"
+	pathParts[2] = "/branch-protection"
 	uri.AddPathParts(u, pathParts[:]...)
 
-	r, err := ht.NewRequest(ctx, "PUT", u)
+	r, err := ht.NewRequest(ctx, "PATCH", u)
 	if err != nil {
 		return res, errors.Wrap(err, "create request")
 	}
-	if err := encodeSetRepoVisibilityRequest(request, r); err != nil {
+	if err := encodeUpdateBranchProtectionRequest(request, r); err != nil {
 		return res, errors.Wrap(err, "encode request")
 	}
 
@@ -7792,7 +10437,7 @@ func (c *Client) sendSetRepoVisibility(ctx context.Context, request *SetRepoVisi
 		var satisfied bitset
 		{
 
-			switch err := c.securityBearerAuth(ctx, SetRepoVisibilityOperation, r); {
+			switch err := c.securityBearerAuth(ctx, UpdateBranchProtectionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 0
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7803,7 +10448,7 @@ func (c *Client) sendSetRepoVisibility(ctx context.Context, request *SetRepoVisi
 		}
 		{
 
-			switch err := c.securitySessionAuth(ctx, SetRepoVisibilityOperation, r); {
+			switch err := c.securitySessionAuth(ctx, UpdateBranchProtectionOperation, r); {
 			case err == nil: // if NO error
 				satisfied[0] |= 1 << 1
 			case errors.Is(err, ogenerrors.ErrSkipClientSecurity):
@@ -7839,7 +10484,7 @@ func (c *Client) sendSetRepoVisibility(ctx context.Context, request *SetRepoVisi
 	body := resp.Body
 	defer body.Close()
 
-	result, err := decodeSetRepoVisibilityResponse(resp)
+	result, err := decodeUpdateBranchProtectionResponse(resp)
 	if err != nil {
 		return res, errors.Wrap(err, "decode response")
 	}
diff --git a/internal/coreapi/oas_json_gen.go b/internal/coreapi/oas_json_gen.go
index c2e83c7b90..b94b85d419 100644
--- a/internal/coreapi/oas_json_gen.go
+++ b/internal/coreapi/oas_json_gen.go
@@ -625,6 +625,12 @@ func (s *AvailableMirror) encodeFields(e *jx.Encoder) {
 		e.FieldStart("owner")
 		e.Str(s.Owner)
 	}
+	{
+		if s.PushedAt.Set {
+			e.FieldStart("pushedAt")
+			s.PushedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
 	{
 		e.FieldStart("repo")
 		e.Str(s.Repo)
@@ -642,13 +648,14 @@ func (s *AvailableMirror) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfAvailableMirror = [6]string{
+var jsonFieldsNameOfAvailableMirror = [7]string{
 	0: "access",
 	1: "isArchived",
 	2: "isPrivate",
 	3: "owner",
-	4: "repo",
-	5: "status",
+	4: "pushedAt",
+	5: "repo",
+	6: "status",
 }
 
 // Decode decodes AvailableMirror from json.
@@ -703,8 +710,18 @@ func (s *AvailableMirror) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"owner\"")
 			}
+		case "pushedAt":
+			if err := func() error {
+				s.PushedAt.Reset()
+				if err := s.PushedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"pushedAt\"")
+			}
 		case "repo":
-			requiredBitSet[0] |= 1 << 4
+			requiredBitSet[0] |= 1 << 5
 			if err := func() error {
 				v, err := d.Str()
 				s.Repo = string(v)
@@ -716,7 +733,7 @@ func (s *AvailableMirror) Decode(d *jx.Decoder) error {
 				return errors.Wrap(err, "decode field \"repo\"")
 			}
 		case "status":
-			requiredBitSet[0] |= 1 << 5
+			requiredBitSet[0] |= 1 << 6
 			if err := func() error {
 				if err := s.Status.Decode(d); err != nil {
 					return err
@@ -746,7 +763,7 @@ func (s *AvailableMirror) Decode(d *jx.Decoder) error {
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00111001,
+		0b01101001,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -935,14 +952,14 @@ func (s *AvailableMirrorStatus) UnmarshalJSON(data []byte) error {
 }
 
 // Encode implements json.Marshaler.
-func (s *BatchLookupInputBody) Encode(e *jx.Encoder) {
+func (s *Binding) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *BatchLookupInputBody) encodeFields(e *jx.Encoder) {
+func (s *Binding) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -950,12 +967,26 @@ func (s *BatchLookupInputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("refs")
-		e.ArrStart()
-		for _, elem := range s.Refs {
-			elem.Encode(e)
+		e.FieldStart("accountId")
+		e.Str(s.AccountId)
+	}
+	{
+		if len(s.AttributeFilter) != 0 {
+			e.FieldStart("attributeFilter")
+			e.Raw(s.AttributeFilter)
 		}
-		e.ArrEnd()
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("providerId")
+		e.Str(s.ProviderId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -966,15 +997,19 @@ func (s *BatchLookupInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfBatchLookupInputBody = [2]string{
+var jsonFieldsNameOfBinding = [6]string{
 	0: "$schema",
-	1: "refs",
+	1: "accountId",
+	2: "attributeFilter",
+	3: "createdAt",
+	4: "id",
+	5: "providerId",
 }
 
-// Decode decodes BatchLookupInputBody from json.
-func (s *BatchLookupInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes Binding from json.
+func (s *Binding) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode BatchLookupInputBody to nil")
+		return errors.New("invalid: unable to decode Binding to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -991,23 +1026,65 @@ func (s *BatchLookupInputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "refs":
+		case "accountId":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Refs = make([]LookupRef, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem LookupRef
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Refs = append(s.Refs, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.AccountId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"accountId\"")
+			}
+		case "attributeFilter":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				s.AttributeFilter = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"attributeFilter\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "id":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "providerId":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.ProviderId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"refs\"")
+				return errors.Wrap(err, "decode field \"providerId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -1025,12 +1102,12 @@ func (s *BatchLookupInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode BatchLookupInputBody")
+		return errors.Wrap(err, "decode Binding")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00111110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -1042,8 +1119,8 @@ func (s *BatchLookupInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfBatchLookupInputBody) {
-					name = jsonFieldsNameOfBatchLookupInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfBinding) {
+					name = jsonFieldsNameOfBinding[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -1064,27 +1141,27 @@ func (s *BatchLookupInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *BatchLookupInputBody) MarshalJSON() ([]byte, error) {
+func (s *Binding) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *BatchLookupInputBody) UnmarshalJSON(data []byte) error {
+func (s *Binding) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s BatchLookupInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s BindingAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s BatchLookupInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s BindingAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -1094,10 +1171,10 @@ func (s BatchLookupInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes BatchLookupInputBodyAdditional from json.
-func (s *BatchLookupInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes BindingAdditional from json.
+func (s *BindingAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode BatchLookupInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode BindingAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -1115,34 +1192,34 @@ func (s *BatchLookupInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode BatchLookupInputBodyAdditional")
+		return errors.Wrap(err, "decode BindingAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s BatchLookupInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s BindingAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *BatchLookupInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *BindingAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *BatchLookupOutputBody) Encode(e *jx.Encoder) {
+func (s *BranchProtection) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *BatchLookupOutputBody) encodeFields(e *jx.Encoder) {
+func (s *BranchProtection) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -1150,9 +1227,9 @@ func (s *BatchLookupOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("refs")
+		e.FieldStart("rules")
 		e.ArrStart()
-		for _, elem := range s.Refs {
+		for _, elem := range s.Rules {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
@@ -1166,15 +1243,15 @@ func (s *BatchLookupOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfBatchLookupOutputBody = [2]string{
+var jsonFieldsNameOfBranchProtection = [2]string{
 	0: "$schema",
-	1: "refs",
+	1: "rules",
 }
 
-// Decode decodes BatchLookupOutputBody from json.
-func (s *BatchLookupOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes BranchProtection from json.
+func (s *BranchProtection) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode BatchLookupOutputBody to nil")
+		return errors.New("invalid: unable to decode BranchProtection to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -1191,23 +1268,23 @@ func (s *BatchLookupOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "refs":
+		case "rules":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Refs = make([]LookupRefResult, 0)
+				s.Rules = make([]BranchRule, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem LookupRefResult
+					var elem BranchRule
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Refs = append(s.Refs, elem)
+					s.Rules = append(s.Rules, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"refs\"")
+				return errors.Wrap(err, "decode field \"rules\"")
 			}
 		default:
 			var elem jx.Raw
@@ -1225,7 +1302,7 @@ func (s *BatchLookupOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode BatchLookupOutputBody")
+		return errors.Wrap(err, "decode BranchProtection")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -1242,8 +1319,8 @@ func (s *BatchLookupOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfBatchLookupOutputBody) {
-					name = jsonFieldsNameOfBatchLookupOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfBranchProtection) {
+					name = jsonFieldsNameOfBranchProtection[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -1264,27 +1341,27 @@ func (s *BatchLookupOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *BatchLookupOutputBody) MarshalJSON() ([]byte, error) {
+func (s *BranchProtection) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *BatchLookupOutputBody) UnmarshalJSON(data []byte) error {
+func (s *BranchProtection) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s BatchLookupOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s BranchProtectionAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s BatchLookupOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s BranchProtectionAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -1294,10 +1371,10 @@ func (s BatchLookupOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes BatchLookupOutputBodyAdditional from json.
-func (s *BatchLookupOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes BranchProtectionAdditional from json.
+func (s *BranchProtectionAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode BatchLookupOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode BranchProtectionAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -1315,62 +1392,44 @@ func (s *BatchLookupOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode BatchLookupOutputBodyAdditional")
+		return errors.Wrap(err, "decode BranchProtectionAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s BatchLookupOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s BranchProtectionAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *BatchLookupOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *BranchProtectionAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Binding) Encode(e *jx.Encoder) {
+func (s *BranchRule) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Binding) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
+func (s *BranchRule) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("accountId")
-		e.Str(s.AccountId)
+		e.FieldStart("ref")
+		e.Str(s.Ref)
 	}
 	{
-		if len(s.AttributeFilter) != 0 {
-			e.FieldStart("attributeFilter")
-			e.Raw(s.AttributeFilter)
+		if s.ServerSideMergeOnly.Set {
+			e.FieldStart("serverSideMergeOnly")
+			s.ServerSideMergeOnly.Encode(e)
 		}
 	}
-	{
-		e.FieldStart("createdAt")
-		json.EncodeDateTime(e, s.CreatedAt)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("providerId")
-		e.Str(s.ProviderId)
-	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -1380,94 +1439,42 @@ func (s *Binding) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfBinding = [6]string{
-	0: "$schema",
-	1: "accountId",
-	2: "attributeFilter",
-	3: "createdAt",
-	4: "id",
-	5: "providerId",
+var jsonFieldsNameOfBranchRule = [2]string{
+	0: "ref",
+	1: "serverSideMergeOnly",
 }
 
-// Decode decodes Binding from json.
-func (s *Binding) Decode(d *jx.Decoder) error {
+// Decode decodes BranchRule from json.
+func (s *BranchRule) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Binding to nil")
+		return errors.New("invalid: unable to decode BranchRule to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
-			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
-			}
-		case "accountId":
-			requiredBitSet[0] |= 1 << 1
-			if err := func() error {
-				v, err := d.Str()
-				s.AccountId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"accountId\"")
-			}
-		case "attributeFilter":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.RawAppend(nil)
-				s.AttributeFilter = jx.Raw(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"attributeFilter\"")
-			}
-		case "createdAt":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"createdAt\"")
-			}
-		case "id":
-			requiredBitSet[0] |= 1 << 4
+		case "ref":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
 				v, err := d.Str()
-				s.ID = string(v)
+				s.Ref = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
+				return errors.Wrap(err, "decode field \"ref\"")
 			}
-		case "providerId":
-			requiredBitSet[0] |= 1 << 5
+		case "serverSideMergeOnly":
 			if err := func() error {
-				v, err := d.Str()
-				s.ProviderId = string(v)
-				if err != nil {
+				s.ServerSideMergeOnly.Reset()
+				if err := s.ServerSideMergeOnly.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerId\"")
+				return errors.Wrap(err, "decode field \"serverSideMergeOnly\"")
 			}
 		default:
 			var elem jx.Raw
@@ -1485,12 +1492,12 @@ func (s *Binding) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Binding")
+		return errors.Wrap(err, "decode BranchRule")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00111110,
+		0b00000001,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -1502,8 +1509,8 @@ func (s *Binding) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfBinding) {
-					name = jsonFieldsNameOfBinding[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfBranchRule) {
+					name = jsonFieldsNameOfBranchRule[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -1524,27 +1531,27 @@ func (s *Binding) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Binding) MarshalJSON() ([]byte, error) {
+func (s *BranchRule) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Binding) UnmarshalJSON(data []byte) error {
+func (s *BranchRule) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s BindingAdditional) Encode(e *jx.Encoder) {
+func (s BranchRuleAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s BindingAdditional) encodeFields(e *jx.Encoder) {
+func (s BranchRuleAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -1554,10 +1561,10 @@ func (s BindingAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes BindingAdditional from json.
-func (s *BindingAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes BranchRuleAdditional from json.
+func (s *BranchRuleAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode BindingAdditional to nil")
+		return errors.New("invalid: unable to decode BranchRuleAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -1575,39 +1582,37 @@ func (s *BindingAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode BindingAdditional")
+		return errors.Wrap(err, "decode BranchRuleAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s BindingAdditional) MarshalJSON() ([]byte, error) {
+func (s BranchRuleAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *BindingAdditional) UnmarshalJSON(data []byte) error {
+func (s *BranchRuleAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CIWebhookView) Encode(e *jx.Encoder) {
+func (s *CIBuildView) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CIWebhookView) encodeFields(e *jx.Encoder) {
+func (s *CIBuildView) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
+		e.FieldStart("bk_build_uuid")
+		e.Str(s.BkBuildUUID)
 	}
 	{
 		e.FieldStart("bk_organization")
@@ -1618,45 +1623,75 @@ func (s *CIWebhookView) encodeFields(e *jx.Encoder) {
 		e.Str(s.BkPipeline)
 	}
 	{
-		e.FieldStart("created_at")
-		json.EncodeDateTime(e, s.CreatedAt)
+		e.FieldStart("branch")
+		e.Str(s.Branch)
 	}
 	{
-		e.FieldStart("display_name")
-		e.Str(s.DisplayName)
+		e.FieldStart("build_number")
+		e.Int64(s.BuildNumber)
 	}
 	{
-		e.FieldStart("enabled")
-		e.Bool(s.Enabled)
+		e.FieldStart("commit")
+		e.Str(s.Commit)
 	}
 	{
-		e.FieldStart("events")
-		e.ArrStart()
-		for _, elem := range s.Events {
-			e.Str(elem)
+		if s.CreatedAt.Set {
+			e.FieldStart("created_at")
+			s.CreatedAt.Encode(e, json.EncodeDateTime)
 		}
-		e.ArrEnd()
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
 	}
 	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
+		e.FieldStart("event_at")
+		json.EncodeDateTime(e, s.EventAt)
 	}
 	{
-		e.FieldStart("ref_filter")
-		e.Str(s.RefFilter)
+		if s.FinishedAt.Set {
+			e.FieldStart("finished_at")
+			s.FinishedAt.Encode(e, json.EncodeDateTime)
+		}
 	}
 	{
-		e.FieldStart("repo_id")
-		e.Str(s.RepoID)
+		e.FieldStart("jobs")
+		e.ArrStart()
+		for _, elem := range s.Jobs {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	{
+		e.FieldStart("last_event")
+		e.Str(s.LastEvent)
+	}
+	{
+		e.FieldStart("message")
+		e.Str(s.Message)
+	}
+	{
+		e.FieldStart("stale")
+		e.Bool(s.Stale)
+	}
+	{
+		if s.StartedAt.Set {
+			e.FieldStart("started_at")
+			s.StartedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		e.FieldStart("state")
+		e.Str(s.State)
+	}
+	{
+		e.FieldStart("terminal")
+		e.Bool(s.Terminal)
 	}
 	{
 		e.FieldStart("updated_at")
 		json.EncodeDateTime(e, s.UpdatedAt)
 	}
+	{
+		e.FieldStart("web_url")
+		e.Str(s.WebURL)
+	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -1666,40 +1701,48 @@ func (s *CIWebhookView) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCIWebhookView = [12]string{
-	0:  "$schema",
+var jsonFieldsNameOfCIBuildView = [18]string{
+	0:  "bk_build_uuid",
 	1:  "bk_organization",
 	2:  "bk_pipeline",
-	3:  "created_at",
-	4:  "display_name",
-	5:  "enabled",
-	6:  "events",
-	7:  "id",
-	8:  "provider",
-	9:  "ref_filter",
-	10: "repo_id",
-	11: "updated_at",
+	3:  "branch",
+	4:  "build_number",
+	5:  "commit",
+	6:  "created_at",
+	7:  "event_at",
+	8:  "finished_at",
+	9:  "jobs",
+	10: "last_event",
+	11: "message",
+	12: "stale",
+	13: "started_at",
+	14: "state",
+	15: "terminal",
+	16: "updated_at",
+	17: "web_url",
 }
 
-// Decode decodes CIWebhookView from json.
-func (s *CIWebhookView) Decode(d *jx.Decoder) error {
+// Decode decodes CIBuildView from json.
+func (s *CIBuildView) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CIWebhookView to nil")
+		return errors.New("invalid: unable to decode CIBuildView to nil")
 	}
-	var requiredBitSet [2]uint8
+	var requiredBitSet [3]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "bk_build_uuid":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Str()
+				s.BkBuildUUID = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"bk_build_uuid\"")
 			}
 		case "bk_organization":
 			requiredBitSet[0] |= 1 << 1
@@ -1725,112 +1768,164 @@ func (s *CIWebhookView) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"bk_pipeline\"")
 			}
-		case "created_at":
+		case "branch":
 			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
+				v, err := d.Str()
+				s.Branch = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"created_at\"")
+				return errors.Wrap(err, "decode field \"branch\"")
 			}
-		case "display_name":
+		case "build_number":
 			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				v, err := d.Str()
-				s.DisplayName = string(v)
+				v, err := d.Int64()
+				s.BuildNumber = int64(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"display_name\"")
+				return errors.Wrap(err, "decode field \"build_number\"")
 			}
-		case "enabled":
+		case "commit":
 			requiredBitSet[0] |= 1 << 5
 			if err := func() error {
-				v, err := d.Bool()
-				s.Enabled = bool(v)
+				v, err := d.Str()
+				s.Commit = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"enabled\"")
+				return errors.Wrap(err, "decode field \"commit\"")
 			}
-		case "events":
-			requiredBitSet[0] |= 1 << 6
+		case "created_at":
 			if err := func() error {
-				s.Events = make([]string, 0)
+				s.CreatedAt.Reset()
+				if err := s.CreatedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"created_at\"")
+			}
+		case "event_at":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.EventAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"event_at\"")
+			}
+		case "finished_at":
+			if err := func() error {
+				s.FinishedAt.Reset()
+				if err := s.FinishedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"finished_at\"")
+			}
+		case "jobs":
+			requiredBitSet[1] |= 1 << 1
+			if err := func() error {
+				s.Jobs = make([]CIJobView, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem string
-					v, err := d.Str()
-					elem = string(v)
-					if err != nil {
+					var elem CIJobView
+					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Events = append(s.Events, elem)
+					s.Jobs = append(s.Jobs, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"events\"")
+				return errors.Wrap(err, "decode field \"jobs\"")
 			}
-		case "id":
-			requiredBitSet[0] |= 1 << 7
+		case "last_event":
+			requiredBitSet[1] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.ID = string(v)
+				s.LastEvent = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
+				return errors.Wrap(err, "decode field \"last_event\"")
 			}
-		case "provider":
-			requiredBitSet[1] |= 1 << 0
+		case "message":
+			requiredBitSet[1] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.Provider = string(v)
+				s.Message = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"message\"")
 			}
-		case "ref_filter":
-			requiredBitSet[1] |= 1 << 1
+		case "stale":
+			requiredBitSet[1] |= 1 << 4
 			if err := func() error {
-				v, err := d.Str()
-				s.RefFilter = string(v)
+				v, err := d.Bool()
+				s.Stale = bool(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ref_filter\"")
+				return errors.Wrap(err, "decode field \"stale\"")
 			}
-		case "repo_id":
-			requiredBitSet[1] |= 1 << 2
+		case "started_at":
+			if err := func() error {
+				s.StartedAt.Reset()
+				if err := s.StartedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"started_at\"")
+			}
+		case "state":
+			requiredBitSet[1] |= 1 << 6
 			if err := func() error {
 				v, err := d.Str()
-				s.RepoID = string(v)
+				s.State = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repo_id\"")
+				return errors.Wrap(err, "decode field \"state\"")
+			}
+		case "terminal":
+			requiredBitSet[1] |= 1 << 7
+			if err := func() error {
+				v, err := d.Bool()
+				s.Terminal = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"terminal\"")
 			}
 		case "updated_at":
-			requiredBitSet[1] |= 1 << 3
+			requiredBitSet[2] |= 1 << 0
 			if err := func() error {
 				v, err := json.DecodeDateTime(d)
 				s.UpdatedAt = v
@@ -1841,6 +1936,18 @@ func (s *CIWebhookView) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"updated_at\"")
 			}
+		case "web_url":
+			requiredBitSet[2] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.WebURL = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"web_url\"")
+			}
 		default:
 			var elem jx.Raw
 			if err := func() error {
@@ -1857,13 +1964,14 @@ func (s *CIWebhookView) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CIWebhookView")
+		return errors.Wrap(err, "decode CIBuildView")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [2]uint8{
-		0b11111110,
-		0b00001111,
+	for i, mask := range [3]uint8{
+		0b10111111,
+		0b11011110,
+		0b00000011,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -1875,8 +1983,8 @@ func (s *CIWebhookView) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCIWebhookView) {
-					name = jsonFieldsNameOfCIWebhookView[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIBuildView) {
+					name = jsonFieldsNameOfCIBuildView[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -1897,27 +2005,27 @@ func (s *CIWebhookView) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CIWebhookView) MarshalJSON() ([]byte, error) {
+func (s *CIBuildView) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CIWebhookView) UnmarshalJSON(data []byte) error {
+func (s *CIBuildView) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CIWebhookViewAdditional) Encode(e *jx.Encoder) {
+func (s CIBuildViewAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CIWebhookViewAdditional) encodeFields(e *jx.Encoder) {
+func (s CIBuildViewAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -1927,10 +2035,10 @@ func (s CIWebhookViewAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CIWebhookViewAdditional from json.
-func (s *CIWebhookViewAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIBuildViewAdditional from json.
+func (s *CIBuildViewAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CIWebhookViewAdditional to nil")
+		return errors.New("invalid: unable to decode CIBuildViewAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -1948,55 +2056,71 @@ func (s *CIWebhookViewAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CIWebhookViewAdditional")
+		return errors.Wrap(err, "decode CIBuildViewAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CIWebhookViewAdditional) MarshalJSON() ([]byte, error) {
+func (s CIBuildViewAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CIWebhookViewAdditional) UnmarshalJSON(data []byte) error {
+func (s *CIBuildViewAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Cluster) Encode(e *jx.Encoder) {
+func (s *CIJobView) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Cluster) encodeFields(e *jx.Encoder) {
+func (s *CIJobView) encodeFields(e *jx.Encoder) {
 	{
-		if s.ApiUrl.Set {
-			e.FieldStart("apiUrl")
-			s.ApiUrl.Encode(e)
+		e.FieldStart("bk_job_id")
+		e.Str(s.BkJobID)
+	}
+	{
+		if s.ExitStatus.Set {
+			e.FieldStart("exit_status")
+			s.ExitStatus.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("isDefault")
-		e.Bool(s.IsDefault)
+		if s.FinishedAt.Set {
+			e.FieldStart("finished_at")
+			s.FinishedAt.Encode(e, json.EncodeDateTime)
+		}
 	}
 	{
-		e.FieldStart("jurisdiction")
-		e.Str(s.Jurisdiction)
+		e.FieldStart("name")
+		e.Str(s.Name)
 	}
 	{
-		e.FieldStart("publicUrl")
-		e.Str(s.PublicUrl)
+		if s.StartedAt.Set {
+			e.FieldStart("started_at")
+			s.StartedAt.Encode(e, json.EncodeDateTime)
+		}
 	}
 	{
-		e.FieldStart("slug")
-		e.Str(s.Slug)
+		e.FieldStart("state")
+		e.Str(s.State)
+	}
+	{
+		e.FieldStart("step_key")
+		e.Str(s.StepKey)
+	}
+	{
+		e.FieldStart("type")
+		e.Str(s.Type)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -2007,81 +2131,116 @@ func (s *Cluster) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCluster = [5]string{
-	0: "apiUrl",
-	1: "isDefault",
-	2: "jurisdiction",
-	3: "publicUrl",
-	4: "slug",
+var jsonFieldsNameOfCIJobView = [8]string{
+	0: "bk_job_id",
+	1: "exit_status",
+	2: "finished_at",
+	3: "name",
+	4: "started_at",
+	5: "state",
+	6: "step_key",
+	7: "type",
 }
 
-// Decode decodes Cluster from json.
-func (s *Cluster) Decode(d *jx.Decoder) error {
+// Decode decodes CIJobView from json.
+func (s *CIJobView) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Cluster to nil")
+		return errors.New("invalid: unable to decode CIJobView to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "apiUrl":
+		case "bk_job_id":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.ApiUrl.Reset()
-				if err := s.ApiUrl.Decode(d); err != nil {
+				v, err := d.Str()
+				s.BkJobID = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"apiUrl\"")
+				return errors.Wrap(err, "decode field \"bk_job_id\"")
 			}
-		case "isDefault":
-			requiredBitSet[0] |= 1 << 1
+		case "exit_status":
 			if err := func() error {
-				v, err := d.Bool()
-				s.IsDefault = bool(v)
+				s.ExitStatus.Reset()
+				if err := s.ExitStatus.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"exit_status\"")
+			}
+		case "finished_at":
+			if err := func() error {
+				s.FinishedAt.Reset()
+				if err := s.FinishedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"finished_at\"")
+			}
+		case "name":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"isDefault\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
-		case "jurisdiction":
-			requiredBitSet[0] |= 1 << 2
+		case "started_at":
+			if err := func() error {
+				s.StartedAt.Reset()
+				if err := s.StartedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"started_at\"")
+			}
+		case "state":
+			requiredBitSet[0] |= 1 << 5
 			if err := func() error {
 				v, err := d.Str()
-				s.Jurisdiction = string(v)
+				s.State = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
+				return errors.Wrap(err, "decode field \"state\"")
 			}
-		case "publicUrl":
-			requiredBitSet[0] |= 1 << 3
+		case "step_key":
+			requiredBitSet[0] |= 1 << 6
 			if err := func() error {
 				v, err := d.Str()
-				s.PublicUrl = string(v)
+				s.StepKey = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"publicUrl\"")
+				return errors.Wrap(err, "decode field \"step_key\"")
 			}
-		case "slug":
-			requiredBitSet[0] |= 1 << 4
+		case "type":
+			requiredBitSet[0] |= 1 << 7
 			if err := func() error {
 				v, err := d.Str()
-				s.Slug = string(v)
+				s.Type = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"slug\"")
+				return errors.Wrap(err, "decode field \"type\"")
 			}
 		default:
 			var elem jx.Raw
@@ -2099,12 +2258,12 @@ func (s *Cluster) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Cluster")
+		return errors.Wrap(err, "decode CIJobView")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b11101001,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -2116,8 +2275,8 @@ func (s *Cluster) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCluster) {
-					name = jsonFieldsNameOfCluster[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIJobView) {
+					name = jsonFieldsNameOfCIJobView[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -2138,27 +2297,27 @@ func (s *Cluster) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Cluster) MarshalJSON() ([]byte, error) {
+func (s *CIJobView) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Cluster) UnmarshalJSON(data []byte) error {
+func (s *CIJobView) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ClusterAdditional) Encode(e *jx.Encoder) {
+func (s CIJobViewAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ClusterAdditional) encodeFields(e *jx.Encoder) {
+func (s CIJobViewAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -2168,10 +2327,10 @@ func (s ClusterAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ClusterAdditional from json.
-func (s *ClusterAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIJobViewAdditional from json.
+func (s *CIJobViewAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ClusterAdditional to nil")
+		return errors.New("invalid: unable to decode CIJobViewAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -2189,43 +2348,67 @@ func (s *ClusterAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ClusterAdditional")
+		return errors.Wrap(err, "decode CIJobViewAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ClusterAdditional) MarshalJSON() ([]byte, error) {
+func (s CIJobViewAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ClusterAdditional) UnmarshalJSON(data []byte) error {
+func (s *CIJobViewAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CompleteOnboardingOutputBody) Encode(e *jx.Encoder) {
+func (s *CIProviderDescriptor) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CompleteOnboardingOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CIProviderDescriptor) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		e.FieldStart("enrollable")
+		e.Bool(s.Enrollable)
+	}
+	{
+		e.FieldStart("fields")
+		e.ArrStart()
+		for _, elem := range s.Fields {
+			elem.Encode(e)
 		}
+		e.ArrEnd()
 	}
 	{
-		e.FieldStart("needsOnboarding")
-		e.Bool(s.NeedsOnboarding)
+		e.FieldStart("label")
+		e.Str(s.Label)
+	}
+	{
+		e.FieldStart("modes")
+		e.ArrStart()
+		for _, elem := range s.Modes {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	{
+		if s.Reason.Set {
+			e.FieldStart("reason")
+			s.Reason.Encode(e)
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -2236,42 +2419,106 @@ func (s *CompleteOnboardingOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCompleteOnboardingOutputBody = [2]string{
-	0: "$schema",
-	1: "needsOnboarding",
+var jsonFieldsNameOfCIProviderDescriptor = [6]string{
+	0: "enrollable",
+	1: "fields",
+	2: "label",
+	3: "modes",
+	4: "name",
+	5: "reason",
 }
 
-// Decode decodes CompleteOnboardingOutputBody from json.
-func (s *CompleteOnboardingOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderDescriptor from json.
+func (s *CIProviderDescriptor) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CompleteOnboardingOutputBody to nil")
+		return errors.New("invalid: unable to decode CIProviderDescriptor to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "enrollable":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Bool()
+				s.Enrollable = bool(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"enrollable\"")
 			}
-		case "needsOnboarding":
+		case "fields":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Bool()
-				s.NeedsOnboarding = bool(v)
+				s.Fields = make([]CIProviderField, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIProviderField
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Fields = append(s.Fields, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"fields\"")
+			}
+		case "label":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Label = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"needsOnboarding\"")
+				return errors.Wrap(err, "decode field \"label\"")
+			}
+		case "modes":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				s.Modes = make([]CIProviderMode, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIProviderMode
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Modes = append(s.Modes, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"modes\"")
+			}
+		case "name":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"name\"")
+			}
+		case "reason":
+			if err := func() error {
+				s.Reason.Reset()
+				if err := s.Reason.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"reason\"")
 			}
 		default:
 			var elem jx.Raw
@@ -2289,12 +2536,12 @@ func (s *CompleteOnboardingOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CompleteOnboardingOutputBody")
+		return errors.Wrap(err, "decode CIProviderDescriptor")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00011111,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -2306,8 +2553,8 @@ func (s *CompleteOnboardingOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCompleteOnboardingOutputBody) {
-					name = jsonFieldsNameOfCompleteOnboardingOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIProviderDescriptor) {
+					name = jsonFieldsNameOfCIProviderDescriptor[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -2328,27 +2575,27 @@ func (s *CompleteOnboardingOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CompleteOnboardingOutputBody) MarshalJSON() ([]byte, error) {
+func (s *CIProviderDescriptor) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CompleteOnboardingOutputBody) UnmarshalJSON(data []byte) error {
+func (s *CIProviderDescriptor) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CompleteOnboardingOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIProviderDescriptorAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CompleteOnboardingOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIProviderDescriptorAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -2358,10 +2605,10 @@ func (s CompleteOnboardingOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CompleteOnboardingOutputBodyAdditional from json.
-func (s *CompleteOnboardingOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderDescriptorAdditional from json.
+func (s *CIProviderDescriptorAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CompleteOnboardingOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIProviderDescriptorAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -2379,49 +2626,79 @@ func (s *CompleteOnboardingOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CompleteOnboardingOutputBodyAdditional")
+		return errors.Wrap(err, "decode CIProviderDescriptorAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CompleteOnboardingOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CIProviderDescriptorAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CompleteOnboardingOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CIProviderDescriptorAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateBindingInputBody) Encode(e *jx.Encoder) {
+func (s *CIProviderField) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateBindingInputBody) encodeFields(e *jx.Encoder) {
+func (s *CIProviderField) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.Help.Set {
+			e.FieldStart("help")
+			s.Help.Encode(e)
 		}
 	}
 	{
-		if len(s.AttributeFilter) != 0 {
-			e.FieldStart("attributeFilter")
-			e.Raw(s.AttributeFilter)
+		e.FieldStart("key")
+		e.Str(s.Key)
+	}
+	{
+		e.FieldStart("kind")
+		e.Str(s.Kind)
+	}
+	{
+		e.FieldStart("label")
+		e.Str(s.Label)
+	}
+	{
+		if s.Options != nil {
+			e.FieldStart("options")
+			e.ArrStart()
+			for _, elem := range s.Options {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
 		}
 	}
 	{
-		e.FieldStart("providerId")
-		e.Str(s.ProviderId)
+		if s.Placeholder.Set {
+			e.FieldStart("placeholder")
+			s.Placeholder.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("required_in")
+		e.ArrStart()
+		for _, elem := range s.RequiredIn {
+			e.Str(elem)
+		}
+		e.ArrEnd()
+	}
+	{
+		e.FieldStart("target")
+		e.Str(s.Target)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -2432,54 +2709,131 @@ func (s *CreateBindingInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateBindingInputBody = [3]string{
-	0: "$schema",
-	1: "attributeFilter",
-	2: "providerId",
+var jsonFieldsNameOfCIProviderField = [8]string{
+	0: "help",
+	1: "key",
+	2: "kind",
+	3: "label",
+	4: "options",
+	5: "placeholder",
+	6: "required_in",
+	7: "target",
 }
 
-// Decode decodes CreateBindingInputBody from json.
-func (s *CreateBindingInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderField from json.
+func (s *CIProviderField) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateBindingInputBody to nil")
+		return errors.New("invalid: unable to decode CIProviderField to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "help":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.Help.Reset()
+				if err := s.Help.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"help\"")
 			}
-		case "attributeFilter":
+		case "key":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.RawAppend(nil)
-				s.AttributeFilter = jx.Raw(v)
+				v, err := d.Str()
+				s.Key = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"attributeFilter\"")
+				return errors.Wrap(err, "decode field \"key\"")
 			}
-		case "providerId":
+		case "kind":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.ProviderId = string(v)
+				s.Kind = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerId\"")
+				return errors.Wrap(err, "decode field \"kind\"")
+			}
+		case "label":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Label = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"label\"")
+			}
+		case "options":
+			if err := func() error {
+				s.Options = make([]CIProviderOption, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIProviderOption
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Options = append(s.Options, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"options\"")
+			}
+		case "placeholder":
+			if err := func() error {
+				s.Placeholder.Reset()
+				if err := s.Placeholder.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"placeholder\"")
+			}
+		case "required_in":
+			requiredBitSet[0] |= 1 << 6
+			if err := func() error {
+				s.RequiredIn = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.RequiredIn = append(s.RequiredIn, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"required_in\"")
+			}
+		case "target":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := d.Str()
+				s.Target = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"target\"")
 			}
 		default:
 			var elem jx.Raw
@@ -2497,12 +2851,12 @@ func (s *CreateBindingInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateBindingInputBody")
+		return errors.Wrap(err, "decode CIProviderField")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000100,
+		0b11001110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -2514,8 +2868,8 @@ func (s *CreateBindingInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateBindingInputBody) {
-					name = jsonFieldsNameOfCreateBindingInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIProviderField) {
+					name = jsonFieldsNameOfCIProviderField[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -2536,27 +2890,27 @@ func (s *CreateBindingInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateBindingInputBody) MarshalJSON() ([]byte, error) {
+func (s *CIProviderField) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateBindingInputBody) UnmarshalJSON(data []byte) error {
+func (s *CIProviderField) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateBindingInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIProviderFieldAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateBindingInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIProviderFieldAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -2566,10 +2920,10 @@ func (s CreateBindingInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateBindingInputBodyAdditional from json.
-func (s *CreateBindingInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderFieldAdditional from json.
+func (s *CIProviderFieldAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateBindingInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIProviderFieldAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -2587,55 +2941,53 @@ func (s *CreateBindingInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateBindingInputBodyAdditional")
+		return errors.Wrap(err, "decode CIProviderFieldAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateBindingInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CIProviderFieldAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateBindingInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CIProviderFieldAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateMirrorInputBody) Encode(e *jx.Encoder) {
+func (s *CIProviderMode) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateMirrorInputBody) encodeFields(e *jx.Encoder) {
+func (s *CIProviderMode) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.Default.Set {
+			e.FieldStart("default")
+			s.Default.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("clusterHost")
-		e.Str(s.ClusterHost)
-	}
-	{
-		e.FieldStart("owner")
-		e.Str(s.Owner)
+		if s.Help.Set {
+			e.FieldStart("help")
+			s.Help.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("provider")
-		s.Provider.Encode(e)
+		e.FieldStart("key")
+		e.Str(s.Key)
 	}
 	{
-		e.FieldStart("repo")
-		e.Str(s.Repo)
+		e.FieldStart("label")
+		e.Str(s.Label)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -2646,79 +2998,66 @@ func (s *CreateMirrorInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateMirrorInputBody = [5]string{
-	0: "$schema",
-	1: "clusterHost",
-	2: "owner",
-	3: "provider",
-	4: "repo",
+var jsonFieldsNameOfCIProviderMode = [4]string{
+	0: "default",
+	1: "help",
+	2: "key",
+	3: "label",
 }
 
-// Decode decodes CreateMirrorInputBody from json.
-func (s *CreateMirrorInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderMode from json.
+func (s *CIProviderMode) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateMirrorInputBody to nil")
+		return errors.New("invalid: unable to decode CIProviderMode to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "default":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.Default.Reset()
+				if err := s.Default.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"default\"")
 			}
-		case "clusterHost":
-			requiredBitSet[0] |= 1 << 1
+		case "help":
 			if err := func() error {
-				v, err := d.Str()
-				s.ClusterHost = string(v)
-				if err != nil {
+				s.Help.Reset()
+				if err := s.Help.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterHost\"")
+				return errors.Wrap(err, "decode field \"help\"")
 			}
-		case "owner":
+		case "key":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.Owner = string(v)
+				s.Key = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"owner\"")
+				return errors.Wrap(err, "decode field \"key\"")
 			}
-		case "provider":
+		case "label":
 			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				if err := s.Provider.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
-			}
-		case "repo":
-			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
 				v, err := d.Str()
-				s.Repo = string(v)
+				s.Label = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repo\"")
+				return errors.Wrap(err, "decode field \"label\"")
 			}
 		default:
 			var elem jx.Raw
@@ -2736,12 +3075,12 @@ func (s *CreateMirrorInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateMirrorInputBody")
+		return errors.Wrap(err, "decode CIProviderMode")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b00001100,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -2753,8 +3092,8 @@ func (s *CreateMirrorInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateMirrorInputBody) {
-					name = jsonFieldsNameOfCreateMirrorInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIProviderMode) {
+					name = jsonFieldsNameOfCIProviderMode[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -2775,27 +3114,27 @@ func (s *CreateMirrorInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateMirrorInputBody) MarshalJSON() ([]byte, error) {
+func (s *CIProviderMode) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateMirrorInputBody) UnmarshalJSON(data []byte) error {
+func (s *CIProviderMode) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateMirrorInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIProviderModeAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateMirrorInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIProviderModeAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -2805,10 +3144,10 @@ func (s CreateMirrorInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateMirrorInputBodyAdditional from json.
-func (s *CreateMirrorInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderModeAdditional from json.
+func (s *CIProviderModeAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateMirrorInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIProviderModeAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -2826,93 +3165,41 @@ func (s *CreateMirrorInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateMirrorInputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s CreateMirrorInputBodyAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateMirrorInputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes CreateMirrorInputBodyProvider as json.
-func (s CreateMirrorInputBodyProvider) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes CreateMirrorInputBodyProvider from json.
-func (s *CreateMirrorInputBodyProvider) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateMirrorInputBodyProvider to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch CreateMirrorInputBodyProvider(v) {
-	case CreateMirrorInputBodyProviderGithub:
-		*s = CreateMirrorInputBodyProviderGithub
-	default:
-		*s = CreateMirrorInputBodyProvider(v)
+		return errors.Wrap(err, "decode CIProviderModeAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateMirrorInputBodyProvider) MarshalJSON() ([]byte, error) {
+func (s CIProviderModeAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateMirrorInputBodyProvider) UnmarshalJSON(data []byte) error {
+func (s *CIProviderModeAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateMirrorRequestInputBody) Encode(e *jx.Encoder) {
+func (s *CIProviderOption) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateMirrorRequestInputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
+func (s *CIProviderOption) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("clusterHost")
-		e.Str(s.ClusterHost)
-	}
-	{
-		e.FieldStart("owner")
-		e.Str(s.Owner)
-	}
-	{
-		e.FieldStart("provider")
-		s.Provider.Encode(e)
+		e.FieldStart("label")
+		e.Str(s.Label)
 	}
 	{
-		e.FieldStart("repo")
-		e.Str(s.Repo)
+		e.FieldStart("value")
+		e.Str(s.Value)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -2923,79 +3210,44 @@ func (s *CreateMirrorRequestInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateMirrorRequestInputBody = [5]string{
-	0: "$schema",
-	1: "clusterHost",
-	2: "owner",
-	3: "provider",
-	4: "repo",
+var jsonFieldsNameOfCIProviderOption = [2]string{
+	0: "label",
+	1: "value",
 }
 
-// Decode decodes CreateMirrorRequestInputBody from json.
-func (s *CreateMirrorRequestInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderOption from json.
+func (s *CIProviderOption) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateMirrorRequestInputBody to nil")
+		return errors.New("invalid: unable to decode CIProviderOption to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
-			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
-			}
-		case "clusterHost":
-			requiredBitSet[0] |= 1 << 1
-			if err := func() error {
-				v, err := d.Str()
-				s.ClusterHost = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterHost\"")
-			}
-		case "owner":
-			requiredBitSet[0] |= 1 << 2
+		case "label":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
 				v, err := d.Str()
-				s.Owner = string(v)
+				s.Label = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"owner\"")
-			}
-		case "provider":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				if err := s.Provider.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"label\"")
 			}
-		case "repo":
-			requiredBitSet[0] |= 1 << 4
+		case "value":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.Repo = string(v)
+				s.Value = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repo\"")
+				return errors.Wrap(err, "decode field \"value\"")
 			}
 		default:
 			var elem jx.Raw
@@ -3013,12 +3265,12 @@ func (s *CreateMirrorRequestInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateMirrorRequestInputBody")
+		return errors.Wrap(err, "decode CIProviderOption")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b00000011,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -3030,8 +3282,8 @@ func (s *CreateMirrorRequestInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateMirrorRequestInputBody) {
-					name = jsonFieldsNameOfCreateMirrorRequestInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIProviderOption) {
+					name = jsonFieldsNameOfCIProviderOption[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -3052,27 +3304,27 @@ func (s *CreateMirrorRequestInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateMirrorRequestInputBody) MarshalJSON() ([]byte, error) {
+func (s *CIProviderOption) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateMirrorRequestInputBody) UnmarshalJSON(data []byte) error {
+func (s *CIProviderOption) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateMirrorRequestInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIProviderOptionAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateMirrorRequestInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIProviderOptionAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -3082,10 +3334,10 @@ func (s CreateMirrorRequestInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateMirrorRequestInputBodyAdditional from json.
-func (s *CreateMirrorRequestInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIProviderOptionAdditional from json.
+func (s *CIProviderOptionAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateMirrorRequestInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIProviderOptionAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -3103,87 +3355,45 @@ func (s *CreateMirrorRequestInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateMirrorRequestInputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s CreateMirrorRequestInputBodyAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateMirrorRequestInputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes CreateMirrorRequestInputBodyProvider as json.
-func (s CreateMirrorRequestInputBodyProvider) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes CreateMirrorRequestInputBodyProvider from json.
-func (s *CreateMirrorRequestInputBodyProvider) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateMirrorRequestInputBodyProvider to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch CreateMirrorRequestInputBodyProvider(v) {
-	case CreateMirrorRequestInputBodyProviderGithub:
-		*s = CreateMirrorRequestInputBodyProviderGithub
-	default:
-		*s = CreateMirrorRequestInputBodyProvider(v)
+		return errors.Wrap(err, "decode CIProviderOptionAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateMirrorRequestInputBodyProvider) MarshalJSON() ([]byte, error) {
+func (s CIProviderOptionAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateMirrorRequestInputBodyProvider) UnmarshalJSON(data []byte) error {
+func (s *CIProviderOptionAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateOrgInputBody) Encode(e *jx.Encoder) {
+func (s *CISetupBlock) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateOrgInputBody) encodeFields(e *jx.Encoder) {
+func (s *CISetupBlock) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
+		e.FieldStart("content")
+		e.Str(s.Content)
 	}
 	{
-		e.FieldStart("name")
-		e.Str(s.Name)
+		e.FieldStart("format")
+		e.Str(s.Format)
 	}
 	{
-		if s.Region.Set {
-			e.FieldStart("region")
-			s.Region.Encode(e)
-		}
+		e.FieldStart("heading")
+		e.Str(s.Heading)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -3194,53 +3404,57 @@ func (s *CreateOrgInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateOrgInputBody = [3]string{
-	0: "$schema",
-	1: "name",
-	2: "region",
+var jsonFieldsNameOfCISetupBlock = [3]string{
+	0: "content",
+	1: "format",
+	2: "heading",
 }
 
-// Decode decodes CreateOrgInputBody from json.
-func (s *CreateOrgInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CISetupBlock from json.
+func (s *CISetupBlock) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateOrgInputBody to nil")
+		return errors.New("invalid: unable to decode CISetupBlock to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "content":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Content = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"content\"")
 			}
-		case "name":
+		case "format":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.Name = string(v)
+				s.Format = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"format\"")
 			}
-		case "region":
+		case "heading":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Region.Reset()
-				if err := s.Region.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Heading = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"region\"")
+				return errors.Wrap(err, "decode field \"heading\"")
 			}
 		default:
 			var elem jx.Raw
@@ -3258,12 +3472,12 @@ func (s *CreateOrgInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateOrgInputBody")
+		return errors.Wrap(err, "decode CISetupBlock")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00000111,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -3275,8 +3489,8 @@ func (s *CreateOrgInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateOrgInputBody) {
-					name = jsonFieldsNameOfCreateOrgInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCISetupBlock) {
+					name = jsonFieldsNameOfCISetupBlock[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -3297,27 +3511,27 @@ func (s *CreateOrgInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateOrgInputBody) MarshalJSON() ([]byte, error) {
+func (s *CISetupBlock) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateOrgInputBody) UnmarshalJSON(data []byte) error {
+func (s *CISetupBlock) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateOrgInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CISetupBlockAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateOrgInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CISetupBlockAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -3327,10 +3541,10 @@ func (s CreateOrgInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateOrgInputBodyAdditional from json.
-func (s *CreateOrgInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CISetupBlockAdditional from json.
+func (s *CISetupBlockAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateOrgInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CISetupBlockAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -3348,56 +3562,48 @@ func (s *CreateOrgInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateOrgInputBodyAdditional")
+		return errors.Wrap(err, "decode CISetupBlockAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateOrgInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CISetupBlockAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateOrgInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CISetupBlockAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateProjectInputBody) Encode(e *jx.Encoder) {
+func (s *CIWebhookAuditActor) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateProjectInputBody) encodeFields(e *jx.Encoder) {
+func (s *CIWebhookAuditActor) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("name")
-		e.Str(s.Name)
+		e.FieldStart("account_id")
+		e.Str(s.AccountID)
 	}
 	{
-		e.FieldStart("ownerId")
-		e.Str(s.OwnerId)
-	}
-	{
-		e.FieldStart("ownerType")
-		s.OwnerType.Encode(e)
+		if s.Handle.Set {
+			e.FieldStart("handle")
+			s.Handle.Encode(e)
+		}
 	}
 	{
-		if s.Region.Set {
-			e.FieldStart("region")
-			s.Region.Encode(e)
+		if s.HandleProvider.Set {
+			e.FieldStart("handle_provider")
+			s.HandleProvider.Encode(e)
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -3409,77 +3615,53 @@ func (s *CreateProjectInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateProjectInputBody = [5]string{
-	0: "$schema",
-	1: "name",
-	2: "ownerId",
-	3: "ownerType",
-	4: "region",
+var jsonFieldsNameOfCIWebhookAuditActor = [3]string{
+	0: "account_id",
+	1: "handle",
+	2: "handle_provider",
 }
 
-// Decode decodes CreateProjectInputBody from json.
-func (s *CreateProjectInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIWebhookAuditActor from json.
+func (s *CIWebhookAuditActor) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateProjectInputBody to nil")
+		return errors.New("invalid: unable to decode CIWebhookAuditActor to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
-			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
-			}
-		case "name":
-			requiredBitSet[0] |= 1 << 1
-			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
-			}
-		case "ownerId":
-			requiredBitSet[0] |= 1 << 2
+		case "account_id":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
 				v, err := d.Str()
-				s.OwnerId = string(v)
+				s.AccountID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ownerId\"")
+				return errors.Wrap(err, "decode field \"account_id\"")
 			}
-		case "ownerType":
-			requiredBitSet[0] |= 1 << 3
+		case "handle":
 			if err := func() error {
-				if err := s.OwnerType.Decode(d); err != nil {
+				s.Handle.Reset()
+				if err := s.Handle.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ownerType\"")
+				return errors.Wrap(err, "decode field \"handle\"")
 			}
-		case "region":
+		case "handle_provider":
 			if err := func() error {
-				s.Region.Reset()
-				if err := s.Region.Decode(d); err != nil {
+				s.HandleProvider.Reset()
+				if err := s.HandleProvider.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"region\"")
+				return errors.Wrap(err, "decode field \"handle_provider\"")
 			}
 		default:
 			var elem jx.Raw
@@ -3497,12 +3679,12 @@ func (s *CreateProjectInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateProjectInputBody")
+		return errors.Wrap(err, "decode CIWebhookAuditActor")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001110,
+		0b00000001,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -3514,8 +3696,8 @@ func (s *CreateProjectInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateProjectInputBody) {
-					name = jsonFieldsNameOfCreateProjectInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIWebhookAuditActor) {
+					name = jsonFieldsNameOfCIWebhookAuditActor[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -3536,27 +3718,27 @@ func (s *CreateProjectInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateProjectInputBody) MarshalJSON() ([]byte, error) {
+func (s *CIWebhookAuditActor) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateProjectInputBody) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookAuditActor) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateProjectInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIWebhookAuditActorAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateProjectInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIWebhookAuditActorAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -3566,10 +3748,10 @@ func (s CreateProjectInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateProjectInputBodyAdditional from json.
-func (s *CreateProjectInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIWebhookAuditActorAdditional from json.
+func (s *CIWebhookAuditActorAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateProjectInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIWebhookAuditActorAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -3587,119 +3769,55 @@ func (s *CreateProjectInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateProjectInputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s CreateProjectInputBodyAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateProjectInputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes CreateProjectInputBodyOwnerType as json.
-func (s CreateProjectInputBodyOwnerType) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes CreateProjectInputBodyOwnerType from json.
-func (s *CreateProjectInputBodyOwnerType) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateProjectInputBodyOwnerType to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch CreateProjectInputBodyOwnerType(v) {
-	case CreateProjectInputBodyOwnerTypeOrg:
-		*s = CreateProjectInputBodyOwnerTypeOrg
-	case CreateProjectInputBodyOwnerTypeAccount:
-		*s = CreateProjectInputBodyOwnerTypeAccount
-	default:
-		*s = CreateProjectInputBodyOwnerType(v)
+		return errors.Wrap(err, "decode CIWebhookAuditActorAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateProjectInputBodyOwnerType) MarshalJSON() ([]byte, error) {
+func (s CIWebhookAuditActorAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateProjectInputBodyOwnerType) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookAuditActorAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateRepoCIWebhookInputBody) Encode(e *jx.Encoder) {
+func (s *CIWebhookAuditEventView) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateRepoCIWebhookInputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("bk_cluster_id")
-		e.Str(s.BkClusterID)
-	}
+func (s *CIWebhookAuditEventView) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("bk_organization")
-		e.Str(s.BkOrganization)
+		e.FieldStart("actor")
+		s.Actor.Encode(e)
 	}
 	{
-		if s.BkPipeline.Set {
-			e.FieldStart("bk_pipeline")
-			s.BkPipeline.Encode(e)
-		}
+		e.FieldStart("event_type")
+		e.Str(s.EventType)
 	}
 	{
-		if s.DisplayName.Set {
-			e.FieldStart("display_name")
-			s.DisplayName.Encode(e)
-		}
+		e.FieldStart("id")
+		e.Str(s.ID)
 	}
 	{
-		if s.Events != nil {
-			e.FieldStart("events")
-			e.ArrStart()
-			for _, elem := range s.Events {
-				e.Str(elem)
-			}
-			e.ArrEnd()
+		if s.Metadata.Set {
+			e.FieldStart("metadata")
+			s.Metadata.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("provider")
-		s.Provider.Encode(e)
-	}
-	{
-		if s.RefFilter.Set {
-			e.FieldStart("ref_filter")
-			s.RefFilter.Encode(e)
-		}
+		e.FieldStart("occurred_at")
+		json.EncodeDateTime(e, s.OccurredAt)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -3710,142 +3828,102 @@ func (s *CreateRepoCIWebhookInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateRepoCIWebhookInputBody = [8]string{
-	0: "$schema",
-	1: "bk_cluster_id",
-	2: "bk_organization",
-	3: "bk_pipeline",
-	4: "display_name",
-	5: "events",
-	6: "provider",
-	7: "ref_filter",
+var jsonFieldsNameOfCIWebhookAuditEventView = [5]string{
+	0: "actor",
+	1: "event_type",
+	2: "id",
+	3: "metadata",
+	4: "occurred_at",
 }
 
-// Decode decodes CreateRepoCIWebhookInputBody from json.
-func (s *CreateRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIWebhookAuditEventView from json.
+func (s *CIWebhookAuditEventView) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateRepoCIWebhookInputBody to nil")
+		return errors.New("invalid: unable to decode CIWebhookAuditEventView to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "actor":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				if err := s.Actor.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"actor\"")
 			}
-		case "bk_cluster_id":
+		case "event_type":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.BkClusterID = string(v)
+				s.EventType = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"bk_cluster_id\"")
+				return errors.Wrap(err, "decode field \"event_type\"")
 			}
-		case "bk_organization":
+		case "id":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.BkOrganization = string(v)
+				s.ID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"bk_organization\"")
-			}
-		case "bk_pipeline":
-			if err := func() error {
-				s.BkPipeline.Reset()
-				if err := s.BkPipeline.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"bk_pipeline\"")
+				return errors.Wrap(err, "decode field \"id\"")
 			}
-		case "display_name":
+		case "metadata":
 			if err := func() error {
-				s.DisplayName.Reset()
-				if err := s.DisplayName.Decode(d); err != nil {
+				s.Metadata.Reset()
+				if err := s.Metadata.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"display_name\"")
+				return errors.Wrap(err, "decode field \"metadata\"")
 			}
-		case "events":
+		case "occurred_at":
+			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				s.Events = make([]string, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem string
-					v, err := d.Str()
-					elem = string(v)
-					if err != nil {
-						return err
-					}
-					s.Events = append(s.Events, elem)
-					return nil
-				}); err != nil {
+				v, err := json.DecodeDateTime(d)
+				s.OccurredAt = v
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"events\"")
+				return errors.Wrap(err, "decode field \"occurred_at\"")
 			}
-		case "provider":
-			requiredBitSet[0] |= 1 << 6
+		default:
+			var elem jx.Raw
 			if err := func() error {
-				if err := s.Provider.Decode(d); err != nil {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
-			}
-		case "ref_filter":
-			if err := func() error {
-				s.RefFilter.Reset()
-				if err := s.RefFilter.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ref_filter\"")
-			}
-		default:
-			var elem jx.Raw
-			if err := func() error {
-				v, err := d.RawAppend(nil)
-				elem = jx.Raw(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrapf(err, "decode field %q", k)
+				return errors.Wrapf(err, "decode field %q", k)
 			}
 			s.AdditionalProps[string(k)] = elem
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateRepoCIWebhookInputBody")
+		return errors.Wrap(err, "decode CIWebhookAuditEventView")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b01000110,
+		0b00010111,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -3857,8 +3935,8 @@ func (s *CreateRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateRepoCIWebhookInputBody) {
-					name = jsonFieldsNameOfCreateRepoCIWebhookInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIWebhookAuditEventView) {
+					name = jsonFieldsNameOfCIWebhookAuditEventView[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -3879,27 +3957,27 @@ func (s *CreateRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateRepoCIWebhookInputBody) MarshalJSON() ([]byte, error) {
+func (s *CIWebhookAuditEventView) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateRepoCIWebhookInputBody) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookAuditEventView) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateRepoCIWebhookInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIWebhookAuditEventViewAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateRepoCIWebhookInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIWebhookAuditEventViewAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -3909,10 +3987,10 @@ func (s CreateRepoCIWebhookInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateRepoCIWebhookInputBodyAdditional from json.
-func (s *CreateRepoCIWebhookInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIWebhookAuditEventViewAdditional from json.
+func (s *CIWebhookAuditEventViewAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateRepoCIWebhookInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIWebhookAuditEventViewAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -3930,72 +4008,92 @@ func (s *CreateRepoCIWebhookInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateRepoCIWebhookInputBodyAdditional")
+		return errors.Wrap(err, "decode CIWebhookAuditEventViewAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateRepoCIWebhookInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CIWebhookAuditEventViewAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateRepoCIWebhookInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookAuditEventViewAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes CreateRepoCIWebhookInputBodyProvider as json.
-func (s CreateRepoCIWebhookInputBodyProvider) Encode(e *jx.Encoder) {
-	e.Str(string(s))
+// Encode implements json.Marshaler.
+func (s CIWebhookAuditEventViewMetadata) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes CreateRepoCIWebhookInputBodyProvider from json.
-func (s *CreateRepoCIWebhookInputBodyProvider) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateRepoCIWebhookInputBodyProvider to nil")
+// encodeFields implements json.Marshaler.
+func (s CIWebhookAuditEventViewMetadata) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
+}
+
+// Decode decodes CIWebhookAuditEventViewMetadata from json.
+func (s *CIWebhookAuditEventViewMetadata) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode CIWebhookAuditEventViewMetadata to nil")
 	}
-	// Try to use constant string.
-	switch CreateRepoCIWebhookInputBodyProvider(v) {
-	case CreateRepoCIWebhookInputBodyProviderBuildkite:
-		*s = CreateRepoCIWebhookInputBodyProviderBuildkite
-	default:
-		*s = CreateRepoCIWebhookInputBodyProvider(v)
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode CIWebhookAuditEventViewMetadata")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateRepoCIWebhookInputBodyProvider) MarshalJSON() ([]byte, error) {
+func (s CIWebhookAuditEventViewMetadata) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateRepoCIWebhookInputBodyProvider) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookAuditEventViewMetadata) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreateRepoInputBody) Encode(e *jx.Encoder) {
+func (s *CIWebhookView) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreateRepoInputBody) encodeFields(e *jx.Encoder) {
+func (s *CIWebhookView) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -4003,24 +4101,56 @@ func (s *CreateRepoInputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.ClusterHost.Set {
-			e.FieldStart("clusterHost")
-			s.ClusterHost.Encode(e)
-		}
+		e.FieldStart("bk_organization")
+		e.Str(s.BkOrganization)
 	}
 	{
-		e.FieldStart("name")
-		e.Str(s.Name)
+		e.FieldStart("bk_pipeline")
+		e.Str(s.BkPipeline)
 	}
 	{
-		if s.ObjectFormat.Set {
-			e.FieldStart("objectFormat")
-			s.ObjectFormat.Encode(e)
+		e.FieldStart("created_at")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		e.FieldStart("display_name")
+		e.Str(s.DisplayName)
+	}
+	{
+		e.FieldStart("enabled")
+		e.Bool(s.Enabled)
+	}
+	{
+		e.FieldStart("events")
+		e.ArrStart()
+		for _, elem := range s.Events {
+			e.Str(elem)
 		}
+		e.ArrEnd()
 	}
 	{
-		e.FieldStart("projectId")
-		e.Str(s.ProjectId)
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		e.FieldStart("publish_checks")
+		e.Bool(s.PublishChecks)
+	}
+	{
+		e.FieldStart("ref_filter")
+		e.Str(s.RefFilter)
+	}
+	{
+		e.FieldStart("repo_id")
+		e.Str(s.RepoID)
+	}
+	{
+		e.FieldStart("updated_at")
+		json.EncodeDateTime(e, s.UpdatedAt)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -4031,20 +4161,28 @@ func (s *CreateRepoInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreateRepoInputBody = [5]string{
-	0: "$schema",
-	1: "clusterHost",
-	2: "name",
-	3: "objectFormat",
-	4: "projectId",
+var jsonFieldsNameOfCIWebhookView = [13]string{
+	0:  "$schema",
+	1:  "bk_organization",
+	2:  "bk_pipeline",
+	3:  "created_at",
+	4:  "display_name",
+	5:  "enabled",
+	6:  "events",
+	7:  "id",
+	8:  "provider",
+	9:  "publish_checks",
+	10: "ref_filter",
+	11: "repo_id",
+	12: "updated_at",
 }
 
-// Decode decodes CreateRepoInputBody from json.
-func (s *CreateRepoInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CIWebhookView from json.
+func (s *CIWebhookView) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateRepoInputBody to nil")
+		return errors.New("invalid: unable to decode CIWebhookView to nil")
 	}
-	var requiredBitSet [1]uint8
+	var requiredBitSet [2]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -4059,296 +4197,157 @@ func (s *CreateRepoInputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "clusterHost":
+		case "bk_organization":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.ClusterHost.Reset()
-				if err := s.ClusterHost.Decode(d); err != nil {
+				v, err := d.Str()
+				s.BkOrganization = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterHost\"")
+				return errors.Wrap(err, "decode field \"bk_organization\"")
 			}
-		case "name":
+		case "bk_pipeline":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.Name = string(v)
+				s.BkPipeline = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"bk_pipeline\"")
 			}
-		case "objectFormat":
+		case "created_at":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.ObjectFormat.Reset()
-				if err := s.ObjectFormat.Decode(d); err != nil {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"objectFormat\"")
+				return errors.Wrap(err, "decode field \"created_at\"")
 			}
-		case "projectId":
+		case "display_name":
 			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
 				v, err := d.Str()
-				s.ProjectId = string(v)
+				s.DisplayName = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"projectId\"")
+				return errors.Wrap(err, "decode field \"display_name\"")
 			}
-		default:
-			var elem jx.Raw
+		case "enabled":
+			requiredBitSet[0] |= 1 << 5
 			if err := func() error {
-				v, err := d.RawAppend(nil)
-				elem = jx.Raw(v)
+				v, err := d.Bool()
+				s.Enabled = bool(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrapf(err, "decode field %q", k)
+				return errors.Wrap(err, "decode field \"enabled\"")
 			}
-			s.AdditionalProps[string(k)] = elem
-		}
-		return nil
-	}); err != nil {
-		return errors.Wrap(err, "decode CreateRepoInputBody")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00010100,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateRepoInputBody) {
-					name = jsonFieldsNameOfCreateRepoInputBody[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
+		case "events":
+			requiredBitSet[0] |= 1 << 6
+			if err := func() error {
+				s.Events = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.Events = append(s.Events, elem)
+					return nil
+				}); err != nil {
+					return err
 				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"events\"")
 			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s *CreateRepoInputBody) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateRepoInputBody) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s CreateRepoInputBodyAdditional) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields implements json.Marshaler.
-func (s CreateRepoInputBodyAdditional) encodeFields(e *jx.Encoder) {
-	for k, elem := range s {
-		e.FieldStart(k)
-
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
-}
-
-// Decode decodes CreateRepoInputBodyAdditional from json.
-func (s *CreateRepoInputBodyAdditional) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateRepoInputBodyAdditional to nil")
-	}
-	m := s.init()
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		var elem jx.Raw
-		if err := func() error {
-			v, err := d.RawAppend(nil)
-			elem = jx.Raw(v)
-			if err != nil {
-				return err
+		case "id":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
 			}
-			return nil
-		}(); err != nil {
-			return errors.Wrapf(err, "decode field %q", k)
-		}
-		m[string(k)] = elem
-		return nil
-	}); err != nil {
-		return errors.Wrap(err, "decode CreateRepoInputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s CreateRepoInputBodyAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateRepoInputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes CreateRepoInputBodyObjectFormat as json.
-func (s CreateRepoInputBodyObjectFormat) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes CreateRepoInputBodyObjectFormat from json.
-func (s *CreateRepoInputBodyObjectFormat) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateRepoInputBodyObjectFormat to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch CreateRepoInputBodyObjectFormat(v) {
-	case CreateRepoInputBodyObjectFormatSHA1:
-		*s = CreateRepoInputBodyObjectFormatSHA1
-	case CreateRepoInputBodyObjectFormatSHA256:
-		*s = CreateRepoInputBodyObjectFormatSHA256
-	default:
-		*s = CreateRepoInputBodyObjectFormat(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s CreateRepoInputBodyObjectFormat) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateRepoInputBodyObjectFormat) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s *CreateServiceAccountInputBody) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields encodes fields.
-func (s *CreateServiceAccountInputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("name")
-		e.Str(s.Name)
-	}
-	{
-		e.FieldStart("orgId")
-		e.Str(s.OrgId)
-	}
-	for k, elem := range s.AdditionalProps {
-		e.FieldStart(k)
-
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
-}
-
-var jsonFieldsNameOfCreateServiceAccountInputBody = [3]string{
-	0: "$schema",
-	1: "name",
-	2: "orgId",
-}
-
-// Decode decodes CreateServiceAccountInputBody from json.
-func (s *CreateServiceAccountInputBody) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode CreateServiceAccountInputBody to nil")
-	}
-	var requiredBitSet [1]uint8
-	s.AdditionalProps = map[string]jx.Raw{}
-
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		switch string(k) {
-		case "$schema":
+		case "provider":
+			requiredBitSet[1] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
-		case "name":
-			requiredBitSet[0] |= 1 << 1
+		case "publish_checks":
+			requiredBitSet[1] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.PublishChecks = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"publish_checks\"")
+			}
+		case "ref_filter":
+			requiredBitSet[1] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.Name = string(v)
+				s.RefFilter = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"ref_filter\"")
 			}
-		case "orgId":
-			requiredBitSet[0] |= 1 << 2
+		case "repo_id":
+			requiredBitSet[1] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.OrgId = string(v)
+				s.RepoID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"orgId\"")
+				return errors.Wrap(err, "decode field \"repo_id\"")
+			}
+		case "updated_at":
+			requiredBitSet[1] |= 1 << 4
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.UpdatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"updated_at\"")
 			}
 		default:
 			var elem jx.Raw
@@ -4366,12 +4365,13 @@ func (s *CreateServiceAccountInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateServiceAccountInputBody")
+		return errors.Wrap(err, "decode CIWebhookView")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00000110,
+	for i, mask := range [2]uint8{
+		0b11111110,
+		0b00011111,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -4383,8 +4383,8 @@ func (s *CreateServiceAccountInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreateServiceAccountInputBody) {
-					name = jsonFieldsNameOfCreateServiceAccountInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCIWebhookView) {
+					name = jsonFieldsNameOfCIWebhookView[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -4405,27 +4405,27 @@ func (s *CreateServiceAccountInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreateServiceAccountInputBody) MarshalJSON() ([]byte, error) {
+func (s *CIWebhookView) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateServiceAccountInputBody) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookView) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreateServiceAccountInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CIWebhookViewAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreateServiceAccountInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CIWebhookViewAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -4435,10 +4435,10 @@ func (s CreateServiceAccountInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreateServiceAccountInputBodyAdditional from json.
-func (s *CreateServiceAccountInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CIWebhookViewAdditional from json.
+func (s *CIWebhookViewAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreateServiceAccountInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CIWebhookViewAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -4456,63 +4456,55 @@ func (s *CreateServiceAccountInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreateServiceAccountInputBodyAdditional")
+		return errors.Wrap(err, "decode CIWebhookViewAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreateServiceAccountInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CIWebhookViewAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreateServiceAccountInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CIWebhookViewAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *CreatedMirror) Encode(e *jx.Encoder) {
+func (s *Cluster) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *CreatedMirror) encodeFields(e *jx.Encoder) {
+func (s *Cluster) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.ApiUrl.Set {
+			e.FieldStart("apiUrl")
+			s.ApiUrl.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("created")
-		e.Bool(s.Created)
+		e.FieldStart("isDefault")
+		e.Bool(s.IsDefault)
 	}
 	{
-		e.FieldStart("empty")
-		e.Bool(s.Empty)
-	}
-	{
-		e.FieldStart("mirrorId")
-		e.Str(s.MirrorId)
-	}
-	{
-		e.FieldStart("mirrorUrl")
-		e.Str(s.MirrorUrl)
+		e.FieldStart("jurisdiction")
+		e.Str(s.Jurisdiction)
 	}
 	{
 		e.FieldStart("publicUrl")
 		e.Str(s.PublicUrl)
 	}
 	{
-		e.FieldStart("suspended")
-		e.Bool(s.Suspended)
+		e.FieldStart("slug")
+		e.Str(s.Slug)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -4523,86 +4515,60 @@ func (s *CreatedMirror) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfCreatedMirror = [7]string{
-	0: "$schema",
-	1: "created",
-	2: "empty",
-	3: "mirrorId",
-	4: "mirrorUrl",
-	5: "publicUrl",
-	6: "suspended",
+var jsonFieldsNameOfCluster = [5]string{
+	0: "apiUrl",
+	1: "isDefault",
+	2: "jurisdiction",
+	3: "publicUrl",
+	4: "slug",
 }
 
-// Decode decodes CreatedMirror from json.
-func (s *CreatedMirror) Decode(d *jx.Decoder) error {
+// Decode decodes Cluster from json.
+func (s *Cluster) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreatedMirror to nil")
+		return errors.New("invalid: unable to decode Cluster to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "apiUrl":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.ApiUrl.Reset()
+				if err := s.ApiUrl.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"apiUrl\"")
 			}
-		case "created":
+		case "isDefault":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Bool()
-				s.Created = bool(v)
+				s.IsDefault = bool(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"created\"")
+				return errors.Wrap(err, "decode field \"isDefault\"")
 			}
-		case "empty":
+		case "jurisdiction":
 			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Bool()
-				s.Empty = bool(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"empty\"")
-			}
-		case "mirrorId":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.MirrorId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorId\"")
-			}
-		case "mirrorUrl":
-			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
 				v, err := d.Str()
-				s.MirrorUrl = string(v)
+				s.Jurisdiction = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorUrl\"")
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
 			}
 		case "publicUrl":
-			requiredBitSet[0] |= 1 << 5
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
 				s.PublicUrl = string(v)
@@ -4613,17 +4579,17 @@ func (s *CreatedMirror) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"publicUrl\"")
 			}
-		case "suspended":
-			requiredBitSet[0] |= 1 << 6
+		case "slug":
+			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				v, err := d.Bool()
-				s.Suspended = bool(v)
+				v, err := d.Str()
+				s.Slug = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"suspended\"")
+				return errors.Wrap(err, "decode field \"slug\"")
 			}
 		default:
 			var elem jx.Raw
@@ -4641,12 +4607,12 @@ func (s *CreatedMirror) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreatedMirror")
+		return errors.Wrap(err, "decode Cluster")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b01111110,
+		0b00011110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -4658,8 +4624,8 @@ func (s *CreatedMirror) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfCreatedMirror) {
-					name = jsonFieldsNameOfCreatedMirror[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCluster) {
+					name = jsonFieldsNameOfCluster[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -4680,27 +4646,27 @@ func (s *CreatedMirror) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *CreatedMirror) MarshalJSON() ([]byte, error) {
+func (s *Cluster) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreatedMirror) UnmarshalJSON(data []byte) error {
+func (s *Cluster) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s CreatedMirrorAdditional) Encode(e *jx.Encoder) {
+func (s ClusterAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s CreatedMirrorAdditional) encodeFields(e *jx.Encoder) {
+func (s ClusterAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -4710,10 +4676,10 @@ func (s CreatedMirrorAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes CreatedMirrorAdditional from json.
-func (s *CreatedMirrorAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ClusterAdditional from json.
+func (s *ClusterAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode CreatedMirrorAdditional to nil")
+		return errors.New("invalid: unable to decode ClusterAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -4731,53 +4697,43 @@ func (s *CreatedMirrorAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode CreatedMirrorAdditional")
+		return errors.Wrap(err, "decode ClusterAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s CreatedMirrorAdditional) MarshalJSON() ([]byte, error) {
+func (s ClusterAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *CreatedMirrorAdditional) UnmarshalJSON(data []byte) error {
+func (s *ClusterAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *DeletionBlocker) Encode(e *jx.Encoder) {
+func (s *CompleteOnboardingOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *DeletionBlocker) encodeFields(e *jx.Encoder) {
-	{
-		e.FieldStart("deletable")
-		e.Bool(s.Deletable)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("kind")
-		s.Kind.Encode(e)
-	}
+func (s *CompleteOnboardingOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("message")
-		e.Str(s.Message)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("name")
-		e.Str(s.Name)
+		e.FieldStart("needsOnboarding")
+		e.Bool(s.NeedsOnboarding)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -4788,81 +4744,42 @@ func (s *DeletionBlocker) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfDeletionBlocker = [5]string{
-	0: "deletable",
-	1: "id",
-	2: "kind",
-	3: "message",
-	4: "name",
+var jsonFieldsNameOfCompleteOnboardingOutputBody = [2]string{
+	0: "$schema",
+	1: "needsOnboarding",
 }
 
-// Decode decodes DeletionBlocker from json.
-func (s *DeletionBlocker) Decode(d *jx.Decoder) error {
+// Decode decodes CompleteOnboardingOutputBody from json.
+func (s *CompleteOnboardingOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionBlocker to nil")
+		return errors.New("invalid: unable to decode CompleteOnboardingOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "deletable":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Bool()
-				s.Deletable = bool(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"deletable\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "id":
+		case "needsOnboarding":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
-			}
-		case "kind":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				if err := s.Kind.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"kind\"")
-			}
-		case "message":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.Message = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"message\"")
-			}
-		case "name":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
+				v, err := d.Bool()
+				s.NeedsOnboarding = bool(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"needsOnboarding\"")
 			}
 		default:
 			var elem jx.Raw
@@ -4880,12 +4797,12 @@ func (s *DeletionBlocker) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionBlocker")
+		return errors.Wrap(err, "decode CompleteOnboardingOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011111,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -4897,8 +4814,8 @@ func (s *DeletionBlocker) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfDeletionBlocker) {
-					name = jsonFieldsNameOfDeletionBlocker[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCompleteOnboardingOutputBody) {
+					name = jsonFieldsNameOfCompleteOnboardingOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -4919,27 +4836,27 @@ func (s *DeletionBlocker) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *DeletionBlocker) MarshalJSON() ([]byte, error) {
+func (s *CompleteOnboardingOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionBlocker) UnmarshalJSON(data []byte) error {
+func (s *CompleteOnboardingOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s DeletionBlockerAdditional) Encode(e *jx.Encoder) {
+func (s CompleteOnboardingOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s DeletionBlockerAdditional) encodeFields(e *jx.Encoder) {
+func (s CompleteOnboardingOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -4949,10 +4866,10 @@ func (s DeletionBlockerAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes DeletionBlockerAdditional from json.
-func (s *DeletionBlockerAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CompleteOnboardingOutputBodyAdditional from json.
+func (s *CompleteOnboardingOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionBlockerAdditional to nil")
+		return errors.New("invalid: unable to decode CompleteOnboardingOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -4970,93 +4887,47 @@ func (s *DeletionBlockerAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionBlockerAdditional")
+		return errors.Wrap(err, "decode CompleteOnboardingOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s DeletionBlockerAdditional) MarshalJSON() ([]byte, error) {
+func (s CompleteOnboardingOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionBlockerAdditional) UnmarshalJSON(data []byte) error {
+func (s *CompleteOnboardingOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes DeletionBlockerKind as json.
-func (s DeletionBlockerKind) Encode(e *jx.Encoder) {
-	e.Str(string(s))
+// Encode implements json.Marshaler.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes DeletionBlockerKind from json.
-func (s *DeletionBlockerKind) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode DeletionBlockerKind to nil")
+// encodeFields encodes fields.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch DeletionBlockerKind(v) {
-	case DeletionBlockerKindOwnedOrg:
-		*s = DeletionBlockerKindOwnedOrg
-	default:
-		*s = DeletionBlockerKind(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s DeletionBlockerKind) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionBlockerKind) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s *DeletionGrant) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields encodes fields.
-func (s *DeletionGrant) encodeFields(e *jx.Encoder) {
-	{
-		if s.Jurisdiction.Set {
-			e.FieldStart("jurisdiction")
-			s.Jurisdiction.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("resourceId")
-		e.Str(s.ResourceId)
-	}
-	{
-		e.FieldStart("resourceName")
-		e.Str(s.ResourceName)
-	}
-	{
-		e.FieldStart("resourceType")
-		s.ResourceType.Encode(e)
+	{
+		e.FieldStart("bk_api_token")
+		e.Str(s.BkAPIToken)
 	}
 	{
-		e.FieldStart("role")
-		e.Str(s.Role)
+		e.FieldStart("bk_organization")
+		e.Str(s.BkOrganization)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -5067,79 +4938,55 @@ func (s *DeletionGrant) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfDeletionGrant = [5]string{
-	0: "jurisdiction",
-	1: "resourceId",
-	2: "resourceName",
-	3: "resourceType",
-	4: "role",
+var jsonFieldsNameOfConnectOrgCIBuildkiteCredentialInputBody = [3]string{
+	0: "$schema",
+	1: "bk_api_token",
+	2: "bk_organization",
 }
 
-// Decode decodes DeletionGrant from json.
-func (s *DeletionGrant) Decode(d *jx.Decoder) error {
+// Decode decodes ConnectOrgCIBuildkiteCredentialInputBody from json.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionGrant to nil")
+		return errors.New("invalid: unable to decode ConnectOrgCIBuildkiteCredentialInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "jurisdiction":
+		case "$schema":
 			if err := func() error {
-				s.Jurisdiction.Reset()
-				if err := s.Jurisdiction.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "resourceId":
+		case "bk_api_token":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.ResourceId = string(v)
+				s.BkAPIToken = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceId\"")
+				return errors.Wrap(err, "decode field \"bk_api_token\"")
 			}
-		case "resourceName":
+		case "bk_organization":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.ResourceName = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceName\"")
-			}
-		case "resourceType":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				if err := s.ResourceType.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceType\"")
-			}
-		case "role":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.Role = string(v)
+				s.BkOrganization = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
+				return errors.Wrap(err, "decode field \"bk_organization\"")
 			}
 		default:
 			var elem jx.Raw
@@ -5157,12 +5004,12 @@ func (s *DeletionGrant) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionGrant")
+		return errors.Wrap(err, "decode ConnectOrgCIBuildkiteCredentialInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b00000110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -5174,8 +5021,8 @@ func (s *DeletionGrant) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfDeletionGrant) {
-					name = jsonFieldsNameOfDeletionGrant[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfConnectOrgCIBuildkiteCredentialInputBody) {
+					name = jsonFieldsNameOfConnectOrgCIBuildkiteCredentialInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -5196,27 +5043,27 @@ func (s *DeletionGrant) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *DeletionGrant) MarshalJSON() ([]byte, error) {
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionGrant) UnmarshalJSON(data []byte) error {
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s DeletionGrantAdditional) Encode(e *jx.Encoder) {
+func (s ConnectOrgCIBuildkiteCredentialInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s DeletionGrantAdditional) encodeFields(e *jx.Encoder) {
+func (s ConnectOrgCIBuildkiteCredentialInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -5226,10 +5073,10 @@ func (s DeletionGrantAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes DeletionGrantAdditional from json.
-func (s *DeletionGrantAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ConnectOrgCIBuildkiteCredentialInputBodyAdditional from json.
+func (s *ConnectOrgCIBuildkiteCredentialInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionGrantAdditional to nil")
+		return errors.New("invalid: unable to decode ConnectOrgCIBuildkiteCredentialInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -5247,81 +5094,49 @@ func (s *DeletionGrantAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionGrantAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s DeletionGrantAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionGrantAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes DeletionGrantResourceType as json.
-func (s DeletionGrantResourceType) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes DeletionGrantResourceType from json.
-func (s *DeletionGrantResourceType) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode DeletionGrantResourceType to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch DeletionGrantResourceType(v) {
-	case DeletionGrantResourceTypeProject:
-		*s = DeletionGrantResourceTypeProject
-	case DeletionGrantResourceTypeRepo:
-		*s = DeletionGrantResourceTypeRepo
-	default:
-		*s = DeletionGrantResourceType(v)
+		return errors.Wrap(err, "decode ConnectOrgCIBuildkiteCredentialInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s DeletionGrantResourceType) MarshalJSON() ([]byte, error) {
+func (s ConnectOrgCIBuildkiteCredentialInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionGrantResourceType) UnmarshalJSON(data []byte) error {
+func (s *ConnectOrgCIBuildkiteCredentialInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *DeletionMembership) Encode(e *jx.Encoder) {
+func (s *CreateBindingInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *DeletionMembership) encodeFields(e *jx.Encoder) {
+func (s *CreateBindingInputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("name")
-		e.Str(s.Name)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("orgId")
-		e.Str(s.OrgId)
+		if len(s.AttributeFilter) != 0 {
+			e.FieldStart("attributeFilter")
+			e.Raw(s.AttributeFilter)
+		}
+	}
+	{
+		e.FieldStart("providerId")
+		e.Str(s.ProviderId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -5332,44 +5147,54 @@ func (s *DeletionMembership) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfDeletionMembership = [2]string{
-	0: "name",
-	1: "orgId",
+var jsonFieldsNameOfCreateBindingInputBody = [3]string{
+	0: "$schema",
+	1: "attributeFilter",
+	2: "providerId",
 }
 
-// Decode decodes DeletionMembership from json.
-func (s *DeletionMembership) Decode(d *jx.Decoder) error {
+// Decode decodes CreateBindingInputBody from json.
+func (s *CreateBindingInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionMembership to nil")
+		return errors.New("invalid: unable to decode CreateBindingInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "name":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "attributeFilter":
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				s.AttributeFilter = jx.Raw(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"attributeFilter\"")
 			}
-		case "orgId":
-			requiredBitSet[0] |= 1 << 1
+		case "providerId":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.OrgId = string(v)
+				s.ProviderId = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"orgId\"")
+				return errors.Wrap(err, "decode field \"providerId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -5387,12 +5212,12 @@ func (s *DeletionMembership) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionMembership")
+		return errors.Wrap(err, "decode CreateBindingInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000011,
+		0b00000100,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -5404,8 +5229,8 @@ func (s *DeletionMembership) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfDeletionMembership) {
-					name = jsonFieldsNameOfDeletionMembership[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateBindingInputBody) {
+					name = jsonFieldsNameOfCreateBindingInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -5426,27 +5251,27 @@ func (s *DeletionMembership) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *DeletionMembership) MarshalJSON() ([]byte, error) {
+func (s *CreateBindingInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionMembership) UnmarshalJSON(data []byte) error {
+func (s *CreateBindingInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s DeletionMembershipAdditional) Encode(e *jx.Encoder) {
+func (s CreateBindingInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s DeletionMembershipAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateBindingInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -5456,10 +5281,10 @@ func (s DeletionMembershipAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes DeletionMembershipAdditional from json.
-func (s *DeletionMembershipAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateBindingInputBodyAdditional from json.
+func (s *CreateBindingInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionMembershipAdditional to nil")
+		return errors.New("invalid: unable to decode CreateBindingInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -5477,47 +5302,55 @@ func (s *DeletionMembershipAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionMembershipAdditional")
+		return errors.Wrap(err, "decode CreateBindingInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s DeletionMembershipAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateBindingInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionMembershipAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateBindingInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *DeletionRepo) Encode(e *jx.Encoder) {
+func (s *CreateMirrorInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *DeletionRepo) encodeFields(e *jx.Encoder) {
+func (s *CreateMirrorInputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.Cluster.Set {
-			e.FieldStart("cluster")
-			s.Cluster.Encode(e)
-		}
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("id")
-		e.Str(s.ID)
+		e.FieldStart("clusterHost")
+		e.Str(s.ClusterHost)
 	}
 	{
-		e.FieldStart("name")
-		e.Str(s.Name)
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("provider")
+		s.Provider.Encode(e)
+	}
+	{
+		e.FieldStart("repo")
+		e.Str(s.Repo)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -5528,55 +5361,79 @@ func (s *DeletionRepo) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfDeletionRepo = [3]string{
-	0: "cluster",
-	1: "id",
-	2: "name",
+var jsonFieldsNameOfCreateMirrorInputBody = [5]string{
+	0: "$schema",
+	1: "clusterHost",
+	2: "owner",
+	3: "provider",
+	4: "repo",
 }
 
-// Decode decodes DeletionRepo from json.
-func (s *DeletionRepo) Decode(d *jx.Decoder) error {
+// Decode decodes CreateMirrorInputBody from json.
+func (s *CreateMirrorInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionRepo to nil")
+		return errors.New("invalid: unable to decode CreateMirrorInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "cluster":
+		case "$schema":
 			if err := func() error {
-				s.Cluster.Reset()
-				if err := s.Cluster.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cluster\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "id":
+		case "clusterHost":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.ID = string(v)
+				s.ClusterHost = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
+				return errors.Wrap(err, "decode field \"clusterHost\"")
 			}
-		case "name":
+		case "owner":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.Name = string(v)
+				s.Owner = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "provider":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				if err := s.Provider.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "repo":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Repo = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repo\"")
 			}
 		default:
 			var elem jx.Raw
@@ -5594,12 +5451,12 @@ func (s *DeletionRepo) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionRepo")
+		return errors.Wrap(err, "decode CreateMirrorInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000110,
+		0b00011110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -5611,8 +5468,8 @@ func (s *DeletionRepo) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfDeletionRepo) {
-					name = jsonFieldsNameOfDeletionRepo[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateMirrorInputBody) {
+					name = jsonFieldsNameOfCreateMirrorInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -5633,27 +5490,27 @@ func (s *DeletionRepo) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *DeletionRepo) MarshalJSON() ([]byte, error) {
+func (s *CreateMirrorInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionRepo) UnmarshalJSON(data []byte) error {
+func (s *CreateMirrorInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s DeletionRepoAdditional) Encode(e *jx.Encoder) {
+func (s CreateMirrorInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s DeletionRepoAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateMirrorInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -5663,10 +5520,10 @@ func (s DeletionRepoAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes DeletionRepoAdditional from json.
-func (s *DeletionRepoAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateMirrorInputBodyAdditional from json.
+func (s *CreateMirrorInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode DeletionRepoAdditional to nil")
+		return errors.New("invalid: unable to decode CreateMirrorInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -5684,51 +5541,93 @@ func (s *DeletionRepoAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode DeletionRepoAdditional")
+		return errors.Wrap(err, "decode CreateMirrorInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s DeletionRepoAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateMirrorInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *DeletionRepoAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateMirrorInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CreateMirrorInputBodyProvider as json.
+func (s CreateMirrorInputBodyProvider) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes CreateMirrorInputBodyProvider from json.
+func (s *CreateMirrorInputBodyProvider) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode CreateMirrorInputBodyProvider to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch CreateMirrorInputBodyProvider(v) {
+	case CreateMirrorInputBodyProviderGithub:
+		*s = CreateMirrorInputBodyProviderGithub
+	default:
+		*s = CreateMirrorInputBodyProvider(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s CreateMirrorInputBodyProvider) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *CreateMirrorInputBodyProvider) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ErrorDetail) Encode(e *jx.Encoder) {
+func (s *CreateMirrorRequestInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ErrorDetail) encodeFields(e *jx.Encoder) {
+func (s *CreateMirrorRequestInputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.Location.Set {
-			e.FieldStart("location")
-			s.Location.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		if s.Message.Set {
-			e.FieldStart("message")
-			s.Message.Encode(e)
-		}
+		e.FieldStart("clusterHost")
+		e.Str(s.ClusterHost)
 	}
 	{
-		if len(s.Value) != 0 {
-			e.FieldStart("value")
-			e.Raw(s.Value)
-		}
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("provider")
+		s.Provider.Encode(e)
+	}
+	{
+		e.FieldStart("repo")
+		e.Str(s.Repo)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -5739,51 +5638,79 @@ func (s *ErrorDetail) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfErrorDetail = [3]string{
-	0: "location",
-	1: "message",
-	2: "value",
+var jsonFieldsNameOfCreateMirrorRequestInputBody = [5]string{
+	0: "$schema",
+	1: "clusterHost",
+	2: "owner",
+	3: "provider",
+	4: "repo",
 }
 
-// Decode decodes ErrorDetail from json.
-func (s *ErrorDetail) Decode(d *jx.Decoder) error {
+// Decode decodes CreateMirrorRequestInputBody from json.
+func (s *CreateMirrorRequestInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ErrorDetail to nil")
+		return errors.New("invalid: unable to decode CreateMirrorRequestInputBody to nil")
 	}
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "location":
+		case "$schema":
 			if err := func() error {
-				s.Location.Reset()
-				if err := s.Location.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"location\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "message":
+		case "clusterHost":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Message.Reset()
-				if err := s.Message.Decode(d); err != nil {
+				v, err := d.Str()
+				s.ClusterHost = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"message\"")
+				return errors.Wrap(err, "decode field \"clusterHost\"")
 			}
-		case "value":
+		case "owner":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				v, err := d.RawAppend(nil)
-				s.Value = jx.Raw(v)
+				v, err := d.Str()
+				s.Owner = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"value\"")
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "provider":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				if err := s.Provider.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "repo":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Repo = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repo\"")
 			}
 		default:
 			var elem jx.Raw
@@ -5801,34 +5728,66 @@ func (s *ErrorDetail) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ErrorDetail")
+		return errors.Wrap(err, "decode CreateMirrorRequestInputBody")
 	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s *ErrorDetail) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ErrorDetail) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00011110,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfCreateMirrorRequestInputBody) {
+					name = jsonFieldsNameOfCreateMirrorRequestInputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *CreateMirrorRequestInputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *CreateMirrorRequestInputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ErrorDetailAdditional) Encode(e *jx.Encoder) {
+func (s CreateMirrorRequestInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ErrorDetailAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateMirrorRequestInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -5838,10 +5797,10 @@ func (s ErrorDetailAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ErrorDetailAdditional from json.
-func (s *ErrorDetailAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateMirrorRequestInputBodyAdditional from json.
+func (s *CreateMirrorRequestInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ErrorDetailAdditional to nil")
+		return errors.New("invalid: unable to decode CreateMirrorRequestInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -5859,34 +5818,72 @@ func (s *ErrorDetailAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ErrorDetailAdditional")
+		return errors.Wrap(err, "decode CreateMirrorRequestInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ErrorDetailAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateMirrorRequestInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ErrorDetailAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateMirrorRequestInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CreateMirrorRequestInputBodyProvider as json.
+func (s CreateMirrorRequestInputBodyProvider) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes CreateMirrorRequestInputBodyProvider from json.
+func (s *CreateMirrorRequestInputBodyProvider) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode CreateMirrorRequestInputBodyProvider to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch CreateMirrorRequestInputBodyProvider(v) {
+	case CreateMirrorRequestInputBodyProviderGithub:
+		*s = CreateMirrorRequestInputBodyProviderGithub
+	default:
+		*s = CreateMirrorRequestInputBodyProvider(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s CreateMirrorRequestInputBodyProvider) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *CreateMirrorRequestInputBodyProvider) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ErrorModel) Encode(e *jx.Encoder) {
+func (s *CreateNativeMirrorInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ErrorModel) encodeFields(e *jx.Encoder) {
+func (s *CreateNativeMirrorInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -5894,44 +5891,8 @@ func (s *ErrorModel) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.Detail.Set {
-			e.FieldStart("detail")
-			s.Detail.Encode(e)
-		}
-	}
-	{
-		if s.Errors != nil {
-			e.FieldStart("errors")
-			e.ArrStart()
-			for _, elem := range s.Errors {
-				elem.Encode(e)
-			}
-			e.ArrEnd()
-		}
-	}
-	{
-		if s.Instance.Set {
-			e.FieldStart("instance")
-			s.Instance.Encode(e)
-		}
-	}
-	{
-		if s.Status.Set {
-			e.FieldStart("status")
-			s.Status.Encode(e)
-		}
-	}
-	{
-		if s.Title.Set {
-			e.FieldStart("title")
-			s.Title.Encode(e)
-		}
-	}
-	{
-		if s.Type.Set {
-			e.FieldStart("type")
-			s.Type.Encode(e)
-		}
+		e.FieldStart("clusterSlug")
+		e.Str(s.ClusterSlug)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -5942,22 +5903,17 @@ func (s *ErrorModel) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfErrorModel = [7]string{
+var jsonFieldsNameOfCreateNativeMirrorInputBody = [2]string{
 	0: "$schema",
-	1: "detail",
-	2: "errors",
-	3: "instance",
-	4: "status",
-	5: "title",
-	6: "type",
+	1: "clusterSlug",
 }
 
-// Decode decodes ErrorModel from json.
-func (s *ErrorModel) Decode(d *jx.Decoder) error {
+// Decode decodes CreateNativeMirrorInputBody from json.
+func (s *CreateNativeMirrorInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ErrorModel to nil")
+		return errors.New("invalid: unable to decode CreateNativeMirrorInputBody to nil")
 	}
-	s.setDefaults()
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -5972,72 +5928,17 @@ func (s *ErrorModel) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "detail":
-			if err := func() error {
-				s.Detail.Reset()
-				if err := s.Detail.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"detail\"")
-			}
-		case "errors":
-			if err := func() error {
-				s.Errors = make([]ErrorDetail, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem ErrorDetail
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Errors = append(s.Errors, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"errors\"")
-			}
-		case "instance":
-			if err := func() error {
-				s.Instance.Reset()
-				if err := s.Instance.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"instance\"")
-			}
-		case "status":
-			if err := func() error {
-				s.Status.Reset()
-				if err := s.Status.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
-			}
-		case "title":
-			if err := func() error {
-				s.Title.Reset()
-				if err := s.Title.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"title\"")
-			}
-		case "type":
+		case "clusterSlug":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Type.Reset()
-				if err := s.Type.Decode(d); err != nil {
+				v, err := d.Str()
+				s.ClusterSlug = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"type\"")
+				return errors.Wrap(err, "decode field \"clusterSlug\"")
 			}
 		default:
 			var elem jx.Raw
@@ -6055,34 +5956,66 @@ func (s *ErrorModel) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ErrorModel")
+		return errors.Wrap(err, "decode CreateNativeMirrorInputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfCreateNativeMirrorInputBody) {
+					name = jsonFieldsNameOfCreateNativeMirrorInputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ErrorModel) MarshalJSON() ([]byte, error) {
+func (s *CreateNativeMirrorInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ErrorModel) UnmarshalJSON(data []byte) error {
+func (s *CreateNativeMirrorInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ErrorModelAdditional) Encode(e *jx.Encoder) {
+func (s CreateNativeMirrorInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ErrorModelAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateNativeMirrorInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -6092,10 +6025,10 @@ func (s ErrorModelAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ErrorModelAdditional from json.
-func (s *ErrorModelAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateNativeMirrorInputBodyAdditional from json.
+func (s *CreateNativeMirrorInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ErrorModelAdditional to nil")
+		return errors.New("invalid: unable to decode CreateNativeMirrorInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -6113,34 +6046,34 @@ func (s *ErrorModelAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ErrorModelAdditional")
+		return errors.Wrap(err, "decode CreateNativeMirrorInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ErrorModelAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateNativeMirrorInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ErrorModelAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateNativeMirrorInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GetDeletionPreviewOutputBody) Encode(e *jx.Encoder) {
+func (s *CreateOrgInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GetDeletionPreviewOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CreateOrgInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -6148,24 +6081,14 @@ func (s *GetDeletionPreviewOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("blocked")
-		e.Bool(s.Blocked)
+		e.FieldStart("name")
+		e.Str(s.Name)
 	}
 	{
-		e.FieldStart("blockers")
-		e.ArrStart()
-		for _, elem := range s.Blockers {
-			elem.Encode(e)
+		if s.Region.Set {
+			e.FieldStart("region")
+			s.Region.Encode(e)
 		}
-		e.ArrEnd()
-	}
-	{
-		e.FieldStart("willDelete")
-		s.WillDelete.Encode(e)
-	}
-	{
-		e.FieldStart("willUnlink")
-		s.WillUnlink.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -6176,18 +6099,16 @@ func (s *GetDeletionPreviewOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGetDeletionPreviewOutputBody = [5]string{
+var jsonFieldsNameOfCreateOrgInputBody = [3]string{
 	0: "$schema",
-	1: "blocked",
-	2: "blockers",
-	3: "willDelete",
-	4: "willUnlink",
+	1: "name",
+	2: "region",
 }
 
-// Decode decodes GetDeletionPreviewOutputBody from json.
-func (s *GetDeletionPreviewOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CreateOrgInputBody from json.
+func (s *CreateOrgInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetDeletionPreviewOutputBody to nil")
+		return errors.New("invalid: unable to decode CreateOrgInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -6204,55 +6125,27 @@ func (s *GetDeletionPreviewOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "blocked":
+		case "name":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Bool()
-				s.Blocked = bool(v)
+				v, err := d.Str()
+				s.Name = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"blocked\"")
-			}
-		case "blockers":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				s.Blockers = make([]DeletionBlocker, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem DeletionBlocker
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Blockers = append(s.Blockers, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"blockers\"")
-			}
-		case "willDelete":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				if err := s.WillDelete.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"willDelete\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
-		case "willUnlink":
-			requiredBitSet[0] |= 1 << 4
+		case "region":
 			if err := func() error {
-				if err := s.WillUnlink.Decode(d); err != nil {
+				s.Region.Reset()
+				if err := s.Region.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"willUnlink\"")
+				return errors.Wrap(err, "decode field \"region\"")
 			}
 		default:
 			var elem jx.Raw
@@ -6270,12 +6163,12 @@ func (s *GetDeletionPreviewOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetDeletionPreviewOutputBody")
+		return errors.Wrap(err, "decode CreateOrgInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -6287,8 +6180,8 @@ func (s *GetDeletionPreviewOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetDeletionPreviewOutputBody) {
-					name = jsonFieldsNameOfGetDeletionPreviewOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateOrgInputBody) {
+					name = jsonFieldsNameOfCreateOrgInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -6309,27 +6202,27 @@ func (s *GetDeletionPreviewOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GetDeletionPreviewOutputBody) MarshalJSON() ([]byte, error) {
+func (s *CreateOrgInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetDeletionPreviewOutputBody) UnmarshalJSON(data []byte) error {
+func (s *CreateOrgInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GetDeletionPreviewOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CreateOrgInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GetDeletionPreviewOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateOrgInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -6339,10 +6232,10 @@ func (s GetDeletionPreviewOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GetDeletionPreviewOutputBodyAdditional from json.
-func (s *GetDeletionPreviewOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateOrgInputBodyAdditional from json.
+func (s *CreateOrgInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetDeletionPreviewOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CreateOrgInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -6360,34 +6253,34 @@ func (s *GetDeletionPreviewOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetDeletionPreviewOutputBodyAdditional")
+		return errors.Wrap(err, "decode CreateOrgInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetDeletionPreviewOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateOrgInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetDeletionPreviewOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateOrgInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GetMeOutputBody) Encode(e *jx.Encoder) {
+func (s *CreateProjectInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GetMeOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CreateProjectInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -6395,41 +6288,21 @@ func (s *GetMeOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("auth")
-		s.Auth.Encode(e)
-	}
-	{
-		if s.Deletion.Set {
-			e.FieldStart("deletion")
-			s.Deletion.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("global")
-		s.Global.Encode(e)
-	}
-	{
-		if s.Jurisdiction.Set {
-			e.FieldStart("jurisdiction")
-			s.Jurisdiction.Encode(e)
-		}
+		e.FieldStart("name")
+		e.Str(s.Name)
 	}
 	{
-		if s.Mode.Set {
-			e.FieldStart("mode")
-			s.Mode.Encode(e)
-		}
+		e.FieldStart("ownerId")
+		e.Str(s.OwnerId)
 	}
 	{
-		if s.Regional.Set {
-			e.FieldStart("regional")
-			s.Regional.Encode(e)
-		}
+		e.FieldStart("ownerType")
+		s.OwnerType.Encode(e)
 	}
 	{
-		if s.RegionalUnavailable.Set {
-			e.FieldStart("regionalUnavailable")
-			s.RegionalUnavailable.Encode(e)
+		if s.Region.Set {
+			e.FieldStart("region")
+			s.Region.Encode(e)
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -6441,21 +6314,18 @@ func (s *GetMeOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGetMeOutputBody = [8]string{
+var jsonFieldsNameOfCreateProjectInputBody = [5]string{
 	0: "$schema",
-	1: "auth",
-	2: "deletion",
-	3: "global",
-	4: "jurisdiction",
-	5: "mode",
-	6: "regional",
-	7: "regionalUnavailable",
+	1: "name",
+	2: "ownerId",
+	3: "ownerType",
+	4: "region",
 }
 
-// Decode decodes GetMeOutputBody from json.
-func (s *GetMeOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CreateProjectInputBody from json.
+func (s *CreateProjectInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetMeOutputBody to nil")
+		return errors.New("invalid: unable to decode CreateProjectInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -6472,75 +6342,49 @@ func (s *GetMeOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "auth":
+		case "name":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				if err := s.Auth.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"auth\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
-		case "deletion":
+		case "ownerId":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Deletion.Reset()
-				if err := s.Deletion.Decode(d); err != nil {
+				v, err := d.Str()
+				s.OwnerId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"deletion\"")
+				return errors.Wrap(err, "decode field \"ownerId\"")
 			}
-		case "global":
+		case "ownerType":
 			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				if err := s.Global.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"global\"")
-			}
-		case "jurisdiction":
-			if err := func() error {
-				s.Jurisdiction.Reset()
-				if err := s.Jurisdiction.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
-			}
-		case "mode":
-			if err := func() error {
-				s.Mode.Reset()
-				if err := s.Mode.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mode\"")
-			}
-		case "regional":
-			if err := func() error {
-				s.Regional.Reset()
-				if err := s.Regional.Decode(d); err != nil {
+				if err := s.OwnerType.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"regional\"")
+				return errors.Wrap(err, "decode field \"ownerType\"")
 			}
-		case "regionalUnavailable":
+		case "region":
 			if err := func() error {
-				s.RegionalUnavailable.Reset()
-				if err := s.RegionalUnavailable.Decode(d); err != nil {
+				s.Region.Reset()
+				if err := s.Region.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"regionalUnavailable\"")
+				return errors.Wrap(err, "decode field \"region\"")
 			}
 		default:
 			var elem jx.Raw
@@ -6558,12 +6402,12 @@ func (s *GetMeOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetMeOutputBody")
+		return errors.Wrap(err, "decode CreateProjectInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001010,
+		0b00001110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -6575,8 +6419,8 @@ func (s *GetMeOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetMeOutputBody) {
-					name = jsonFieldsNameOfGetMeOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateProjectInputBody) {
+					name = jsonFieldsNameOfCreateProjectInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -6597,27 +6441,27 @@ func (s *GetMeOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GetMeOutputBody) MarshalJSON() ([]byte, error) {
+func (s *CreateProjectInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetMeOutputBody) UnmarshalJSON(data []byte) error {
+func (s *CreateProjectInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GetMeOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CreateProjectInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GetMeOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateProjectInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -6627,10 +6471,10 @@ func (s GetMeOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GetMeOutputBodyAdditional from json.
-func (s *GetMeOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateProjectInputBodyAdditional from json.
+func (s *CreateProjectInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetMeOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CreateProjectInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -6648,76 +6492,74 @@ func (s *GetMeOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetMeOutputBodyAdditional")
+		return errors.Wrap(err, "decode CreateProjectInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetMeOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateProjectInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetMeOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateProjectInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GetMeOutputBodyMode as json.
-func (s GetMeOutputBodyMode) Encode(e *jx.Encoder) {
+// Encode encodes CreateProjectInputBodyOwnerType as json.
+func (s CreateProjectInputBodyOwnerType) Encode(e *jx.Encoder) {
 	e.Str(string(s))
 }
 
-// Decode decodes GetMeOutputBodyMode from json.
-func (s *GetMeOutputBodyMode) Decode(d *jx.Decoder) error {
+// Decode decodes CreateProjectInputBodyOwnerType from json.
+func (s *CreateProjectInputBodyOwnerType) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetMeOutputBodyMode to nil")
+		return errors.New("invalid: unable to decode CreateProjectInputBodyOwnerType to nil")
 	}
 	v, err := d.StrBytes()
 	if err != nil {
 		return err
 	}
 	// Try to use constant string.
-	switch GetMeOutputBodyMode(v) {
-	case GetMeOutputBodyModeStandalone:
-		*s = GetMeOutputBodyModeStandalone
-	case GetMeOutputBodyModeGlobal:
-		*s = GetMeOutputBodyModeGlobal
-	case GetMeOutputBodyModeRegional:
-		*s = GetMeOutputBodyModeRegional
+	switch CreateProjectInputBodyOwnerType(v) {
+	case CreateProjectInputBodyOwnerTypeOrg:
+		*s = CreateProjectInputBodyOwnerTypeOrg
+	case CreateProjectInputBodyOwnerTypeAccount:
+		*s = CreateProjectInputBodyOwnerTypeAccount
 	default:
-		*s = GetMeOutputBodyMode(v)
+		*s = CreateProjectInputBodyOwnerType(v)
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetMeOutputBodyMode) MarshalJSON() ([]byte, error) {
+func (s CreateProjectInputBodyOwnerType) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetMeOutputBodyMode) UnmarshalJSON(data []byte) error {
+func (s *CreateProjectInputBodyOwnerType) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GetOnboardingStatusOutputBody) Encode(e *jx.Encoder) {
+func (s *CreateRepoCIWebhookBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GetOnboardingStatusOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CreateRepoCIWebhookBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -6725,8 +6567,74 @@ func (s *GetOnboardingStatusOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("needsOnboarding")
-		e.Bool(s.NeedsOnboarding)
+		e.FieldStart("auth_plugin_ref")
+		e.Str(s.AuthPluginRef)
+	}
+	{
+		e.FieldStart("automation_id")
+		e.Str(s.AutomationID)
+	}
+	{
+		e.FieldStart("bk_organization")
+		e.Str(s.BkOrganization)
+	}
+	{
+		e.FieldStart("bk_pipeline")
+		e.Str(s.BkPipeline)
+	}
+	{
+		e.FieldStart("core_url")
+		e.Str(s.CoreURL)
+	}
+	{
+		e.FieldStart("created_at")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		e.FieldStart("display_name")
+		e.Str(s.DisplayName)
+	}
+	{
+		e.FieldStart("enabled")
+		e.Bool(s.Enabled)
+	}
+	{
+		e.FieldStart("events")
+		e.ArrStart()
+		for _, elem := range s.Events {
+			e.Str(elem)
+		}
+		e.ArrEnd()
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		e.FieldStart("publish_checks")
+		e.Bool(s.PublishChecks)
+	}
+	{
+		e.FieldStart("ref_filter")
+		e.Str(s.RefFilter)
+	}
+	{
+		e.FieldStart("repo_id")
+		e.Str(s.RepoID)
+	}
+	{
+		if s.Setup.Set {
+			e.FieldStart("setup")
+			s.Setup.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("updated_at")
+		json.EncodeDateTime(e, s.UpdatedAt)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -6737,17 +6645,32 @@ func (s *GetOnboardingStatusOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGetOnboardingStatusOutputBody = [2]string{
-	0: "$schema",
-	1: "needsOnboarding",
-}
-
-// Decode decodes GetOnboardingStatusOutputBody from json.
-func (s *GetOnboardingStatusOutputBody) Decode(d *jx.Decoder) error {
+var jsonFieldsNameOfCreateRepoCIWebhookBody = [17]string{
+	0:  "$schema",
+	1:  "auth_plugin_ref",
+	2:  "automation_id",
+	3:  "bk_organization",
+	4:  "bk_pipeline",
+	5:  "core_url",
+	6:  "created_at",
+	7:  "display_name",
+	8:  "enabled",
+	9:  "events",
+	10: "id",
+	11: "provider",
+	12: "publish_checks",
+	13: "ref_filter",
+	14: "repo_id",
+	15: "setup",
+	16: "updated_at",
+}
+
+// Decode decodes CreateRepoCIWebhookBody from json.
+func (s *CreateRepoCIWebhookBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetOnboardingStatusOutputBody to nil")
+		return errors.New("invalid: unable to decode CreateRepoCIWebhookBody to nil")
 	}
-	var requiredBitSet [1]uint8
+	var requiredBitSet [3]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -6762,232 +6685,106 @@ func (s *GetOnboardingStatusOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "needsOnboarding":
+		case "auth_plugin_ref":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Bool()
-				s.NeedsOnboarding = bool(v)
+				v, err := d.Str()
+				s.AuthPluginRef = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"needsOnboarding\"")
+				return errors.Wrap(err, "decode field \"auth_plugin_ref\"")
 			}
-		default:
-			var elem jx.Raw
+		case "automation_id":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				v, err := d.RawAppend(nil)
-				elem = jx.Raw(v)
+				v, err := d.Str()
+				s.AutomationID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrapf(err, "decode field %q", k)
+				return errors.Wrap(err, "decode field \"automation_id\"")
 			}
-			s.AdditionalProps[string(k)] = elem
-		}
-		return nil
-	}); err != nil {
-		return errors.Wrap(err, "decode GetOnboardingStatusOutputBody")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00000010,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetOnboardingStatusOutputBody) {
-					name = jsonFieldsNameOfGetOnboardingStatusOutputBody[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
+		case "bk_organization":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.BkOrganization = string(v)
+				if err != nil {
+					return err
 				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_organization\"")
 			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s *GetOnboardingStatusOutputBody) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetOnboardingStatusOutputBody) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s GetOnboardingStatusOutputBodyAdditional) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields implements json.Marshaler.
-func (s GetOnboardingStatusOutputBodyAdditional) encodeFields(e *jx.Encoder) {
-	for k, elem := range s {
-		e.FieldStart(k)
-
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
-}
-
-// Decode decodes GetOnboardingStatusOutputBodyAdditional from json.
-func (s *GetOnboardingStatusOutputBodyAdditional) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GetOnboardingStatusOutputBodyAdditional to nil")
-	}
-	m := s.init()
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		var elem jx.Raw
-		if err := func() error {
-			v, err := d.RawAppend(nil)
-			elem = jx.Raw(v)
-			if err != nil {
-				return err
+		case "bk_pipeline":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.BkPipeline = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_pipeline\"")
 			}
-			return nil
-		}(); err != nil {
-			return errors.Wrapf(err, "decode field %q", k)
-		}
-		m[string(k)] = elem
-		return nil
-	}); err != nil {
-		return errors.Wrap(err, "decode GetOnboardingStatusOutputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GetOnboardingStatusOutputBodyAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetOnboardingStatusOutputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s *GetPermissionsOutputBody) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields encodes fields.
-func (s *GetPermissionsOutputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		if s.Explain.Set {
-			e.FieldStart("explain")
-			s.Explain.Encode(e)
-		}
-	}
-	{
-		if s.Permissions != nil {
-			e.FieldStart("permissions")
-			e.ArrStart()
-			for _, elem := range s.Permissions {
-				e.Str(elem)
+		case "core_url":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.CoreURL = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"core_url\"")
 			}
-			e.ArrEnd()
-		}
-	}
-	{
-		e.FieldStart("resourceId")
-		e.Str(s.ResourceId)
-	}
-	{
-		e.FieldStart("resourceType")
-		e.Str(s.ResourceType)
-	}
-	for k, elem := range s.AdditionalProps {
-		e.FieldStart(k)
-
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
-}
-
-var jsonFieldsNameOfGetPermissionsOutputBody = [5]string{
-	0: "$schema",
-	1: "explain",
-	2: "permissions",
-	3: "resourceId",
-	4: "resourceType",
-}
-
-// Decode decodes GetPermissionsOutputBody from json.
-func (s *GetPermissionsOutputBody) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GetPermissionsOutputBody to nil")
-	}
-	var requiredBitSet [1]uint8
-	s.AdditionalProps = map[string]jx.Raw{}
-
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		switch string(k) {
-		case "$schema":
+		case "created_at":
+			requiredBitSet[0] |= 1 << 6
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"created_at\"")
 			}
-		case "explain":
+		case "display_name":
+			requiredBitSet[0] |= 1 << 7
 			if err := func() error {
-				s.Explain.Reset()
-				if err := s.Explain.Decode(d); err != nil {
+				v, err := d.Str()
+				s.DisplayName = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"explain\"")
+				return errors.Wrap(err, "decode field \"display_name\"")
 			}
-		case "permissions":
+		case "enabled":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Bool()
+				s.Enabled = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"enabled\"")
+			}
+		case "events":
+			requiredBitSet[1] |= 1 << 1
 			if err := func() error {
-				s.Permissions = make([]string, 0)
+				s.Events = make([]string, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
 					var elem string
 					v, err := d.Str()
@@ -6995,38 +6792,96 @@ func (s *GetPermissionsOutputBody) Decode(d *jx.Decoder) error {
 					if err != nil {
 						return err
 					}
-					s.Permissions = append(s.Permissions, elem)
+					s.Events = append(s.Events, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"permissions\"")
+				return errors.Wrap(err, "decode field \"events\"")
 			}
-		case "resourceId":
-			requiredBitSet[0] |= 1 << 3
+		case "id":
+			requiredBitSet[1] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.ResourceId = string(v)
+				s.ID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceId\"")
+				return errors.Wrap(err, "decode field \"id\"")
 			}
-		case "resourceType":
-			requiredBitSet[0] |= 1 << 4
+		case "provider":
+			requiredBitSet[1] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.ResourceType = string(v)
+				s.Provider = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceType\"")
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "publish_checks":
+			requiredBitSet[1] |= 1 << 4
+			if err := func() error {
+				v, err := d.Bool()
+				s.PublishChecks = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"publish_checks\"")
+			}
+		case "ref_filter":
+			requiredBitSet[1] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.RefFilter = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"ref_filter\"")
+			}
+		case "repo_id":
+			requiredBitSet[1] |= 1 << 6
+			if err := func() error {
+				v, err := d.Str()
+				s.RepoID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repo_id\"")
+			}
+		case "setup":
+			if err := func() error {
+				s.Setup.Reset()
+				if err := s.Setup.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"setup\"")
+			}
+		case "updated_at":
+			requiredBitSet[2] |= 1 << 0
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.UpdatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"updated_at\"")
 			}
 		default:
 			var elem jx.Raw
@@ -7044,12 +6899,14 @@ func (s *GetPermissionsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetPermissionsOutputBody")
+		return errors.Wrap(err, "decode CreateRepoCIWebhookBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00011000,
+	for i, mask := range [3]uint8{
+		0b11111110,
+		0b01111111,
+		0b00000001,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -7061,8 +6918,8 @@ func (s *GetPermissionsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetPermissionsOutputBody) {
-					name = jsonFieldsNameOfGetPermissionsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateRepoCIWebhookBody) {
+					name = jsonFieldsNameOfCreateRepoCIWebhookBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -7083,85 +6940,27 @@ func (s *GetPermissionsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GetPermissionsOutputBody) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetPermissionsOutputBody) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s GetPermissionsOutputBodyAdditional) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields implements json.Marshaler.
-func (s GetPermissionsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
-	for k, elem := range s {
-		e.FieldStart(k)
-
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
-}
-
-// Decode decodes GetPermissionsOutputBodyAdditional from json.
-func (s *GetPermissionsOutputBodyAdditional) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GetPermissionsOutputBodyAdditional to nil")
-	}
-	m := s.init()
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		var elem jx.Raw
-		if err := func() error {
-			v, err := d.RawAppend(nil)
-			elem = jx.Raw(v)
-			if err != nil {
-				return err
-			}
-			return nil
-		}(); err != nil {
-			return errors.Wrapf(err, "decode field %q", k)
-		}
-		m[string(k)] = elem
-		return nil
-	}); err != nil {
-		return errors.Wrap(err, "decode GetPermissionsOutputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GetPermissionsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s *CreateRepoCIWebhookBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetPermissionsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoCIWebhookBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GetPermissionsOutputBodyExplain) Encode(e *jx.Encoder) {
+func (s CreateRepoCIWebhookBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GetPermissionsOutputBodyExplain) encodeFields(e *jx.Encoder) {
+func (s CreateRepoCIWebhookBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -7171,10 +6970,10 @@ func (s GetPermissionsOutputBodyExplain) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GetPermissionsOutputBodyExplain from json.
-func (s *GetPermissionsOutputBodyExplain) Decode(d *jx.Decoder) error {
+// Decode decodes CreateRepoCIWebhookBodyAdditional from json.
+func (s *CreateRepoCIWebhookBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetPermissionsOutputBodyExplain to nil")
+		return errors.New("invalid: unable to decode CreateRepoCIWebhookBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -7192,34 +6991,34 @@ func (s *GetPermissionsOutputBodyExplain) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetPermissionsOutputBodyExplain")
+		return errors.Wrap(err, "decode CreateRepoCIWebhookBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetPermissionsOutputBodyExplain) MarshalJSON() ([]byte, error) {
+func (s CreateRepoCIWebhookBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetPermissionsOutputBodyExplain) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoCIWebhookBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GetRepoVisibilityOutputBody) Encode(e *jx.Encoder) {
+func (s *CreateRepoCIWebhookInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GetRepoVisibilityOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CreateRepoCIWebhookInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -7227,29 +7026,124 @@ func (s *GetRepoVisibilityOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("visibility")
-		s.Visibility.Encode(e)
+		if s.BkClusterID.Set {
+			e.FieldStart("bk_cluster_id")
+			s.BkClusterID.Encode(e)
+		}
 	}
-	for k, elem := range s.AdditionalProps {
-		e.FieldStart(k)
-
+	{
+		if s.BkForceRescaffold.Set {
+			e.FieldStart("bk_force_rescaffold")
+			s.BkForceRescaffold.Encode(e)
+		}
+	}
+	{
+		if s.BkOrganization.Set {
+			e.FieldStart("bk_organization")
+			s.BkOrganization.Encode(e)
+		}
+	}
+	{
+		if s.BkPipeline.Set {
+			e.FieldStart("bk_pipeline")
+			s.BkPipeline.Encode(e)
+		}
+	}
+	{
+		if s.BkPipelineSelfManaged.Set {
+			e.FieldStart("bk_pipeline_self_managed")
+			s.BkPipelineSelfManaged.Encode(e)
+		}
+	}
+	{
+		if s.BkProvisioningToken.Set {
+			e.FieldStart("bk_provisioning_token")
+			s.BkProvisioningToken.Encode(e)
+		}
+	}
+	{
+		if s.Config.Set {
+			e.FieldStart("config")
+			s.Config.Encode(e)
+		}
+	}
+	{
+		if s.DisplayName.Set {
+			e.FieldStart("display_name")
+			s.DisplayName.Encode(e)
+		}
+	}
+	{
+		if s.Events != nil {
+			e.FieldStart("events")
+			e.ArrStart()
+			for _, elem := range s.Events {
+				e.Str(elem)
+			}
+			e.ArrEnd()
+		}
+	}
+	{
+		if s.Mode.Set {
+			e.FieldStart("mode")
+			s.Mode.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		if s.ProviderAccount.Set {
+			e.FieldStart("provider_account")
+			s.ProviderAccount.Encode(e)
+		}
+	}
+	{
+		if s.RefFilter.Set {
+			e.FieldStart("ref_filter")
+			s.RefFilter.Encode(e)
+		}
+	}
+	{
+		if s.TargetRef.Set {
+			e.FieldStart("target_ref")
+			s.TargetRef.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
 		if len(elem) != 0 {
 			e.Raw(elem)
 		}
 	}
 }
 
-var jsonFieldsNameOfGetRepoVisibilityOutputBody = [2]string{
-	0: "$schema",
-	1: "visibility",
+var jsonFieldsNameOfCreateRepoCIWebhookInputBody = [15]string{
+	0:  "$schema",
+	1:  "bk_cluster_id",
+	2:  "bk_force_rescaffold",
+	3:  "bk_organization",
+	4:  "bk_pipeline",
+	5:  "bk_pipeline_self_managed",
+	6:  "bk_provisioning_token",
+	7:  "config",
+	8:  "display_name",
+	9:  "events",
+	10: "mode",
+	11: "provider",
+	12: "provider_account",
+	13: "ref_filter",
+	14: "target_ref",
 }
 
-// Decode decodes GetRepoVisibilityOutputBody from json.
-func (s *GetRepoVisibilityOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CreateRepoCIWebhookInputBody from json.
+func (s *CreateRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetRepoVisibilityOutputBody to nil")
+		return errors.New("invalid: unable to decode CreateRepoCIWebhookInputBody to nil")
 	}
-	var requiredBitSet [1]uint8
+	var requiredBitSet [2]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -7264,15 +7158,156 @@ func (s *GetRepoVisibilityOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "visibility":
-			requiredBitSet[0] |= 1 << 1
+		case "bk_cluster_id":
 			if err := func() error {
-				if err := s.Visibility.Decode(d); err != nil {
+				s.BkClusterID.Reset()
+				if err := s.BkClusterID.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"visibility\"")
+				return errors.Wrap(err, "decode field \"bk_cluster_id\"")
+			}
+		case "bk_force_rescaffold":
+			if err := func() error {
+				s.BkForceRescaffold.Reset()
+				if err := s.BkForceRescaffold.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_force_rescaffold\"")
+			}
+		case "bk_organization":
+			if err := func() error {
+				s.BkOrganization.Reset()
+				if err := s.BkOrganization.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_organization\"")
+			}
+		case "bk_pipeline":
+			if err := func() error {
+				s.BkPipeline.Reset()
+				if err := s.BkPipeline.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_pipeline\"")
+			}
+		case "bk_pipeline_self_managed":
+			if err := func() error {
+				s.BkPipelineSelfManaged.Reset()
+				if err := s.BkPipelineSelfManaged.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_pipeline_self_managed\"")
+			}
+		case "bk_provisioning_token":
+			if err := func() error {
+				s.BkProvisioningToken.Reset()
+				if err := s.BkProvisioningToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_provisioning_token\"")
+			}
+		case "config":
+			if err := func() error {
+				s.Config.Reset()
+				if err := s.Config.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"config\"")
+			}
+		case "display_name":
+			if err := func() error {
+				s.DisplayName.Reset()
+				if err := s.DisplayName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"display_name\"")
+			}
+		case "events":
+			if err := func() error {
+				s.Events = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.Events = append(s.Events, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"events\"")
+			}
+		case "mode":
+			if err := func() error {
+				s.Mode.Reset()
+				if err := s.Mode.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mode\"")
+			}
+		case "provider":
+			requiredBitSet[1] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "provider_account":
+			if err := func() error {
+				s.ProviderAccount.Reset()
+				if err := s.ProviderAccount.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider_account\"")
+			}
+		case "ref_filter":
+			if err := func() error {
+				s.RefFilter.Reset()
+				if err := s.RefFilter.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"ref_filter\"")
+			}
+		case "target_ref":
+			if err := func() error {
+				s.TargetRef.Reset()
+				if err := s.TargetRef.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"target_ref\"")
 			}
 		default:
 			var elem jx.Raw
@@ -7290,12 +7325,13 @@ func (s *GetRepoVisibilityOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetRepoVisibilityOutputBody")
+		return errors.Wrap(err, "decode CreateRepoCIWebhookInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00000010,
+	for i, mask := range [2]uint8{
+		0b00000000,
+		0b00001000,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -7307,8 +7343,8 @@ func (s *GetRepoVisibilityOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetRepoVisibilityOutputBody) {
-					name = jsonFieldsNameOfGetRepoVisibilityOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateRepoCIWebhookInputBody) {
+					name = jsonFieldsNameOfCreateRepoCIWebhookInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -7329,27 +7365,27 @@ func (s *GetRepoVisibilityOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GetRepoVisibilityOutputBody) MarshalJSON() ([]byte, error) {
+func (s *CreateRepoCIWebhookInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetRepoVisibilityOutputBody) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoCIWebhookInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GetRepoVisibilityOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CreateRepoCIWebhookInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GetRepoVisibilityOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateRepoCIWebhookInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -7359,10 +7395,10 @@ func (s GetRepoVisibilityOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GetRepoVisibilityOutputBodyAdditional from json.
-func (s *GetRepoVisibilityOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateRepoCIWebhookInputBodyAdditional from json.
+func (s *CreateRepoCIWebhookInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetRepoVisibilityOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CreateRepoCIWebhookInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -7380,74 +7416,90 @@ func (s *GetRepoVisibilityOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetRepoVisibilityOutputBodyAdditional")
+		return errors.Wrap(err, "decode CreateRepoCIWebhookInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetRepoVisibilityOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateRepoCIWebhookInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetRepoVisibilityOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoCIWebhookInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GetRepoVisibilityOutputBodyVisibility as json.
-func (s GetRepoVisibilityOutputBodyVisibility) Encode(e *jx.Encoder) {
-	e.Str(string(s))
+// Encode implements json.Marshaler.
+func (s CreateRepoCIWebhookInputBodyConfig) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes GetRepoVisibilityOutputBodyVisibility from json.
-func (s *GetRepoVisibilityOutputBodyVisibility) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GetRepoVisibilityOutputBodyVisibility to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch GetRepoVisibilityOutputBodyVisibility(v) {
-	case GetRepoVisibilityOutputBodyVisibilityPublic:
-		*s = GetRepoVisibilityOutputBodyVisibilityPublic
-	case GetRepoVisibilityOutputBodyVisibilityPrivate:
-		*s = GetRepoVisibilityOutputBodyVisibilityPrivate
-	default:
-		*s = GetRepoVisibilityOutputBodyVisibility(v)
-	}
+// encodeFields implements json.Marshaler.
+func (s CreateRepoCIWebhookInputBodyConfig) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
 
-	return nil
+		e.Str(elem)
+	}
 }
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s GetRepoVisibilityOutputBodyVisibility) MarshalJSON() ([]byte, error) {
+// Decode decodes CreateRepoCIWebhookInputBodyConfig from json.
+func (s *CreateRepoCIWebhookInputBodyConfig) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode CreateRepoCIWebhookInputBodyConfig to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem string
+		if err := func() error {
+			v, err := d.Str()
+			elem = string(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode CreateRepoCIWebhookInputBodyConfig")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s CreateRepoCIWebhookInputBodyConfig) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetRepoVisibilityOutputBodyVisibility) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoCIWebhookInputBodyConfig) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GetTopologyOutputBody) Encode(e *jx.Encoder) {
+func (s *CreateRepoInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GetTopologyOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CreateRepoInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -7455,12 +7507,24 @@ func (s *GetTopologyOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("jurisdictions")
-		e.ArrStart()
-		for _, elem := range s.Jurisdictions {
-			elem.Encode(e)
+		if s.ClusterHost.Set {
+			e.FieldStart("clusterHost")
+			s.ClusterHost.Encode(e)
 		}
-		e.ArrEnd()
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	{
+		if s.ObjectFormat.Set {
+			e.FieldStart("objectFormat")
+			s.ObjectFormat.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("projectId")
+		e.Str(s.ProjectId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -7471,15 +7535,18 @@ func (s *GetTopologyOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGetTopologyOutputBody = [2]string{
+var jsonFieldsNameOfCreateRepoInputBody = [5]string{
 	0: "$schema",
-	1: "jurisdictions",
+	1: "clusterHost",
+	2: "name",
+	3: "objectFormat",
+	4: "projectId",
 }
 
-// Decode decodes GetTopologyOutputBody from json.
-func (s *GetTopologyOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CreateRepoInputBody from json.
+func (s *CreateRepoInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetTopologyOutputBody to nil")
+		return errors.New("invalid: unable to decode CreateRepoInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -7496,23 +7563,49 @@ func (s *GetTopologyOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "jurisdictions":
-			requiredBitSet[0] |= 1 << 1
+		case "clusterHost":
 			if err := func() error {
-				s.Jurisdictions = make([]TopologyJurisdiction, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem TopologyJurisdiction
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Jurisdictions = append(s.Jurisdictions, elem)
-					return nil
-				}); err != nil {
+				s.ClusterHost.Reset()
+				if err := s.ClusterHost.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdictions\"")
+				return errors.Wrap(err, "decode field \"clusterHost\"")
+			}
+		case "name":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"name\"")
+			}
+		case "objectFormat":
+			if err := func() error {
+				s.ObjectFormat.Reset()
+				if err := s.ObjectFormat.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"objectFormat\"")
+			}
+		case "projectId":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.ProjectId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"projectId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -7530,12 +7623,12 @@ func (s *GetTopologyOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetTopologyOutputBody")
+		return errors.Wrap(err, "decode CreateRepoInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00010100,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -7547,8 +7640,8 @@ func (s *GetTopologyOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetTopologyOutputBody) {
-					name = jsonFieldsNameOfGetTopologyOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateRepoInputBody) {
+					name = jsonFieldsNameOfCreateRepoInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -7569,27 +7662,27 @@ func (s *GetTopologyOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GetTopologyOutputBody) MarshalJSON() ([]byte, error) {
+func (s *CreateRepoInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetTopologyOutputBody) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GetTopologyOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CreateRepoInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GetTopologyOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateRepoInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -7599,10 +7692,10 @@ func (s GetTopologyOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GetTopologyOutputBodyAdditional from json.
-func (s *GetTopologyOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateRepoInputBodyAdditional from json.
+func (s *CreateRepoInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetTopologyOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CreateRepoInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -7620,34 +7713,74 @@ func (s *GetTopologyOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetTopologyOutputBodyAdditional")
+		return errors.Wrap(err, "decode CreateRepoInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetTopologyOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateRepoInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetTopologyOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreateRepoInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CreateRepoInputBodyObjectFormat as json.
+func (s CreateRepoInputBodyObjectFormat) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes CreateRepoInputBodyObjectFormat from json.
+func (s *CreateRepoInputBodyObjectFormat) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode CreateRepoInputBodyObjectFormat to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch CreateRepoInputBodyObjectFormat(v) {
+	case CreateRepoInputBodyObjectFormatSHA1:
+		*s = CreateRepoInputBodyObjectFormatSHA1
+	case CreateRepoInputBodyObjectFormatSHA256:
+		*s = CreateRepoInputBodyObjectFormatSHA256
+	default:
+		*s = CreateRepoInputBodyObjectFormat(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s CreateRepoInputBodyObjectFormat) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *CreateRepoInputBodyObjectFormat) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GetVersionOutputBody) Encode(e *jx.Encoder) {
+func (s *CreateServiceAccountInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GetVersionOutputBody) encodeFields(e *jx.Encoder) {
+func (s *CreateServiceAccountInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -7655,14 +7788,12 @@ func (s *GetVersionOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.Mode.Set {
-			e.FieldStart("mode")
-			s.Mode.Encode(e)
-		}
+		e.FieldStart("name")
+		e.Str(s.Name)
 	}
 	{
-		e.FieldStart("version")
-		e.Str(s.Version)
+		e.FieldStart("orgId")
+		e.Str(s.OrgId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -7673,16 +7804,16 @@ func (s *GetVersionOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGetVersionOutputBody = [3]string{
+var jsonFieldsNameOfCreateServiceAccountInputBody = [3]string{
 	0: "$schema",
-	1: "mode",
-	2: "version",
+	1: "name",
+	2: "orgId",
 }
 
-// Decode decodes GetVersionOutputBody from json.
-func (s *GetVersionOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CreateServiceAccountInputBody from json.
+func (s *CreateServiceAccountInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetVersionOutputBody to nil")
+		return errors.New("invalid: unable to decode CreateServiceAccountInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -7699,27 +7830,29 @@ func (s *GetVersionOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "mode":
+		case "name":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Mode.Reset()
-				if err := s.Mode.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mode\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
-		case "version":
+		case "orgId":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.Version = string(v)
+				s.OrgId = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"version\"")
+				return errors.Wrap(err, "decode field \"orgId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -7737,12 +7870,12 @@ func (s *GetVersionOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetVersionOutputBody")
+		return errors.Wrap(err, "decode CreateServiceAccountInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000100,
+		0b00000110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -7754,8 +7887,8 @@ func (s *GetVersionOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGetVersionOutputBody) {
-					name = jsonFieldsNameOfGetVersionOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreateServiceAccountInputBody) {
+					name = jsonFieldsNameOfCreateServiceAccountInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -7776,27 +7909,27 @@ func (s *GetVersionOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GetVersionOutputBody) MarshalJSON() ([]byte, error) {
+func (s *CreateServiceAccountInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetVersionOutputBody) UnmarshalJSON(data []byte) error {
+func (s *CreateServiceAccountInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GetVersionOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CreateServiceAccountInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GetVersionOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CreateServiceAccountInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -7806,10 +7939,10 @@ func (s GetVersionOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GetVersionOutputBodyAdditional from json.
-func (s *GetVersionOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreateServiceAccountInputBodyAdditional from json.
+func (s *CreateServiceAccountInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GetVersionOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CreateServiceAccountInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -7827,76 +7960,34 @@ func (s *GetVersionOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GetVersionOutputBodyAdditional")
+		return errors.Wrap(err, "decode CreateServiceAccountInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GetVersionOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CreateServiceAccountInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetVersionOutputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes GetVersionOutputBodyMode as json.
-func (s GetVersionOutputBodyMode) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes GetVersionOutputBodyMode from json.
-func (s *GetVersionOutputBodyMode) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GetVersionOutputBodyMode to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch GetVersionOutputBodyMode(v) {
-	case GetVersionOutputBodyModeStandalone:
-		*s = GetVersionOutputBodyModeStandalone
-	case GetVersionOutputBodyModeGlobal:
-		*s = GetVersionOutputBodyModeGlobal
-	case GetVersionOutputBodyModeRegional:
-		*s = GetVersionOutputBodyModeRegional
-	default:
-		*s = GetVersionOutputBodyMode(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GetVersionOutputBodyMode) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GetVersionOutputBodyMode) UnmarshalJSON(data []byte) error {
+func (s *CreateServiceAccountInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GrantProjectAccessInputBody) Encode(e *jx.Encoder) {
+func (s *CreatedMirror) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GrantProjectAccessInputBody) encodeFields(e *jx.Encoder) {
+func (s *CreatedMirror) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -7904,22 +7995,28 @@ func (s *GrantProjectAccessInputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.GranteeType.Set {
-			e.FieldStart("granteeType")
-			s.GranteeType.Encode(e)
-		}
+		e.FieldStart("created")
+		e.Bool(s.Created)
 	}
 	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
+		e.FieldStart("empty")
+		e.Bool(s.Empty)
 	}
 	{
-		e.FieldStart("providerUserId")
-		e.Str(s.ProviderUserId)
+		e.FieldStart("mirrorId")
+		e.Str(s.MirrorId)
 	}
 	{
-		e.FieldStart("role")
-		s.Role.Encode(e)
+		e.FieldStart("mirrorUrl")
+		e.Str(s.MirrorUrl)
+	}
+	{
+		e.FieldStart("publicUrl")
+		e.Str(s.PublicUrl)
+	}
+	{
+		e.FieldStart("suspended")
+		e.Bool(s.Suspended)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -7930,21 +8027,22 @@ func (s *GrantProjectAccessInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGrantProjectAccessInputBody = [5]string{
+var jsonFieldsNameOfCreatedMirror = [7]string{
 	0: "$schema",
-	1: "granteeType",
-	2: "provider",
-	3: "providerUserId",
-	4: "role",
+	1: "created",
+	2: "empty",
+	3: "mirrorId",
+	4: "mirrorUrl",
+	5: "publicUrl",
+	6: "suspended",
 }
 
-// Decode decodes GrantProjectAccessInputBody from json.
-func (s *GrantProjectAccessInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes CreatedMirror from json.
+func (s *CreatedMirror) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantProjectAccessInputBody to nil")
+		return errors.New("invalid: unable to decode CreatedMirror to nil")
 	}
 	var requiredBitSet [1]uint8
-	s.setDefaults()
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -7959,49 +8057,77 @@ func (s *GrantProjectAccessInputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "granteeType":
+		case "created":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.GranteeType.Reset()
-				if err := s.GranteeType.Decode(d); err != nil {
+				v, err := d.Bool()
+				s.Created = bool(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeType\"")
+				return errors.Wrap(err, "decode field \"created\"")
 			}
-		case "provider":
+		case "empty":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				v, err := d.Str()
-				s.Provider = string(v)
+				v, err := d.Bool()
+				s.Empty = bool(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"empty\"")
 			}
-		case "providerUserId":
+		case "mirrorId":
 			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.ProviderUserId = string(v)
+				s.MirrorId = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerUserId\"")
+				return errors.Wrap(err, "decode field \"mirrorId\"")
 			}
-		case "role":
+		case "mirrorUrl":
 			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				if err := s.Role.Decode(d); err != nil {
+				v, err := d.Str()
+				s.MirrorUrl = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
+				return errors.Wrap(err, "decode field \"mirrorUrl\"")
+			}
+		case "publicUrl":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.PublicUrl = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"publicUrl\"")
+			}
+		case "suspended":
+			requiredBitSet[0] |= 1 << 6
+			if err := func() error {
+				v, err := d.Bool()
+				s.Suspended = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"suspended\"")
 			}
 		default:
 			var elem jx.Raw
@@ -8019,12 +8145,12 @@ func (s *GrantProjectAccessInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantProjectAccessInputBody")
+		return errors.Wrap(err, "decode CreatedMirror")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011100,
+		0b01111110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -8036,8 +8162,8 @@ func (s *GrantProjectAccessInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGrantProjectAccessInputBody) {
-					name = jsonFieldsNameOfGrantProjectAccessInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfCreatedMirror) {
+					name = jsonFieldsNameOfCreatedMirror[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -8058,27 +8184,27 @@ func (s *GrantProjectAccessInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GrantProjectAccessInputBody) MarshalJSON() ([]byte, error) {
+func (s *CreatedMirror) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantProjectAccessInputBody) UnmarshalJSON(data []byte) error {
+func (s *CreatedMirror) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GrantProjectAccessInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s CreatedMirrorAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GrantProjectAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s CreatedMirrorAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -8088,10 +8214,10 @@ func (s GrantProjectAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GrantProjectAccessInputBodyAdditional from json.
-func (s *GrantProjectAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes CreatedMirrorAdditional from json.
+func (s *CreatedMirrorAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantProjectAccessInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode CreatedMirrorAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -8109,169 +8235,138 @@ func (s *GrantProjectAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantProjectAccessInputBodyAdditional")
+		return errors.Wrap(err, "decode CreatedMirrorAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantProjectAccessInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s CreatedMirrorAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantProjectAccessInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *CreatedMirrorAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GrantProjectAccessInputBodyGranteeType as json.
-func (s GrantProjectAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
-	e.Str(string(s))
+// Encode implements json.Marshaler.
+func (s *DeletionBlocker) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes GrantProjectAccessInputBodyGranteeType from json.
-func (s *GrantProjectAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GrantProjectAccessInputBodyGranteeType to nil")
+// encodeFields encodes fields.
+func (s *DeletionBlocker) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("deletable")
+		e.Bool(s.Deletable)
 	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
 	}
-	// Try to use constant string.
-	switch GrantProjectAccessInputBodyGranteeType(v) {
-	case GrantProjectAccessInputBodyGranteeTypeAccount:
-		*s = GrantProjectAccessInputBodyGranteeTypeAccount
-	default:
-		*s = GrantProjectAccessInputBodyGranteeType(v)
+	{
+		e.FieldStart("kind")
+		s.Kind.Encode(e)
 	}
+	{
+		e.FieldStart("message")
+		e.Str(s.Message)
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GrantProjectAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantProjectAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
 }
 
-// Encode encodes GrantProjectAccessInputBodyRole as json.
-func (s GrantProjectAccessInputBodyRole) Encode(e *jx.Encoder) {
-	e.Str(string(s))
+var jsonFieldsNameOfDeletionBlocker = [5]string{
+	0: "deletable",
+	1: "id",
+	2: "kind",
+	3: "message",
+	4: "name",
 }
 
-// Decode decodes GrantProjectAccessInputBodyRole from json.
-func (s *GrantProjectAccessInputBodyRole) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionBlocker from json.
+func (s *DeletionBlocker) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantProjectAccessInputBodyRole to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch GrantProjectAccessInputBodyRole(v) {
-	case GrantProjectAccessInputBodyRoleReader:
-		*s = GrantProjectAccessInputBodyRoleReader
-	case GrantProjectAccessInputBodyRoleWriter:
-		*s = GrantProjectAccessInputBodyRoleWriter
-	case GrantProjectAccessInputBodyRoleAdmin:
-		*s = GrantProjectAccessInputBodyRoleAdmin
-	default:
-		*s = GrantProjectAccessInputBodyRole(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GrantProjectAccessInputBodyRole) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantProjectAccessInputBodyRole) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s *GrantProjectAccessOutputBody) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields encodes fields.
-func (s *GrantProjectAccessOutputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("status")
-		e.Str(s.Status)
-	}
-	for k, elem := range s.AdditionalProps {
-		e.FieldStart(k)
-
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
-}
-
-var jsonFieldsNameOfGrantProjectAccessOutputBody = [2]string{
-	0: "$schema",
-	1: "status",
-}
-
-// Decode decodes GrantProjectAccessOutputBody from json.
-func (s *GrantProjectAccessOutputBody) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GrantProjectAccessOutputBody to nil")
+		return errors.New("invalid: unable to decode DeletionBlocker to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "deletable":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Bool()
+				s.Deletable = bool(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"deletable\"")
 			}
-		case "status":
+		case "id":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.Status = string(v)
+				s.ID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "kind":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				if err := s.Kind.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"kind\"")
+			}
+		case "message":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Message = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"message\"")
+			}
+		case "name":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"name\"")
 			}
 		default:
 			var elem jx.Raw
@@ -8289,12 +8384,12 @@ func (s *GrantProjectAccessOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantProjectAccessOutputBody")
+		return errors.Wrap(err, "decode DeletionBlocker")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00011111,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -8306,8 +8401,8 @@ func (s *GrantProjectAccessOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGrantProjectAccessOutputBody) {
-					name = jsonFieldsNameOfGrantProjectAccessOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfDeletionBlocker) {
+					name = jsonFieldsNameOfDeletionBlocker[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -8328,27 +8423,27 @@ func (s *GrantProjectAccessOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GrantProjectAccessOutputBody) MarshalJSON() ([]byte, error) {
+func (s *DeletionBlocker) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantProjectAccessOutputBody) UnmarshalJSON(data []byte) error {
+func (s *DeletionBlocker) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GrantProjectAccessOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s DeletionBlockerAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GrantProjectAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s DeletionBlockerAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -8358,10 +8453,10 @@ func (s GrantProjectAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GrantProjectAccessOutputBodyAdditional from json.
-func (s *GrantProjectAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionBlockerAdditional from json.
+func (s *DeletionBlockerAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantProjectAccessOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode DeletionBlockerAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -8379,57 +8474,93 @@ func (s *GrantProjectAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantProjectAccessOutputBodyAdditional")
+		return errors.Wrap(err, "decode DeletionBlockerAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantProjectAccessOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s DeletionBlockerAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantProjectAccessOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *DeletionBlockerAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes DeletionBlockerKind as json.
+func (s DeletionBlockerKind) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes DeletionBlockerKind from json.
+func (s *DeletionBlockerKind) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode DeletionBlockerKind to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch DeletionBlockerKind(v) {
+	case DeletionBlockerKindOwnedOrg:
+		*s = DeletionBlockerKindOwnedOrg
+	default:
+		*s = DeletionBlockerKind(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s DeletionBlockerKind) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *DeletionBlockerKind) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GrantRepoAccessInputBody) Encode(e *jx.Encoder) {
+func (s *DeletionGrant) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GrantRepoAccessInputBody) encodeFields(e *jx.Encoder) {
+func (s *DeletionGrant) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.Jurisdiction.Set {
+			e.FieldStart("jurisdiction")
+			s.Jurisdiction.Encode(e)
 		}
 	}
 	{
-		if s.GranteeType.Set {
-			e.FieldStart("granteeType")
-			s.GranteeType.Encode(e)
-		}
+		e.FieldStart("resourceId")
+		e.Str(s.ResourceId)
 	}
 	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
+		e.FieldStart("resourceName")
+		e.Str(s.ResourceName)
 	}
 	{
-		e.FieldStart("providerUserId")
-		e.Str(s.ProviderUserId)
+		e.FieldStart("resourceType")
+		s.ResourceType.Encode(e)
 	}
 	{
 		e.FieldStart("role")
-		s.Role.Encode(e)
+		e.Str(s.Role)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -8440,73 +8571,74 @@ func (s *GrantRepoAccessInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGrantRepoAccessInputBody = [5]string{
-	0: "$schema",
-	1: "granteeType",
-	2: "provider",
-	3: "providerUserId",
+var jsonFieldsNameOfDeletionGrant = [5]string{
+	0: "jurisdiction",
+	1: "resourceId",
+	2: "resourceName",
+	3: "resourceType",
 	4: "role",
 }
 
-// Decode decodes GrantRepoAccessInputBody from json.
-func (s *GrantRepoAccessInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionGrant from json.
+func (s *DeletionGrant) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantRepoAccessInputBody to nil")
+		return errors.New("invalid: unable to decode DeletionGrant to nil")
 	}
 	var requiredBitSet [1]uint8
-	s.setDefaults()
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "jurisdiction":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.Jurisdiction.Reset()
+				if err := s.Jurisdiction.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
 			}
-		case "granteeType":
+		case "resourceId":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.GranteeType.Reset()
-				if err := s.GranteeType.Decode(d); err != nil {
+				v, err := d.Str()
+				s.ResourceId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeType\"")
+				return errors.Wrap(err, "decode field \"resourceId\"")
 			}
-		case "provider":
+		case "resourceName":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.Provider = string(v)
+				s.ResourceName = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"resourceName\"")
 			}
-		case "providerUserId":
+		case "resourceType":
 			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				v, err := d.Str()
-				s.ProviderUserId = string(v)
-				if err != nil {
+				if err := s.ResourceType.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerUserId\"")
+				return errors.Wrap(err, "decode field \"resourceType\"")
 			}
 		case "role":
 			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				if err := s.Role.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Role = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
@@ -8529,12 +8661,12 @@ func (s *GrantRepoAccessInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantRepoAccessInputBody")
+		return errors.Wrap(err, "decode DeletionGrant")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011100,
+		0b00011110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -8546,8 +8678,8 @@ func (s *GrantRepoAccessInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGrantRepoAccessInputBody) {
-					name = jsonFieldsNameOfGrantRepoAccessInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfDeletionGrant) {
+					name = jsonFieldsNameOfDeletionGrant[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -8568,27 +8700,27 @@ func (s *GrantRepoAccessInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GrantRepoAccessInputBody) MarshalJSON() ([]byte, error) {
+func (s *DeletionGrant) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantRepoAccessInputBody) UnmarshalJSON(data []byte) error {
+func (s *DeletionGrant) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GrantRepoAccessInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s DeletionGrantAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GrantRepoAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s DeletionGrantAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -8598,10 +8730,10 @@ func (s GrantRepoAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GrantRepoAccessInputBodyAdditional from json.
-func (s *GrantRepoAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionGrantAdditional from json.
+func (s *DeletionGrantAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantRepoAccessInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode DeletionGrantAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -8619,125 +8751,81 @@ func (s *GrantRepoAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantRepoAccessInputBodyAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GrantRepoAccessInputBodyAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantRepoAccessInputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes GrantRepoAccessInputBodyGranteeType as json.
-func (s GrantRepoAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes GrantRepoAccessInputBodyGranteeType from json.
-func (s *GrantRepoAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GrantRepoAccessInputBodyGranteeType to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch GrantRepoAccessInputBodyGranteeType(v) {
-	case GrantRepoAccessInputBodyGranteeTypeAccount:
-		*s = GrantRepoAccessInputBodyGranteeTypeAccount
-	default:
-		*s = GrantRepoAccessInputBodyGranteeType(v)
+		return errors.Wrap(err, "decode DeletionGrantAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantRepoAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
+func (s DeletionGrantAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantRepoAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
+func (s *DeletionGrantAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GrantRepoAccessInputBodyRole as json.
-func (s GrantRepoAccessInputBodyRole) Encode(e *jx.Encoder) {
+// Encode encodes DeletionGrantResourceType as json.
+func (s DeletionGrantResourceType) Encode(e *jx.Encoder) {
 	e.Str(string(s))
 }
 
-// Decode decodes GrantRepoAccessInputBodyRole from json.
-func (s *GrantRepoAccessInputBodyRole) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionGrantResourceType from json.
+func (s *DeletionGrantResourceType) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantRepoAccessInputBodyRole to nil")
+		return errors.New("invalid: unable to decode DeletionGrantResourceType to nil")
 	}
 	v, err := d.StrBytes()
 	if err != nil {
 		return err
 	}
 	// Try to use constant string.
-	switch GrantRepoAccessInputBodyRole(v) {
-	case GrantRepoAccessInputBodyRoleReader:
-		*s = GrantRepoAccessInputBodyRoleReader
-	case GrantRepoAccessInputBodyRoleWriter:
-		*s = GrantRepoAccessInputBodyRoleWriter
-	case GrantRepoAccessInputBodyRoleAdmin:
-		*s = GrantRepoAccessInputBodyRoleAdmin
-	case GrantRepoAccessInputBodyRoleCiManager:
-		*s = GrantRepoAccessInputBodyRoleCiManager
+	switch DeletionGrantResourceType(v) {
+	case DeletionGrantResourceTypeProject:
+		*s = DeletionGrantResourceTypeProject
+	case DeletionGrantResourceTypeRepo:
+		*s = DeletionGrantResourceTypeRepo
 	default:
-		*s = GrantRepoAccessInputBodyRole(v)
+		*s = DeletionGrantResourceType(v)
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantRepoAccessInputBodyRole) MarshalJSON() ([]byte, error) {
+func (s DeletionGrantResourceType) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantRepoAccessInputBodyRole) UnmarshalJSON(data []byte) error {
+func (s *DeletionGrantResourceType) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GrantRepoAccessOutputBody) Encode(e *jx.Encoder) {
+func (s *DeletionMembership) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GrantRepoAccessOutputBody) encodeFields(e *jx.Encoder) {
+func (s *DeletionMembership) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
+		e.FieldStart("name")
+		e.Str(s.Name)
 	}
 	{
-		e.FieldStart("status")
-		e.Str(s.Status)
+		e.FieldStart("orgId")
+		e.Str(s.OrgId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -8748,42 +8836,44 @@ func (s *GrantRepoAccessOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGrantRepoAccessOutputBody = [2]string{
-	0: "$schema",
-	1: "status",
+var jsonFieldsNameOfDeletionMembership = [2]string{
+	0: "name",
+	1: "orgId",
 }
 
-// Decode decodes GrantRepoAccessOutputBody from json.
-func (s *GrantRepoAccessOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionMembership from json.
+func (s *DeletionMembership) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantRepoAccessOutputBody to nil")
+		return errors.New("invalid: unable to decode DeletionMembership to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "name":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
-		case "status":
+		case "orgId":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.Status = string(v)
+				s.OrgId = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
+				return errors.Wrap(err, "decode field \"orgId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -8801,12 +8891,12 @@ func (s *GrantRepoAccessOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantRepoAccessOutputBody")
+		return errors.Wrap(err, "decode DeletionMembership")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00000011,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -8818,8 +8908,8 @@ func (s *GrantRepoAccessOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGrantRepoAccessOutputBody) {
-					name = jsonFieldsNameOfGrantRepoAccessOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfDeletionMembership) {
+					name = jsonFieldsNameOfDeletionMembership[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -8840,27 +8930,27 @@ func (s *GrantRepoAccessOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GrantRepoAccessOutputBody) MarshalJSON() ([]byte, error) {
+func (s *DeletionMembership) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantRepoAccessOutputBody) UnmarshalJSON(data []byte) error {
+func (s *DeletionMembership) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GrantRepoAccessOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s DeletionMembershipAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GrantRepoAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s DeletionMembershipAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -8870,10 +8960,10 @@ func (s GrantRepoAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes GrantRepoAccessOutputBodyAdditional from json.
-func (s *GrantRepoAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionMembershipAdditional from json.
+func (s *DeletionMembershipAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantRepoAccessOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode DeletionMembershipAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -8891,51 +8981,47 @@ func (s *GrantRepoAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantRepoAccessOutputBodyAdditional")
+		return errors.Wrap(err, "decode DeletionMembershipAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantRepoAccessOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s DeletionMembershipAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantRepoAccessOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *DeletionMembershipAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GrantServiceAccountAccessInputBody) Encode(e *jx.Encoder) {
+func (s *DeletionRepo) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GrantServiceAccountAccessInputBody) encodeFields(e *jx.Encoder) {
+func (s *DeletionRepo) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.Cluster.Set {
+			e.FieldStart("cluster")
+			s.Cluster.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("resourceId")
-		e.Str(s.ResourceId)
-	}
-	{
-		e.FieldStart("resourceType")
-		s.ResourceType.Encode(e)
+		e.FieldStart("id")
+		e.Str(s.ID)
 	}
 	{
-		e.FieldStart("role")
-		s.Role.Encode(e)
+		e.FieldStart("name")
+		e.Str(s.Name)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -8946,64 +9032,55 @@ func (s *GrantServiceAccountAccessInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGrantServiceAccountAccessInputBody = [4]string{
-	0: "$schema",
-	1: "resourceId",
-	2: "resourceType",
-	3: "role",
+var jsonFieldsNameOfDeletionRepo = [3]string{
+	0: "cluster",
+	1: "id",
+	2: "name",
 }
 
-// Decode decodes GrantServiceAccountAccessInputBody from json.
-func (s *GrantServiceAccountAccessInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionRepo from json.
+func (s *DeletionRepo) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBody to nil")
+		return errors.New("invalid: unable to decode DeletionRepo to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "cluster":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.Cluster.Reset()
+				if err := s.Cluster.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"cluster\"")
 			}
-		case "resourceId":
+		case "id":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.ResourceId = string(v)
+				s.ID = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceId\"")
+				return errors.Wrap(err, "decode field \"id\"")
 			}
-		case "resourceType":
+		case "name":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				if err := s.ResourceType.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceType\"")
-			}
-		case "role":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				if err := s.Role.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
 		default:
 			var elem jx.Raw
@@ -9021,12 +9098,12 @@ func (s *GrantServiceAccountAccessInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantServiceAccountAccessInputBody")
+		return errors.Wrap(err, "decode DeletionRepo")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001110,
+		0b00000110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -9038,8 +9115,8 @@ func (s *GrantServiceAccountAccessInputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfGrantServiceAccountAccessInputBody) {
-					name = jsonFieldsNameOfGrantServiceAccountAccessInputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfDeletionRepo) {
+					name = jsonFieldsNameOfDeletionRepo[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -9060,27 +9137,27 @@ func (s *GrantServiceAccountAccessInputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GrantServiceAccountAccessInputBody) MarshalJSON() ([]byte, error) {
+func (s *DeletionRepo) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantServiceAccountAccessInputBody) UnmarshalJSON(data []byte) error {
+func (s *DeletionRepo) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GrantServiceAccountAccessInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s DeletionRepoAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GrantServiceAccountAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s DeletionRepoAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -9090,10 +9167,10 @@ func (s GrantServiceAccountAccessInputBodyAdditional) encodeFields(e *jx.Encoder
 	}
 }
 
-// Decode decodes GrantServiceAccountAccessInputBodyAdditional from json.
-func (s *GrantServiceAccountAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes DeletionRepoAdditional from json.
+func (s *DeletionRepoAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode DeletionRepoAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -9111,125 +9188,51 @@ func (s *GrantServiceAccountAccessInputBodyAdditional) Decode(d *jx.Decoder) err
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantServiceAccountAccessInputBodyAdditional")
+		return errors.Wrap(err, "decode DeletionRepoAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantServiceAccountAccessInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s DeletionRepoAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantServiceAccountAccessInputBodyAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes GrantServiceAccountAccessInputBodyResourceType as json.
-func (s GrantServiceAccountAccessInputBodyResourceType) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes GrantServiceAccountAccessInputBodyResourceType from json.
-func (s *GrantServiceAccountAccessInputBodyResourceType) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBodyResourceType to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch GrantServiceAccountAccessInputBodyResourceType(v) {
-	case GrantServiceAccountAccessInputBodyResourceTypeRepo:
-		*s = GrantServiceAccountAccessInputBodyResourceTypeRepo
-	case GrantServiceAccountAccessInputBodyResourceTypeProject:
-		*s = GrantServiceAccountAccessInputBodyResourceTypeProject
-	default:
-		*s = GrantServiceAccountAccessInputBodyResourceType(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GrantServiceAccountAccessInputBodyResourceType) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantServiceAccountAccessInputBodyResourceType) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes GrantServiceAccountAccessInputBodyRole as json.
-func (s GrantServiceAccountAccessInputBodyRole) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes GrantServiceAccountAccessInputBodyRole from json.
-func (s *GrantServiceAccountAccessInputBodyRole) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBodyRole to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch GrantServiceAccountAccessInputBodyRole(v) {
-	case GrantServiceAccountAccessInputBodyRoleReader:
-		*s = GrantServiceAccountAccessInputBodyRoleReader
-	case GrantServiceAccountAccessInputBodyRoleWriter:
-		*s = GrantServiceAccountAccessInputBodyRoleWriter
-	case GrantServiceAccountAccessInputBodyRoleAdmin:
-		*s = GrantServiceAccountAccessInputBodyRoleAdmin
-	default:
-		*s = GrantServiceAccountAccessInputBodyRole(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s GrantServiceAccountAccessInputBodyRole) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantServiceAccountAccessInputBodyRole) UnmarshalJSON(data []byte) error {
+func (s *DeletionRepoAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *GrantServiceAccountAccessOutputBody) Encode(e *jx.Encoder) {
+func (s *ErrorDetail) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *GrantServiceAccountAccessOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ErrorDetail) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.Location.Set {
+			e.FieldStart("location")
+			s.Location.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("status")
-		e.Str(s.Status)
+		if s.Message.Set {
+			e.FieldStart("message")
+			s.Message.Encode(e)
+		}
+	}
+	{
+		if len(s.Value) != 0 {
+			e.FieldStart("value")
+			e.Raw(s.Value)
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -9240,42 +9243,51 @@ func (s *GrantServiceAccountAccessOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfGrantServiceAccountAccessOutputBody = [2]string{
-	0: "$schema",
-	1: "status",
+var jsonFieldsNameOfErrorDetail = [3]string{
+	0: "location",
+	1: "message",
+	2: "value",
 }
 
-// Decode decodes GrantServiceAccountAccessOutputBody from json.
-func (s *GrantServiceAccountAccessOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ErrorDetail from json.
+func (s *ErrorDetail) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantServiceAccountAccessOutputBody to nil")
+		return errors.New("invalid: unable to decode ErrorDetail to nil")
 	}
-	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "location":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.Location.Reset()
+				if err := s.Location.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"location\"")
 			}
-		case "status":
-			requiredBitSet[0] |= 1 << 1
+		case "message":
 			if err := func() error {
-				v, err := d.Str()
-				s.Status = string(v)
+				s.Message.Reset()
+				if err := s.Message.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"message\"")
+			}
+		case "value":
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				s.Value = jx.Raw(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
+				return errors.Wrap(err, "decode field \"value\"")
 			}
 		default:
 			var elem jx.Raw
@@ -9293,66 +9305,34 @@ func (s *GrantServiceAccountAccessOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantServiceAccountAccessOutputBody")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00000010,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfGrantServiceAccountAccessOutputBody) {
-					name = jsonFieldsNameOfGrantServiceAccountAccessOutputBody[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
-				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
-			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
+		return errors.Wrap(err, "decode ErrorDetail")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *GrantServiceAccountAccessOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ErrorDetail) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantServiceAccountAccessOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ErrorDetail) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s GrantServiceAccountAccessOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ErrorDetailAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s GrantServiceAccountAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ErrorDetailAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -9362,10 +9342,10 @@ func (s GrantServiceAccountAccessOutputBodyAdditional) encodeFields(e *jx.Encode
 	}
 }
 
-// Decode decodes GrantServiceAccountAccessOutputBodyAdditional from json.
-func (s *GrantServiceAccountAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ErrorDetailAdditional from json.
+func (s *ErrorDetailAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode GrantServiceAccountAccessOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ErrorDetailAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -9383,34 +9363,34 @@ func (s *GrantServiceAccountAccessOutputBodyAdditional) Decode(d *jx.Decoder) er
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode GrantServiceAccountAccessOutputBodyAdditional")
+		return errors.Wrap(err, "decode ErrorDetailAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s GrantServiceAccountAccessOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ErrorDetailAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *GrantServiceAccountAccessOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ErrorDetailAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListAuditEventsOutputBody) Encode(e *jx.Encoder) {
+func (s *ErrorModel) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListAuditEventsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ErrorModel) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -9418,17 +9398,43 @@ func (s *ListAuditEventsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("events")
-		e.ArrStart()
-		for _, elem := range s.Events {
-			elem.Encode(e)
+		if s.Detail.Set {
+			e.FieldStart("detail")
+			s.Detail.Encode(e)
 		}
-		e.ArrEnd()
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
+		if s.Errors != nil {
+			e.FieldStart("errors")
+			e.ArrStart()
+			for _, elem := range s.Errors {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
+		}
+	}
+	{
+		if s.Instance.Set {
+			e.FieldStart("instance")
+			s.Instance.Encode(e)
+		}
+	}
+	{
+		if s.Status.Set {
+			e.FieldStart("status")
+			s.Status.Encode(e)
+		}
+	}
+	{
+		if s.Title.Set {
+			e.FieldStart("title")
+			s.Title.Encode(e)
+		}
+	}
+	{
+		if s.Type.Set {
+			e.FieldStart("type")
+			s.Type.Encode(e)
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -9440,18 +9446,22 @@ func (s *ListAuditEventsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListAuditEventsOutputBody = [3]string{
+var jsonFieldsNameOfErrorModel = [7]string{
 	0: "$schema",
-	1: "events",
-	2: "nextPageToken",
+	1: "detail",
+	2: "errors",
+	3: "instance",
+	4: "status",
+	5: "title",
+	6: "type",
 }
 
-// Decode decodes ListAuditEventsOutputBody from json.
-func (s *ListAuditEventsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ErrorModel from json.
+func (s *ErrorModel) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListAuditEventsOutputBody to nil")
+		return errors.New("invalid: unable to decode ErrorModel to nil")
 	}
-	var requiredBitSet [1]uint8
+	s.setDefaults()
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -9466,33 +9476,72 @@ func (s *ListAuditEventsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "events":
-			requiredBitSet[0] |= 1 << 1
+		case "detail":
 			if err := func() error {
-				s.Events = make([]AuditEvent, 0)
+				s.Detail.Reset()
+				if err := s.Detail.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"detail\"")
+			}
+		case "errors":
+			if err := func() error {
+				s.Errors = make([]ErrorDetail, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem AuditEvent
+					var elem ErrorDetail
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Events = append(s.Events, elem)
+					s.Errors = append(s.Errors, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"events\"")
+				return errors.Wrap(err, "decode field \"errors\"")
 			}
-		case "nextPageToken":
+		case "instance":
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				s.Instance.Reset()
+				if err := s.Instance.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"instance\"")
+			}
+		case "status":
+			if err := func() error {
+				s.Status.Reset()
+				if err := s.Status.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"status\"")
+			}
+		case "title":
+			if err := func() error {
+				s.Title.Reset()
+				if err := s.Title.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"title\"")
+			}
+		case "type":
+			if err := func() error {
+				s.Type.Reset()
+				if err := s.Type.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"type\"")
 			}
 		default:
 			var elem jx.Raw
@@ -9510,66 +9559,34 @@ func (s *ListAuditEventsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListAuditEventsOutputBody")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00000010,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfListAuditEventsOutputBody) {
-					name = jsonFieldsNameOfListAuditEventsOutputBody[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
-				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
-			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
+		return errors.Wrap(err, "decode ErrorModel")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListAuditEventsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ErrorModel) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListAuditEventsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ErrorModel) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListAuditEventsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ErrorModelAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListAuditEventsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ErrorModelAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -9579,10 +9596,10 @@ func (s ListAuditEventsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListAuditEventsOutputBodyAdditional from json.
-func (s *ListAuditEventsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ErrorModelAdditional from json.
+func (s *ErrorModelAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListAuditEventsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ErrorModelAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -9600,47 +9617,41 @@ func (s *ListAuditEventsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListAuditEventsOutputBodyAdditional")
+		return errors.Wrap(err, "decode ErrorModelAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListAuditEventsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ErrorModelAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListAuditEventsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ErrorModelAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListAvailableMirrorsOutputBody) Encode(e *jx.Encoder) {
+func (s *ForgeRepoIdentity) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListAvailableMirrorsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ForgeRepoIdentity) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
+		e.FieldStart("forge")
+		e.Str(s.Forge)
 	}
 	{
-		e.FieldStart("available")
-		e.ArrStart()
-		for _, elem := range s.Available {
-			elem.Encode(e)
-		}
-		e.ArrEnd()
+		e.FieldStart("repo_id")
+		e.Str(s.RepoID)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -9651,48 +9662,44 @@ func (s *ListAvailableMirrorsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListAvailableMirrorsOutputBody = [2]string{
-	0: "$schema",
-	1: "available",
+var jsonFieldsNameOfForgeRepoIdentity = [2]string{
+	0: "forge",
+	1: "repo_id",
 }
 
-// Decode decodes ListAvailableMirrorsOutputBody from json.
-func (s *ListAvailableMirrorsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ForgeRepoIdentity from json.
+func (s *ForgeRepoIdentity) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListAvailableMirrorsOutputBody to nil")
+		return errors.New("invalid: unable to decode ForgeRepoIdentity to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "forge":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Forge = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"forge\"")
 			}
-		case "available":
+		case "repo_id":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Available = make([]AvailableMirror, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem AvailableMirror
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Available = append(s.Available, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.RepoID = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"available\"")
+				return errors.Wrap(err, "decode field \"repo_id\"")
 			}
 		default:
 			var elem jx.Raw
@@ -9710,12 +9717,12 @@ func (s *ListAvailableMirrorsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListAvailableMirrorsOutputBody")
+		return errors.Wrap(err, "decode ForgeRepoIdentity")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00000011,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -9727,8 +9734,8 @@ func (s *ListAvailableMirrorsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListAvailableMirrorsOutputBody) {
-					name = jsonFieldsNameOfListAvailableMirrorsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfForgeRepoIdentity) {
+					name = jsonFieldsNameOfForgeRepoIdentity[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -9749,27 +9756,27 @@ func (s *ListAvailableMirrorsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListAvailableMirrorsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ForgeRepoIdentity) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListAvailableMirrorsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ForgeRepoIdentity) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListAvailableMirrorsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ForgeRepoIdentityAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListAvailableMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ForgeRepoIdentityAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -9779,10 +9786,10 @@ func (s ListAvailableMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListAvailableMirrorsOutputBodyAdditional from json.
-func (s *ListAvailableMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ForgeRepoIdentityAdditional from json.
+func (s *ForgeRepoIdentityAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListAvailableMirrorsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ForgeRepoIdentityAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -9800,34 +9807,34 @@ func (s *ListAvailableMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListAvailableMirrorsOutputBodyAdditional")
+		return errors.Wrap(err, "decode ForgeRepoIdentityAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListAvailableMirrorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ForgeRepoIdentityAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListAvailableMirrorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ForgeRepoIdentityAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListBindingsOutputBody) Encode(e *jx.Encoder) {
+func (s *GetDeletionPreviewOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListBindingsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GetDeletionPreviewOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -9835,18 +9842,24 @@ func (s *ListBindingsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("bindings")
+		e.FieldStart("blocked")
+		e.Bool(s.Blocked)
+	}
+	{
+		e.FieldStart("blockers")
 		e.ArrStart()
-		for _, elem := range s.Bindings {
+		for _, elem := range s.Blockers {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
+		e.FieldStart("willDelete")
+		s.WillDelete.Encode(e)
+	}
+	{
+		e.FieldStart("willUnlink")
+		s.WillUnlink.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -9857,16 +9870,18 @@ func (s *ListBindingsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListBindingsOutputBody = [3]string{
+var jsonFieldsNameOfGetDeletionPreviewOutputBody = [5]string{
 	0: "$schema",
-	1: "bindings",
-	2: "nextPageToken",
+	1: "blocked",
+	2: "blockers",
+	3: "willDelete",
+	4: "willUnlink",
 }
 
-// Decode decodes ListBindingsOutputBody from json.
-func (s *ListBindingsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GetDeletionPreviewOutputBody from json.
+func (s *GetDeletionPreviewOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListBindingsOutputBody to nil")
+		return errors.New("invalid: unable to decode GetDeletionPreviewOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -9883,33 +9898,55 @@ func (s *ListBindingsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "bindings":
+		case "blocked":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Bindings = make([]Binding, 0)
+				v, err := d.Bool()
+				s.Blocked = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"blocked\"")
+			}
+		case "blockers":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				s.Blockers = make([]DeletionBlocker, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Binding
+					var elem DeletionBlocker
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Bindings = append(s.Bindings, elem)
+					s.Blockers = append(s.Blockers, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"bindings\"")
+				return errors.Wrap(err, "decode field \"blockers\"")
 			}
-		case "nextPageToken":
+		case "willDelete":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				if err := s.WillDelete.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"willDelete\"")
+			}
+		case "willUnlink":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				if err := s.WillUnlink.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"willUnlink\"")
 			}
 		default:
 			var elem jx.Raw
@@ -9927,12 +9964,12 @@ func (s *ListBindingsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListBindingsOutputBody")
+		return errors.Wrap(err, "decode GetDeletionPreviewOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00011110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -9944,8 +9981,8 @@ func (s *ListBindingsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListBindingsOutputBody) {
-					name = jsonFieldsNameOfListBindingsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGetDeletionPreviewOutputBody) {
+					name = jsonFieldsNameOfGetDeletionPreviewOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -9966,27 +10003,27 @@ func (s *ListBindingsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListBindingsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetDeletionPreviewOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListBindingsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetDeletionPreviewOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListBindingsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetDeletionPreviewOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListBindingsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetDeletionPreviewOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -9996,10 +10033,10 @@ func (s ListBindingsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListBindingsOutputBodyAdditional from json.
-func (s *ListBindingsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetDeletionPreviewOutputBodyAdditional from json.
+func (s *GetDeletionPreviewOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListBindingsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetDeletionPreviewOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -10017,34 +10054,34 @@ func (s *ListBindingsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListBindingsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetDeletionPreviewOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListBindingsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetDeletionPreviewOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListBindingsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetDeletionPreviewOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListClustersOutputBody) Encode(e *jx.Encoder) {
+func (s *GetMeOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListClustersOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GetMeOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -10052,12 +10089,42 @@ func (s *ListClustersOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("clusters")
-		e.ArrStart()
-		for _, elem := range s.Clusters {
-			elem.Encode(e)
+		e.FieldStart("auth")
+		s.Auth.Encode(e)
+	}
+	{
+		if s.Deletion.Set {
+			e.FieldStart("deletion")
+			s.Deletion.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("global")
+		s.Global.Encode(e)
+	}
+	{
+		if s.Jurisdiction.Set {
+			e.FieldStart("jurisdiction")
+			s.Jurisdiction.Encode(e)
+		}
+	}
+	{
+		if s.Mode.Set {
+			e.FieldStart("mode")
+			s.Mode.Encode(e)
+		}
+	}
+	{
+		if s.Regional.Set {
+			e.FieldStart("regional")
+			s.Regional.Encode(e)
+		}
+	}
+	{
+		if s.RegionalUnavailable.Set {
+			e.FieldStart("regionalUnavailable")
+			s.RegionalUnavailable.Encode(e)
 		}
-		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -10068,15 +10135,21 @@ func (s *ListClustersOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListClustersOutputBody = [2]string{
+var jsonFieldsNameOfGetMeOutputBody = [8]string{
 	0: "$schema",
-	1: "clusters",
+	1: "auth",
+	2: "deletion",
+	3: "global",
+	4: "jurisdiction",
+	5: "mode",
+	6: "regional",
+	7: "regionalUnavailable",
 }
 
-// Decode decodes ListClustersOutputBody from json.
-func (s *ListClustersOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GetMeOutputBody from json.
+func (s *GetMeOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListClustersOutputBody to nil")
+		return errors.New("invalid: unable to decode GetMeOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -10093,23 +10166,75 @@ func (s *ListClustersOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "clusters":
+		case "auth":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Clusters = make([]Cluster, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Cluster
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Clusters = append(s.Clusters, elem)
-					return nil
-				}); err != nil {
+				if err := s.Auth.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusters\"")
+				return errors.Wrap(err, "decode field \"auth\"")
+			}
+		case "deletion":
+			if err := func() error {
+				s.Deletion.Reset()
+				if err := s.Deletion.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"deletion\"")
+			}
+		case "global":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				if err := s.Global.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"global\"")
+			}
+		case "jurisdiction":
+			if err := func() error {
+				s.Jurisdiction.Reset()
+				if err := s.Jurisdiction.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "mode":
+			if err := func() error {
+				s.Mode.Reset()
+				if err := s.Mode.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mode\"")
+			}
+		case "regional":
+			if err := func() error {
+				s.Regional.Reset()
+				if err := s.Regional.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"regional\"")
+			}
+		case "regionalUnavailable":
+			if err := func() error {
+				s.RegionalUnavailable.Reset()
+				if err := s.RegionalUnavailable.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"regionalUnavailable\"")
 			}
 		default:
 			var elem jx.Raw
@@ -10127,12 +10252,12 @@ func (s *ListClustersOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListClustersOutputBody")
+		return errors.Wrap(err, "decode GetMeOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00001010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -10144,8 +10269,8 @@ func (s *ListClustersOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListClustersOutputBody) {
-					name = jsonFieldsNameOfListClustersOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGetMeOutputBody) {
+					name = jsonFieldsNameOfGetMeOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -10166,27 +10291,27 @@ func (s *ListClustersOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListClustersOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetMeOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListClustersOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetMeOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListClustersOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetMeOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListClustersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetMeOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -10196,10 +10321,10 @@ func (s ListClustersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListClustersOutputBodyAdditional from json.
-func (s *ListClustersOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetMeOutputBodyAdditional from json.
+func (s *GetMeOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListClustersOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetMeOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -10217,34 +10342,74 @@ func (s *ListClustersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListClustersOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetMeOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListClustersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetMeOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListClustersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetMeOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetMeOutputBodyMode as json.
+func (s GetMeOutputBodyMode) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GetMeOutputBodyMode from json.
+func (s *GetMeOutputBodyMode) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GetMeOutputBodyMode to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GetMeOutputBodyMode(v) {
+	case GetMeOutputBodyModeGlobal:
+		*s = GetMeOutputBodyModeGlobal
+	case GetMeOutputBodyModeRegional:
+		*s = GetMeOutputBodyModeRegional
+	default:
+		*s = GetMeOutputBodyMode(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GetMeOutputBodyMode) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GetMeOutputBodyMode) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListMirrorCollaboratorsOutputBody) Encode(e *jx.Encoder) {
+func (s *GetOnboardingStatusOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListMirrorCollaboratorsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GetOnboardingStatusOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -10252,12 +10417,12 @@ func (s *ListMirrorCollaboratorsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("collaborators")
-		e.ArrStart()
-		for _, elem := range s.Collaborators {
-			elem.Encode(e)
-		}
-		e.ArrEnd()
+		e.FieldStart("cliLoggedIn")
+		e.Bool(s.CliLoggedIn)
+	}
+	{
+		e.FieldStart("needsOnboarding")
+		e.Bool(s.NeedsOnboarding)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -10268,15 +10433,16 @@ func (s *ListMirrorCollaboratorsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListMirrorCollaboratorsOutputBody = [2]string{
+var jsonFieldsNameOfGetOnboardingStatusOutputBody = [3]string{
 	0: "$schema",
-	1: "collaborators",
+	1: "cliLoggedIn",
+	2: "needsOnboarding",
 }
 
-// Decode decodes ListMirrorCollaboratorsOutputBody from json.
-func (s *ListMirrorCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GetOnboardingStatusOutputBody from json.
+func (s *GetOnboardingStatusOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListMirrorCollaboratorsOutputBody to nil")
+		return errors.New("invalid: unable to decode GetOnboardingStatusOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -10293,23 +10459,29 @@ func (s *ListMirrorCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "collaborators":
+		case "cliLoggedIn":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Collaborators = make([]MirrorCollaborator, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem MirrorCollaborator
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Collaborators = append(s.Collaborators, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Bool()
+				s.CliLoggedIn = bool(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"collaborators\"")
+				return errors.Wrap(err, "decode field \"cliLoggedIn\"")
+			}
+		case "needsOnboarding":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Bool()
+				s.NeedsOnboarding = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"needsOnboarding\"")
 			}
 		default:
 			var elem jx.Raw
@@ -10327,12 +10499,12 @@ func (s *ListMirrorCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListMirrorCollaboratorsOutputBody")
+		return errors.Wrap(err, "decode GetOnboardingStatusOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00000110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -10344,8 +10516,8 @@ func (s *ListMirrorCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListMirrorCollaboratorsOutputBody) {
-					name = jsonFieldsNameOfListMirrorCollaboratorsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGetOnboardingStatusOutputBody) {
+					name = jsonFieldsNameOfGetOnboardingStatusOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -10366,27 +10538,27 @@ func (s *ListMirrorCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListMirrorCollaboratorsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetOnboardingStatusOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListMirrorCollaboratorsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetOnboardingStatusOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListMirrorCollaboratorsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetOnboardingStatusOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListMirrorCollaboratorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetOnboardingStatusOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -10396,10 +10568,10 @@ func (s ListMirrorCollaboratorsOutputBodyAdditional) encodeFields(e *jx.Encoder)
 	}
 }
 
-// Decode decodes ListMirrorCollaboratorsOutputBodyAdditional from json.
-func (s *ListMirrorCollaboratorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetOnboardingStatusOutputBodyAdditional from json.
+func (s *GetOnboardingStatusOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListMirrorCollaboratorsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetOnboardingStatusOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -10417,34 +10589,34 @@ func (s *ListMirrorCollaboratorsOutputBodyAdditional) Decode(d *jx.Decoder) erro
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListMirrorCollaboratorsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetOnboardingStatusOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListMirrorCollaboratorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetOnboardingStatusOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListMirrorCollaboratorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetOnboardingStatusOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListMirrorsOutputBody) Encode(e *jx.Encoder) {
+func (s *GetPermissionsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListMirrorsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GetPermissionsOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -10452,19 +10624,29 @@ func (s *ListMirrorsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("mirrors")
-		e.ArrStart()
-		for _, elem := range s.Mirrors {
-			elem.Encode(e)
+		if s.Explain.Set {
+			e.FieldStart("explain")
+			s.Explain.Encode(e)
 		}
-		e.ArrEnd()
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
+		if s.Permissions != nil {
+			e.FieldStart("permissions")
+			e.ArrStart()
+			for _, elem := range s.Permissions {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
 		}
 	}
+	{
+		e.FieldStart("resourceId")
+		e.Str(s.ResourceId)
+	}
+	{
+		e.FieldStart("resourceType")
+		e.Str(s.ResourceType)
+	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -10474,16 +10656,18 @@ func (s *ListMirrorsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListMirrorsOutputBody = [3]string{
+var jsonFieldsNameOfGetPermissionsOutputBody = [5]string{
 	0: "$schema",
-	1: "mirrors",
-	2: "nextPageToken",
+	1: "explain",
+	2: "permissions",
+	3: "resourceId",
+	4: "resourceType",
 }
 
-// Decode decodes ListMirrorsOutputBody from json.
-func (s *ListMirrorsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GetPermissionsOutputBody from json.
+func (s *GetPermissionsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListMirrorsOutputBody to nil")
+		return errors.New("invalid: unable to decode GetPermissionsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -10500,33 +10684,56 @@ func (s *ListMirrorsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "mirrors":
-			requiredBitSet[0] |= 1 << 1
+		case "explain":
 			if err := func() error {
-				s.Mirrors = make([]Mirror, 0)
+				s.Explain.Reset()
+				if err := s.Explain.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"explain\"")
+			}
+		case "permissions":
+			if err := func() error {
+				s.Permissions = make([]GetPermissionsOutputBodyPermissionsItem, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Mirror
+					var elem GetPermissionsOutputBodyPermissionsItem
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Mirrors = append(s.Mirrors, elem)
+					s.Permissions = append(s.Permissions, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrors\"")
+				return errors.Wrap(err, "decode field \"permissions\"")
 			}
-		case "nextPageToken":
+		case "resourceId":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				v, err := d.Str()
+				s.ResourceId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"resourceId\"")
+			}
+		case "resourceType":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.ResourceType = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"resourceType\"")
 			}
 		default:
 			var elem jx.Raw
@@ -10544,12 +10751,12 @@ func (s *ListMirrorsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListMirrorsOutputBody")
+		return errors.Wrap(err, "decode GetPermissionsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00011000,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -10561,8 +10768,8 @@ func (s *ListMirrorsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListMirrorsOutputBody) {
-					name = jsonFieldsNameOfListMirrorsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGetPermissionsOutputBody) {
+					name = jsonFieldsNameOfGetPermissionsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -10583,27 +10790,27 @@ func (s *ListMirrorsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListMirrorsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetPermissionsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListMirrorsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetPermissionsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListMirrorsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetPermissionsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetPermissionsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -10613,10 +10820,10 @@ func (s ListMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListMirrorsOutputBodyAdditional from json.
-func (s *ListMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetPermissionsOutputBodyAdditional from json.
+func (s *GetPermissionsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListMirrorsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetPermissionsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -10634,55 +10841,35 @@ func (s *ListMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListMirrorsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetPermissionsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListMirrorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetPermissionsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListMirrorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetPermissionsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListOIDCProvidersOutputBody) Encode(e *jx.Encoder) {
+func (s GetPermissionsOutputBodyExplain) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
-// encodeFields encodes fields.
-func (s *ListOIDCProvidersOutputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("providers")
-		e.ArrStart()
-		for _, elem := range s.Providers {
-			elem.Encode(e)
-		}
-		e.ArrEnd()
-	}
-	for k, elem := range s.AdditionalProps {
+// encodeFields implements json.Marshaler.
+func (s GetPermissionsOutputBodyExplain) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
 		e.FieldStart(k)
 
 		if len(elem) != 0 {
@@ -10691,59 +10878,162 @@ func (s *ListOIDCProvidersOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListOIDCProvidersOutputBody = [3]string{
-	0: "$schema",
-	1: "nextPageToken",
-	2: "providers",
+// Decode decodes GetPermissionsOutputBodyExplain from json.
+func (s *GetPermissionsOutputBodyExplain) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GetPermissionsOutputBodyExplain to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode GetPermissionsOutputBodyExplain")
+	}
+
+	return nil
 }
 
-// Decode decodes ListOIDCProvidersOutputBody from json.
-func (s *ListOIDCProvidersOutputBody) Decode(d *jx.Decoder) error {
+// MarshalJSON implements stdjson.Marshaler.
+func (s GetPermissionsOutputBodyExplain) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GetPermissionsOutputBodyExplain) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetPermissionsOutputBodyPermissionsItem as json.
+func (s GetPermissionsOutputBodyPermissionsItem) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GetPermissionsOutputBodyPermissionsItem from json.
+func (s *GetPermissionsOutputBodyPermissionsItem) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOIDCProvidersOutputBody to nil")
+		return errors.New("invalid: unable to decode GetPermissionsOutputBodyPermissionsItem to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GetPermissionsOutputBodyPermissionsItem(v) {
+	case GetPermissionsOutputBodyPermissionsItemManage:
+		*s = GetPermissionsOutputBodyPermissionsItemManage
+	case GetPermissionsOutputBodyPermissionsItemView:
+		*s = GetPermissionsOutputBodyPermissionsItemView
+	case GetPermissionsOutputBodyPermissionsItemRead:
+		*s = GetPermissionsOutputBodyPermissionsItemRead
+	case GetPermissionsOutputBodyPermissionsItemWrite:
+		*s = GetPermissionsOutputBodyPermissionsItemWrite
+	case GetPermissionsOutputBodyPermissionsItemPush:
+		*s = GetPermissionsOutputBodyPermissionsItemPush
+	case GetPermissionsOutputBodyPermissionsItemPull:
+		*s = GetPermissionsOutputBodyPermissionsItemPull
+	case GetPermissionsOutputBodyPermissionsItemCreateRepo:
+		*s = GetPermissionsOutputBodyPermissionsItemCreateRepo
+	case GetPermissionsOutputBodyPermissionsItemAdmin:
+		*s = GetPermissionsOutputBodyPermissionsItemAdmin
+	case GetPermissionsOutputBodyPermissionsItemAdminRead:
+		*s = GetPermissionsOutputBodyPermissionsItemAdminRead
+	default:
+		*s = GetPermissionsOutputBodyPermissionsItem(v)
 	}
-	var requiredBitSet [1]uint8
-	s.AdditionalProps = map[string]jx.Raw{}
 
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		switch string(k) {
-		case "$schema":
-			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
-			}
-		case "nextPageToken":
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GetPermissionsOutputBodyPermissionsItem) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GetPermissionsOutputBodyPermissionsItem) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *GetRepoVisibilityOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *GetRepoVisibilityOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("visibility")
+		s.Visibility.Encode(e)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfGetRepoVisibilityOutputBody = [2]string{
+	0: "$schema",
+	1: "visibility",
+}
+
+// Decode decodes GetRepoVisibilityOutputBody from json.
+func (s *GetRepoVisibilityOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GetRepoVisibilityOutputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "providers":
-			requiredBitSet[0] |= 1 << 2
+		case "visibility":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Providers = make([]OIDCProvider, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem OIDCProvider
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Providers = append(s.Providers, elem)
-					return nil
-				}); err != nil {
+				if err := s.Visibility.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providers\"")
+				return errors.Wrap(err, "decode field \"visibility\"")
 			}
 		default:
 			var elem jx.Raw
@@ -10761,12 +11051,12 @@ func (s *ListOIDCProvidersOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOIDCProvidersOutputBody")
+		return errors.Wrap(err, "decode GetRepoVisibilityOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000100,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -10778,8 +11068,8 @@ func (s *ListOIDCProvidersOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListOIDCProvidersOutputBody) {
-					name = jsonFieldsNameOfListOIDCProvidersOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGetRepoVisibilityOutputBody) {
+					name = jsonFieldsNameOfGetRepoVisibilityOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -10800,27 +11090,27 @@ func (s *ListOIDCProvidersOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListOIDCProvidersOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetRepoVisibilityOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOIDCProvidersOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetRepoVisibilityOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListOIDCProvidersOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetRepoVisibilityOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListOIDCProvidersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetRepoVisibilityOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -10830,10 +11120,10 @@ func (s ListOIDCProvidersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListOIDCProvidersOutputBodyAdditional from json.
-func (s *ListOIDCProvidersOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetRepoVisibilityOutputBodyAdditional from json.
+func (s *GetRepoVisibilityOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOIDCProvidersOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetRepoVisibilityOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -10851,34 +11141,74 @@ func (s *ListOIDCProvidersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOIDCProvidersOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetRepoVisibilityOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListOIDCProvidersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetRepoVisibilityOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOIDCProvidersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetRepoVisibilityOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetRepoVisibilityOutputBodyVisibility as json.
+func (s GetRepoVisibilityOutputBodyVisibility) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GetRepoVisibilityOutputBodyVisibility from json.
+func (s *GetRepoVisibilityOutputBodyVisibility) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GetRepoVisibilityOutputBodyVisibility to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GetRepoVisibilityOutputBodyVisibility(v) {
+	case GetRepoVisibilityOutputBodyVisibilityPublic:
+		*s = GetRepoVisibilityOutputBodyVisibilityPublic
+	case GetRepoVisibilityOutputBodyVisibilityPrivate:
+		*s = GetRepoVisibilityOutputBodyVisibilityPrivate
+	default:
+		*s = GetRepoVisibilityOutputBodyVisibility(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GetRepoVisibilityOutputBodyVisibility) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GetRepoVisibilityOutputBodyVisibility) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListOrgMembersOutputBody) Encode(e *jx.Encoder) {
+func (s *GetTopologyOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListOrgMembersOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GetTopologyOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -10886,19 +11216,13 @@ func (s *ListOrgMembersOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("members")
+		e.FieldStart("jurisdictions")
 		e.ArrStart()
-		for _, elem := range s.Members {
+		for _, elem := range s.Jurisdictions {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
 	}
-	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -10908,16 +11232,15 @@ func (s *ListOrgMembersOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListOrgMembersOutputBody = [3]string{
+var jsonFieldsNameOfGetTopologyOutputBody = [2]string{
 	0: "$schema",
-	1: "members",
-	2: "nextPageToken",
+	1: "jurisdictions",
 }
 
-// Decode decodes ListOrgMembersOutputBody from json.
-func (s *ListOrgMembersOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GetTopologyOutputBody from json.
+func (s *GetTopologyOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOrgMembersOutputBody to nil")
+		return errors.New("invalid: unable to decode GetTopologyOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -10934,33 +11257,23 @@ func (s *ListOrgMembersOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "members":
+		case "jurisdictions":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Members = make([]Membership, 0)
+				s.Jurisdictions = make([]TopologyJurisdiction, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Membership
+					var elem TopologyJurisdiction
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Members = append(s.Members, elem)
+					s.Jurisdictions = append(s.Jurisdictions, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"members\"")
-			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"jurisdictions\"")
 			}
 		default:
 			var elem jx.Raw
@@ -10978,7 +11291,7 @@ func (s *ListOrgMembersOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOrgMembersOutputBody")
+		return errors.Wrap(err, "decode GetTopologyOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -10995,8 +11308,8 @@ func (s *ListOrgMembersOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListOrgMembersOutputBody) {
-					name = jsonFieldsNameOfListOrgMembersOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGetTopologyOutputBody) {
+					name = jsonFieldsNameOfGetTopologyOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -11017,27 +11330,27 @@ func (s *ListOrgMembersOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListOrgMembersOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetTopologyOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOrgMembersOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetTopologyOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListOrgMembersOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetTopologyOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListOrgMembersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetTopologyOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -11047,10 +11360,10 @@ func (s ListOrgMembersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListOrgMembersOutputBodyAdditional from json.
-func (s *ListOrgMembersOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetTopologyOutputBodyAdditional from json.
+func (s *GetTopologyOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOrgMembersOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetTopologyOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11068,34 +11381,34 @@ func (s *ListOrgMembersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOrgMembersOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetTopologyOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListOrgMembersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetTopologyOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOrgMembersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetTopologyOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListOrgProjectsOutputBody) Encode(e *jx.Encoder) {
+func (s *GetVersionOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListOrgProjectsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GetVersionOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -11103,26 +11416,14 @@ func (s *ListOrgProjectsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
-	{
-		if s.Project.Set {
-			e.FieldStart("project")
-			s.Project.Encode(e)
+		if s.Mode.Set {
+			e.FieldStart("mode")
+			s.Mode.Encode(e)
 		}
 	}
 	{
-		if s.Projects != nil {
-			e.FieldStart("projects")
-			e.ArrStart()
-			for _, elem := range s.Projects {
-				elem.Encode(e)
-			}
-			e.ArrEnd()
-		}
+		e.FieldStart("version")
+		e.Str(s.Version)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -11133,18 +11434,18 @@ func (s *ListOrgProjectsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListOrgProjectsOutputBody = [4]string{
+var jsonFieldsNameOfGetVersionOutputBody = [3]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "project",
-	3: "projects",
+	1: "mode",
+	2: "version",
 }
 
-// Decode decodes ListOrgProjectsOutputBody from json.
-func (s *ListOrgProjectsOutputBody) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode ListOrgProjectsOutputBody to nil")
+// Decode decodes GetVersionOutputBody from json.
+func (s *GetVersionOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GetVersionOutputBody to nil")
 	}
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11159,42 +11460,27 @@ func (s *ListOrgProjectsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
-			}
-		case "project":
+		case "mode":
 			if err := func() error {
-				s.Project.Reset()
-				if err := s.Project.Decode(d); err != nil {
+				s.Mode.Reset()
+				if err := s.Mode.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"project\"")
+				return errors.Wrap(err, "decode field \"mode\"")
 			}
-		case "projects":
+		case "version":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Projects = make([]Project, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Project
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Projects = append(s.Projects, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.Version = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"projects\"")
+				return errors.Wrap(err, "decode field \"version\"")
 			}
 		default:
 			var elem jx.Raw
@@ -11212,34 +11498,66 @@ func (s *ListOrgProjectsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOrgProjectsOutputBody")
+		return errors.Wrap(err, "decode GetVersionOutputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfGetVersionOutputBody) {
+					name = jsonFieldsNameOfGetVersionOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListOrgProjectsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GetVersionOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOrgProjectsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GetVersionOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListOrgProjectsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GetVersionOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListOrgProjectsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GetVersionOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -11249,10 +11567,10 @@ func (s ListOrgProjectsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListOrgProjectsOutputBodyAdditional from json.
-func (s *ListOrgProjectsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GetVersionOutputBodyAdditional from json.
+func (s *GetVersionOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOrgProjectsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GetVersionOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11270,34 +11588,74 @@ func (s *ListOrgProjectsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOrgProjectsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GetVersionOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListOrgProjectsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GetVersionOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOrgProjectsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GetVersionOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetVersionOutputBodyMode as json.
+func (s GetVersionOutputBodyMode) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GetVersionOutputBodyMode from json.
+func (s *GetVersionOutputBodyMode) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GetVersionOutputBodyMode to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GetVersionOutputBodyMode(v) {
+	case GetVersionOutputBodyModeGlobal:
+		*s = GetVersionOutputBodyModeGlobal
+	case GetVersionOutputBodyModeRegional:
+		*s = GetVersionOutputBodyModeRegional
+	default:
+		*s = GetVersionOutputBodyMode(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GetVersionOutputBodyMode) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GetVersionOutputBodyMode) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListOrgsOutputBody) Encode(e *jx.Encoder) {
+func (s *GrantProjectAccessInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListOrgsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GrantProjectAccessInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -11305,26 +11663,22 @@ func (s *ListOrgsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
+		if s.GranteeType.Set {
+			e.FieldStart("granteeType")
+			s.GranteeType.Encode(e)
 		}
 	}
 	{
-		if s.Org.Set {
-			e.FieldStart("org")
-			s.Org.Encode(e)
-		}
+		e.FieldStart("provider")
+		e.Str(s.Provider)
 	}
 	{
-		if s.Orgs != nil {
-			e.FieldStart("orgs")
-			e.ArrStart()
-			for _, elem := range s.Orgs {
-				elem.Encode(e)
-			}
-			e.ArrEnd()
-		}
+		e.FieldStart("providerUserId")
+		e.Str(s.ProviderUserId)
+	}
+	{
+		e.FieldStart("role")
+		s.Role.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -11335,18 +11689,21 @@ func (s *ListOrgsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListOrgsOutputBody = [4]string{
+var jsonFieldsNameOfGrantProjectAccessInputBody = [5]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "org",
-	3: "orgs",
+	1: "granteeType",
+	2: "provider",
+	3: "providerUserId",
+	4: "role",
 }
 
-// Decode decodes ListOrgsOutputBody from json.
-func (s *ListOrgsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GrantProjectAccessInputBody from json.
+func (s *GrantProjectAccessInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOrgsOutputBody to nil")
+		return errors.New("invalid: unable to decode GrantProjectAccessInputBody to nil")
 	}
+	var requiredBitSet [1]uint8
+	s.setDefaults()
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11361,42 +11718,49 @@ func (s *ListOrgsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
+		case "granteeType":
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				s.GranteeType.Reset()
+				if err := s.GranteeType.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"granteeType\"")
 			}
-		case "org":
+		case "provider":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Org.Reset()
-				if err := s.Org.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"org\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
-		case "orgs":
+		case "providerUserId":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.Orgs = make([]Org, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Org
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Orgs = append(s.Orgs, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.ProviderUserId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"orgs\"")
+				return errors.Wrap(err, "decode field \"providerUserId\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				if err := s.Role.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
 			}
 		default:
 			var elem jx.Raw
@@ -11414,35 +11778,67 @@ func (s *ListOrgsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOrgsOutputBody")
+		return errors.Wrap(err, "decode GrantProjectAccessInputBody")
 	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s *ListOrgsOutputBody) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOrgsOutputBody) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode implements json.Marshaler.
-func (s ListOrgsOutputBodyAdditional) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
-}
-
-// encodeFields implements json.Marshaler.
-func (s ListOrgsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
-	for k, elem := range s {
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00011100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfGrantProjectAccessInputBody) {
+					name = jsonFieldsNameOfGrantProjectAccessInputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *GrantProjectAccessInputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantProjectAccessInputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s GrantProjectAccessInputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s GrantProjectAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
 		e.FieldStart(k)
 
 		if len(elem) != 0 {
@@ -11451,10 +11847,10 @@ func (s ListOrgsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListOrgsOutputBodyAdditional from json.
-func (s *ListOrgsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GrantProjectAccessInputBodyAdditional from json.
+func (s *GrantProjectAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListOrgsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GrantProjectAccessInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11472,34 +11868,114 @@ func (s *ListOrgsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListOrgsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GrantProjectAccessInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListOrgsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GrantProjectAccessInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListOrgsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GrantProjectAccessInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantProjectAccessInputBodyGranteeType as json.
+func (s GrantProjectAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GrantProjectAccessInputBodyGranteeType from json.
+func (s *GrantProjectAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GrantProjectAccessInputBodyGranteeType to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GrantProjectAccessInputBodyGranteeType(v) {
+	case GrantProjectAccessInputBodyGranteeTypeAccount:
+		*s = GrantProjectAccessInputBodyGranteeTypeAccount
+	default:
+		*s = GrantProjectAccessInputBodyGranteeType(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GrantProjectAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantProjectAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantProjectAccessInputBodyRole as json.
+func (s GrantProjectAccessInputBodyRole) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GrantProjectAccessInputBodyRole from json.
+func (s *GrantProjectAccessInputBodyRole) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GrantProjectAccessInputBodyRole to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GrantProjectAccessInputBodyRole(v) {
+	case GrantProjectAccessInputBodyRoleReader:
+		*s = GrantProjectAccessInputBodyRoleReader
+	case GrantProjectAccessInputBodyRoleWriter:
+		*s = GrantProjectAccessInputBodyRoleWriter
+	case GrantProjectAccessInputBodyRoleAdmin:
+		*s = GrantProjectAccessInputBodyRoleAdmin
+	default:
+		*s = GrantProjectAccessInputBodyRole(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GrantProjectAccessInputBodyRole) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantProjectAccessInputBodyRole) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListProjectMembersOutputBody) Encode(e *jx.Encoder) {
+func (s *GrantProjectAccessOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListProjectMembersOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GrantProjectAccessOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -11507,18 +11983,8 @@ func (s *ListProjectMembersOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("members")
-		e.ArrStart()
-		for _, elem := range s.Members {
-			elem.Encode(e)
-		}
-		e.ArrEnd()
-	}
-	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
+		e.FieldStart("status")
+		e.Str(s.Status)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -11529,16 +11995,15 @@ func (s *ListProjectMembersOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListProjectMembersOutputBody = [3]string{
+var jsonFieldsNameOfGrantProjectAccessOutputBody = [2]string{
 	0: "$schema",
-	1: "members",
-	2: "nextPageToken",
+	1: "status",
 }
 
-// Decode decodes ListProjectMembersOutputBody from json.
-func (s *ListProjectMembersOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GrantProjectAccessOutputBody from json.
+func (s *GrantProjectAccessOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListProjectMembersOutputBody to nil")
+		return errors.New("invalid: unable to decode GrantProjectAccessOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -11555,33 +12020,17 @@ func (s *ListProjectMembersOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "members":
+		case "status":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Members = make([]ProjectGrant, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem ProjectGrant
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Members = append(s.Members, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"members\"")
-			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Status = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"status\"")
 			}
 		default:
 			var elem jx.Raw
@@ -11599,7 +12048,7 @@ func (s *ListProjectMembersOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListProjectMembersOutputBody")
+		return errors.Wrap(err, "decode GrantProjectAccessOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -11616,8 +12065,8 @@ func (s *ListProjectMembersOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListProjectMembersOutputBody) {
-					name = jsonFieldsNameOfListProjectMembersOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGrantProjectAccessOutputBody) {
+					name = jsonFieldsNameOfGrantProjectAccessOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -11638,27 +12087,27 @@ func (s *ListProjectMembersOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListProjectMembersOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GrantProjectAccessOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListProjectMembersOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GrantProjectAccessOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListProjectMembersOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GrantProjectAccessOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListProjectMembersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GrantProjectAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -11668,10 +12117,10 @@ func (s ListProjectMembersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListProjectMembersOutputBodyAdditional from json.
-func (s *ListProjectMembersOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GrantProjectAccessOutputBodyAdditional from json.
+func (s *GrantProjectAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListProjectMembersOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GrantProjectAccessOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11689,34 +12138,34 @@ func (s *ListProjectMembersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListProjectMembersOutputBodyAdditional")
+		return errors.Wrap(err, "decode GrantProjectAccessOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListProjectMembersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GrantProjectAccessOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListProjectMembersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GrantProjectAccessOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListProjectReposOutputBody) Encode(e *jx.Encoder) {
+func (s *GrantRepoAccessInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListProjectReposOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GrantRepoAccessInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -11724,26 +12173,22 @@ func (s *ListProjectReposOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
+		if s.GranteeType.Set {
+			e.FieldStart("granteeType")
+			s.GranteeType.Encode(e)
 		}
 	}
 	{
-		if s.Repo.Set {
-			e.FieldStart("repo")
-			s.Repo.Encode(e)
-		}
+		e.FieldStart("provider")
+		e.Str(s.Provider)
 	}
 	{
-		if s.Repos != nil {
-			e.FieldStart("repos")
-			e.ArrStart()
-			for _, elem := range s.Repos {
-				elem.Encode(e)
-			}
-			e.ArrEnd()
-		}
+		e.FieldStart("providerUserId")
+		e.Str(s.ProviderUserId)
+	}
+	{
+		e.FieldStart("role")
+		s.Role.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -11754,18 +12199,21 @@ func (s *ListProjectReposOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListProjectReposOutputBody = [4]string{
+var jsonFieldsNameOfGrantRepoAccessInputBody = [5]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "repo",
-	3: "repos",
+	1: "granteeType",
+	2: "provider",
+	3: "providerUserId",
+	4: "role",
 }
 
-// Decode decodes ListProjectReposOutputBody from json.
-func (s *ListProjectReposOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GrantRepoAccessInputBody from json.
+func (s *GrantRepoAccessInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListProjectReposOutputBody to nil")
+		return errors.New("invalid: unable to decode GrantRepoAccessInputBody to nil")
 	}
+	var requiredBitSet [1]uint8
+	s.setDefaults()
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11780,42 +12228,49 @@ func (s *ListProjectReposOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
+		case "granteeType":
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				s.GranteeType.Reset()
+				if err := s.GranteeType.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"granteeType\"")
 			}
-		case "repo":
+		case "provider":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Repo.Reset()
-				if err := s.Repo.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repo\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
-		case "repos":
+		case "providerUserId":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.Repos = make([]Repo, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Repo
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Repos = append(s.Repos, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.ProviderUserId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repos\"")
+				return errors.Wrap(err, "decode field \"providerUserId\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				if err := s.Role.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
 			}
 		default:
 			var elem jx.Raw
@@ -11833,34 +12288,66 @@ func (s *ListProjectReposOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListProjectReposOutputBody")
+		return errors.Wrap(err, "decode GrantRepoAccessInputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00011100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfGrantRepoAccessInputBody) {
+					name = jsonFieldsNameOfGrantRepoAccessInputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListProjectReposOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GrantRepoAccessInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListProjectReposOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GrantRepoAccessInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListProjectReposOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GrantRepoAccessInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListProjectReposOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GrantRepoAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -11870,10 +12357,10 @@ func (s ListProjectReposOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListProjectReposOutputBodyAdditional from json.
-func (s *ListProjectReposOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GrantRepoAccessInputBodyAdditional from json.
+func (s *GrantRepoAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListProjectReposOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GrantRepoAccessInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11891,34 +12378,114 @@ func (s *ListProjectReposOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListProjectReposOutputBodyAdditional")
+		return errors.Wrap(err, "decode GrantRepoAccessInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListProjectReposOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GrantRepoAccessInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListProjectReposOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GrantRepoAccessInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantRepoAccessInputBodyGranteeType as json.
+func (s GrantRepoAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GrantRepoAccessInputBodyGranteeType from json.
+func (s *GrantRepoAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GrantRepoAccessInputBodyGranteeType to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GrantRepoAccessInputBodyGranteeType(v) {
+	case GrantRepoAccessInputBodyGranteeTypeAccount:
+		*s = GrantRepoAccessInputBodyGranteeTypeAccount
+	default:
+		*s = GrantRepoAccessInputBodyGranteeType(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GrantRepoAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantRepoAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantRepoAccessInputBodyRole as json.
+func (s GrantRepoAccessInputBodyRole) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GrantRepoAccessInputBodyRole from json.
+func (s *GrantRepoAccessInputBodyRole) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GrantRepoAccessInputBodyRole to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GrantRepoAccessInputBodyRole(v) {
+	case GrantRepoAccessInputBodyRoleReader:
+		*s = GrantRepoAccessInputBodyRoleReader
+	case GrantRepoAccessInputBodyRoleWriter:
+		*s = GrantRepoAccessInputBodyRoleWriter
+	case GrantRepoAccessInputBodyRoleAdmin:
+		*s = GrantRepoAccessInputBodyRoleAdmin
+	default:
+		*s = GrantRepoAccessInputBodyRole(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GrantRepoAccessInputBodyRole) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantRepoAccessInputBodyRole) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListProjectsOutputBody) Encode(e *jx.Encoder) {
+func (s *GrantRepoAccessOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListProjectsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GrantRepoAccessOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -11926,26 +12493,8 @@ func (s *ListProjectsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
-	{
-		if s.Project.Set {
-			e.FieldStart("project")
-			s.Project.Encode(e)
-		}
-	}
-	{
-		if s.Projects != nil {
-			e.FieldStart("projects")
-			e.ArrStart()
-			for _, elem := range s.Projects {
-				elem.Encode(e)
-			}
-			e.ArrEnd()
-		}
+		e.FieldStart("status")
+		e.Str(s.Status)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -11956,18 +12505,17 @@ func (s *ListProjectsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListProjectsOutputBody = [4]string{
+var jsonFieldsNameOfGrantRepoAccessOutputBody = [2]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "project",
-	3: "projects",
+	1: "status",
 }
 
-// Decode decodes ListProjectsOutputBody from json.
-func (s *ListProjectsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GrantRepoAccessOutputBody from json.
+func (s *GrantRepoAccessOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListProjectsOutputBody to nil")
+		return errors.New("invalid: unable to decode GrantRepoAccessOutputBody to nil")
 	}
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -11982,45 +12530,20 @@ func (s *ListProjectsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
+		case "status":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Status = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"status\"")
 			}
-		case "project":
-			if err := func() error {
-				s.Project.Reset()
-				if err := s.Project.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"project\"")
-			}
-		case "projects":
-			if err := func() error {
-				s.Projects = make([]Project, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem Project
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Projects = append(s.Projects, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"projects\"")
-			}
-		default:
-			var elem jx.Raw
+		default:
+			var elem jx.Raw
 			if err := func() error {
 				v, err := d.RawAppend(nil)
 				elem = jx.Raw(v)
@@ -12035,34 +12558,66 @@ func (s *ListProjectsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListProjectsOutputBody")
+		return errors.Wrap(err, "decode GrantRepoAccessOutputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfGrantRepoAccessOutputBody) {
+					name = jsonFieldsNameOfGrantRepoAccessOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListProjectsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GrantRepoAccessOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListProjectsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GrantRepoAccessOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListProjectsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GrantRepoAccessOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListProjectsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GrantRepoAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -12072,10 +12627,10 @@ func (s ListProjectsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListProjectsOutputBodyAdditional from json.
-func (s *ListProjectsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GrantRepoAccessOutputBodyAdditional from json.
+func (s *GrantRepoAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListProjectsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GrantRepoAccessOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -12093,34 +12648,34 @@ func (s *ListProjectsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListProjectsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GrantRepoAccessOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListProjectsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GrantRepoAccessOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListProjectsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GrantRepoAccessOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListRepoCIWebhooksOutputBody) Encode(e *jx.Encoder) {
+func (s *GrantServiceAccountAccessInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListRepoCIWebhooksOutputBody) encodeFields(e *jx.Encoder) {
+func (s *GrantServiceAccountAccessInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -12128,12 +12683,16 @@ func (s *ListRepoCIWebhooksOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("subscriptions")
-		e.ArrStart()
-		for _, elem := range s.Subscriptions {
-			elem.Encode(e)
-		}
-		e.ArrEnd()
+		e.FieldStart("resourceId")
+		e.Str(s.ResourceId)
+	}
+	{
+		e.FieldStart("resourceType")
+		s.ResourceType.Encode(e)
+	}
+	{
+		e.FieldStart("role")
+		s.Role.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -12144,15 +12703,17 @@ func (s *ListRepoCIWebhooksOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListRepoCIWebhooksOutputBody = [2]string{
+var jsonFieldsNameOfGrantServiceAccountAccessInputBody = [4]string{
 	0: "$schema",
-	1: "subscriptions",
+	1: "resourceId",
+	2: "resourceType",
+	3: "role",
 }
 
-// Decode decodes ListRepoCIWebhooksOutputBody from json.
-func (s *ListRepoCIWebhooksOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes GrantServiceAccountAccessInputBody from json.
+func (s *GrantServiceAccountAccessInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListRepoCIWebhooksOutputBody to nil")
+		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -12169,23 +12730,37 @@ func (s *ListRepoCIWebhooksOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "subscriptions":
+		case "resourceId":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Subscriptions = make([]CIWebhookView, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem CIWebhookView
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Subscriptions = append(s.Subscriptions, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.ResourceId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"subscriptions\"")
+				return errors.Wrap(err, "decode field \"resourceId\"")
+			}
+		case "resourceType":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				if err := s.ResourceType.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"resourceType\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				if err := s.Role.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
 			}
 		default:
 			var elem jx.Raw
@@ -12203,12 +12778,12 @@ func (s *ListRepoCIWebhooksOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListRepoCIWebhooksOutputBody")
+		return errors.Wrap(err, "decode GrantServiceAccountAccessInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000010,
+		0b00001110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -12220,8 +12795,8 @@ func (s *ListRepoCIWebhooksOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListRepoCIWebhooksOutputBody) {
-					name = jsonFieldsNameOfListRepoCIWebhooksOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGrantServiceAccountAccessInputBody) {
+					name = jsonFieldsNameOfGrantServiceAccountAccessInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -12242,27 +12817,27 @@ func (s *ListRepoCIWebhooksOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListRepoCIWebhooksOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GrantServiceAccountAccessInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListRepoCIWebhooksOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GrantServiceAccountAccessInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListRepoCIWebhooksOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GrantServiceAccountAccessInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListRepoCIWebhooksOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GrantServiceAccountAccessInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -12272,10 +12847,10 @@ func (s ListRepoCIWebhooksOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListRepoCIWebhooksOutputBodyAdditional from json.
-func (s *ListRepoCIWebhooksOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GrantServiceAccountAccessInputBodyAdditional from json.
+func (s *GrantServiceAccountAccessInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListRepoCIWebhooksOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -12293,79 +12868,150 @@ func (s *ListRepoCIWebhooksOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListRepoCIWebhooksOutputBodyAdditional")
+		return errors.Wrap(err, "decode GrantServiceAccountAccessInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListRepoCIWebhooksOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GrantServiceAccountAccessInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListRepoCIWebhooksOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GrantServiceAccountAccessInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode implements json.Marshaler.
-func (s *ListRepoGrantsOutputBody) Encode(e *jx.Encoder) {
-	e.ObjStart()
-	s.encodeFields(e)
-	e.ObjEnd()
+// Encode encodes GrantServiceAccountAccessInputBodyResourceType as json.
+func (s GrantServiceAccountAccessInputBodyResourceType) Encode(e *jx.Encoder) {
+	e.Str(string(s))
 }
 
-// encodeFields encodes fields.
-func (s *ListRepoGrantsOutputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
+// Decode decodes GrantServiceAccountAccessInputBodyResourceType from json.
+func (s *GrantServiceAccountAccessInputBodyResourceType) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBodyResourceType to nil")
 	}
-	{
-		e.FieldStart("grants")
-		e.ArrStart()
-		for _, elem := range s.Grants {
-			elem.Encode(e)
-		}
-		e.ArrEnd()
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
 	}
-	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
+	// Try to use constant string.
+	switch GrantServiceAccountAccessInputBodyResourceType(v) {
+	case GrantServiceAccountAccessInputBodyResourceTypeRepo:
+		*s = GrantServiceAccountAccessInputBodyResourceTypeRepo
+	case GrantServiceAccountAccessInputBodyResourceTypeProject:
+		*s = GrantServiceAccountAccessInputBodyResourceTypeProject
+	default:
+		*s = GrantServiceAccountAccessInputBodyResourceType(v)
 	}
-	for k, elem := range s.AdditionalProps {
-		e.FieldStart(k)
 
-		if len(elem) != 0 {
-			e.Raw(elem)
-		}
-	}
+	return nil
 }
 
-var jsonFieldsNameOfListRepoGrantsOutputBody = [3]string{
-	0: "$schema",
-	1: "grants",
-	2: "nextPageToken",
+// MarshalJSON implements stdjson.Marshaler.
+func (s GrantServiceAccountAccessInputBodyResourceType) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
 }
 
-// Decode decodes ListRepoGrantsOutputBody from json.
-func (s *ListRepoGrantsOutputBody) Decode(d *jx.Decoder) error {
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantServiceAccountAccessInputBodyResourceType) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantServiceAccountAccessInputBodyRole as json.
+func (s GrantServiceAccountAccessInputBodyRole) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes GrantServiceAccountAccessInputBodyRole from json.
+func (s *GrantServiceAccountAccessInputBodyRole) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListRepoGrantsOutputBody to nil")
+		return errors.New("invalid: unable to decode GrantServiceAccountAccessInputBodyRole to nil")
 	}
-	var requiredBitSet [1]uint8
-	s.AdditionalProps = map[string]jx.Raw{}
-
-	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		switch string(k) {
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch GrantServiceAccountAccessInputBodyRole(v) {
+	case GrantServiceAccountAccessInputBodyRoleReader:
+		*s = GrantServiceAccountAccessInputBodyRoleReader
+	case GrantServiceAccountAccessInputBodyRoleWriter:
+		*s = GrantServiceAccountAccessInputBodyRoleWriter
+	case GrantServiceAccountAccessInputBodyRoleAdmin:
+		*s = GrantServiceAccountAccessInputBodyRoleAdmin
+	default:
+		*s = GrantServiceAccountAccessInputBodyRole(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s GrantServiceAccountAccessInputBodyRole) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *GrantServiceAccountAccessInputBodyRole) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *GrantServiceAccountAccessOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *GrantServiceAccountAccessOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("status")
+		e.Str(s.Status)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfGrantServiceAccountAccessOutputBody = [2]string{
+	0: "$schema",
+	1: "status",
+}
+
+// Decode decodes GrantServiceAccountAccessOutputBody from json.
+func (s *GrantServiceAccountAccessOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode GrantServiceAccountAccessOutputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
 		case "$schema":
 			if err := func() error {
 				s.Schema.Reset()
@@ -12376,33 +13022,17 @@ func (s *ListRepoGrantsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "grants":
+		case "status":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Grants = make([]RepoGrant, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem RepoGrant
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Grants = append(s.Grants, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"grants\"")
-			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Status = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
+				return errors.Wrap(err, "decode field \"status\"")
 			}
 		default:
 			var elem jx.Raw
@@ -12420,7 +13050,7 @@ func (s *ListRepoGrantsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListRepoGrantsOutputBody")
+		return errors.Wrap(err, "decode GrantServiceAccountAccessOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -12437,8 +13067,8 @@ func (s *ListRepoGrantsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListRepoGrantsOutputBody) {
-					name = jsonFieldsNameOfListRepoGrantsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfGrantServiceAccountAccessOutputBody) {
+					name = jsonFieldsNameOfGrantServiceAccountAccessOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -12459,27 +13089,27 @@ func (s *ListRepoGrantsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListRepoGrantsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *GrantServiceAccountAccessOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListRepoGrantsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *GrantServiceAccountAccessOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListRepoGrantsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s GrantServiceAccountAccessOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListRepoGrantsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s GrantServiceAccountAccessOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -12489,10 +13119,10 @@ func (s ListRepoGrantsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListRepoGrantsOutputBodyAdditional from json.
-func (s *ListRepoGrantsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes GrantServiceAccountAccessOutputBodyAdditional from json.
+func (s *GrantServiceAccountAccessOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListRepoGrantsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode GrantServiceAccountAccessOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -12510,34 +13140,34 @@ func (s *ListRepoGrantsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListRepoGrantsOutputBodyAdditional")
+		return errors.Wrap(err, "decode GrantServiceAccountAccessOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListRepoGrantsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s GrantServiceAccountAccessOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListRepoGrantsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *GrantServiceAccountAccessOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListReposOutputBody) Encode(e *jx.Encoder) {
+func (s *ListAuditEventsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListReposOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ListAuditEventsOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -12545,22 +13175,18 @@ func (s *ListReposOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("repos")
+		e.FieldStart("events")
 		e.ArrStart()
-		for _, elem := range s.Repos {
+		for _, elem := range s.Events {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
 	}
 	{
-		e.FieldStart("truncated")
-		e.Bool(s.Truncated)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -12571,17 +13197,16 @@ func (s *ListReposOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListReposOutputBody = [4]string{
+var jsonFieldsNameOfListAuditEventsOutputBody = [3]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "repos",
-	3: "truncated",
+	1: "events",
+	2: "nextPageToken",
 }
 
-// Decode decodes ListReposOutputBody from json.
-func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ListAuditEventsOutputBody from json.
+func (s *ListAuditEventsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListReposOutputBody to nil")
+		return errors.New("invalid: unable to decode ListAuditEventsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -12598,45 +13223,33 @@ func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
-			}
-		case "repos":
-			requiredBitSet[0] |= 1 << 2
+		case "events":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Repos = make([]RepoIndexEntry, 0)
+				s.Events = make([]AuditEvent, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem RepoIndexEntry
+					var elem AuditEvent
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Repos = append(s.Repos, elem)
+					s.Events = append(s.Events, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repos\"")
+				return errors.Wrap(err, "decode field \"events\"")
 			}
-		case "truncated":
-			requiredBitSet[0] |= 1 << 3
+		case "nextPageToken":
 			if err := func() error {
-				v, err := d.Bool()
-				s.Truncated = bool(v)
-				if err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"truncated\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		default:
 			var elem jx.Raw
@@ -12654,12 +13267,12 @@ func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListReposOutputBody")
+		return errors.Wrap(err, "decode ListAuditEventsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001100,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -12671,8 +13284,8 @@ func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListReposOutputBody) {
-					name = jsonFieldsNameOfListReposOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListAuditEventsOutputBody) {
+					name = jsonFieldsNameOfListAuditEventsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -12693,27 +13306,27 @@ func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListReposOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ListAuditEventsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListReposOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ListAuditEventsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListReposOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ListAuditEventsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListReposOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ListAuditEventsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -12723,10 +13336,10 @@ func (s ListReposOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListReposOutputBodyAdditional from json.
-func (s *ListReposOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListAuditEventsOutputBodyAdditional from json.
+func (s *ListAuditEventsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListReposOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ListAuditEventsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -12744,34 +13357,34 @@ func (s *ListReposOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListReposOutputBodyAdditional")
+		return errors.Wrap(err, "decode ListAuditEventsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListReposOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ListAuditEventsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListReposOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListAuditEventsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListServiceAccountGrantsOutputBody) Encode(e *jx.Encoder) {
+func (s *ListAvailableMirrorsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListServiceAccountGrantsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ListAvailableMirrorsOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -12779,19 +13392,13 @@ func (s *ListServiceAccountGrantsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("grants")
+		e.FieldStart("available")
 		e.ArrStart()
-		for _, elem := range s.Grants {
+		for _, elem := range s.Available {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
 	}
-	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -12801,16 +13408,15 @@ func (s *ListServiceAccountGrantsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListServiceAccountGrantsOutputBody = [3]string{
+var jsonFieldsNameOfListAvailableMirrorsOutputBody = [2]string{
 	0: "$schema",
-	1: "grants",
-	2: "nextPageToken",
+	1: "available",
 }
 
-// Decode decodes ListServiceAccountGrantsOutputBody from json.
-func (s *ListServiceAccountGrantsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ListAvailableMirrorsOutputBody from json.
+func (s *ListAvailableMirrorsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListServiceAccountGrantsOutputBody to nil")
+		return errors.New("invalid: unable to decode ListAvailableMirrorsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -12827,36 +13433,26 @@ func (s *ListServiceAccountGrantsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "grants":
+		case "available":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Grants = make([]ServiceAccountGrant, 0)
+				s.Available = make([]AvailableMirror, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem ServiceAccountGrant
+					var elem AvailableMirror
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Grants = append(s.Grants, elem)
+					s.Available = append(s.Available, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"grants\"")
+				return errors.Wrap(err, "decode field \"available\"")
 			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
-			}
-		default:
-			var elem jx.Raw
+		default:
+			var elem jx.Raw
 			if err := func() error {
 				v, err := d.RawAppend(nil)
 				elem = jx.Raw(v)
@@ -12871,7 +13467,7 @@ func (s *ListServiceAccountGrantsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListServiceAccountGrantsOutputBody")
+		return errors.Wrap(err, "decode ListAvailableMirrorsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -12888,8 +13484,8 @@ func (s *ListServiceAccountGrantsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListServiceAccountGrantsOutputBody) {
-					name = jsonFieldsNameOfListServiceAccountGrantsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListAvailableMirrorsOutputBody) {
+					name = jsonFieldsNameOfListAvailableMirrorsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -12910,27 +13506,27 @@ func (s *ListServiceAccountGrantsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListServiceAccountGrantsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ListAvailableMirrorsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListServiceAccountGrantsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ListAvailableMirrorsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListServiceAccountGrantsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ListAvailableMirrorsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListServiceAccountGrantsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ListAvailableMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -12940,10 +13536,10 @@ func (s ListServiceAccountGrantsOutputBodyAdditional) encodeFields(e *jx.Encoder
 	}
 }
 
-// Decode decodes ListServiceAccountGrantsOutputBodyAdditional from json.
-func (s *ListServiceAccountGrantsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListAvailableMirrorsOutputBodyAdditional from json.
+func (s *ListAvailableMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListServiceAccountGrantsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ListAvailableMirrorsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -12961,34 +13557,34 @@ func (s *ListServiceAccountGrantsOutputBodyAdditional) Decode(d *jx.Decoder) err
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListServiceAccountGrantsOutputBodyAdditional")
+		return errors.Wrap(err, "decode ListAvailableMirrorsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListServiceAccountGrantsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ListAvailableMirrorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListServiceAccountGrantsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListAvailableMirrorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ListServiceAccountsOutputBody) Encode(e *jx.Encoder) {
+func (s *ListBindingsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ListServiceAccountsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ListBindingsOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -12996,19 +13592,19 @@ func (s *ListServiceAccountsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("serviceAccounts")
+		e.FieldStart("bindings")
 		e.ArrStart()
-		for _, elem := range s.ServiceAccounts {
+		for _, elem := range s.Bindings {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
 	}
+	{
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -13018,16 +13614,16 @@ func (s *ListServiceAccountsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfListServiceAccountsOutputBody = [3]string{
+var jsonFieldsNameOfListBindingsOutputBody = [3]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "serviceAccounts",
+	1: "bindings",
+	2: "nextPageToken",
 }
 
-// Decode decodes ListServiceAccountsOutputBody from json.
-func (s *ListServiceAccountsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ListBindingsOutputBody from json.
+func (s *ListBindingsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListServiceAccountsOutputBody to nil")
+		return errors.New("invalid: unable to decode ListBindingsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -13044,33 +13640,33 @@ func (s *ListServiceAccountsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
-			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
-			}
-		case "serviceAccounts":
-			requiredBitSet[0] |= 1 << 2
+		case "bindings":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.ServiceAccounts = make([]ServiceAccountWithGrants, 0)
+				s.Bindings = make([]Binding, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem ServiceAccountWithGrants
+					var elem Binding
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.ServiceAccounts = append(s.ServiceAccounts, elem)
+					s.Bindings = append(s.Bindings, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"serviceAccounts\"")
+				return errors.Wrap(err, "decode field \"bindings\"")
+			}
+		case "nextPageToken":
+			if err := func() error {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		default:
 			var elem jx.Raw
@@ -13088,12 +13684,12 @@ func (s *ListServiceAccountsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListServiceAccountsOutputBody")
+		return errors.Wrap(err, "decode ListBindingsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000100,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -13105,8 +13701,8 @@ func (s *ListServiceAccountsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfListServiceAccountsOutputBody) {
-					name = jsonFieldsNameOfListServiceAccountsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListBindingsOutputBody) {
+					name = jsonFieldsNameOfListBindingsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -13127,27 +13723,27 @@ func (s *ListServiceAccountsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ListServiceAccountsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ListBindingsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListServiceAccountsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ListBindingsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ListServiceAccountsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ListBindingsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ListServiceAccountsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ListBindingsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -13157,10 +13753,10 @@ func (s ListServiceAccountsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ListServiceAccountsOutputBodyAdditional from json.
-func (s *ListServiceAccountsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListBindingsOutputBodyAdditional from json.
+func (s *ListBindingsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ListServiceAccountsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ListBindingsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -13178,34 +13774,34 @@ func (s *ListServiceAccountsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ListServiceAccountsOutputBodyAdditional")
+		return errors.Wrap(err, "decode ListBindingsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ListServiceAccountsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ListBindingsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ListServiceAccountsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListBindingsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *LookupBySlugOutputBody) Encode(e *jx.Encoder) {
+func (s *ListClustersOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *LookupBySlugOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ListClustersOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -13213,24 +13809,12 @@ func (s *LookupBySlugOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("cell")
-		e.Str(s.Cell)
-	}
-	{
-		e.FieldStart("jurisdiction")
-		e.Str(s.Jurisdiction)
-	}
-	{
-		e.FieldStart("owner")
-		e.Str(s.Owner)
-	}
-	{
-		e.FieldStart("repo")
-		e.Str(s.Repo)
-	}
-	{
-		e.FieldStart("repoId")
-		e.Str(s.RepoId)
+		e.FieldStart("clusters")
+		e.ArrStart()
+		for _, elem := range s.Clusters {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -13241,19 +13825,15 @@ func (s *LookupBySlugOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfLookupBySlugOutputBody = [6]string{
+var jsonFieldsNameOfListClustersOutputBody = [2]string{
 	0: "$schema",
-	1: "cell",
-	2: "jurisdiction",
-	3: "owner",
-	4: "repo",
-	5: "repoId",
+	1: "clusters",
 }
 
-// Decode decodes LookupBySlugOutputBody from json.
-func (s *LookupBySlugOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ListClustersOutputBody from json.
+func (s *ListClustersOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupBySlugOutputBody to nil")
+		return errors.New("invalid: unable to decode ListClustersOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -13270,65 +13850,23 @@ func (s *LookupBySlugOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "cell":
+		case "clusters":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Cell = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cell\"")
-			}
-		case "jurisdiction":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.Jurisdiction = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
-			}
-		case "owner":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.Owner = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"owner\"")
-			}
-		case "repo":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.Repo = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repo\"")
-			}
-		case "repoId":
-			requiredBitSet[0] |= 1 << 5
-			if err := func() error {
-				v, err := d.Str()
-				s.RepoId = string(v)
-				if err != nil {
+				s.Clusters = make([]Cluster, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Cluster
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Clusters = append(s.Clusters, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repoId\"")
+				return errors.Wrap(err, "decode field \"clusters\"")
 			}
 		default:
 			var elem jx.Raw
@@ -13346,12 +13884,12 @@ func (s *LookupBySlugOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupBySlugOutputBody")
+		return errors.Wrap(err, "decode ListClustersOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00111110,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -13363,8 +13901,8 @@ func (s *LookupBySlugOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfLookupBySlugOutputBody) {
-					name = jsonFieldsNameOfLookupBySlugOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListClustersOutputBody) {
+					name = jsonFieldsNameOfListClustersOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -13385,27 +13923,27 @@ func (s *LookupBySlugOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *LookupBySlugOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ListClustersOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupBySlugOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ListClustersOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s LookupBySlugOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ListClustersOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s LookupBySlugOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ListClustersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -13415,10 +13953,10 @@ func (s LookupBySlugOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes LookupBySlugOutputBodyAdditional from json.
-func (s *LookupBySlugOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListClustersOutputBodyAdditional from json.
+func (s *ListClustersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupBySlugOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ListClustersOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -13436,41 +13974,47 @@ func (s *LookupBySlugOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupBySlugOutputBodyAdditional")
+		return errors.Wrap(err, "decode ListClustersOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s LookupBySlugOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ListClustersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupBySlugOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListClustersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *LookupRef) Encode(e *jx.Encoder) {
+func (s *ListMirrorCollaboratorsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *LookupRef) encodeFields(e *jx.Encoder) {
+func (s *ListMirrorCollaboratorsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("id")
-		e.Str(s.ID)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("type")
-		e.Str(s.Type)
+		e.FieldStart("collaborators")
+		e.ArrStart()
+		for _, elem := range s.Collaborators {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -13481,44 +14025,48 @@ func (s *LookupRef) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfLookupRef = [2]string{
-	0: "id",
-	1: "type",
+var jsonFieldsNameOfListMirrorCollaboratorsOutputBody = [2]string{
+	0: "$schema",
+	1: "collaborators",
 }
 
-// Decode decodes LookupRef from json.
-func (s *LookupRef) Decode(d *jx.Decoder) error {
+// Decode decodes ListMirrorCollaboratorsOutputBody from json.
+func (s *ListMirrorCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupRef to nil")
+		return errors.New("invalid: unable to decode ListMirrorCollaboratorsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "id":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "type":
+		case "collaborators":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Type = string(v)
-				if err != nil {
+				s.Collaborators = make([]MirrorCollaborator, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem MirrorCollaborator
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Collaborators = append(s.Collaborators, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"type\"")
+				return errors.Wrap(err, "decode field \"collaborators\"")
 			}
 		default:
 			var elem jx.Raw
@@ -13536,12 +14084,12 @@ func (s *LookupRef) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupRef")
+		return errors.Wrap(err, "decode ListMirrorCollaboratorsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000011,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -13553,8 +14101,8 @@ func (s *LookupRef) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfLookupRef) {
-					name = jsonFieldsNameOfLookupRef[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListMirrorCollaboratorsOutputBody) {
+					name = jsonFieldsNameOfListMirrorCollaboratorsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -13575,27 +14123,27 @@ func (s *LookupRef) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *LookupRef) MarshalJSON() ([]byte, error) {
+func (s *ListMirrorCollaboratorsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupRef) UnmarshalJSON(data []byte) error {
+func (s *ListMirrorCollaboratorsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s LookupRefAdditional) Encode(e *jx.Encoder) {
+func (s ListMirrorCollaboratorsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s LookupRefAdditional) encodeFields(e *jx.Encoder) {
+func (s ListMirrorCollaboratorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -13605,10 +14153,10 @@ func (s LookupRefAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes LookupRefAdditional from json.
-func (s *LookupRefAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListMirrorCollaboratorsOutputBodyAdditional from json.
+func (s *ListMirrorCollaboratorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupRefAdditional to nil")
+		return errors.New("invalid: unable to decode ListMirrorCollaboratorsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -13626,70 +14174,52 @@ func (s *LookupRefAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupRefAdditional")
+		return errors.Wrap(err, "decode ListMirrorCollaboratorsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s LookupRefAdditional) MarshalJSON() ([]byte, error) {
+func (s ListMirrorCollaboratorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupRefAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListMirrorCollaboratorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *LookupRefResult) Encode(e *jx.Encoder) {
+func (s *ListMirrorsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *LookupRefResult) encodeFields(e *jx.Encoder) {
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		if s.Name.Set {
-			e.FieldStart("name")
-			s.Name.Encode(e)
-		}
-	}
-	{
-		if s.OwnerId.Set {
-			e.FieldStart("ownerId")
-			s.OwnerId.Encode(e)
-		}
-	}
+func (s *ListMirrorsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.OwnerType.Set {
-			e.FieldStart("ownerType")
-			s.OwnerType.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		if s.ProjectId.Set {
-			e.FieldStart("projectId")
-			s.ProjectId.Encode(e)
+		e.FieldStart("mirrors")
+		e.ArrStart()
+		for _, elem := range s.Mirrors {
+			elem.Encode(e)
 		}
+		e.ArrEnd()
 	}
 	{
-		e.FieldStart("type")
-		e.Str(s.Type)
-	}
-	{
-		if s.URL.Set {
-			e.FieldStart("url")
-			s.URL.Encode(e)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -13701,99 +14231,59 @@ func (s *LookupRefResult) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfLookupRefResult = [7]string{
-	0: "id",
-	1: "name",
-	2: "ownerId",
-	3: "ownerType",
-	4: "projectId",
-	5: "type",
-	6: "url",
+var jsonFieldsNameOfListMirrorsOutputBody = [3]string{
+	0: "$schema",
+	1: "mirrors",
+	2: "nextPageToken",
 }
 
-// Decode decodes LookupRefResult from json.
-func (s *LookupRefResult) Decode(d *jx.Decoder) error {
+// Decode decodes ListMirrorsOutputBody from json.
+func (s *ListMirrorsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupRefResult to nil")
+		return errors.New("invalid: unable to decode ListMirrorsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "id":
-			requiredBitSet[0] |= 1 << 0
-			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
-			}
-		case "name":
-			if err := func() error {
-				s.Name.Reset()
-				if err := s.Name.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
-			}
-		case "ownerId":
-			if err := func() error {
-				s.OwnerId.Reset()
-				if err := s.OwnerId.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ownerId\"")
-			}
-		case "ownerType":
-			if err := func() error {
-				s.OwnerType.Reset()
-				if err := s.OwnerType.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ownerType\"")
-			}
-		case "projectId":
+		case "$schema":
 			if err := func() error {
-				s.ProjectId.Reset()
-				if err := s.ProjectId.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"projectId\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "type":
-			requiredBitSet[0] |= 1 << 5
+		case "mirrors":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Type = string(v)
-				if err != nil {
+				s.Mirrors = make([]Mirror, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Mirror
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Mirrors = append(s.Mirrors, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"type\"")
+				return errors.Wrap(err, "decode field \"mirrors\"")
 			}
-		case "url":
+		case "nextPageToken":
 			if err := func() error {
-				s.URL.Reset()
-				if err := s.URL.Decode(d); err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"url\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		default:
 			var elem jx.Raw
@@ -13811,12 +14301,12 @@ func (s *LookupRefResult) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupRefResult")
+		return errors.Wrap(err, "decode ListMirrorsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00100001,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -13828,8 +14318,8 @@ func (s *LookupRefResult) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfLookupRefResult) {
-					name = jsonFieldsNameOfLookupRefResult[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListMirrorsOutputBody) {
+					name = jsonFieldsNameOfListMirrorsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -13850,27 +14340,27 @@ func (s *LookupRefResult) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *LookupRefResult) MarshalJSON() ([]byte, error) {
+func (s *ListMirrorsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupRefResult) UnmarshalJSON(data []byte) error {
+func (s *ListMirrorsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s LookupRefResultAdditional) Encode(e *jx.Encoder) {
+func (s ListMirrorsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s LookupRefResultAdditional) encodeFields(e *jx.Encoder) {
+func (s ListMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -13880,10 +14370,10 @@ func (s LookupRefResultAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes LookupRefResultAdditional from json.
-func (s *LookupRefResultAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListMirrorsOutputBodyAdditional from json.
+func (s *ListMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupRefResultAdditional to nil")
+		return errors.New("invalid: unable to decode ListMirrorsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -13901,74 +14391,34 @@ func (s *LookupRefResultAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupRefResultAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s LookupRefResultAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupRefResultAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes LookupRefResultOwnerType as json.
-func (s LookupRefResultOwnerType) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes LookupRefResultOwnerType from json.
-func (s *LookupRefResultOwnerType) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode LookupRefResultOwnerType to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch LookupRefResultOwnerType(v) {
-	case LookupRefResultOwnerTypeOrg:
-		*s = LookupRefResultOwnerTypeOrg
-	case LookupRefResultOwnerTypeAccount:
-		*s = LookupRefResultOwnerTypeAccount
-	default:
-		*s = LookupRefResultOwnerType(v)
+		return errors.Wrap(err, "decode ListMirrorsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s LookupRefResultOwnerType) MarshalJSON() ([]byte, error) {
+func (s ListMirrorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupRefResultOwnerType) UnmarshalJSON(data []byte) error {
+func (s *ListMirrorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *LookupResourcesOutputBody) Encode(e *jx.Encoder) {
+func (s *ListNativeMirrorsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *LookupResourcesOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ListNativeMirrorsOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -13976,40 +14426,12 @@ func (s *LookupResourcesOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.NextPageToken.Set {
-			e.FieldStart("nextPageToken")
-			s.NextPageToken.Encode(e)
-		}
-	}
-	{
-		if s.Permission.Set {
-			e.FieldStart("permission")
-			s.Permission.Encode(e)
-		}
-	}
-	{
-		if s.ResourceIds != nil {
-			e.FieldStart("resourceIds")
-			e.ArrStart()
-			for _, elem := range s.ResourceIds {
-				e.Str(elem)
-			}
-			e.ArrEnd()
-		}
-	}
-	{
-		e.FieldStart("resourceType")
-		e.Str(s.ResourceType)
-	}
-	{
-		if s.Resources != nil {
-			e.FieldStart("resources")
-			e.ArrStart()
-			for _, elem := range s.Resources {
-				elem.Encode(e)
-			}
-			e.ArrEnd()
+		e.FieldStart("nativeMirrors")
+		e.ArrStart()
+		for _, elem := range s.NativeMirrors {
+			elem.Encode(e)
 		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -14020,19 +14442,15 @@ func (s *LookupResourcesOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfLookupResourcesOutputBody = [6]string{
+var jsonFieldsNameOfListNativeMirrorsOutputBody = [2]string{
 	0: "$schema",
-	1: "nextPageToken",
-	2: "permission",
-	3: "resourceIds",
-	4: "resourceType",
-	5: "resources",
+	1: "nativeMirrors",
 }
 
-// Decode decodes LookupResourcesOutputBody from json.
-func (s *LookupResourcesOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ListNativeMirrorsOutputBody from json.
+func (s *ListNativeMirrorsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupResourcesOutputBody to nil")
+		return errors.New("invalid: unable to decode ListNativeMirrorsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -14049,73 +14467,23 @@ func (s *LookupResourcesOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "nextPageToken":
+		case "nativeMirrors":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.NextPageToken.Reset()
-				if err := s.NextPageToken.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"nextPageToken\"")
-			}
-		case "permission":
-			if err := func() error {
-				s.Permission.Reset()
-				if err := s.Permission.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"permission\"")
-			}
-		case "resourceIds":
-			if err := func() error {
-				s.ResourceIds = make([]string, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem string
-					v, err := d.Str()
-					elem = string(v)
-					if err != nil {
-						return err
-					}
-					s.ResourceIds = append(s.ResourceIds, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceIds\"")
-			}
-		case "resourceType":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.ResourceType = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceType\"")
-			}
-		case "resources":
-			if err := func() error {
-				s.Resources = make([]ResourceAccess, 0)
+				s.NativeMirrors = make([]NativeMirrorPlacement, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem ResourceAccess
+					var elem NativeMirrorPlacement
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Resources = append(s.Resources, elem)
+					s.NativeMirrors = append(s.NativeMirrors, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resources\"")
+				return errors.Wrap(err, "decode field \"nativeMirrors\"")
 			}
 		default:
 			var elem jx.Raw
@@ -14133,12 +14501,12 @@ func (s *LookupResourcesOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupResourcesOutputBody")
+		return errors.Wrap(err, "decode ListNativeMirrorsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00010000,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -14150,8 +14518,8 @@ func (s *LookupResourcesOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfLookupResourcesOutputBody) {
-					name = jsonFieldsNameOfLookupResourcesOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListNativeMirrorsOutputBody) {
+					name = jsonFieldsNameOfListNativeMirrorsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -14172,27 +14540,27 @@ func (s *LookupResourcesOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *LookupResourcesOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ListNativeMirrorsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupResourcesOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ListNativeMirrorsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s LookupResourcesOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ListNativeMirrorsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s LookupResourcesOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ListNativeMirrorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -14202,10 +14570,10 @@ func (s LookupResourcesOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes LookupResourcesOutputBodyAdditional from json.
-func (s *LookupResourcesOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListNativeMirrorsOutputBodyAdditional from json.
+func (s *ListNativeMirrorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode LookupResourcesOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ListNativeMirrorsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -14223,41 +14591,53 @@ func (s *LookupResourcesOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode LookupResourcesOutputBodyAdditional")
+		return errors.Wrap(err, "decode ListNativeMirrorsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s LookupResourcesOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ListNativeMirrorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *LookupResourcesOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListNativeMirrorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MeAuth) Encode(e *jx.Encoder) {
+func (s *ListOIDCProvidersOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MeAuth) encodeFields(e *jx.Encoder) {
+func (s *ListOIDCProvidersOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("providerUserId")
-		e.Str(s.ProviderUserId)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("providers")
+		e.ArrStart()
+		for _, elem := range s.Providers {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -14268,44 +14648,59 @@ func (s *MeAuth) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMeAuth = [2]string{
-	0: "provider",
-	1: "providerUserId",
+var jsonFieldsNameOfListOIDCProvidersOutputBody = [3]string{
+	0: "$schema",
+	1: "nextPageToken",
+	2: "providers",
 }
 
-// Decode decodes MeAuth from json.
-func (s *MeAuth) Decode(d *jx.Decoder) error {
+// Decode decodes ListOIDCProvidersOutputBody from json.
+func (s *ListOIDCProvidersOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeAuth to nil")
+		return errors.New("invalid: unable to decode ListOIDCProvidersOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "provider":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.Provider = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "providerUserId":
-			requiredBitSet[0] |= 1 << 1
+		case "nextPageToken":
 			if err := func() error {
-				v, err := d.Str()
-				s.ProviderUserId = string(v)
-				if err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerUserId\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
+			}
+		case "providers":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				s.Providers = make([]OIDCProvider, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem OIDCProvider
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Providers = append(s.Providers, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"providers\"")
 			}
 		default:
 			var elem jx.Raw
@@ -14323,12 +14718,12 @@ func (s *MeAuth) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeAuth")
+		return errors.Wrap(err, "decode ListOIDCProvidersOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000011,
+		0b00000100,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -14340,8 +14735,8 @@ func (s *MeAuth) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMeAuth) {
-					name = jsonFieldsNameOfMeAuth[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListOIDCProvidersOutputBody) {
+					name = jsonFieldsNameOfListOIDCProvidersOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -14362,27 +14757,27 @@ func (s *MeAuth) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MeAuth) MarshalJSON() ([]byte, error) {
+func (s *ListOIDCProvidersOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeAuth) UnmarshalJSON(data []byte) error {
+func (s *ListOIDCProvidersOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MeAuthAdditional) Encode(e *jx.Encoder) {
+func (s ListOIDCProvidersOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MeAuthAdditional) encodeFields(e *jx.Encoder) {
+func (s ListOIDCProvidersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -14392,10 +14787,10 @@ func (s MeAuthAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MeAuthAdditional from json.
-func (s *MeAuthAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOIDCProvidersOutputBodyAdditional from json.
+func (s *ListOIDCProvidersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeAuthAdditional to nil")
+		return errors.New("invalid: unable to decode ListOIDCProvidersOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -14413,41 +14808,47 @@ func (s *MeAuthAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeAuthAdditional")
+		return errors.Wrap(err, "decode ListOIDCProvidersOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MeAuthAdditional) MarshalJSON() ([]byte, error) {
+func (s ListOIDCProvidersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeAuthAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListOIDCProvidersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MeDeletion) Encode(e *jx.Encoder) {
+func (s *ListOrgCIBuildkiteClustersOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MeDeletion) encodeFields(e *jx.Encoder) {
+func (s *ListOrgCIBuildkiteClustersOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("cooldownEndsAt")
-		json.EncodeDateTime(e, s.CooldownEndsAt)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("requestedAt")
-		json.EncodeDateTime(e, s.RequestedAt)
+		e.FieldStart("clusters")
+		e.ArrStart()
+		for _, elem := range s.Clusters {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -14458,44 +14859,48 @@ func (s *MeDeletion) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMeDeletion = [2]string{
-	0: "cooldownEndsAt",
-	1: "requestedAt",
+var jsonFieldsNameOfListOrgCIBuildkiteClustersOutputBody = [2]string{
+	0: "$schema",
+	1: "clusters",
 }
 
-// Decode decodes MeDeletion from json.
-func (s *MeDeletion) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgCIBuildkiteClustersOutputBody from json.
+func (s *ListOrgCIBuildkiteClustersOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeDeletion to nil")
+		return errors.New("invalid: unable to decode ListOrgCIBuildkiteClustersOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "cooldownEndsAt":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CooldownEndsAt = v
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cooldownEndsAt\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "requestedAt":
+		case "clusters":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.RequestedAt = v
-				if err != nil {
+				s.Clusters = make([]OrgCIBuildkiteClusterView, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem OrgCIBuildkiteClusterView
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Clusters = append(s.Clusters, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"requestedAt\"")
+				return errors.Wrap(err, "decode field \"clusters\"")
 			}
 		default:
 			var elem jx.Raw
@@ -14513,12 +14918,12 @@ func (s *MeDeletion) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeDeletion")
+		return errors.Wrap(err, "decode ListOrgCIBuildkiteClustersOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000011,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -14530,8 +14935,8 @@ func (s *MeDeletion) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMeDeletion) {
-					name = jsonFieldsNameOfMeDeletion[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListOrgCIBuildkiteClustersOutputBody) {
+					name = jsonFieldsNameOfListOrgCIBuildkiteClustersOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -14552,27 +14957,27 @@ func (s *MeDeletion) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MeDeletion) MarshalJSON() ([]byte, error) {
+func (s *ListOrgCIBuildkiteClustersOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeDeletion) UnmarshalJSON(data []byte) error {
+func (s *ListOrgCIBuildkiteClustersOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MeDeletionAdditional) Encode(e *jx.Encoder) {
+func (s ListOrgCIBuildkiteClustersOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MeDeletionAdditional) encodeFields(e *jx.Encoder) {
+func (s ListOrgCIBuildkiteClustersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -14582,10 +14987,10 @@ func (s MeDeletionAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MeDeletionAdditional from json.
-func (s *MeDeletionAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgCIBuildkiteClustersOutputBodyAdditional from json.
+func (s *ListOrgCIBuildkiteClustersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeDeletionAdditional to nil")
+		return errors.New("invalid: unable to decode ListOrgCIBuildkiteClustersOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -14603,68 +15008,48 @@ func (s *MeDeletionAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeDeletionAdditional")
+		return errors.Wrap(err, "decode ListOrgCIBuildkiteClustersOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MeDeletionAdditional) MarshalJSON() ([]byte, error) {
+func (s ListOrgCIBuildkiteClustersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeDeletionAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListOrgCIBuildkiteClustersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MeGlobal) Encode(e *jx.Encoder) {
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MeGlobal) encodeFields(e *jx.Encoder) {
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("accountId")
-		e.Str(s.AccountId)
-	}
-	{
-		if s.AvatarUrl.Set {
-			e.FieldStart("avatarUrl")
-			s.AvatarUrl.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("createdAt")
-		json.EncodeDateTime(e, s.CreatedAt)
-	}
-	{
-		if s.Handle.Set {
-			e.FieldStart("handle")
-			s.Handle.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("handles")
+		e.FieldStart("credentials")
 		e.ArrStart()
-		for _, elem := range s.Handles {
+		for _, elem := range s.Credentials {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
 	}
-	{
-		if s.HomeJurisdiction.Set {
-			e.FieldStart("homeJurisdiction")
-			s.HomeJurisdiction.Encode(e)
-		}
-	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -14674,96 +15059,48 @@ func (s *MeGlobal) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMeGlobal = [6]string{
-	0: "accountId",
-	1: "avatarUrl",
-	2: "createdAt",
-	3: "handle",
-	4: "handles",
-	5: "homeJurisdiction",
+var jsonFieldsNameOfListOrgCIBuildkiteCredentialsOutputBody = [2]string{
+	0: "$schema",
+	1: "credentials",
 }
 
-// Decode decodes MeGlobal from json.
-func (s *MeGlobal) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgCIBuildkiteCredentialsOutputBody from json.
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeGlobal to nil")
+		return errors.New("invalid: unable to decode ListOrgCIBuildkiteCredentialsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "accountId":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.AccountId = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"accountId\"")
-			}
-		case "avatarUrl":
-			if err := func() error {
-				s.AvatarUrl.Reset()
-				if err := s.AvatarUrl.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"avatarUrl\"")
-			}
-		case "createdAt":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"createdAt\"")
-			}
-		case "handle":
-			if err := func() error {
-				s.Handle.Reset()
-				if err := s.Handle.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"handle\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "handles":
-			requiredBitSet[0] |= 1 << 4
+		case "credentials":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Handles = make([]MeIdentityHandle, 0)
+				s.Credentials = make([]OrgCIBuildkiteCredentialView, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem MeIdentityHandle
+					var elem OrgCIBuildkiteCredentialView
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Handles = append(s.Handles, elem)
+					s.Credentials = append(s.Credentials, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"handles\"")
-			}
-		case "homeJurisdiction":
-			if err := func() error {
-				s.HomeJurisdiction.Reset()
-				if err := s.HomeJurisdiction.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"homeJurisdiction\"")
+				return errors.Wrap(err, "decode field \"credentials\"")
 			}
 		default:
 			var elem jx.Raw
@@ -14781,12 +15118,12 @@ func (s *MeGlobal) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeGlobal")
+		return errors.Wrap(err, "decode ListOrgCIBuildkiteCredentialsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00010101,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -14798,8 +15135,8 @@ func (s *MeGlobal) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMeGlobal) {
-					name = jsonFieldsNameOfMeGlobal[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListOrgCIBuildkiteCredentialsOutputBody) {
+					name = jsonFieldsNameOfListOrgCIBuildkiteCredentialsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -14820,27 +15157,27 @@ func (s *MeGlobal) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MeGlobal) MarshalJSON() ([]byte, error) {
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeGlobal) UnmarshalJSON(data []byte) error {
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MeGlobalAdditional) Encode(e *jx.Encoder) {
+func (s ListOrgCIBuildkiteCredentialsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MeGlobalAdditional) encodeFields(e *jx.Encoder) {
+func (s ListOrgCIBuildkiteCredentialsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -14850,10 +15187,10 @@ func (s MeGlobalAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MeGlobalAdditional from json.
-func (s *MeGlobalAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgCIBuildkiteCredentialsOutputBodyAdditional from json.
+func (s *ListOrgCIBuildkiteCredentialsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeGlobalAdditional to nil")
+		return errors.New("invalid: unable to decode ListOrgCIBuildkiteCredentialsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -14871,51 +15208,53 @@ func (s *MeGlobalAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeGlobalAdditional")
+		return errors.Wrap(err, "decode ListOrgCIBuildkiteCredentialsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MeGlobalAdditional) MarshalJSON() ([]byte, error) {
+func (s ListOrgCIBuildkiteCredentialsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeGlobalAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListOrgCIBuildkiteCredentialsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MeIdentityHandle) Encode(e *jx.Encoder) {
+func (s *ListOrgMembersOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MeIdentityHandle) encodeFields(e *jx.Encoder) {
+func (s *ListOrgMembersOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.Email.Set {
-			e.FieldStart("email")
-			s.Email.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("handle")
-		e.Str(s.Handle)
-	}
-	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
+		e.FieldStart("members")
+		e.ArrStart()
+		for _, elem := range s.Members {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	{
-		e.FieldStart("providerUserId")
-		e.Str(s.ProviderUserId)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -14926,68 +15265,59 @@ func (s *MeIdentityHandle) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMeIdentityHandle = [4]string{
-	0: "email",
-	1: "handle",
-	2: "provider",
-	3: "providerUserId",
+var jsonFieldsNameOfListOrgMembersOutputBody = [3]string{
+	0: "$schema",
+	1: "members",
+	2: "nextPageToken",
 }
 
-// Decode decodes MeIdentityHandle from json.
-func (s *MeIdentityHandle) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgMembersOutputBody from json.
+func (s *ListOrgMembersOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeIdentityHandle to nil")
+		return errors.New("invalid: unable to decode ListOrgMembersOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "email":
+		case "$schema":
 			if err := func() error {
-				s.Email.Reset()
-				if err := s.Email.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"email\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "handle":
+		case "members":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Handle = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"handle\"")
-			}
-		case "provider":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.Provider = string(v)
-				if err != nil {
+				s.Members = make([]Membership, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Membership
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Members = append(s.Members, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"members\"")
 			}
-		case "providerUserId":
-			requiredBitSet[0] |= 1 << 3
+		case "nextPageToken":
 			if err := func() error {
-				v, err := d.Str()
-				s.ProviderUserId = string(v)
-				if err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerUserId\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		default:
 			var elem jx.Raw
@@ -15005,12 +15335,12 @@ func (s *MeIdentityHandle) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeIdentityHandle")
+		return errors.Wrap(err, "decode ListOrgMembersOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001110,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -15022,8 +15352,8 @@ func (s *MeIdentityHandle) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMeIdentityHandle) {
-					name = jsonFieldsNameOfMeIdentityHandle[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListOrgMembersOutputBody) {
+					name = jsonFieldsNameOfListOrgMembersOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -15044,27 +15374,27 @@ func (s *MeIdentityHandle) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MeIdentityHandle) MarshalJSON() ([]byte, error) {
+func (s *ListOrgMembersOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeIdentityHandle) UnmarshalJSON(data []byte) error {
+func (s *ListOrgMembersOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MeIdentityHandleAdditional) Encode(e *jx.Encoder) {
+func (s ListOrgMembersOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MeIdentityHandleAdditional) encodeFields(e *jx.Encoder) {
+func (s ListOrgMembersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -15074,10 +15404,10 @@ func (s MeIdentityHandleAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MeIdentityHandleAdditional from json.
-func (s *MeIdentityHandleAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgMembersOutputBodyAdditional from json.
+func (s *ListOrgMembersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeIdentityHandleAdditional to nil")
+		return errors.New("invalid: unable to decode ListOrgMembersOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -15095,62 +15425,60 @@ func (s *MeIdentityHandleAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeIdentityHandleAdditional")
+		return errors.Wrap(err, "decode ListOrgMembersOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MeIdentityHandleAdditional) MarshalJSON() ([]byte, error) {
+func (s ListOrgMembersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeIdentityHandleAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListOrgMembersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MeRegional) Encode(e *jx.Encoder) {
+func (s *ListOrgProjectsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MeRegional) encodeFields(e *jx.Encoder) {
-	{
-		if s.Bio.Set {
-			e.FieldStart("bio")
-			s.Bio.Encode(e)
-		}
-	}
+func (s *ListOrgProjectsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.Company.Set {
-			e.FieldStart("company")
-			s.Company.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		if s.DisplayName.Set {
-			e.FieldStart("displayName")
-			s.DisplayName.Encode(e)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
 		}
 	}
 	{
-		if s.Email.Set {
-			e.FieldStart("email")
-			s.Email.Encode(e)
+		if s.Project.Set {
+			e.FieldStart("project")
+			s.Project.Encode(e)
 		}
 	}
 	{
-		if s.Location.Set {
-			e.FieldStart("location")
-			s.Location.Encode(e)
+		if s.Projects != nil {
+			e.FieldStart("projects")
+			e.ArrStart()
+			for _, elem := range s.Projects {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -15162,72 +15490,68 @@ func (s *MeRegional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMeRegional = [5]string{
-	0: "bio",
-	1: "company",
-	2: "displayName",
-	3: "email",
-	4: "location",
+var jsonFieldsNameOfListOrgProjectsOutputBody = [4]string{
+	0: "$schema",
+	1: "nextPageToken",
+	2: "project",
+	3: "projects",
 }
 
-// Decode decodes MeRegional from json.
-func (s *MeRegional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgProjectsOutputBody from json.
+func (s *ListOrgProjectsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeRegional to nil")
+		return errors.New("invalid: unable to decode ListOrgProjectsOutputBody to nil")
 	}
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "bio":
+		case "$schema":
 			if err := func() error {
-				s.Bio.Reset()
-				if err := s.Bio.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"bio\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "company":
+		case "nextPageToken":
 			if err := func() error {
-				s.Company.Reset()
-				if err := s.Company.Decode(d); err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"company\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
-		case "displayName":
+		case "project":
 			if err := func() error {
-				s.DisplayName.Reset()
-				if err := s.DisplayName.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"displayName\"")
-			}
-		case "email":
-			if err := func() error {
-				s.Email.Reset()
-				if err := s.Email.Decode(d); err != nil {
+				s.Project.Reset()
+				if err := s.Project.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"email\"")
+				return errors.Wrap(err, "decode field \"project\"")
 			}
-		case "location":
+		case "projects":
 			if err := func() error {
-				s.Location.Reset()
-				if err := s.Location.Decode(d); err != nil {
+				s.Projects = make([]Project, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Project
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Projects = append(s.Projects, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"location\"")
+				return errors.Wrap(err, "decode field \"projects\"")
 			}
 		default:
 			var elem jx.Raw
@@ -15245,34 +15569,34 @@ func (s *MeRegional) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeRegional")
+		return errors.Wrap(err, "decode ListOrgProjectsOutputBody")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MeRegional) MarshalJSON() ([]byte, error) {
+func (s *ListOrgProjectsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeRegional) UnmarshalJSON(data []byte) error {
+func (s *ListOrgProjectsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MeRegionalAdditional) Encode(e *jx.Encoder) {
+func (s ListOrgProjectsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MeRegionalAdditional) encodeFields(e *jx.Encoder) {
+func (s ListOrgProjectsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -15282,10 +15606,10 @@ func (s MeRegionalAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MeRegionalAdditional from json.
-func (s *MeRegionalAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgProjectsOutputBodyAdditional from json.
+func (s *ListOrgProjectsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeRegionalAdditional to nil")
+		return errors.New("invalid: unable to decode ListOrgProjectsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -15303,49 +15627,61 @@ func (s *MeRegionalAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeRegionalAdditional")
+		return errors.Wrap(err, "decode ListOrgProjectsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MeRegionalAdditional) MarshalJSON() ([]byte, error) {
+func (s ListOrgProjectsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeRegionalAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListOrgProjectsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MeRegionalUnavailable) Encode(e *jx.Encoder) {
+func (s *ListOrgsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MeRegionalUnavailable) encodeFields(e *jx.Encoder) {
+func (s *ListOrgsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("error")
-		s.Error.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("homeCoreUrl")
-		e.Str(s.HomeCoreUrl)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("jurisdiction")
-		e.Str(s.Jurisdiction)
+		if s.Org.Set {
+			e.FieldStart("org")
+			s.Org.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("message")
-		e.Str(s.Message)
+		if s.Orgs != nil {
+			e.FieldStart("orgs")
+			e.ArrStart()
+			for _, elem := range s.Orgs {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -15356,68 +15692,68 @@ func (s *MeRegionalUnavailable) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMeRegionalUnavailable = [4]string{
-	0: "error",
-	1: "homeCoreUrl",
-	2: "jurisdiction",
-	3: "message",
+var jsonFieldsNameOfListOrgsOutputBody = [4]string{
+	0: "$schema",
+	1: "nextPageToken",
+	2: "org",
+	3: "orgs",
 }
 
-// Decode decodes MeRegionalUnavailable from json.
-func (s *MeRegionalUnavailable) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgsOutputBody from json.
+func (s *ListOrgsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeRegionalUnavailable to nil")
+		return errors.New("invalid: unable to decode ListOrgsOutputBody to nil")
 	}
-	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "error":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				if err := s.Error.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"error\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "homeCoreUrl":
-			requiredBitSet[0] |= 1 << 1
+		case "nextPageToken":
 			if err := func() error {
-				v, err := d.Str()
-				s.HomeCoreUrl = string(v)
-				if err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"homeCoreUrl\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
-		case "jurisdiction":
-			requiredBitSet[0] |= 1 << 2
+		case "org":
 			if err := func() error {
-				v, err := d.Str()
-				s.Jurisdiction = string(v)
-				if err != nil {
+				s.Org.Reset()
+				if err := s.Org.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
+				return errors.Wrap(err, "decode field \"org\"")
 			}
-		case "message":
-			requiredBitSet[0] |= 1 << 3
+		case "orgs":
 			if err := func() error {
-				v, err := d.Str()
-				s.Message = string(v)
-				if err != nil {
+				s.Orgs = make([]Org, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Org
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Orgs = append(s.Orgs, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"message\"")
+				return errors.Wrap(err, "decode field \"orgs\"")
 			}
 		default:
 			var elem jx.Raw
@@ -15435,66 +15771,34 @@ func (s *MeRegionalUnavailable) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeRegionalUnavailable")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00001111,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfMeRegionalUnavailable) {
-					name = jsonFieldsNameOfMeRegionalUnavailable[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
-				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
-			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
+		return errors.Wrap(err, "decode ListOrgsOutputBody")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MeRegionalUnavailable) MarshalJSON() ([]byte, error) {
+func (s *ListOrgsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeRegionalUnavailable) UnmarshalJSON(data []byte) error {
+func (s *ListOrgsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MeRegionalUnavailableAdditional) Encode(e *jx.Encoder) {
+func (s ListOrgsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MeRegionalUnavailableAdditional) encodeFields(e *jx.Encoder) {
+func (s ListOrgsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -15504,10 +15808,10 @@ func (s MeRegionalUnavailableAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MeRegionalUnavailableAdditional from json.
-func (s *MeRegionalUnavailableAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListOrgsOutputBodyAdditional from json.
+func (s *ListOrgsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MeRegionalUnavailableAdditional to nil")
+		return errors.New("invalid: unable to decode ListOrgsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -15525,72 +15829,34 @@ func (s *MeRegionalUnavailableAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MeRegionalUnavailableAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s MeRegionalUnavailableAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeRegionalUnavailableAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes MeRegionalUnavailableError as json.
-func (s MeRegionalUnavailableError) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes MeRegionalUnavailableError from json.
-func (s *MeRegionalUnavailableError) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode MeRegionalUnavailableError to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch MeRegionalUnavailableError(v) {
-	case MeRegionalUnavailableErrorForeignJurisdiction:
-		*s = MeRegionalUnavailableErrorForeignJurisdiction
-	default:
-		*s = MeRegionalUnavailableError(v)
+		return errors.Wrap(err, "decode ListOrgsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MeRegionalUnavailableError) MarshalJSON() ([]byte, error) {
+func (s ListOrgsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MeRegionalUnavailableError) UnmarshalJSON(data []byte) error {
+func (s *ListOrgsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Membership) Encode(e *jx.Encoder) {
+func (s *ListProjectMembersOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Membership) encodeFields(e *jx.Encoder) {
+func (s *ListProjectMembersOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -15598,34 +15864,18 @@ func (s *Membership) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("accountId")
-		e.Str(s.AccountId)
+		e.FieldStart("members")
+		e.ArrStart()
+		for _, elem := range s.Members {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	{
-		e.FieldStart("createdAt")
-		json.EncodeDateTime(e, s.CreatedAt)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("orgId")
-		e.Str(s.OrgId)
-	}
-	{
-		e.FieldStart("role")
-		e.Str(s.Role)
-	}
-	{
-		e.FieldStart("status")
-		e.Str(s.Status)
-	}
-	{
-		if s.WorkosOrgMembershipId.Set {
-			e.FieldStart("workosOrgMembershipId")
-			s.WorkosOrgMembershipId.Encode(e)
-		}
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -15636,21 +15886,16 @@ func (s *Membership) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMembership = [8]string{
+var jsonFieldsNameOfListProjectMembersOutputBody = [3]string{
 	0: "$schema",
-	1: "accountId",
-	2: "createdAt",
-	3: "id",
-	4: "orgId",
-	5: "role",
-	6: "status",
-	7: "workosOrgMembershipId",
+	1: "members",
+	2: "nextPageToken",
 }
 
-// Decode decodes Membership from json.
-func (s *Membership) Decode(d *jx.Decoder) error {
+// Decode decodes ListProjectMembersOutputBody from json.
+func (s *ListProjectMembersOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Membership to nil")
+		return errors.New("invalid: unable to decode ListProjectMembersOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -15667,87 +15912,33 @@ func (s *Membership) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "accountId":
+		case "members":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.AccountId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"accountId\"")
-			}
-		case "createdAt":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"createdAt\"")
-			}
-		case "id":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
-			}
-		case "orgId":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.OrgId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"orgId\"")
-			}
-		case "role":
-			requiredBitSet[0] |= 1 << 5
-			if err := func() error {
-				v, err := d.Str()
-				s.Role = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
-			}
-		case "status":
-			requiredBitSet[0] |= 1 << 6
-			if err := func() error {
-				v, err := d.Str()
-				s.Status = string(v)
-				if err != nil {
+				s.Members = make([]ProjectGrant, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem ProjectGrant
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Members = append(s.Members, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
+				return errors.Wrap(err, "decode field \"members\"")
 			}
-		case "workosOrgMembershipId":
+		case "nextPageToken":
 			if err := func() error {
-				s.WorkosOrgMembershipId.Reset()
-				if err := s.WorkosOrgMembershipId.Decode(d); err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"workosOrgMembershipId\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		default:
 			var elem jx.Raw
@@ -15765,12 +15956,12 @@ func (s *Membership) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Membership")
+		return errors.Wrap(err, "decode ListProjectMembersOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b01111110,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -15782,8 +15973,8 @@ func (s *Membership) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMembership) {
-					name = jsonFieldsNameOfMembership[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListProjectMembersOutputBody) {
+					name = jsonFieldsNameOfListProjectMembersOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -15804,27 +15995,27 @@ func (s *Membership) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Membership) MarshalJSON() ([]byte, error) {
+func (s *ListProjectMembersOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Membership) UnmarshalJSON(data []byte) error {
+func (s *ListProjectMembersOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MembershipAdditional) Encode(e *jx.Encoder) {
+func (s ListProjectMembersOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MembershipAdditional) encodeFields(e *jx.Encoder) {
+func (s ListProjectMembersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -15834,10 +16025,10 @@ func (s MembershipAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MembershipAdditional from json.
-func (s *MembershipAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListProjectMembersOutputBodyAdditional from json.
+func (s *ListProjectMembersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MembershipAdditional to nil")
+		return errors.New("invalid: unable to decode ListProjectMembersOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -15855,34 +16046,34 @@ func (s *MembershipAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MembershipAdditional")
+		return errors.Wrap(err, "decode ListProjectMembersOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MembershipAdditional) MarshalJSON() ([]byte, error) {
+func (s ListProjectMembersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MembershipAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListProjectMembersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Mirror) Encode(e *jx.Encoder) {
+func (s *ListProjectReposOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Mirror) encodeFields(e *jx.Encoder) {
+func (s *ListProjectReposOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -15890,69 +16081,25 @@ func (s *Mirror) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.Cell.Set {
-			e.FieldStart("cell")
-			s.Cell.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("clusterHost")
-		e.Str(s.ClusterHost)
-	}
-	{
-		e.FieldStart("createdAt")
-		json.EncodeDateTime(e, s.CreatedAt)
-	}
-	{
-		if s.InstallationId.Set {
-			e.FieldStart("installationId")
-			s.InstallationId.Encode(e)
-		}
-	}
-	{
-		if s.IsArchived.Set {
-			e.FieldStart("isArchived")
-			s.IsArchived.Encode(e)
-		}
-	}
-	{
-		if s.IsPrivate.Set {
-			e.FieldStart("isPrivate")
-			s.IsPrivate.Encode(e)
-		}
-	}
-	{
-		if s.Jurisdiction.Set {
-			e.FieldStart("jurisdiction")
-			s.Jurisdiction.Encode(e)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("mirrorId")
-		e.Str(s.MirrorId)
-	}
-	{
-		e.FieldStart("owner")
-		e.Str(s.Owner)
-	}
-	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
-	}
-	{
-		e.FieldStart("repo")
-		e.Str(s.Repo)
-	}
-	{
-		if s.Status.Set {
-			e.FieldStart("status")
-			s.Status.Encode(e)
+		if s.Repo.Set {
+			e.FieldStart("repo")
+			s.Repo.Encode(e)
 		}
 	}
 	{
-		if s.SuspendedAt.Set {
-			e.FieldStart("suspendedAt")
-			s.SuspendedAt.Encode(e, json.EncodeDateTime)
+		if s.Repos != nil {
+			e.FieldStart("repos")
+			e.ArrStart()
+			for _, elem := range s.Repos {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -15964,29 +16111,18 @@ func (s *Mirror) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMirror = [14]string{
-	0:  "$schema",
-	1:  "cell",
-	2:  "clusterHost",
-	3:  "createdAt",
-	4:  "installationId",
-	5:  "isArchived",
-	6:  "isPrivate",
-	7:  "jurisdiction",
-	8:  "mirrorId",
-	9:  "owner",
-	10: "provider",
-	11: "repo",
-	12: "status",
-	13: "suspendedAt",
+var jsonFieldsNameOfListProjectReposOutputBody = [4]string{
+	0: "$schema",
+	1: "nextPageToken",
+	2: "repo",
+	3: "repos",
 }
 
-// Decode decodes Mirror from json.
-func (s *Mirror) Decode(d *jx.Decoder) error {
+// Decode decodes ListProjectReposOutputBody from json.
+func (s *ListProjectReposOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Mirror to nil")
+		return errors.New("invalid: unable to decode ListProjectReposOutputBody to nil")
 	}
-	var requiredBitSet [2]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -16001,147 +16137,42 @@ func (s *Mirror) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "cell":
+		case "nextPageToken":
 			if err := func() error {
-				s.Cell.Reset()
-				if err := s.Cell.Decode(d); err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cell\"")
-			}
-		case "clusterHost":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.ClusterHost = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterHost\"")
-			}
-		case "createdAt":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"createdAt\"")
-			}
-		case "installationId":
-			if err := func() error {
-				s.InstallationId.Reset()
-				if err := s.InstallationId.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"installationId\"")
-			}
-		case "isArchived":
-			if err := func() error {
-				s.IsArchived.Reset()
-				if err := s.IsArchived.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"isArchived\"")
-			}
-		case "isPrivate":
-			if err := func() error {
-				s.IsPrivate.Reset()
-				if err := s.IsPrivate.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"isPrivate\"")
-			}
-		case "jurisdiction":
-			if err := func() error {
-				s.Jurisdiction.Reset()
-				if err := s.Jurisdiction.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
-			}
-		case "mirrorId":
-			requiredBitSet[1] |= 1 << 0
-			if err := func() error {
-				v, err := d.Str()
-				s.MirrorId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorId\"")
-			}
-		case "owner":
-			requiredBitSet[1] |= 1 << 1
-			if err := func() error {
-				v, err := d.Str()
-				s.Owner = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"owner\"")
-			}
-		case "provider":
-			requiredBitSet[1] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.Provider = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		case "repo":
-			requiredBitSet[1] |= 1 << 3
 			if err := func() error {
-				v, err := d.Str()
-				s.Repo = string(v)
-				if err != nil {
+				s.Repo.Reset()
+				if err := s.Repo.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"repo\"")
 			}
-		case "status":
-			if err := func() error {
-				s.Status.Reset()
-				if err := s.Status.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
-			}
-		case "suspendedAt":
+		case "repos":
 			if err := func() error {
-				s.SuspendedAt.Reset()
-				if err := s.SuspendedAt.Decode(d, json.DecodeDateTime); err != nil {
+				s.Repos = make([]Repo, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Repo
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Repos = append(s.Repos, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"suspendedAt\"")
+				return errors.Wrap(err, "decode field \"repos\"")
 			}
 		default:
 			var elem jx.Raw
@@ -16159,67 +16190,34 @@ func (s *Mirror) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Mirror")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [2]uint8{
-		0b00001100,
-		0b00001111,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfMirror) {
-					name = jsonFieldsNameOfMirror[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
-				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
-			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
+		return errors.Wrap(err, "decode ListProjectReposOutputBody")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Mirror) MarshalJSON() ([]byte, error) {
+func (s *ListProjectReposOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Mirror) UnmarshalJSON(data []byte) error {
+func (s *ListProjectReposOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MirrorAdditional) Encode(e *jx.Encoder) {
+func (s ListProjectReposOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MirrorAdditional) encodeFields(e *jx.Encoder) {
+func (s ListProjectReposOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -16229,10 +16227,10 @@ func (s MirrorAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MirrorAdditional from json.
-func (s *MirrorAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListProjectReposOutputBodyAdditional from json.
+func (s *ListProjectReposOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorAdditional to nil")
+		return errors.New("invalid: unable to decode ListProjectReposOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -16250,47 +16248,61 @@ func (s *MirrorAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorAdditional")
+		return errors.Wrap(err, "decode ListProjectReposOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MirrorAdditional) MarshalJSON() ([]byte, error) {
+func (s ListProjectReposOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListProjectReposOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MirrorCollaborator) Encode(e *jx.Encoder) {
+func (s *ListProjectsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MirrorCollaborator) encodeFields(e *jx.Encoder) {
+func (s *ListProjectsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("accountId")
-		e.Str(s.AccountId)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		if s.Handle.Set {
-			e.FieldStart("handle")
-			s.Handle.Encode(e)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("role")
-		e.Str(s.Role)
+		if s.Project.Set {
+			e.FieldStart("project")
+			s.Project.Encode(e)
+		}
+	}
+	{
+		if s.Projects != nil {
+			e.FieldStart("projects")
+			e.ArrStart()
+			for _, elem := range s.Projects {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
+		}
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -16301,55 +16313,68 @@ func (s *MirrorCollaborator) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMirrorCollaborator = [3]string{
-	0: "accountId",
-	1: "handle",
-	2: "role",
+var jsonFieldsNameOfListProjectsOutputBody = [4]string{
+	0: "$schema",
+	1: "nextPageToken",
+	2: "project",
+	3: "projects",
 }
 
-// Decode decodes MirrorCollaborator from json.
-func (s *MirrorCollaborator) Decode(d *jx.Decoder) error {
+// Decode decodes ListProjectsOutputBody from json.
+func (s *ListProjectsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorCollaborator to nil")
+		return errors.New("invalid: unable to decode ListProjectsOutputBody to nil")
 	}
-	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "accountId":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.AccountId = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"accountId\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "handle":
+		case "nextPageToken":
 			if err := func() error {
-				s.Handle.Reset()
-				if err := s.Handle.Decode(d); err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"handle\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
-		case "role":
-			requiredBitSet[0] |= 1 << 2
+		case "project":
 			if err := func() error {
-				v, err := d.Str()
-				s.Role = string(v)
-				if err != nil {
+				s.Project.Reset()
+				if err := s.Project.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
+				return errors.Wrap(err, "decode field \"project\"")
+			}
+		case "projects":
+			if err := func() error {
+				s.Projects = make([]Project, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem Project
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Projects = append(s.Projects, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"projects\"")
 			}
 		default:
 			var elem jx.Raw
@@ -16367,66 +16392,34 @@ func (s *MirrorCollaborator) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorCollaborator")
-	}
-	// Validate required fields.
-	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00000101,
-	} {
-		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
-			// Mask only required fields and check equality to mask using XOR.
-			//
-			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
-			// Bits of fields which would be set are actually bits of missed fields.
-			missed := bits.OnesCount8(result)
-			for bitN := 0; bitN < missed; bitN++ {
-				bitIdx := bits.TrailingZeros8(result)
-				fieldIdx := i*8 + bitIdx
-				var name string
-				if fieldIdx < len(jsonFieldsNameOfMirrorCollaborator) {
-					name = jsonFieldsNameOfMirrorCollaborator[fieldIdx]
-				} else {
-					name = strconv.Itoa(fieldIdx)
-				}
-				failures = append(failures, validate.FieldError{
-					Name:  name,
-					Error: validate.ErrFieldRequired,
-				})
-				// Reset bit.
-				result &^= 1 << bitIdx
-			}
-		}
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
+		return errors.Wrap(err, "decode ListProjectsOutputBody")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MirrorCollaborator) MarshalJSON() ([]byte, error) {
+func (s *ListProjectsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorCollaborator) UnmarshalJSON(data []byte) error {
+func (s *ListProjectsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MirrorCollaboratorAdditional) Encode(e *jx.Encoder) {
+func (s ListProjectsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MirrorCollaboratorAdditional) encodeFields(e *jx.Encoder) {
+func (s ListProjectsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -16436,10 +16429,10 @@ func (s MirrorCollaboratorAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MirrorCollaboratorAdditional from json.
-func (s *MirrorCollaboratorAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListProjectsOutputBodyAdditional from json.
+func (s *ListProjectsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorCollaboratorAdditional to nil")
+		return errors.New("invalid: unable to decode ListProjectsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -16457,34 +16450,34 @@ func (s *MirrorCollaboratorAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorCollaboratorAdditional")
+		return errors.Wrap(err, "decode ListProjectsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MirrorCollaboratorAdditional) MarshalJSON() ([]byte, error) {
+func (s ListProjectsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorCollaboratorAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListProjectsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MirrorRequest) Encode(e *jx.Encoder) {
+func (s *ListRepoCIBuildsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MirrorRequest) encodeFields(e *jx.Encoder) {
+func (s *ListRepoCIBuildsOutputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -16492,24 +16485,12 @@ func (s *MirrorRequest) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		if s.Failure.Set {
-			e.FieldStart("failure")
-			s.Failure.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("requestId")
-		json.EncodeUUID(e, s.RequestId)
-	}
-	{
-		if s.Result.Set {
-			e.FieldStart("result")
-			s.Result.Encode(e)
+		e.FieldStart("builds")
+		e.ArrStart()
+		for _, elem := range s.Builds {
+			elem.Encode(e)
 		}
-	}
-	{
-		e.FieldStart("status")
-		s.Status.Encode(e)
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -16520,18 +16501,15 @@ func (s *MirrorRequest) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMirrorRequest = [5]string{
+var jsonFieldsNameOfListRepoCIBuildsOutputBody = [2]string{
 	0: "$schema",
-	1: "failure",
-	2: "requestId",
-	3: "result",
-	4: "status",
+	1: "builds",
 }
 
-// Decode decodes MirrorRequest from json.
-func (s *MirrorRequest) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIBuildsOutputBody from json.
+func (s *ListRepoCIBuildsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequest to nil")
+		return errors.New("invalid: unable to decode ListRepoCIBuildsOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -16548,47 +16526,23 @@ func (s *MirrorRequest) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "failure":
-			if err := func() error {
-				s.Failure.Reset()
-				if err := s.Failure.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"failure\"")
-			}
-		case "requestId":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := json.DecodeUUID(d)
-				s.RequestId = v
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"requestId\"")
-			}
-		case "result":
-			if err := func() error {
-				s.Result.Reset()
-				if err := s.Result.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"result\"")
-			}
-		case "status":
-			requiredBitSet[0] |= 1 << 4
+		case "builds":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				if err := s.Status.Decode(d); err != nil {
+				s.Builds = make([]CIBuildView, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIBuildView
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Builds = append(s.Builds, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
+				return errors.Wrap(err, "decode field \"builds\"")
 			}
 		default:
 			var elem jx.Raw
@@ -16606,12 +16560,12 @@ func (s *MirrorRequest) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorRequest")
+		return errors.Wrap(err, "decode ListRepoCIBuildsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00010100,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -16623,8 +16577,8 @@ func (s *MirrorRequest) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMirrorRequest) {
-					name = jsonFieldsNameOfMirrorRequest[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListRepoCIBuildsOutputBody) {
+					name = jsonFieldsNameOfListRepoCIBuildsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -16645,27 +16599,27 @@ func (s *MirrorRequest) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MirrorRequest) MarshalJSON() ([]byte, error) {
+func (s *ListRepoCIBuildsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequest) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIBuildsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MirrorRequestAdditional) Encode(e *jx.Encoder) {
+func (s ListRepoCIBuildsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MirrorRequestAdditional) encodeFields(e *jx.Encoder) {
+func (s ListRepoCIBuildsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -16675,10 +16629,10 @@ func (s MirrorRequestAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MirrorRequestAdditional from json.
-func (s *MirrorRequestAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIBuildsOutputBodyAdditional from json.
+func (s *ListRepoCIBuildsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequestAdditional to nil")
+		return errors.New("invalid: unable to decode ListRepoCIBuildsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -16696,45 +16650,47 @@ func (s *MirrorRequestAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorRequestAdditional")
+		return errors.Wrap(err, "decode ListRepoCIBuildsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MirrorRequestAdditional) MarshalJSON() ([]byte, error) {
+func (s ListRepoCIBuildsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequestAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIBuildsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MirrorRequestFailure) Encode(e *jx.Encoder) {
+func (s *ListRepoCIProvidersOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MirrorRequestFailure) encodeFields(e *jx.Encoder) {
+func (s *ListRepoCIProvidersOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("code")
-		e.Str(s.Code)
-	}
-	{
-		e.FieldStart("message")
-		e.Str(s.Message)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("retryable")
-		e.Bool(s.Retryable)
+		e.FieldStart("providers")
+		e.ArrStart()
+		for _, elem := range s.Providers {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -16745,57 +16701,48 @@ func (s *MirrorRequestFailure) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMirrorRequestFailure = [3]string{
-	0: "code",
-	1: "message",
-	2: "retryable",
+var jsonFieldsNameOfListRepoCIProvidersOutputBody = [2]string{
+	0: "$schema",
+	1: "providers",
 }
 
-// Decode decodes MirrorRequestFailure from json.
-func (s *MirrorRequestFailure) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIProvidersOutputBody from json.
+func (s *ListRepoCIProvidersOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequestFailure to nil")
+		return errors.New("invalid: unable to decode ListRepoCIProvidersOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "code":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.Code = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"code\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "message":
+		case "providers":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Message = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"message\"")
-			}
-		case "retryable":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Bool()
-				s.Retryable = bool(v)
-				if err != nil {
+				s.Providers = make([]CIProviderDescriptor, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIProviderDescriptor
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Providers = append(s.Providers, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"retryable\"")
+				return errors.Wrap(err, "decode field \"providers\"")
 			}
 		default:
 			var elem jx.Raw
@@ -16813,12 +16760,12 @@ func (s *MirrorRequestFailure) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorRequestFailure")
+		return errors.Wrap(err, "decode ListRepoCIProvidersOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000111,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -16830,8 +16777,8 @@ func (s *MirrorRequestFailure) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMirrorRequestFailure) {
-					name = jsonFieldsNameOfMirrorRequestFailure[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListRepoCIProvidersOutputBody) {
+					name = jsonFieldsNameOfListRepoCIProvidersOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -16852,27 +16799,27 @@ func (s *MirrorRequestFailure) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MirrorRequestFailure) MarshalJSON() ([]byte, error) {
+func (s *ListRepoCIProvidersOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequestFailure) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIProvidersOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MirrorRequestFailureAdditional) Encode(e *jx.Encoder) {
+func (s ListRepoCIProvidersOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MirrorRequestFailureAdditional) encodeFields(e *jx.Encoder) {
+func (s ListRepoCIProvidersOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -16882,10 +16829,10 @@ func (s MirrorRequestFailureAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MirrorRequestFailureAdditional from json.
-func (s *MirrorRequestFailureAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIProvidersOutputBodyAdditional from json.
+func (s *ListRepoCIProvidersOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequestFailureAdditional to nil")
+		return errors.New("invalid: unable to decode ListRepoCIProvidersOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -16903,45 +16850,47 @@ func (s *MirrorRequestFailureAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorRequestFailureAdditional")
+		return errors.Wrap(err, "decode ListRepoCIProvidersOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MirrorRequestFailureAdditional) MarshalJSON() ([]byte, error) {
+func (s ListRepoCIProvidersOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequestFailureAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIProvidersOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *MirrorRequestResult) Encode(e *jx.Encoder) {
+func (s *ListRepoCIWebhookAuditOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *MirrorRequestResult) encodeFields(e *jx.Encoder) {
+func (s *ListRepoCIWebhookAuditOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("mirrorId")
-		e.Str(s.MirrorId)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("mirrorUrl")
-		e.Str(s.MirrorUrl)
-	}
-	{
-		e.FieldStart("publicUrl")
-		e.Str(s.PublicUrl)
+		e.FieldStart("events")
+		e.ArrStart()
+		for _, elem := range s.Events {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -16952,57 +16901,48 @@ func (s *MirrorRequestResult) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfMirrorRequestResult = [3]string{
-	0: "mirrorId",
-	1: "mirrorUrl",
-	2: "publicUrl",
+var jsonFieldsNameOfListRepoCIWebhookAuditOutputBody = [2]string{
+	0: "$schema",
+	1: "events",
 }
 
-// Decode decodes MirrorRequestResult from json.
-func (s *MirrorRequestResult) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIWebhookAuditOutputBody from json.
+func (s *ListRepoCIWebhookAuditOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequestResult to nil")
+		return errors.New("invalid: unable to decode ListRepoCIWebhookAuditOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "mirrorId":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.MirrorId = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorId\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "mirrorUrl":
+		case "events":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.MirrorUrl = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorUrl\"")
-			}
-		case "publicUrl":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.PublicUrl = string(v)
-				if err != nil {
+				s.Events = make([]CIWebhookAuditEventView, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIWebhookAuditEventView
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Events = append(s.Events, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"publicUrl\"")
+				return errors.Wrap(err, "decode field \"events\"")
 			}
 		default:
 			var elem jx.Raw
@@ -17020,12 +16960,12 @@ func (s *MirrorRequestResult) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorRequestResult")
+		return errors.Wrap(err, "decode ListRepoCIWebhookAuditOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000111,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -17037,8 +16977,8 @@ func (s *MirrorRequestResult) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfMirrorRequestResult) {
-					name = jsonFieldsNameOfMirrorRequestResult[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListRepoCIWebhookAuditOutputBody) {
+					name = jsonFieldsNameOfListRepoCIWebhookAuditOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -17059,27 +16999,27 @@ func (s *MirrorRequestResult) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *MirrorRequestResult) MarshalJSON() ([]byte, error) {
+func (s *ListRepoCIWebhookAuditOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequestResult) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIWebhookAuditOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s MirrorRequestResultAdditional) Encode(e *jx.Encoder) {
+func (s ListRepoCIWebhookAuditOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s MirrorRequestResultAdditional) encodeFields(e *jx.Encoder) {
+func (s ListRepoCIWebhookAuditOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -17089,10 +17029,10 @@ func (s MirrorRequestResultAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes MirrorRequestResultAdditional from json.
-func (s *MirrorRequestResultAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIWebhookAuditOutputBodyAdditional from json.
+func (s *ListRepoCIWebhookAuditOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequestResultAdditional to nil")
+		return errors.New("invalid: unable to decode ListRepoCIWebhookAuditOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -17110,141 +17050,47 @@ func (s *MirrorRequestResultAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode MirrorRequestResultAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s MirrorRequestResultAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequestResultAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes MirrorRequestStatus as json.
-func (s MirrorRequestStatus) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes MirrorRequestStatus from json.
-func (s *MirrorRequestStatus) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode MirrorRequestStatus to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch MirrorRequestStatus(v) {
-	case MirrorRequestStatusPending:
-		*s = MirrorRequestStatusPending
-	case MirrorRequestStatusProcessing:
-		*s = MirrorRequestStatusProcessing
-	case MirrorRequestStatusSucceeded:
-		*s = MirrorRequestStatusSucceeded
-	case MirrorRequestStatusFailed:
-		*s = MirrorRequestStatusFailed
-	default:
-		*s = MirrorRequestStatus(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s MirrorRequestStatus) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorRequestStatus) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes MirrorStatus as json.
-func (s MirrorStatus) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes MirrorStatus from json.
-func (s *MirrorStatus) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode MirrorStatus to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch MirrorStatus(v) {
-	case MirrorStatusProcessing:
-		*s = MirrorStatusProcessing
-	case MirrorStatusReady:
-		*s = MirrorStatusReady
-	case MirrorStatusFailed:
-		*s = MirrorStatusFailed
-	case MirrorStatusSuspended:
-		*s = MirrorStatusSuspended
-	default:
-		*s = MirrorStatus(v)
+		return errors.Wrap(err, "decode ListRepoCIWebhookAuditOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s MirrorStatus) MarshalJSON() ([]byte, error) {
+func (s ListRepoCIWebhookAuditOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *MirrorStatus) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIWebhookAuditOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *OIDCProvider) Encode(e *jx.Encoder) {
+func (s *ListRepoCIWebhooksOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *OIDCProvider) encodeFields(e *jx.Encoder) {
+func (s *ListRepoCIWebhooksOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.Description.Set {
-			e.FieldStart("description")
-			s.Description.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		if s.DisplayName.Set {
-			e.FieldStart("displayName")
-			s.DisplayName.Encode(e)
+		e.FieldStart("subscriptions")
+		e.ArrStart()
+		for _, elem := range s.Subscriptions {
+			elem.Encode(e)
 		}
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("issuer")
-		e.Str(s.Issuer)
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -17255,66 +17101,48 @@ func (s *OIDCProvider) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfOIDCProvider = [4]string{
-	0: "description",
-	1: "displayName",
-	2: "id",
-	3: "issuer",
+var jsonFieldsNameOfListRepoCIWebhooksOutputBody = [2]string{
+	0: "$schema",
+	1: "subscriptions",
 }
 
-// Decode decodes OIDCProvider from json.
-func (s *OIDCProvider) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIWebhooksOutputBody from json.
+func (s *ListRepoCIWebhooksOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode OIDCProvider to nil")
+		return errors.New("invalid: unable to decode ListRepoCIWebhooksOutputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "description":
-			if err := func() error {
-				s.Description.Reset()
-				if err := s.Description.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"description\"")
-			}
-		case "displayName":
-			if err := func() error {
-				s.DisplayName.Reset()
-				if err := s.DisplayName.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"displayName\"")
-			}
-		case "id":
-			requiredBitSet[0] |= 1 << 2
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "issuer":
-			requiredBitSet[0] |= 1 << 3
+		case "subscriptions":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Issuer = string(v)
-				if err != nil {
+				s.Subscriptions = make([]CIWebhookView, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem CIWebhookView
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Subscriptions = append(s.Subscriptions, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"issuer\"")
+				return errors.Wrap(err, "decode field \"subscriptions\"")
 			}
 		default:
 			var elem jx.Raw
@@ -17332,12 +17160,12 @@ func (s *OIDCProvider) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode OIDCProvider")
+		return errors.Wrap(err, "decode ListRepoCIWebhooksOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001100,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -17349,8 +17177,8 @@ func (s *OIDCProvider) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfOIDCProvider) {
-					name = jsonFieldsNameOfOIDCProvider[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfListRepoCIWebhooksOutputBody) {
+					name = jsonFieldsNameOfListRepoCIWebhooksOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -17371,27 +17199,27 @@ func (s *OIDCProvider) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *OIDCProvider) MarshalJSON() ([]byte, error) {
+func (s *ListRepoCIWebhooksOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OIDCProvider) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIWebhooksOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s OIDCProviderAdditional) Encode(e *jx.Encoder) {
+func (s ListRepoCIWebhooksOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s OIDCProviderAdditional) encodeFields(e *jx.Encoder) {
+func (s ListRepoCIWebhooksOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -17401,10 +17229,10 @@ func (s OIDCProviderAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes OIDCProviderAdditional from json.
-func (s *OIDCProviderAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ListRepoCIWebhooksOutputBodyAdditional from json.
+func (s *ListRepoCIWebhooksOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode OIDCProviderAdditional to nil")
+		return errors.New("invalid: unable to decode ListRepoCIWebhooksOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -17422,871 +17250,10285 @@ func (s *OIDCProviderAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode OIDCProviderAdditional")
+		return errors.Wrap(err, "decode ListRepoCIWebhooksOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OIDCProviderAdditional) MarshalJSON() ([]byte, error) {
+func (s ListRepoCIWebhooksOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OIDCProviderAdditional) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCIWebhooksOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes AddOrgMemberInputBodyRole as json.
-func (o OptAddOrgMemberInputBodyRole) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	e.Str(string(o.Value))
+// Encode implements json.Marshaler.
+func (s *ListRepoCollaboratorsOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes AddOrgMemberInputBodyRole from json.
-func (o *OptAddOrgMemberInputBodyRole) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptAddOrgMemberInputBodyRole to nil")
+// encodeFields encodes fields.
+func (s *ListRepoCollaboratorsOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	{
+		e.FieldStart("collaborators")
+		e.ArrStart()
+		for _, elem := range s.Collaborators {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
-	return nil
-}
+	{
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptAddOrgMemberInputBodyRole) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptAddOrgMemberInputBodyRole) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
+var jsonFieldsNameOfListRepoCollaboratorsOutputBody = [3]string{
+	0: "$schema",
+	1: "collaborators",
+	2: "nextPageToken",
 }
 
-// Encode encodes AuditEventMetadata as json.
-func (o OptAuditEventMetadata) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+// Decode decodes ListRepoCollaboratorsOutputBody from json.
+func (s *ListRepoCollaboratorsOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListRepoCollaboratorsOutputBody to nil")
 	}
-	o.Value.Encode(e)
-}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
 
-// Decode decodes AuditEventMetadata from json.
-func (o *OptAuditEventMetadata) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptAuditEventMetadata to nil")
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "collaborators":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				s.Collaborators = make([]RepoCollaborator, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoCollaborator
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Collaborators = append(s.Collaborators, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"collaborators\"")
+			}
+		case "nextPageToken":
+			if err := func() error {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListRepoCollaboratorsOutputBody")
 	}
-	o.Set = true
-	o.Value = make(AuditEventMetadata)
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfListRepoCollaboratorsOutputBody) {
+					name = jsonFieldsNameOfListRepoCollaboratorsOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptAuditEventMetadata) MarshalJSON() ([]byte, error) {
+func (s *ListRepoCollaboratorsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptAuditEventMetadata) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCollaboratorsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes bool as json.
-func (o OptBool) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+// Encode implements json.Marshaler.
+func (s ListRepoCollaboratorsOutputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ListRepoCollaboratorsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	e.Bool(bool(o.Value))
 }
 
-// Decode decodes bool from json.
-func (o *OptBool) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptBool to nil")
+// Decode decodes ListRepoCollaboratorsOutputBodyAdditional from json.
+func (s *ListRepoCollaboratorsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListRepoCollaboratorsOutputBodyAdditional to nil")
 	}
-	o.Set = true
-	v, err := d.Bool()
-	if err != nil {
-		return err
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListRepoCollaboratorsOutputBodyAdditional")
 	}
-	o.Value = bool(v)
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptBool) MarshalJSON() ([]byte, error) {
+func (s ListRepoCollaboratorsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptBool) UnmarshalJSON(data []byte) error {
+func (s *ListRepoCollaboratorsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes CreateRepoInputBodyObjectFormat as json.
-func (o OptCreateRepoInputBodyObjectFormat) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	e.Str(string(o.Value))
+// Encode implements json.Marshaler.
+func (s *ListRepoGrantsOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes CreateRepoInputBodyObjectFormat from json.
-func (o *OptCreateRepoInputBodyObjectFormat) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptCreateRepoInputBodyObjectFormat to nil")
+// encodeFields encodes fields.
+func (s *ListRepoGrantsOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	{
+		e.FieldStart("grants")
+		e.ArrStart()
+		for _, elem := range s.Grants {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
-	return nil
-}
+	{
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptCreateRepoInputBodyObjectFormat) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptCreateRepoInputBodyObjectFormat) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
+var jsonFieldsNameOfListRepoGrantsOutputBody = [3]string{
+	0: "$schema",
+	1: "grants",
+	2: "nextPageToken",
 }
 
-// Encode encodes time.Time as json.
-func (o OptDateTime) Encode(e *jx.Encoder, format func(*jx.Encoder, time.Time)) {
-	if !o.Set {
-		return
+// Decode decodes ListRepoGrantsOutputBody from json.
+func (s *ListRepoGrantsOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListRepoGrantsOutputBody to nil")
 	}
-	format(e, o.Value)
-}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
 
-// Decode decodes time.Time from json.
-func (o *OptDateTime) Decode(d *jx.Decoder, format func(*jx.Decoder) (time.Time, error)) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptDateTime to nil")
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "grants":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				s.Grants = make([]RepoGrant, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoGrant
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Grants = append(s.Grants, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"grants\"")
+			}
+		case "nextPageToken":
+			if err := func() error {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListRepoGrantsOutputBody")
 	}
-	o.Set = true
-	v, err := format(d)
-	if err != nil {
-		return err
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfListRepoGrantsOutputBody) {
+					name = jsonFieldsNameOfListRepoGrantsOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
 	}
-	o.Value = v
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptDateTime) MarshalJSON() ([]byte, error) {
+func (s *ListRepoGrantsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
-	s.Encode(&e, json.EncodeDateTime)
+	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptDateTime) UnmarshalJSON(data []byte) error {
+func (s *ListRepoGrantsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
-	return s.Decode(d, json.DecodeDateTime)
+	return s.Decode(d)
 }
 
-// Encode encodes GetMeOutputBodyMode as json.
-func (o OptGetMeOutputBodyMode) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+// Encode implements json.Marshaler.
+func (s ListRepoGrantsOutputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ListRepoGrantsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	e.Str(string(o.Value))
 }
 
-// Decode decodes GetMeOutputBodyMode from json.
-func (o *OptGetMeOutputBodyMode) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptGetMeOutputBodyMode to nil")
+// Decode decodes ListRepoGrantsOutputBodyAdditional from json.
+func (s *ListRepoGrantsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListRepoGrantsOutputBodyAdditional to nil")
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListRepoGrantsOutputBodyAdditional")
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptGetMeOutputBodyMode) MarshalJSON() ([]byte, error) {
+func (s ListRepoGrantsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptGetMeOutputBodyMode) UnmarshalJSON(data []byte) error {
+func (s *ListRepoGrantsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GetPermissionsOutputBodyExplain as json.
-func (o OptGetPermissionsOutputBodyExplain) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	o.Value.Encode(e)
+// Encode implements json.Marshaler.
+func (s *ListReposOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes GetPermissionsOutputBodyExplain from json.
-func (o *OptGetPermissionsOutputBodyExplain) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptGetPermissionsOutputBodyExplain to nil")
+// encodeFields encodes fields.
+func (s *ListReposOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
-	o.Set = true
-	o.Value = make(GetPermissionsOutputBodyExplain)
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	{
+		e.FieldStart("candidatesIncomplete")
+		e.Bool(s.CandidatesIncomplete)
 	}
-	return nil
-}
+	{
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("repos")
+		e.ArrStart()
+		for _, elem := range s.Repos {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	{
+		e.FieldStart("truncated")
+		e.Bool(s.Truncated)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptGetPermissionsOutputBodyExplain) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptGetPermissionsOutputBodyExplain) UnmarshalJSON(data []byte) error {
+var jsonFieldsNameOfListReposOutputBody = [5]string{
+	0: "$schema",
+	1: "candidatesIncomplete",
+	2: "nextPageToken",
+	3: "repos",
+	4: "truncated",
+}
+
+// Decode decodes ListReposOutputBody from json.
+func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListReposOutputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "candidatesIncomplete":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.CandidatesIncomplete = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"candidatesIncomplete\"")
+			}
+		case "nextPageToken":
+			if err := func() error {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
+			}
+		case "repos":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				s.Repos = make([]RepoIndexEntry, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoIndexEntry
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Repos = append(s.Repos, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repos\"")
+			}
+		case "truncated":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Bool()
+				s.Truncated = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"truncated\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListReposOutputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00011010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfListReposOutputBody) {
+					name = jsonFieldsNameOfListReposOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *ListReposOutputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ListReposOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GetVersionOutputBodyMode as json.
-func (o OptGetVersionOutputBodyMode) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+// Encode implements json.Marshaler.
+func (s ListReposOutputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ListReposOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes ListReposOutputBodyAdditional from json.
+func (s *ListReposOutputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListReposOutputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListReposOutputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ListReposOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ListReposOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *ListServiceAccountGrantsOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *ListServiceAccountGrantsOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("grants")
+		e.ArrStart()
+		for _, elem := range s.Grants {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	{
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfListServiceAccountGrantsOutputBody = [3]string{
+	0: "$schema",
+	1: "grants",
+	2: "nextPageToken",
+}
+
+// Decode decodes ListServiceAccountGrantsOutputBody from json.
+func (s *ListServiceAccountGrantsOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListServiceAccountGrantsOutputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "grants":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				s.Grants = make([]ServiceAccountGrant, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem ServiceAccountGrant
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Grants = append(s.Grants, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"grants\"")
+			}
+		case "nextPageToken":
+			if err := func() error {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListServiceAccountGrantsOutputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfListServiceAccountGrantsOutputBody) {
+					name = jsonFieldsNameOfListServiceAccountGrantsOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *ListServiceAccountGrantsOutputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ListServiceAccountGrantsOutputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s ListServiceAccountGrantsOutputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ListServiceAccountGrantsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes ListServiceAccountGrantsOutputBodyAdditional from json.
+func (s *ListServiceAccountGrantsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListServiceAccountGrantsOutputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListServiceAccountGrantsOutputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ListServiceAccountGrantsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ListServiceAccountGrantsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *ListServiceAccountsOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *ListServiceAccountsOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("serviceAccounts")
+		e.ArrStart()
+		for _, elem := range s.ServiceAccounts {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfListServiceAccountsOutputBody = [3]string{
+	0: "$schema",
+	1: "nextPageToken",
+	2: "serviceAccounts",
+}
+
+// Decode decodes ListServiceAccountsOutputBody from json.
+func (s *ListServiceAccountsOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListServiceAccountsOutputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "nextPageToken":
+			if err := func() error {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
+			}
+		case "serviceAccounts":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				s.ServiceAccounts = make([]ServiceAccountWithGrants, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem ServiceAccountWithGrants
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.ServiceAccounts = append(s.ServiceAccounts, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"serviceAccounts\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListServiceAccountsOutputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfListServiceAccountsOutputBody) {
+					name = jsonFieldsNameOfListServiceAccountsOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *ListServiceAccountsOutputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ListServiceAccountsOutputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s ListServiceAccountsOutputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ListServiceAccountsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes ListServiceAccountsOutputBodyAdditional from json.
+func (s *ListServiceAccountsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ListServiceAccountsOutputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ListServiceAccountsOutputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ListServiceAccountsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ListServiceAccountsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *LookupBySlugOutputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *LookupBySlugOutputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("cell")
+		e.Str(s.Cell)
+	}
+	{
+		e.FieldStart("jurisdiction")
+		e.Str(s.Jurisdiction)
+	}
+	{
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("repo")
+		e.Str(s.Repo)
+	}
+	{
+		e.FieldStart("repoId")
+		e.Str(s.RepoId)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfLookupBySlugOutputBody = [6]string{
+	0: "$schema",
+	1: "cell",
+	2: "jurisdiction",
+	3: "owner",
+	4: "repo",
+	5: "repoId",
+}
+
+// Decode decodes LookupBySlugOutputBody from json.
+func (s *LookupBySlugOutputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode LookupBySlugOutputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "cell":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Cell = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"cell\"")
+			}
+		case "jurisdiction":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Jurisdiction = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "owner":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Owner = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "repo":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Repo = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repo\"")
+			}
+		case "repoId":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.RepoId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repoId\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode LookupBySlugOutputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00111110,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfLookupBySlugOutputBody) {
+					name = jsonFieldsNameOfLookupBySlugOutputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *LookupBySlugOutputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *LookupBySlugOutputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s LookupBySlugOutputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s LookupBySlugOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes LookupBySlugOutputBodyAdditional from json.
+func (s *LookupBySlugOutputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode LookupBySlugOutputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode LookupBySlugOutputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s LookupBySlugOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *LookupBySlugOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MeAuth) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MeAuth) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		e.FieldStart("providerUserId")
+		e.Str(s.ProviderUserId)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMeAuth = [2]string{
+	0: "provider",
+	1: "providerUserId",
+}
+
+// Decode decodes MeAuth from json.
+func (s *MeAuth) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeAuth to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "provider":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "providerUserId":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.ProviderUserId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"providerUserId\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeAuth")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000011,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMeAuth) {
+					name = jsonFieldsNameOfMeAuth[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MeAuth) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeAuth) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MeAuthAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MeAuthAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MeAuthAdditional from json.
+func (s *MeAuthAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeAuthAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeAuthAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeAuthAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeAuthAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MeDeletion) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MeDeletion) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("cooldownEndsAt")
+		json.EncodeDateTime(e, s.CooldownEndsAt)
+	}
+	{
+		e.FieldStart("requestedAt")
+		json.EncodeDateTime(e, s.RequestedAt)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMeDeletion = [2]string{
+	0: "cooldownEndsAt",
+	1: "requestedAt",
+}
+
+// Decode decodes MeDeletion from json.
+func (s *MeDeletion) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeDeletion to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "cooldownEndsAt":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CooldownEndsAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"cooldownEndsAt\"")
+			}
+		case "requestedAt":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.RequestedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"requestedAt\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeDeletion")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000011,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMeDeletion) {
+					name = jsonFieldsNameOfMeDeletion[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MeDeletion) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeDeletion) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MeDeletionAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MeDeletionAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MeDeletionAdditional from json.
+func (s *MeDeletionAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeDeletionAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeDeletionAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeDeletionAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeDeletionAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MeGlobal) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MeGlobal) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("accountId")
+		e.Str(s.AccountId)
+	}
+	{
+		if s.AvatarUrl.Set {
+			e.FieldStart("avatarUrl")
+			s.AvatarUrl.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		if s.Handle.Set {
+			e.FieldStart("handle")
+			s.Handle.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("handles")
+		e.ArrStart()
+		for _, elem := range s.Handles {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	{
+		if s.HomeJurisdiction.Set {
+			e.FieldStart("homeJurisdiction")
+			s.HomeJurisdiction.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMeGlobal = [6]string{
+	0: "accountId",
+	1: "avatarUrl",
+	2: "createdAt",
+	3: "handle",
+	4: "handles",
+	5: "homeJurisdiction",
+}
+
+// Decode decodes MeGlobal from json.
+func (s *MeGlobal) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeGlobal to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "accountId":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.AccountId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"accountId\"")
+			}
+		case "avatarUrl":
+			if err := func() error {
+				s.AvatarUrl.Reset()
+				if err := s.AvatarUrl.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"avatarUrl\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "handle":
+			if err := func() error {
+				s.Handle.Reset()
+				if err := s.Handle.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"handle\"")
+			}
+		case "handles":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				s.Handles = make([]MeIdentityHandle, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem MeIdentityHandle
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Handles = append(s.Handles, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"handles\"")
+			}
+		case "homeJurisdiction":
+			if err := func() error {
+				s.HomeJurisdiction.Reset()
+				if err := s.HomeJurisdiction.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"homeJurisdiction\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeGlobal")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00010101,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMeGlobal) {
+					name = jsonFieldsNameOfMeGlobal[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MeGlobal) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeGlobal) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MeGlobalAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MeGlobalAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MeGlobalAdditional from json.
+func (s *MeGlobalAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeGlobalAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeGlobalAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeGlobalAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeGlobalAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MeIdentityHandle) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MeIdentityHandle) encodeFields(e *jx.Encoder) {
+	{
+		if s.Email.Set {
+			e.FieldStart("email")
+			s.Email.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("handle")
+		e.Str(s.Handle)
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		e.FieldStart("providerUserId")
+		e.Str(s.ProviderUserId)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMeIdentityHandle = [4]string{
+	0: "email",
+	1: "handle",
+	2: "provider",
+	3: "providerUserId",
+}
+
+// Decode decodes MeIdentityHandle from json.
+func (s *MeIdentityHandle) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeIdentityHandle to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "email":
+			if err := func() error {
+				s.Email.Reset()
+				if err := s.Email.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"email\"")
+			}
+		case "handle":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Handle = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"handle\"")
+			}
+		case "provider":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "providerUserId":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.ProviderUserId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"providerUserId\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeIdentityHandle")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00001110,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMeIdentityHandle) {
+					name = jsonFieldsNameOfMeIdentityHandle[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MeIdentityHandle) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeIdentityHandle) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MeIdentityHandleAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MeIdentityHandleAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MeIdentityHandleAdditional from json.
+func (s *MeIdentityHandleAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeIdentityHandleAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeIdentityHandleAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeIdentityHandleAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeIdentityHandleAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MeRegional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MeRegional) encodeFields(e *jx.Encoder) {
+	{
+		if s.Bio.Set {
+			e.FieldStart("bio")
+			s.Bio.Encode(e)
+		}
+	}
+	{
+		if s.Company.Set {
+			e.FieldStart("company")
+			s.Company.Encode(e)
+		}
+	}
+	{
+		if s.DisplayName.Set {
+			e.FieldStart("displayName")
+			s.DisplayName.Encode(e)
+		}
+	}
+	{
+		if s.Email.Set {
+			e.FieldStart("email")
+			s.Email.Encode(e)
+		}
+	}
+	{
+		if s.Location.Set {
+			e.FieldStart("location")
+			s.Location.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMeRegional = [5]string{
+	0: "bio",
+	1: "company",
+	2: "displayName",
+	3: "email",
+	4: "location",
+}
+
+// Decode decodes MeRegional from json.
+func (s *MeRegional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeRegional to nil")
+	}
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "bio":
+			if err := func() error {
+				s.Bio.Reset()
+				if err := s.Bio.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bio\"")
+			}
+		case "company":
+			if err := func() error {
+				s.Company.Reset()
+				if err := s.Company.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"company\"")
+			}
+		case "displayName":
+			if err := func() error {
+				s.DisplayName.Reset()
+				if err := s.DisplayName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"displayName\"")
+			}
+		case "email":
+			if err := func() error {
+				s.Email.Reset()
+				if err := s.Email.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"email\"")
+			}
+		case "location":
+			if err := func() error {
+				s.Location.Reset()
+				if err := s.Location.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"location\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeRegional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MeRegional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeRegional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MeRegionalAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MeRegionalAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MeRegionalAdditional from json.
+func (s *MeRegionalAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeRegionalAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeRegionalAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeRegionalAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeRegionalAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MeRegionalUnavailable) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MeRegionalUnavailable) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("error")
+		s.Error.Encode(e)
+	}
+	{
+		e.FieldStart("homeCoreUrl")
+		e.Str(s.HomeCoreUrl)
+	}
+	{
+		e.FieldStart("jurisdiction")
+		e.Str(s.Jurisdiction)
+	}
+	{
+		e.FieldStart("message")
+		e.Str(s.Message)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMeRegionalUnavailable = [4]string{
+	0: "error",
+	1: "homeCoreUrl",
+	2: "jurisdiction",
+	3: "message",
+}
+
+// Decode decodes MeRegionalUnavailable from json.
+func (s *MeRegionalUnavailable) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeRegionalUnavailable to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "error":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				if err := s.Error.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"error\"")
+			}
+		case "homeCoreUrl":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.HomeCoreUrl = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"homeCoreUrl\"")
+			}
+		case "jurisdiction":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Jurisdiction = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "message":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Message = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"message\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeRegionalUnavailable")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00001111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMeRegionalUnavailable) {
+					name = jsonFieldsNameOfMeRegionalUnavailable[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MeRegionalUnavailable) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeRegionalUnavailable) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MeRegionalUnavailableAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MeRegionalUnavailableAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MeRegionalUnavailableAdditional from json.
+func (s *MeRegionalUnavailableAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeRegionalUnavailableAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MeRegionalUnavailableAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeRegionalUnavailableAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeRegionalUnavailableAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MeRegionalUnavailableError as json.
+func (s MeRegionalUnavailableError) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes MeRegionalUnavailableError from json.
+func (s *MeRegionalUnavailableError) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MeRegionalUnavailableError to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch MeRegionalUnavailableError(v) {
+	case MeRegionalUnavailableErrorForeignJurisdiction:
+		*s = MeRegionalUnavailableErrorForeignJurisdiction
+	default:
+		*s = MeRegionalUnavailableError(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MeRegionalUnavailableError) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MeRegionalUnavailableError) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *Membership) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *Membership) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("accountId")
+		e.Str(s.AccountId)
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		if s.Handle.Set {
+			e.FieldStart("handle")
+			s.Handle.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("orgId")
+		e.Str(s.OrgId)
+	}
+	{
+		if s.Provider.Set {
+			e.FieldStart("provider")
+			s.Provider.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("role")
+		e.Str(s.Role)
+	}
+	{
+		e.FieldStart("status")
+		e.Str(s.Status)
+	}
+	{
+		if s.WorkosOrgMembershipId.Set {
+			e.FieldStart("workosOrgMembershipId")
+			s.WorkosOrgMembershipId.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMembership = [10]string{
+	0: "$schema",
+	1: "accountId",
+	2: "createdAt",
+	3: "handle",
+	4: "id",
+	5: "orgId",
+	6: "provider",
+	7: "role",
+	8: "status",
+	9: "workosOrgMembershipId",
+}
+
+// Decode decodes Membership from json.
+func (s *Membership) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode Membership to nil")
+	}
+	var requiredBitSet [2]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "accountId":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.AccountId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"accountId\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "handle":
+			if err := func() error {
+				s.Handle.Reset()
+				if err := s.Handle.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"handle\"")
+			}
+		case "id":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "orgId":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.OrgId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"orgId\"")
+			}
+		case "provider":
+			if err := func() error {
+				s.Provider.Reset()
+				if err := s.Provider.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := d.Str()
+				s.Role = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
+			}
+		case "status":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.Status = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"status\"")
+			}
+		case "workosOrgMembershipId":
+			if err := func() error {
+				s.WorkosOrgMembershipId.Reset()
+				if err := s.WorkosOrgMembershipId.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"workosOrgMembershipId\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode Membership")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [2]uint8{
+		0b10110110,
+		0b00000001,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMembership) {
+					name = jsonFieldsNameOfMembership[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *Membership) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *Membership) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MembershipAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MembershipAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MembershipAdditional from json.
+func (s *MembershipAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MembershipAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MembershipAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MembershipAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MembershipAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("account")
+		e.Str(s.Account)
+	}
+	{
+		if s.APIToken.Set {
+			e.FieldStart("api_token")
+			s.APIToken.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMintOrgCIGitHubActionsCredentialInputBody = [3]string{
+	0: "$schema",
+	1: "account",
+	2: "api_token",
+}
+
+// Decode decodes MintOrgCIGitHubActionsCredentialInputBody from json.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MintOrgCIGitHubActionsCredentialInputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "account":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Account = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"account\"")
+			}
+		case "api_token":
+			if err := func() error {
+				s.APIToken.Reset()
+				if err := s.APIToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"api_token\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MintOrgCIGitHubActionsCredentialInputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000010,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMintOrgCIGitHubActionsCredentialInputBody) {
+					name = jsonFieldsNameOfMintOrgCIGitHubActionsCredentialInputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MintOrgCIGitHubActionsCredentialInputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MintOrgCIGitHubActionsCredentialInputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MintOrgCIGitHubActionsCredentialInputBodyAdditional from json.
+func (s *MintOrgCIGitHubActionsCredentialInputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MintOrgCIGitHubActionsCredentialInputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MintOrgCIGitHubActionsCredentialInputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MintOrgCIGitHubActionsCredentialInputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MintOrgCIGitHubActionsCredentialInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *Mirror) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *Mirror) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.Cell.Set {
+			e.FieldStart("cell")
+			s.Cell.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("clusterHost")
+		e.Str(s.ClusterHost)
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		if s.InstallationId.Set {
+			e.FieldStart("installationId")
+			s.InstallationId.Encode(e)
+		}
+	}
+	{
+		if s.IsArchived.Set {
+			e.FieldStart("isArchived")
+			s.IsArchived.Encode(e)
+		}
+	}
+	{
+		if s.IsPrivate.Set {
+			e.FieldStart("isPrivate")
+			s.IsPrivate.Encode(e)
+		}
+	}
+	{
+		if s.Jurisdiction.Set {
+			e.FieldStart("jurisdiction")
+			s.Jurisdiction.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("mirrorId")
+		e.Str(s.MirrorId)
+	}
+	{
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		e.FieldStart("repo")
+		e.Str(s.Repo)
+	}
+	{
+		if s.Status.Set {
+			e.FieldStart("status")
+			s.Status.Encode(e)
+		}
+	}
+	{
+		if s.SuspendedAt.Set {
+			e.FieldStart("suspendedAt")
+			s.SuspendedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMirror = [14]string{
+	0:  "$schema",
+	1:  "cell",
+	2:  "clusterHost",
+	3:  "createdAt",
+	4:  "installationId",
+	5:  "isArchived",
+	6:  "isPrivate",
+	7:  "jurisdiction",
+	8:  "mirrorId",
+	9:  "owner",
+	10: "provider",
+	11: "repo",
+	12: "status",
+	13: "suspendedAt",
+}
+
+// Decode decodes Mirror from json.
+func (s *Mirror) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode Mirror to nil")
+	}
+	var requiredBitSet [2]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "cell":
+			if err := func() error {
+				s.Cell.Reset()
+				if err := s.Cell.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"cell\"")
+			}
+		case "clusterHost":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.ClusterHost = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"clusterHost\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "installationId":
+			if err := func() error {
+				s.InstallationId.Reset()
+				if err := s.InstallationId.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"installationId\"")
+			}
+		case "isArchived":
+			if err := func() error {
+				s.IsArchived.Reset()
+				if err := s.IsArchived.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"isArchived\"")
+			}
+		case "isPrivate":
+			if err := func() error {
+				s.IsPrivate.Reset()
+				if err := s.IsPrivate.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"isPrivate\"")
+			}
+		case "jurisdiction":
+			if err := func() error {
+				s.Jurisdiction.Reset()
+				if err := s.Jurisdiction.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "mirrorId":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.MirrorId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mirrorId\"")
+			}
+		case "owner":
+			requiredBitSet[1] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Owner = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "provider":
+			requiredBitSet[1] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "repo":
+			requiredBitSet[1] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Repo = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repo\"")
+			}
+		case "status":
+			if err := func() error {
+				s.Status.Reset()
+				if err := s.Status.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"status\"")
+			}
+		case "suspendedAt":
+			if err := func() error {
+				s.SuspendedAt.Reset()
+				if err := s.SuspendedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"suspendedAt\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode Mirror")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [2]uint8{
+		0b00001100,
+		0b00001111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMirror) {
+					name = jsonFieldsNameOfMirror[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *Mirror) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *Mirror) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MirrorAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MirrorAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MirrorAdditional from json.
+func (s *MirrorAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MirrorCollaborator) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MirrorCollaborator) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("accountId")
+		e.Str(s.AccountId)
+	}
+	{
+		if s.Handle.Set {
+			e.FieldStart("handle")
+			s.Handle.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("role")
+		e.Str(s.Role)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMirrorCollaborator = [3]string{
+	0: "accountId",
+	1: "handle",
+	2: "role",
+}
+
+// Decode decodes MirrorCollaborator from json.
+func (s *MirrorCollaborator) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorCollaborator to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "accountId":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.AccountId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"accountId\"")
+			}
+		case "handle":
+			if err := func() error {
+				s.Handle.Reset()
+				if err := s.Handle.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"handle\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Role = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorCollaborator")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000101,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMirrorCollaborator) {
+					name = jsonFieldsNameOfMirrorCollaborator[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MirrorCollaborator) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorCollaborator) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MirrorCollaboratorAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MirrorCollaboratorAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MirrorCollaboratorAdditional from json.
+func (s *MirrorCollaboratorAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorCollaboratorAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorCollaboratorAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorCollaboratorAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorCollaboratorAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MirrorRequest) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MirrorRequest) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.Failure.Set {
+			e.FieldStart("failure")
+			s.Failure.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("requestId")
+		json.EncodeUUID(e, s.RequestId)
+	}
+	{
+		if s.Result.Set {
+			e.FieldStart("result")
+			s.Result.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("status")
+		s.Status.Encode(e)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMirrorRequest = [5]string{
+	0: "$schema",
+	1: "failure",
+	2: "requestId",
+	3: "result",
+	4: "status",
+}
+
+// Decode decodes MirrorRequest from json.
+func (s *MirrorRequest) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequest to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "failure":
+			if err := func() error {
+				s.Failure.Reset()
+				if err := s.Failure.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"failure\"")
+			}
+		case "requestId":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := json.DecodeUUID(d)
+				s.RequestId = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"requestId\"")
+			}
+		case "result":
+			if err := func() error {
+				s.Result.Reset()
+				if err := s.Result.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"result\"")
+			}
+		case "status":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				if err := s.Status.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"status\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorRequest")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00010100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMirrorRequest) {
+					name = jsonFieldsNameOfMirrorRequest[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MirrorRequest) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequest) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MirrorRequestAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MirrorRequestAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MirrorRequestAdditional from json.
+func (s *MirrorRequestAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequestAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorRequestAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorRequestAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequestAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MirrorRequestFailure) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MirrorRequestFailure) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("code")
+		e.Str(s.Code)
+	}
+	{
+		e.FieldStart("message")
+		e.Str(s.Message)
+	}
+	{
+		e.FieldStart("retryable")
+		e.Bool(s.Retryable)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMirrorRequestFailure = [3]string{
+	0: "code",
+	1: "message",
+	2: "retryable",
+}
+
+// Decode decodes MirrorRequestFailure from json.
+func (s *MirrorRequestFailure) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequestFailure to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "code":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.Code = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"code\"")
+			}
+		case "message":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Message = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"message\"")
+			}
+		case "retryable":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Bool()
+				s.Retryable = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"retryable\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorRequestFailure")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMirrorRequestFailure) {
+					name = jsonFieldsNameOfMirrorRequestFailure[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MirrorRequestFailure) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequestFailure) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MirrorRequestFailureAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MirrorRequestFailureAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MirrorRequestFailureAdditional from json.
+func (s *MirrorRequestFailureAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequestFailureAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorRequestFailureAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorRequestFailureAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequestFailureAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *MirrorRequestResult) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *MirrorRequestResult) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("mirrorId")
+		e.Str(s.MirrorId)
+	}
+	{
+		e.FieldStart("mirrorUrl")
+		e.Str(s.MirrorUrl)
+	}
+	{
+		e.FieldStart("publicUrl")
+		e.Str(s.PublicUrl)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfMirrorRequestResult = [3]string{
+	0: "mirrorId",
+	1: "mirrorUrl",
+	2: "publicUrl",
+}
+
+// Decode decodes MirrorRequestResult from json.
+func (s *MirrorRequestResult) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequestResult to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "mirrorId":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.MirrorId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mirrorId\"")
+			}
+		case "mirrorUrl":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.MirrorUrl = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mirrorUrl\"")
+			}
+		case "publicUrl":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.PublicUrl = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"publicUrl\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorRequestResult")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfMirrorRequestResult) {
+					name = jsonFieldsNameOfMirrorRequestResult[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *MirrorRequestResult) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequestResult) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s MirrorRequestResultAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s MirrorRequestResultAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes MirrorRequestResultAdditional from json.
+func (s *MirrorRequestResultAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequestResultAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode MirrorRequestResultAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorRequestResultAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequestResultAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MirrorRequestStatus as json.
+func (s MirrorRequestStatus) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes MirrorRequestStatus from json.
+func (s *MirrorRequestStatus) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorRequestStatus to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch MirrorRequestStatus(v) {
+	case MirrorRequestStatusPending:
+		*s = MirrorRequestStatusPending
+	case MirrorRequestStatusProcessing:
+		*s = MirrorRequestStatusProcessing
+	case MirrorRequestStatusSucceeded:
+		*s = MirrorRequestStatusSucceeded
+	case MirrorRequestStatusFailed:
+		*s = MirrorRequestStatusFailed
+	default:
+		*s = MirrorRequestStatus(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorRequestStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorRequestStatus) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MirrorStatus as json.
+func (s MirrorStatus) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes MirrorStatus from json.
+func (s *MirrorStatus) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode MirrorStatus to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch MirrorStatus(v) {
+	case MirrorStatusProcessing:
+		*s = MirrorStatusProcessing
+	case MirrorStatusReady:
+		*s = MirrorStatusReady
+	case MirrorStatusFailed:
+		*s = MirrorStatusFailed
+	case MirrorStatusSuspended:
+		*s = MirrorStatusSuspended
+	default:
+		*s = MirrorStatus(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s MirrorStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *MirrorStatus) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *NativeMirrorPlacement) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *NativeMirrorPlacement) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("attempts")
+		e.Int64(s.Attempts)
+	}
+	{
+		e.FieldStart("clusterSlug")
+		e.Str(s.ClusterSlug)
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		if s.CreationFailedAt.Set {
+			e.FieldStart("creationFailedAt")
+			s.CreationFailedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		e.FieldStart("desiredState")
+		s.DesiredState.Encode(e)
+	}
+	{
+		if s.LastError.Set {
+			e.FieldStart("lastError")
+			s.LastError.Encode(e)
+		}
+	}
+	{
+		if s.NextRetryAt.Set {
+			e.FieldStart("nextRetryAt")
+			s.NextRetryAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		e.FieldStart("placementId")
+		e.Str(s.PlacementId)
+	}
+	{
+		e.FieldStart("stage")
+		s.Stage.Encode(e)
+	}
+	{
+		e.FieldStart("status")
+		s.Status.Encode(e)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfNativeMirrorPlacement = [11]string{
+	0:  "$schema",
+	1:  "attempts",
+	2:  "clusterSlug",
+	3:  "createdAt",
+	4:  "creationFailedAt",
+	5:  "desiredState",
+	6:  "lastError",
+	7:  "nextRetryAt",
+	8:  "placementId",
+	9:  "stage",
+	10: "status",
+}
+
+// Decode decodes NativeMirrorPlacement from json.
+func (s *NativeMirrorPlacement) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode NativeMirrorPlacement to nil")
+	}
+	var requiredBitSet [2]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "attempts":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Int64()
+				s.Attempts = int64(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"attempts\"")
+			}
+		case "clusterSlug":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.ClusterSlug = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"clusterSlug\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "creationFailedAt":
+			if err := func() error {
+				s.CreationFailedAt.Reset()
+				if err := s.CreationFailedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"creationFailedAt\"")
+			}
+		case "desiredState":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				if err := s.DesiredState.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"desiredState\"")
+			}
+		case "lastError":
+			if err := func() error {
+				s.LastError.Reset()
+				if err := s.LastError.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"lastError\"")
+			}
+		case "nextRetryAt":
+			if err := func() error {
+				s.NextRetryAt.Reset()
+				if err := s.NextRetryAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"nextRetryAt\"")
+			}
+		case "placementId":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.PlacementId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"placementId\"")
+			}
+		case "stage":
+			requiredBitSet[1] |= 1 << 1
+			if err := func() error {
+				if err := s.Stage.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"stage\"")
+			}
+		case "status":
+			requiredBitSet[1] |= 1 << 2
+			if err := func() error {
+				if err := s.Status.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"status\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode NativeMirrorPlacement")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [2]uint8{
+		0b00101110,
+		0b00000111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfNativeMirrorPlacement) {
+					name = jsonFieldsNameOfNativeMirrorPlacement[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *NativeMirrorPlacement) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *NativeMirrorPlacement) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s NativeMirrorPlacementAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s NativeMirrorPlacementAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes NativeMirrorPlacementAdditional from json.
+func (s *NativeMirrorPlacementAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode NativeMirrorPlacementAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode NativeMirrorPlacementAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s NativeMirrorPlacementAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *NativeMirrorPlacementAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes NativeMirrorPlacementDesiredState as json.
+func (s NativeMirrorPlacementDesiredState) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes NativeMirrorPlacementDesiredState from json.
+func (s *NativeMirrorPlacementDesiredState) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode NativeMirrorPlacementDesiredState to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch NativeMirrorPlacementDesiredState(v) {
+	case NativeMirrorPlacementDesiredStateActive:
+		*s = NativeMirrorPlacementDesiredStateActive
+	case NativeMirrorPlacementDesiredStateDeleted:
+		*s = NativeMirrorPlacementDesiredStateDeleted
+	default:
+		*s = NativeMirrorPlacementDesiredState(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s NativeMirrorPlacementDesiredState) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *NativeMirrorPlacementDesiredState) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes NativeMirrorPlacementStage as json.
+func (s NativeMirrorPlacementStage) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes NativeMirrorPlacementStage from json.
+func (s *NativeMirrorPlacementStage) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode NativeMirrorPlacementStage to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch NativeMirrorPlacementStage(v) {
+	case NativeMirrorPlacementStagePending:
+		*s = NativeMirrorPlacementStagePending
+	case NativeMirrorPlacementStageProvisioned:
+		*s = NativeMirrorPlacementStageProvisioned
+	case NativeMirrorPlacementStageRegistered:
+		*s = NativeMirrorPlacementStageRegistered
+	case NativeMirrorPlacementStageSeeded:
+		*s = NativeMirrorPlacementStageSeeded
+	case NativeMirrorPlacementStageAnnounced:
+		*s = NativeMirrorPlacementStageAnnounced
+	default:
+		*s = NativeMirrorPlacementStage(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s NativeMirrorPlacementStage) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *NativeMirrorPlacementStage) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes NativeMirrorPlacementStatus as json.
+func (s NativeMirrorPlacementStatus) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes NativeMirrorPlacementStatus from json.
+func (s *NativeMirrorPlacementStatus) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode NativeMirrorPlacementStatus to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch NativeMirrorPlacementStatus(v) {
+	case NativeMirrorPlacementStatusProcessing:
+		*s = NativeMirrorPlacementStatusProcessing
+	case NativeMirrorPlacementStatusReady:
+		*s = NativeMirrorPlacementStatusReady
+	case NativeMirrorPlacementStatusFailed:
+		*s = NativeMirrorPlacementStatusFailed
+	case NativeMirrorPlacementStatusSuspended:
+		*s = NativeMirrorPlacementStatusSuspended
+	default:
+		*s = NativeMirrorPlacementStatus(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s NativeMirrorPlacementStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *NativeMirrorPlacementStatus) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *OIDCProvider) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *OIDCProvider) encodeFields(e *jx.Encoder) {
+	{
+		if s.Description.Set {
+			e.FieldStart("description")
+			s.Description.Encode(e)
+		}
+	}
+	{
+		if s.DisplayName.Set {
+			e.FieldStart("displayName")
+			s.DisplayName.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("issuer")
+		e.Str(s.Issuer)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfOIDCProvider = [4]string{
+	0: "description",
+	1: "displayName",
+	2: "id",
+	3: "issuer",
+}
+
+// Decode decodes OIDCProvider from json.
+func (s *OIDCProvider) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OIDCProvider to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "description":
+			if err := func() error {
+				s.Description.Reset()
+				if err := s.Description.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"description\"")
+			}
+		case "displayName":
+			if err := func() error {
+				s.DisplayName.Reset()
+				if err := s.DisplayName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"displayName\"")
+			}
+		case "id":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "issuer":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Issuer = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"issuer\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OIDCProvider")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00001100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfOIDCProvider) {
+					name = jsonFieldsNameOfOIDCProvider[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *OIDCProvider) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OIDCProvider) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s OIDCProviderAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s OIDCProviderAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes OIDCProviderAdditional from json.
+func (s *OIDCProviderAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OIDCProviderAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OIDCProviderAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OIDCProviderAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OIDCProviderAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes AddOrgMemberInputBodyRole as json.
+func (o OptAddOrgMemberInputBodyRole) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes AddOrgMemberInputBodyRole from json.
+func (o *OptAddOrgMemberInputBodyRole) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptAddOrgMemberInputBodyRole to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptAddOrgMemberInputBodyRole) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptAddOrgMemberInputBodyRole) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes AuditEventMetadata as json.
+func (o OptAuditEventMetadata) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes AuditEventMetadata from json.
+func (o *OptAuditEventMetadata) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptAuditEventMetadata to nil")
+	}
+	o.Set = true
+	o.Value = make(AuditEventMetadata)
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptAuditEventMetadata) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptAuditEventMetadata) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes bool as json.
+func (o OptBool) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Bool(bool(o.Value))
+}
+
+// Decode decodes bool from json.
+func (o *OptBool) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptBool to nil")
+	}
+	o.Set = true
+	v, err := d.Bool()
+	if err != nil {
+		return err
+	}
+	o.Value = bool(v)
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptBool) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptBool) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CISetupBlock as json.
+func (o OptCISetupBlock) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes CISetupBlock from json.
+func (o *OptCISetupBlock) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptCISetupBlock to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptCISetupBlock) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptCISetupBlock) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CIWebhookAuditEventViewMetadata as json.
+func (o OptCIWebhookAuditEventViewMetadata) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes CIWebhookAuditEventViewMetadata from json.
+func (o *OptCIWebhookAuditEventViewMetadata) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptCIWebhookAuditEventViewMetadata to nil")
+	}
+	o.Set = true
+	o.Value = make(CIWebhookAuditEventViewMetadata)
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptCIWebhookAuditEventViewMetadata) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptCIWebhookAuditEventViewMetadata) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CreateRepoCIWebhookInputBodyConfig as json.
+func (o OptCreateRepoCIWebhookInputBodyConfig) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes CreateRepoCIWebhookInputBodyConfig from json.
+func (o *OptCreateRepoCIWebhookInputBodyConfig) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptCreateRepoCIWebhookInputBodyConfig to nil")
+	}
+	o.Set = true
+	o.Value = make(CreateRepoCIWebhookInputBodyConfig)
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptCreateRepoCIWebhookInputBodyConfig) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptCreateRepoCIWebhookInputBodyConfig) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes CreateRepoInputBodyObjectFormat as json.
+func (o OptCreateRepoInputBodyObjectFormat) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes CreateRepoInputBodyObjectFormat from json.
+func (o *OptCreateRepoInputBodyObjectFormat) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptCreateRepoInputBodyObjectFormat to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptCreateRepoInputBodyObjectFormat) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptCreateRepoInputBodyObjectFormat) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes time.Time as json.
+func (o OptDateTime) Encode(e *jx.Encoder, format func(*jx.Encoder, time.Time)) {
+	if !o.Set {
+		return
+	}
+	format(e, o.Value)
+}
+
+// Decode decodes time.Time from json.
+func (o *OptDateTime) Decode(d *jx.Decoder, format func(*jx.Decoder) (time.Time, error)) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptDateTime to nil")
+	}
+	o.Set = true
+	v, err := format(d)
+	if err != nil {
+		return err
+	}
+	o.Value = v
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptDateTime) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e, json.EncodeDateTime)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptDateTime) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d, json.DecodeDateTime)
+}
+
+// Encode encodes float64 as json.
+func (o OptFloat64) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Float64(float64(o.Value))
+}
+
+// Decode decodes float64 from json.
+func (o *OptFloat64) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptFloat64 to nil")
+	}
+	o.Set = true
+	v, err := d.Float64()
+	if err != nil {
+		return err
+	}
+	o.Value = float64(v)
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptFloat64) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptFloat64) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes ForgeRepoIdentity as json.
+func (o OptForgeRepoIdentity) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes ForgeRepoIdentity from json.
+func (o *OptForgeRepoIdentity) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptForgeRepoIdentity to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptForgeRepoIdentity) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptForgeRepoIdentity) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetMeOutputBodyMode as json.
+func (o OptGetMeOutputBodyMode) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes GetMeOutputBodyMode from json.
+func (o *OptGetMeOutputBodyMode) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptGetMeOutputBodyMode to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptGetMeOutputBodyMode) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptGetMeOutputBodyMode) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetPermissionsOutputBodyExplain as json.
+func (o OptGetPermissionsOutputBodyExplain) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes GetPermissionsOutputBodyExplain from json.
+func (o *OptGetPermissionsOutputBodyExplain) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptGetPermissionsOutputBodyExplain to nil")
+	}
+	o.Set = true
+	o.Value = make(GetPermissionsOutputBodyExplain)
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptGetPermissionsOutputBodyExplain) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptGetPermissionsOutputBodyExplain) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GetVersionOutputBodyMode as json.
+func (o OptGetVersionOutputBodyMode) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes GetVersionOutputBodyMode from json.
+func (o *OptGetVersionOutputBodyMode) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptGetVersionOutputBodyMode to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptGetVersionOutputBodyMode) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptGetVersionOutputBodyMode) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantProjectAccessInputBodyGranteeType as json.
+func (o OptGrantProjectAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes GrantProjectAccessInputBodyGranteeType from json.
+func (o *OptGrantProjectAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptGrantProjectAccessInputBodyGranteeType to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptGrantProjectAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptGrantProjectAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes GrantRepoAccessInputBodyGranteeType as json.
+func (o OptGrantRepoAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes GrantRepoAccessInputBodyGranteeType from json.
+func (o *OptGrantRepoAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptGrantRepoAccessInputBodyGranteeType to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptGrantRepoAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptGrantRepoAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes int64 as json.
+func (o OptInt64) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Int64(int64(o.Value))
+}
+
+// Decode decodes int64 from json.
+func (o *OptInt64) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptInt64 to nil")
+	}
+	o.Set = true
+	v, err := d.Int64()
+	if err != nil {
+		return err
+	}
+	o.Value = int64(v)
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptInt64) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptInt64) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MeDeletion as json.
+func (o OptMeDeletion) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes MeDeletion from json.
+func (o *OptMeDeletion) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptMeDeletion to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptMeDeletion) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptMeDeletion) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MeRegional as json.
+func (o OptMeRegional) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes MeRegional from json.
+func (o *OptMeRegional) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptMeRegional to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptMeRegional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptMeRegional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MeRegionalUnavailable as json.
+func (o OptMeRegionalUnavailable) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes MeRegionalUnavailable from json.
+func (o *OptMeRegionalUnavailable) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptMeRegionalUnavailable to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptMeRegionalUnavailable) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptMeRegionalUnavailable) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MirrorRequestFailure as json.
+func (o OptMirrorRequestFailure) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes MirrorRequestFailure from json.
+func (o *OptMirrorRequestFailure) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptMirrorRequestFailure to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptMirrorRequestFailure) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptMirrorRequestFailure) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MirrorRequestResult as json.
+func (o OptMirrorRequestResult) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes MirrorRequestResult from json.
+func (o *OptMirrorRequestResult) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptMirrorRequestResult to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptMirrorRequestResult) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptMirrorRequestResult) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes MirrorStatus as json.
+func (o OptMirrorStatus) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes MirrorStatus from json.
+func (o *OptMirrorStatus) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptMirrorStatus to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptMirrorStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptMirrorStatus) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes Org as json.
+func (o OptOrg) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes Org from json.
+func (o *OptOrg) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptOrg to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptOrg) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptOrg) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes Project as json.
+func (o OptProject) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes Project from json.
+func (o *OptProject) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptProject to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptProject) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptProject) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes Repo as json.
+func (o OptRepo) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes Repo from json.
+func (o *OptRepo) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptRepo to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptRepo) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptRepo) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoCandidate as json.
+func (o OptRepoCandidate) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes RepoCandidate from json.
+func (o *OptRepoCandidate) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptRepoCandidate to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptRepoCandidate) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptRepoCandidate) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoCapabilities as json.
+func (o OptRepoCapabilities) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes RepoCapabilities from json.
+func (o *OptRepoCapabilities) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptRepoCapabilities to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptRepoCapabilities) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptRepoCapabilities) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoIndexEntryPermission as json.
+func (o OptRepoIndexEntryPermission) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes RepoIndexEntryPermission from json.
+func (o *OptRepoIndexEntryPermission) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptRepoIndexEntryPermission to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptRepoIndexEntryPermission) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptRepoIndexEntryPermission) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoPrimaries as json.
+func (o OptRepoPrimaries) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes RepoPrimaries from json.
+func (o *OptRepoPrimaries) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptRepoPrimaries to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptRepoPrimaries) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptRepoPrimaries) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes string as json.
+func (o OptString) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	e.Str(string(o.Value))
+}
+
+// Decode decodes string from json.
+func (o *OptString) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptString to nil")
+	}
+	o.Set = true
+	v, err := d.Str()
+	if err != nil {
+		return err
+	}
+	o.Value = string(v)
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptString) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptString) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes url.URL as json.
+func (o OptURI) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	json.EncodeURI(e, o.Value)
+}
+
+// Decode decodes url.URL from json.
+func (o *OptURI) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptURI to nil")
+	}
+	o.Set = true
+	v, err := json.DecodeURI(d)
+	if err != nil {
+		return err
+	}
+	o.Value = v
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptURI) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptURI) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *Org) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *Org) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("capabilities")
+		s.Capabilities.Encode(e)
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	{
+		e.FieldStart("region")
+		e.Str(s.Region)
+	}
+	{
+		if s.WorkosOrganizationId.Set {
+			e.FieldStart("workosOrganizationId")
+			s.WorkosOrganizationId.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfOrg = [7]string{
+	0: "$schema",
+	1: "capabilities",
+	2: "createdAt",
+	3: "id",
+	4: "name",
+	5: "region",
+	6: "workosOrganizationId",
+}
+
+// Decode decodes Org from json.
+func (s *Org) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode Org to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "capabilities":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				if err := s.Capabilities.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"capabilities\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "id":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "name":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"name\"")
+			}
+		case "region":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.Region = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"region\"")
+			}
+		case "workosOrganizationId":
+			if err := func() error {
+				s.WorkosOrganizationId.Reset()
+				if err := s.WorkosOrganizationId.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"workosOrganizationId\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode Org")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00111110,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfOrg) {
+					name = jsonFieldsNameOfOrg[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *Org) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *Org) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s OrgAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s OrgAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes OrgAdditional from json.
+func (s *OrgAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OrgAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *OrgCIBuildkiteClusterView) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *OrgCIBuildkiteClusterView) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("auth_plugin_ref")
+		e.Str(s.AuthPluginRef)
+	}
+	{
+		e.FieldStart("bk_cluster_id")
+		e.Str(s.BkClusterID)
+	}
+	{
+		e.FieldStart("bk_organization")
+		e.Str(s.BkOrganization)
+	}
+	{
+		e.FieldStart("created_at")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		e.FieldStart("label")
+		e.Str(s.Label)
+	}
+	{
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("updated_at")
+		json.EncodeDateTime(e, s.UpdatedAt)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfOrgCIBuildkiteClusterView = [8]string{
+	0: "$schema",
+	1: "auth_plugin_ref",
+	2: "bk_cluster_id",
+	3: "bk_organization",
+	4: "created_at",
+	5: "label",
+	6: "owner",
+	7: "updated_at",
+}
+
+// Decode decodes OrgCIBuildkiteClusterView from json.
+func (s *OrgCIBuildkiteClusterView) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCIBuildkiteClusterView to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "auth_plugin_ref":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.AuthPluginRef = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"auth_plugin_ref\"")
+			}
+		case "bk_cluster_id":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.BkClusterID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_cluster_id\"")
+			}
+		case "bk_organization":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.BkOrganization = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_organization\"")
+			}
+		case "created_at":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"created_at\"")
+			}
+		case "label":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.Label = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"label\"")
+			}
+		case "owner":
+			requiredBitSet[0] |= 1 << 6
+			if err := func() error {
+				v, err := d.Str()
+				s.Owner = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "updated_at":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.UpdatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"updated_at\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCIBuildkiteClusterView")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b11111110,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfOrgCIBuildkiteClusterView) {
+					name = jsonFieldsNameOfOrgCIBuildkiteClusterView[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *OrgCIBuildkiteClusterView) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCIBuildkiteClusterView) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s OrgCIBuildkiteClusterViewAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s OrgCIBuildkiteClusterViewAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes OrgCIBuildkiteClusterViewAdditional from json.
+func (s *OrgCIBuildkiteClusterViewAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCIBuildkiteClusterViewAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCIBuildkiteClusterViewAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OrgCIBuildkiteClusterViewAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCIBuildkiteClusterViewAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *OrgCIBuildkiteCredentialView) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *OrgCIBuildkiteCredentialView) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("bk_organization")
+		e.Str(s.BkOrganization)
+	}
+	{
+		e.FieldStart("cipher_version")
+		e.Int64(s.CipherVersion)
+	}
+	{
+		e.FieldStart("created_at")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		if s.InboundEndpointID.Set {
+			e.FieldStart("inbound_endpoint_id")
+			s.InboundEndpointID.Encode(e)
+		}
+	}
+	{
+		if s.InboundEndpointPath.Set {
+			e.FieldStart("inbound_endpoint_path")
+			s.InboundEndpointPath.Encode(e)
+		}
+	}
+	{
+		if s.InboundEndpointURL.Set {
+			e.FieldStart("inbound_endpoint_url")
+			s.InboundEndpointURL.Encode(e)
+		}
+	}
+	{
+		if s.InboundSecret.Set {
+			e.FieldStart("inbound_secret")
+			s.InboundSecret.Encode(e)
+		}
+	}
+	{
+		if s.InboundSecretIssuedAt.Set {
+			e.FieldStart("inbound_secret_issued_at")
+			s.InboundSecretIssuedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		e.FieldStart("inbound_secret_set")
+		e.Bool(s.InboundSecretSet)
+	}
+	{
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("token_len")
+		e.Int64(s.TokenLen)
+	}
+	{
+		e.FieldStart("updated_at")
+		json.EncodeDateTime(e, s.UpdatedAt)
+	}
+	{
+		if s.VerifiedAt.Set {
+			e.FieldStart("verified_at")
+			s.VerifiedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfOrgCIBuildkiteCredentialView = [14]string{
+	0:  "$schema",
+	1:  "bk_organization",
+	2:  "cipher_version",
+	3:  "created_at",
+	4:  "inbound_endpoint_id",
+	5:  "inbound_endpoint_path",
+	6:  "inbound_endpoint_url",
+	7:  "inbound_secret",
+	8:  "inbound_secret_issued_at",
+	9:  "inbound_secret_set",
+	10: "owner",
+	11: "token_len",
+	12: "updated_at",
+	13: "verified_at",
+}
+
+// Decode decodes OrgCIBuildkiteCredentialView from json.
+func (s *OrgCIBuildkiteCredentialView) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCIBuildkiteCredentialView to nil")
+	}
+	var requiredBitSet [2]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "bk_organization":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.BkOrganization = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_organization\"")
+			}
+		case "cipher_version":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Int64()
+				s.CipherVersion = int64(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"cipher_version\"")
+			}
+		case "created_at":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"created_at\"")
+			}
+		case "inbound_endpoint_id":
+			if err := func() error {
+				s.InboundEndpointID.Reset()
+				if err := s.InboundEndpointID.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_endpoint_id\"")
+			}
+		case "inbound_endpoint_path":
+			if err := func() error {
+				s.InboundEndpointPath.Reset()
+				if err := s.InboundEndpointPath.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_endpoint_path\"")
+			}
+		case "inbound_endpoint_url":
+			if err := func() error {
+				s.InboundEndpointURL.Reset()
+				if err := s.InboundEndpointURL.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_endpoint_url\"")
+			}
+		case "inbound_secret":
+			if err := func() error {
+				s.InboundSecret.Reset()
+				if err := s.InboundSecret.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_secret\"")
+			}
+		case "inbound_secret_issued_at":
+			if err := func() error {
+				s.InboundSecretIssuedAt.Reset()
+				if err := s.InboundSecretIssuedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_secret_issued_at\"")
+			}
+		case "inbound_secret_set":
+			requiredBitSet[1] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.InboundSecretSet = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_secret_set\"")
+			}
+		case "owner":
+			requiredBitSet[1] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Owner = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "token_len":
+			requiredBitSet[1] |= 1 << 3
+			if err := func() error {
+				v, err := d.Int64()
+				s.TokenLen = int64(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"token_len\"")
+			}
+		case "updated_at":
+			requiredBitSet[1] |= 1 << 4
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.UpdatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"updated_at\"")
+			}
+		case "verified_at":
+			if err := func() error {
+				s.VerifiedAt.Reset()
+				if err := s.VerifiedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"verified_at\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCIBuildkiteCredentialView")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [2]uint8{
+		0b00001110,
+		0b00011110,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfOrgCIBuildkiteCredentialView) {
+					name = jsonFieldsNameOfOrgCIBuildkiteCredentialView[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *OrgCIBuildkiteCredentialView) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCIBuildkiteCredentialView) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s OrgCIBuildkiteCredentialViewAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s OrgCIBuildkiteCredentialViewAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes OrgCIBuildkiteCredentialViewAdditional from json.
+func (s *OrgCIBuildkiteCredentialViewAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCIBuildkiteCredentialViewAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCIBuildkiteCredentialViewAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OrgCIBuildkiteCredentialViewAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCIBuildkiteCredentialViewAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *OrgCIGitHubActionsCredentialView) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *OrgCIGitHubActionsCredentialView) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("account")
+		e.Str(s.Account)
+	}
+	{
+		if s.HasAPIToken.Set {
+			e.FieldStart("has_api_token")
+			s.HasAPIToken.Encode(e)
+		}
+	}
+	{
+		if s.InboundEndpointID.Set {
+			e.FieldStart("inbound_endpoint_id")
+			s.InboundEndpointID.Encode(e)
+		}
+	}
+	{
+		if s.InboundEndpointPath.Set {
+			e.FieldStart("inbound_endpoint_path")
+			s.InboundEndpointPath.Encode(e)
+		}
+	}
+	{
+		if s.InboundEndpointURL.Set {
+			e.FieldStart("inbound_endpoint_url")
+			s.InboundEndpointURL.Encode(e)
+		}
+	}
+	{
+		if s.InboundSecret.Set {
+			e.FieldStart("inbound_secret")
+			s.InboundSecret.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("owner")
+		e.Str(s.Owner)
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfOrgCIGitHubActionsCredentialView = [9]string{
+	0: "$schema",
+	1: "account",
+	2: "has_api_token",
+	3: "inbound_endpoint_id",
+	4: "inbound_endpoint_path",
+	5: "inbound_endpoint_url",
+	6: "inbound_secret",
+	7: "owner",
+	8: "provider",
+}
+
+// Decode decodes OrgCIGitHubActionsCredentialView from json.
+func (s *OrgCIGitHubActionsCredentialView) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCIGitHubActionsCredentialView to nil")
+	}
+	var requiredBitSet [2]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "account":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Account = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"account\"")
+			}
+		case "has_api_token":
+			if err := func() error {
+				s.HasAPIToken.Reset()
+				if err := s.HasAPIToken.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"has_api_token\"")
+			}
+		case "inbound_endpoint_id":
+			if err := func() error {
+				s.InboundEndpointID.Reset()
+				if err := s.InboundEndpointID.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_endpoint_id\"")
+			}
+		case "inbound_endpoint_path":
+			if err := func() error {
+				s.InboundEndpointPath.Reset()
+				if err := s.InboundEndpointPath.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_endpoint_path\"")
+			}
+		case "inbound_endpoint_url":
+			if err := func() error {
+				s.InboundEndpointURL.Reset()
+				if err := s.InboundEndpointURL.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_endpoint_url\"")
+			}
+		case "inbound_secret":
+			if err := func() error {
+				s.InboundSecret.Reset()
+				if err := s.InboundSecret.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"inbound_secret\"")
+			}
+		case "owner":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := d.Str()
+				s.Owner = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"owner\"")
+			}
+		case "provider":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCIGitHubActionsCredentialView")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [2]uint8{
+		0b10000010,
+		0b00000001,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfOrgCIGitHubActionsCredentialView) {
+					name = jsonFieldsNameOfOrgCIGitHubActionsCredentialView[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *OrgCIGitHubActionsCredentialView) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCIGitHubActionsCredentialView) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s OrgCIGitHubActionsCredentialViewAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s OrgCIGitHubActionsCredentialViewAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes OrgCIGitHubActionsCredentialViewAdditional from json.
+func (s *OrgCIGitHubActionsCredentialViewAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCIGitHubActionsCredentialViewAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCIGitHubActionsCredentialViewAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OrgCIGitHubActionsCredentialViewAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCIGitHubActionsCredentialViewAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *OrgCapabilities) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *OrgCapabilities) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("canCreateProject")
+		e.Bool(s.CanCreateProject)
+	}
+	{
+		e.FieldStart("canDelete")
+		e.Bool(s.CanDelete)
+	}
+	{
+		e.FieldStart("canManageMembers")
+		e.Bool(s.CanManageMembers)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfOrgCapabilities = [3]string{
+	0: "canCreateProject",
+	1: "canDelete",
+	2: "canManageMembers",
+}
+
+// Decode decodes OrgCapabilities from json.
+func (s *OrgCapabilities) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCapabilities to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "canCreateProject":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanCreateProject = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canCreateProject\"")
+			}
+		case "canDelete":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanDelete = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canDelete\"")
+			}
+		case "canManageMembers":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanManageMembers = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canManageMembers\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCapabilities")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfOrgCapabilities) {
+					name = jsonFieldsNameOfOrgCapabilities[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *OrgCapabilities) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCapabilities) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s OrgCapabilitiesAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s OrgCapabilitiesAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes OrgCapabilitiesAdditional from json.
+func (s *OrgCapabilitiesAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode OrgCapabilitiesAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode OrgCapabilitiesAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OrgCapabilitiesAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OrgCapabilitiesAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *PatchRepoCIWebhookInputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *PatchRepoCIWebhookInputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.DisplayName.Set {
+			e.FieldStart("display_name")
+			s.DisplayName.Encode(e)
+		}
+	}
+	{
+		if s.Enabled.Set {
+			e.FieldStart("enabled")
+			s.Enabled.Encode(e)
+		}
+	}
+	{
+		if s.Events != nil {
+			e.FieldStart("events")
+			e.ArrStart()
+			for _, elem := range s.Events {
+				e.Str(elem)
+			}
+			e.ArrEnd()
+		}
+	}
+	{
+		if s.PublishChecks.Set {
+			e.FieldStart("publish_checks")
+			s.PublishChecks.Encode(e)
+		}
+	}
+	{
+		if s.RefFilter.Set {
+			e.FieldStart("ref_filter")
+			s.RefFilter.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfPatchRepoCIWebhookInputBody = [6]string{
+	0: "$schema",
+	1: "display_name",
+	2: "enabled",
+	3: "events",
+	4: "publish_checks",
+	5: "ref_filter",
+}
+
+// Decode decodes PatchRepoCIWebhookInputBody from json.
+func (s *PatchRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode PatchRepoCIWebhookInputBody to nil")
+	}
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "display_name":
+			if err := func() error {
+				s.DisplayName.Reset()
+				if err := s.DisplayName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"display_name\"")
+			}
+		case "enabled":
+			if err := func() error {
+				s.Enabled.Reset()
+				if err := s.Enabled.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"enabled\"")
+			}
+		case "events":
+			if err := func() error {
+				s.Events = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.Events = append(s.Events, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"events\"")
+			}
+		case "publish_checks":
+			if err := func() error {
+				s.PublishChecks.Reset()
+				if err := s.PublishChecks.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"publish_checks\"")
+			}
+		case "ref_filter":
+			if err := func() error {
+				s.RefFilter.Reset()
+				if err := s.RefFilter.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"ref_filter\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode PatchRepoCIWebhookInputBody")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *PatchRepoCIWebhookInputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *PatchRepoCIWebhookInputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s PatchRepoCIWebhookInputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s PatchRepoCIWebhookInputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes PatchRepoCIWebhookInputBodyAdditional from json.
+func (s *PatchRepoCIWebhookInputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode PatchRepoCIWebhookInputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode PatchRepoCIWebhookInputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s PatchRepoCIWebhookInputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *PatchRepoCIWebhookInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *Project) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *Project) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("capabilities")
+		s.Capabilities.Encode(e)
+	}
+	{
+		e.FieldStart("createdAt")
+		json.EncodeDateTime(e, s.CreatedAt)
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	{
+		e.FieldStart("ownerId")
+		e.Str(s.OwnerId)
+	}
+	{
+		if s.OwnerName.Set {
+			e.FieldStart("ownerName")
+			s.OwnerName.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("ownerType")
+		s.OwnerType.Encode(e)
+	}
+	{
+		e.FieldStart("region")
+		e.Str(s.Region)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfProject = [9]string{
+	0: "$schema",
+	1: "capabilities",
+	2: "createdAt",
+	3: "id",
+	4: "name",
+	5: "ownerId",
+	6: "ownerName",
+	7: "ownerType",
+	8: "region",
+}
+
+// Decode decodes Project from json.
+func (s *Project) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode Project to nil")
+	}
+	var requiredBitSet [2]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "capabilities":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				if err := s.Capabilities.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"capabilities\"")
+			}
+		case "createdAt":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := json.DecodeDateTime(d)
+				s.CreatedAt = v
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"createdAt\"")
+			}
+		case "id":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "name":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"name\"")
+			}
+		case "ownerId":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.OwnerId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"ownerId\"")
+			}
+		case "ownerName":
+			if err := func() error {
+				s.OwnerName.Reset()
+				if err := s.OwnerName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"ownerName\"")
+			}
+		case "ownerType":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				if err := s.OwnerType.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"ownerType\"")
+			}
+		case "region":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.Region = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"region\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode Project")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [2]uint8{
+		0b10111110,
+		0b00000001,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfProject) {
+					name = jsonFieldsNameOfProject[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *Project) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *Project) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s ProjectAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ProjectAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes ProjectAdditional from json.
+func (s *ProjectAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ProjectAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ProjectAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ProjectAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ProjectAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *ProjectCapabilities) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *ProjectCapabilities) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("canCreateRepository")
+		e.Bool(s.CanCreateRepository)
+	}
+	{
+		e.FieldStart("canDelete")
+		e.Bool(s.CanDelete)
+	}
+	{
+		e.FieldStart("canManageAccess")
+		e.Bool(s.CanManageAccess)
+	}
+	{
+		e.FieldStart("canManageTrails")
+		e.Bool(s.CanManageTrails)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfProjectCapabilities = [4]string{
+	0: "canCreateRepository",
+	1: "canDelete",
+	2: "canManageAccess",
+	3: "canManageTrails",
+}
+
+// Decode decodes ProjectCapabilities from json.
+func (s *ProjectCapabilities) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ProjectCapabilities to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "canCreateRepository":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanCreateRepository = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canCreateRepository\"")
+			}
+		case "canDelete":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanDelete = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canDelete\"")
+			}
+		case "canManageAccess":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanManageAccess = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canManageAccess\"")
+			}
+		case "canManageTrails":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanManageTrails = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canManageTrails\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ProjectCapabilities")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00001111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfProjectCapabilities) {
+					name = jsonFieldsNameOfProjectCapabilities[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *ProjectCapabilities) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ProjectCapabilities) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s ProjectCapabilitiesAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ProjectCapabilitiesAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes ProjectCapabilitiesAdditional from json.
+func (s *ProjectCapabilitiesAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ProjectCapabilitiesAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ProjectCapabilitiesAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ProjectCapabilitiesAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ProjectCapabilitiesAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *ProjectGrant) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *ProjectGrant) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("granteeId")
+		e.Str(s.GranteeId)
+	}
+	{
+		if s.GranteeName.Set {
+			e.FieldStart("granteeName")
+			s.GranteeName.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("granteeType")
+		e.Str(s.GranteeType)
+	}
+	{
+		e.FieldStart("role")
+		e.Str(s.Role)
+	}
+	{
+		e.FieldStart("source")
+		e.Str(s.Source)
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfProjectGrant = [5]string{
+	0: "granteeId",
+	1: "granteeName",
+	2: "granteeType",
+	3: "role",
+	4: "source",
+}
+
+// Decode decodes ProjectGrant from json.
+func (s *ProjectGrant) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ProjectGrant to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "granteeId":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.GranteeId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"granteeId\"")
+			}
+		case "granteeName":
+			if err := func() error {
+				s.GranteeName.Reset()
+				if err := s.GranteeName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"granteeName\"")
+			}
+		case "granteeType":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.GranteeType = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"granteeType\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.Role = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
+			}
+		case "source":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.Source = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"source\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ProjectGrant")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00011101,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfProjectGrant) {
+					name = jsonFieldsNameOfProjectGrant[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *ProjectGrant) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ProjectGrant) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s ProjectGrantAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s ProjectGrantAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes ProjectGrantAdditional from json.
+func (s *ProjectGrantAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ProjectGrantAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode ProjectGrantAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ProjectGrantAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ProjectGrantAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes ProjectOwnerType as json.
+func (s ProjectOwnerType) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes ProjectOwnerType from json.
+func (s *ProjectOwnerType) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode ProjectOwnerType to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch ProjectOwnerType(v) {
+	case ProjectOwnerTypeOrg:
+		*s = ProjectOwnerTypeOrg
+	case ProjectOwnerTypeAccount:
+		*s = ProjectOwnerTypeAccount
+	default:
+		*s = ProjectOwnerType(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s ProjectOwnerType) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *ProjectOwnerType) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.AuthPluginRef.Set {
+			e.FieldStart("auth_plugin_ref")
+			s.AuthPluginRef.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("bk_cluster_id")
+		e.Str(s.BkClusterID)
+	}
+	{
+		e.FieldStart("bk_organization")
+		e.Str(s.BkOrganization)
+	}
+	{
+		if s.Label.Set {
+			e.FieldStart("label")
+			s.Label.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfRegisterOrgCIBuildkiteClusterInputBody = [5]string{
+	0: "$schema",
+	1: "auth_plugin_ref",
+	2: "bk_cluster_id",
+	3: "bk_organization",
+	4: "label",
+}
+
+// Decode decodes RegisterOrgCIBuildkiteClusterInputBody from json.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RegisterOrgCIBuildkiteClusterInputBody to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "auth_plugin_ref":
+			if err := func() error {
+				s.AuthPluginRef.Reset()
+				if err := s.AuthPluginRef.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"auth_plugin_ref\"")
+			}
+		case "bk_cluster_id":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.BkClusterID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_cluster_id\"")
+			}
+		case "bk_organization":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.BkOrganization = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"bk_organization\"")
+			}
+		case "label":
+			if err := func() error {
+				s.Label.Reset()
+				if err := s.Label.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"label\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RegisterOrgCIBuildkiteClusterInputBody")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00001100,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRegisterOrgCIBuildkiteClusterInputBody) {
+					name = jsonFieldsNameOfRegisterOrgCIBuildkiteClusterInputBody[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s RegisterOrgCIBuildkiteClusterInputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s RegisterOrgCIBuildkiteClusterInputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes RegisterOrgCIBuildkiteClusterInputBodyAdditional from json.
+func (s *RegisterOrgCIBuildkiteClusterInputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RegisterOrgCIBuildkiteClusterInputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RegisterOrgCIBuildkiteClusterInputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s RegisterOrgCIBuildkiteClusterInputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RegisterOrgCIBuildkiteClusterInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *Repo) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *Repo) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.Capabilities.Set {
+			e.FieldStart("capabilities")
+			s.Capabilities.Encode(e)
+		}
+	}
+	{
+		if s.ClusterHost.Set {
+			e.FieldStart("clusterHost")
+			s.ClusterHost.Encode(e)
+		}
+	}
+	{
+		if s.ClusterSlug.Set {
+			e.FieldStart("clusterSlug")
+			s.ClusterSlug.Encode(e)
+		}
+	}
+	{
+		if s.Foreign.Set {
+			e.FieldStart("foreign")
+			s.Foreign.Encode(e)
+		}
+	}
+	{
+		if s.FullName.Set {
+			e.FieldStart("fullName")
+			s.FullName.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		if s.Jurisdiction.Set {
+			e.FieldStart("jurisdiction")
+			s.Jurisdiction.Encode(e)
+		}
+	}
+	{
+		if s.MirrorSuspended.Set {
+			e.FieldStart("mirrorSuspended")
+			s.MirrorSuspended.Encode(e)
+		}
+	}
+	{
+		if s.MirrorSuspendedAt.Set {
+			e.FieldStart("mirrorSuspendedAt")
+			s.MirrorSuspendedAt.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	{
+		if s.ObjectFormat.Set {
+			e.FieldStart("objectFormat")
+			s.ObjectFormat.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("owningProjectId")
+		e.Str(s.OwningProjectId)
+	}
+	{
+		if s.Path.Set {
+			e.FieldStart("path")
+			s.Path.Encode(e)
+		}
+	}
+	{
+		if s.Primaries.Set {
+			e.FieldStart("primaries")
+			s.Primaries.Encode(e)
+		}
+	}
+	{
+		if s.Provider.Set {
+			e.FieldStart("provider")
+			s.Provider.Encode(e)
+		}
+	}
+	{
+		if s.ProvisionAttempts.Set {
+			e.FieldStart("provisionAttempts")
+			s.ProvisionAttempts.Encode(e)
+		}
+	}
+	{
+		if s.ProvisionReason.Set {
+			e.FieldStart("provisionReason")
+			s.ProvisionReason.Encode(e)
+		}
+	}
+	{
+		if s.RepoGroupId.Set {
+			e.FieldStart("repoGroupId")
+			s.RepoGroupId.Encode(e)
+		}
+	}
+	{
+		if s.State.Set {
+			e.FieldStart("state")
+			s.State.Encode(e)
+		}
+	}
+	{
+		if s.Visibility.Set {
+			e.FieldStart("visibility")
+			s.Visibility.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfRepo = [21]string{
+	0:  "$schema",
+	1:  "capabilities",
+	2:  "clusterHost",
+	3:  "clusterSlug",
+	4:  "foreign",
+	5:  "fullName",
+	6:  "id",
+	7:  "jurisdiction",
+	8:  "mirrorSuspended",
+	9:  "mirrorSuspendedAt",
+	10: "name",
+	11: "objectFormat",
+	12: "owningProjectId",
+	13: "path",
+	14: "primaries",
+	15: "provider",
+	16: "provisionAttempts",
+	17: "provisionReason",
+	18: "repoGroupId",
+	19: "state",
+	20: "visibility",
+}
+
+// Decode decodes Repo from json.
+func (s *Repo) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode Repo to nil")
+	}
+	var requiredBitSet [3]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "capabilities":
+			if err := func() error {
+				s.Capabilities.Reset()
+				if err := s.Capabilities.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"capabilities\"")
+			}
+		case "clusterHost":
+			if err := func() error {
+				s.ClusterHost.Reset()
+				if err := s.ClusterHost.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"clusterHost\"")
+			}
+		case "clusterSlug":
+			if err := func() error {
+				s.ClusterSlug.Reset()
+				if err := s.ClusterSlug.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"clusterSlug\"")
+			}
+		case "foreign":
+			if err := func() error {
+				s.Foreign.Reset()
+				if err := s.Foreign.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"foreign\"")
+			}
+		case "fullName":
+			if err := func() error {
+				s.FullName.Reset()
+				if err := s.FullName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"fullName\"")
+			}
+		case "id":
+			requiredBitSet[0] |= 1 << 6
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "jurisdiction":
+			if err := func() error {
+				s.Jurisdiction.Reset()
+				if err := s.Jurisdiction.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "mirrorSuspended":
+			if err := func() error {
+				s.MirrorSuspended.Reset()
+				if err := s.MirrorSuspended.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mirrorSuspended\"")
+			}
+		case "mirrorSuspendedAt":
+			if err := func() error {
+				s.MirrorSuspendedAt.Reset()
+				if err := s.MirrorSuspendedAt.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mirrorSuspendedAt\"")
+			}
+		case "name":
+			requiredBitSet[1] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"name\"")
+			}
+		case "objectFormat":
+			if err := func() error {
+				s.ObjectFormat.Reset()
+				if err := s.ObjectFormat.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"objectFormat\"")
+			}
+		case "owningProjectId":
+			requiredBitSet[1] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.OwningProjectId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"owningProjectId\"")
+			}
+		case "path":
+			if err := func() error {
+				s.Path.Reset()
+				if err := s.Path.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"path\"")
+			}
+		case "primaries":
+			if err := func() error {
+				s.Primaries.Reset()
+				if err := s.Primaries.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"primaries\"")
+			}
+		case "provider":
+			if err := func() error {
+				s.Provider.Reset()
+				if err := s.Provider.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "provisionAttempts":
+			if err := func() error {
+				s.ProvisionAttempts.Reset()
+				if err := s.ProvisionAttempts.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provisionAttempts\"")
+			}
+		case "provisionReason":
+			if err := func() error {
+				s.ProvisionReason.Reset()
+				if err := s.ProvisionReason.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"provisionReason\"")
+			}
+		case "repoGroupId":
+			if err := func() error {
+				s.RepoGroupId.Reset()
+				if err := s.RepoGroupId.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"repoGroupId\"")
+			}
+		case "state":
+			if err := func() error {
+				s.State.Reset()
+				if err := s.State.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"state\"")
+			}
+		case "visibility":
+			if err := func() error {
+				s.Visibility.Reset()
+				if err := s.Visibility.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"visibility\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode Repo")
 	}
-	e.Str(string(o.Value))
-}
-
-// Decode decodes GetVersionOutputBodyMode from json.
-func (o *OptGetVersionOutputBodyMode) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptGetVersionOutputBodyMode to nil")
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [3]uint8{
+		0b01000000,
+		0b00010100,
+		0b00000000,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRepo) {
+					name = jsonFieldsNameOfRepo[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptGetVersionOutputBodyMode) MarshalJSON() ([]byte, error) {
+func (s *Repo) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptGetVersionOutputBodyMode) UnmarshalJSON(data []byte) error {
+func (s *Repo) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes GrantProjectAccessInputBodyGranteeType as json.
-func (o OptGrantProjectAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	e.Str(string(o.Value))
-}
-
-// Decode decodes GrantProjectAccessInputBodyGranteeType from json.
-func (o *OptGrantProjectAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptGrantProjectAccessInputBodyGranteeType to nil")
-	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
-	}
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptGrantProjectAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+// Encode implements json.Marshaler.
+func (s RepoAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptGrantProjectAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
+// encodeFields implements json.Marshaler.
+func (s RepoAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
 
-// Encode encodes GrantRepoAccessInputBodyGranteeType as json.
-func (o OptGrantRepoAccessInputBodyGranteeType) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	e.Str(string(o.Value))
 }
 
-// Decode decodes GrantRepoAccessInputBodyGranteeType from json.
-func (o *OptGrantRepoAccessInputBodyGranteeType) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptGrantRepoAccessInputBodyGranteeType to nil")
+// Decode decodes RepoAdditional from json.
+func (s *RepoAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoAdditional to nil")
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoAdditional")
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptGrantRepoAccessInputBodyGranteeType) MarshalJSON() ([]byte, error) {
+func (s RepoAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptGrantRepoAccessInputBodyGranteeType) UnmarshalJSON(data []byte) error {
+func (s *RepoAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes int64 as json.
-func (o OptInt64) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	e.Int64(int64(o.Value))
+// Encode implements json.Marshaler.
+func (s *RepoCandidate) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes int64 from json.
-func (o *OptInt64) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptInt64 to nil")
+// encodeFields encodes fields.
+func (s *RepoCandidate) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("access")
+		s.Access.Encode(e)
 	}
-	o.Set = true
-	v, err := d.Int64()
-	if err != nil {
-		return err
+	{
+		e.FieldStart("onboardable")
+		e.Bool(s.Onboardable)
 	}
-	o.Value = int64(v)
-	return nil
-}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptInt64) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptInt64) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
+var jsonFieldsNameOfRepoCandidate = [2]string{
+	0: "access",
+	1: "onboardable",
 }
 
-// Encode encodes LookupRefResultOwnerType as json.
-func (o OptLookupRefResultOwnerType) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+// Decode decodes RepoCandidate from json.
+func (s *RepoCandidate) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCandidate to nil")
 	}
-	e.Str(string(o.Value))
-}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
 
-// Decode decodes LookupRefResultOwnerType from json.
-func (o *OptLookupRefResultOwnerType) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptLookupRefResultOwnerType to nil")
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "access":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				if err := s.Access.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"access\"")
+			}
+		case "onboardable":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.Onboardable = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"onboardable\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoCandidate")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000011,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRepoCandidate) {
+					name = jsonFieldsNameOfRepoCandidate[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptLookupRefResultOwnerType) MarshalJSON() ([]byte, error) {
+func (s *RepoCandidate) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptLookupRefResultOwnerType) UnmarshalJSON(data []byte) error {
+func (s *RepoCandidate) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes MeDeletion as json.
-func (o OptMeDeletion) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	o.Value.Encode(e)
+// Encode encodes RepoCandidateAccess as json.
+func (s RepoCandidateAccess) Encode(e *jx.Encoder) {
+	e.Str(string(s))
 }
 
-// Decode decodes MeDeletion from json.
-func (o *OptMeDeletion) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptMeDeletion to nil")
+// Decode decodes RepoCandidateAccess from json.
+func (s *RepoCandidateAccess) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCandidateAccess to nil")
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
+	v, err := d.StrBytes()
+	if err != nil {
 		return err
 	}
+	// Try to use constant string.
+	switch RepoCandidateAccess(v) {
+	case RepoCandidateAccessRead:
+		*s = RepoCandidateAccessRead
+	case RepoCandidateAccessWrite:
+		*s = RepoCandidateAccessWrite
+	case RepoCandidateAccessAdmin:
+		*s = RepoCandidateAccessAdmin
+	default:
+		*s = RepoCandidateAccess(v)
+	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptMeDeletion) MarshalJSON() ([]byte, error) {
+func (s RepoCandidateAccess) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptMeDeletion) UnmarshalJSON(data []byte) error {
+func (s *RepoCandidateAccess) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes MeRegional as json.
-func (o OptMeRegional) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	o.Value.Encode(e)
-}
-
-// Decode decodes MeRegional from json.
-func (o *OptMeRegional) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptMeRegional to nil")
-	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
-	}
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptMeRegional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+// Encode implements json.Marshaler.
+func (s RepoCandidateAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptMeRegional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
+// encodeFields implements json.Marshaler.
+func (s RepoCandidateAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
 
-// Encode encodes MeRegionalUnavailable as json.
-func (o OptMeRegionalUnavailable) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	o.Value.Encode(e)
 }
 
-// Decode decodes MeRegionalUnavailable from json.
-func (o *OptMeRegionalUnavailable) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptMeRegionalUnavailable to nil")
+// Decode decodes RepoCandidateAdditional from json.
+func (s *RepoCandidateAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCandidateAdditional to nil")
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoCandidateAdditional")
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptMeRegionalUnavailable) MarshalJSON() ([]byte, error) {
+func (s RepoCandidateAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptMeRegionalUnavailable) UnmarshalJSON(data []byte) error {
+func (s *RepoCandidateAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes MirrorRequestFailure as json.
-func (o OptMirrorRequestFailure) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	o.Value.Encode(e)
+// Encode implements json.Marshaler.
+func (s *RepoCapabilities) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes MirrorRequestFailure from json.
-func (o *OptMirrorRequestFailure) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptMirrorRequestFailure to nil")
+// encodeFields encodes fields.
+func (s *RepoCapabilities) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("canManage")
+		e.Bool(s.CanManage)
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	{
+		e.FieldStart("canPull")
+		e.Bool(s.CanPull)
 	}
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptMirrorRequestFailure) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptMirrorRequestFailure) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes MirrorRequestResult as json.
-func (o OptMirrorRequestResult) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+	{
+		e.FieldStart("canPush")
+		e.Bool(s.CanPush)
 	}
-	o.Value.Encode(e)
-}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-// Decode decodes MirrorRequestResult from json.
-func (o *OptMirrorRequestResult) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptMirrorRequestResult to nil")
-	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	return nil
 }
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptMirrorRequestResult) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+var jsonFieldsNameOfRepoCapabilities = [3]string{
+	0: "canManage",
+	1: "canPull",
+	2: "canPush",
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptMirrorRequestResult) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
+// Decode decodes RepoCapabilities from json.
+func (s *RepoCapabilities) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCapabilities to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
 
-// Encode encodes MirrorStatus as json.
-func (o OptMirrorStatus) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "canManage":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanManage = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canManage\"")
+			}
+		case "canPull":
+			requiredBitSet[0] |= 1 << 1
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanPull = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canPull\"")
+			}
+		case "canPush":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Bool()
+				s.CanPush = bool(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"canPush\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoCapabilities")
 	}
-	e.Str(string(o.Value))
-}
-
-// Decode decodes MirrorStatus from json.
-func (o *OptMirrorStatus) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptMirrorStatus to nil")
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRepoCapabilities) {
+					name = jsonFieldsNameOfRepoCapabilities[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptMirrorStatus) MarshalJSON() ([]byte, error) {
+func (s *RepoCapabilities) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptMirrorStatus) UnmarshalJSON(data []byte) error {
+func (s *RepoCapabilities) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes Org as json.
-func (o OptOrg) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	o.Value.Encode(e)
-}
-
-// Decode decodes Org from json.
-func (o *OptOrg) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptOrg to nil")
-	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
-	}
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptOrg) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+// Encode implements json.Marshaler.
+func (s RepoCapabilitiesAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptOrg) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
+// encodeFields implements json.Marshaler.
+func (s RepoCapabilitiesAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
 
-// Encode encodes Project as json.
-func (o OptProject) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	o.Value.Encode(e)
 }
 
-// Decode decodes Project from json.
-func (o *OptProject) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptProject to nil")
+// Decode decodes RepoCapabilitiesAdditional from json.
+func (s *RepoCapabilitiesAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCapabilitiesAdditional to nil")
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoCapabilitiesAdditional")
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptProject) MarshalJSON() ([]byte, error) {
+func (s RepoCapabilitiesAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptProject) UnmarshalJSON(data []byte) error {
+func (s *RepoCapabilitiesAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes Repo as json.
-func (o OptRepo) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	o.Value.Encode(e)
+// Encode implements json.Marshaler.
+func (s *RepoCollaborator) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// Decode decodes Repo from json.
-func (o *OptRepo) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptRepo to nil")
+// encodeFields encodes fields.
+func (s *RepoCollaborator) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("accountId")
+		e.Str(s.AccountId)
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	{
+		if s.Handle.Set {
+			e.FieldStart("handle")
+			s.Handle.Encode(e)
+		}
 	}
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptRepo) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepo) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes RepoCandidate as json.
-func (o OptRepoCandidate) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+	{
+		e.FieldStart("role")
+		e.Str(s.Role)
 	}
-	o.Value.Encode(e)
-}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
 
-// Decode decodes RepoCandidate from json.
-func (o *OptRepoCandidate) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptRepoCandidate to nil")
-	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	return nil
 }
 
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptRepoCandidate) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+var jsonFieldsNameOfRepoCollaborator = [3]string{
+	0: "accountId",
+	1: "handle",
+	2: "role",
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepoCandidate) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
+// Decode decodes RepoCollaborator from json.
+func (s *RepoCollaborator) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCollaborator to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
 
-// Encode encodes RepoPrimaries as json.
-func (o OptRepoPrimaries) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "accountId":
+			requiredBitSet[0] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.AccountId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"accountId\"")
+			}
+		case "handle":
+			if err := func() error {
+				s.Handle.Reset()
+				if err := s.Handle.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"handle\"")
+			}
+		case "role":
+			requiredBitSet[0] |= 1 << 2
+			if err := func() error {
+				v, err := d.Str()
+				s.Role = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"role\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoCollaborator")
 	}
-	o.Value.Encode(e)
-}
-
-// Decode decodes RepoPrimaries from json.
-func (o *OptRepoPrimaries) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptRepoPrimaries to nil")
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00000101,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRepoCollaborator) {
+					name = jsonFieldsNameOfRepoCollaborator[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
 	}
-	o.Set = true
-	if err := o.Value.Decode(d); err != nil {
-		return err
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptRepoPrimaries) MarshalJSON() ([]byte, error) {
+func (s *RepoCollaborator) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepoPrimaries) UnmarshalJSON(data []byte) error {
+func (s *RepoCollaborator) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes string as json.
-func (o OptString) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
-	}
-	e.Str(string(o.Value))
-}
-
-// Decode decodes string from json.
-func (o *OptString) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptString to nil")
-	}
-	o.Set = true
-	v, err := d.Str()
-	if err != nil {
-		return err
-	}
-	o.Value = string(v)
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s OptString) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
+// Encode implements json.Marshaler.
+func (s RepoCollaboratorAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
 }
 
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptString) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
+// encodeFields implements json.Marshaler.
+func (s RepoCollaboratorAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
 
-// Encode encodes url.URL as json.
-func (o OptURI) Encode(e *jx.Encoder) {
-	if !o.Set {
-		return
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
 	}
-	json.EncodeURI(e, o.Value)
 }
 
-// Decode decodes url.URL from json.
-func (o *OptURI) Decode(d *jx.Decoder) error {
-	if o == nil {
-		return errors.New("invalid: unable to decode OptURI to nil")
+// Decode decodes RepoCollaboratorAdditional from json.
+func (s *RepoCollaboratorAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoCollaboratorAdditional to nil")
 	}
-	o.Set = true
-	v, err := json.DecodeURI(d)
-	if err != nil {
-		return err
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoCollaboratorAdditional")
 	}
-	o.Value = v
+
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptURI) MarshalJSON() ([]byte, error) {
+func (s RepoCollaboratorAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptURI) UnmarshalJSON(data []byte) error {
+func (s *RepoCollaboratorAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Org) Encode(e *jx.Encoder) {
+func (s *RepoFacetPage) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Org) encodeFields(e *jx.Encoder) {
+func (s *RepoFacetPage) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -18294,25 +27536,17 @@ func (s *Org) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("createdAt")
-		json.EncodeDateTime(e, s.CreatedAt)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("name")
-		e.Str(s.Name)
-	}
-	{
-		e.FieldStart("region")
-		e.Str(s.Region)
+		e.FieldStart("items")
+		e.ArrStart()
+		for _, elem := range s.Items {
+			e.Str(elem)
+		}
+		e.ArrEnd()
 	}
 	{
-		if s.WorkosOrganizationId.Set {
-			e.FieldStart("workosOrganizationId")
-			s.WorkosOrganizationId.Encode(e)
+		if s.NextPageToken.Set {
+			e.FieldStart("nextPageToken")
+			s.NextPageToken.Encode(e)
 		}
 	}
 	for k, elem := range s.AdditionalProps {
@@ -18324,19 +27558,16 @@ func (s *Org) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfOrg = [6]string{
+var jsonFieldsNameOfRepoFacetPage = [3]string{
 	0: "$schema",
-	1: "createdAt",
-	2: "id",
-	3: "name",
-	4: "region",
-	5: "workosOrganizationId",
+	1: "items",
+	2: "nextPageToken",
 }
 
-// Decode decodes Org from json.
-func (s *Org) Decode(d *jx.Decoder) error {
+// Decode decodes RepoFacetPage from json.
+func (s *RepoFacetPage) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Org to nil")
+		return errors.New("invalid: unable to decode RepoFacetPage to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -18353,63 +27584,35 @@ func (s *Org) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "createdAt":
+		case "items":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"createdAt\"")
-			}
-		case "id":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
-			}
-		case "name":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
-			}
-		case "region":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.Region = string(v)
-				if err != nil {
+				s.Items = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.Items = append(s.Items, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"region\"")
+				return errors.Wrap(err, "decode field \"items\"")
 			}
-		case "workosOrganizationId":
+		case "nextPageToken":
 			if err := func() error {
-				s.WorkosOrganizationId.Reset()
-				if err := s.WorkosOrganizationId.Decode(d); err != nil {
+				s.NextPageToken.Reset()
+				if err := s.NextPageToken.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"workosOrganizationId\"")
+				return errors.Wrap(err, "decode field \"nextPageToken\"")
 			}
 		default:
 			var elem jx.Raw
@@ -18427,12 +27630,12 @@ func (s *Org) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Org")
+		return errors.Wrap(err, "decode RepoFacetPage")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -18444,8 +27647,8 @@ func (s *Org) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfOrg) {
-					name = jsonFieldsNameOfOrg[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfRepoFacetPage) {
+					name = jsonFieldsNameOfRepoFacetPage[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -18466,27 +27669,27 @@ func (s *Org) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Org) MarshalJSON() ([]byte, error) {
+func (s *RepoFacetPage) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Org) UnmarshalJSON(data []byte) error {
+func (s *RepoFacetPage) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s OrgAdditional) Encode(e *jx.Encoder) {
+func (s RepoFacetPageAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s OrgAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoFacetPageAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -18496,10 +27699,10 @@ func (s OrgAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes OrgAdditional from json.
-func (s *OrgAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoFacetPageAdditional from json.
+func (s *RepoFacetPageAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode OrgAdditional to nil")
+		return errors.New("invalid: unable to decode RepoFacetPageAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -18517,67 +27720,55 @@ func (s *OrgAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode OrgAdditional")
+		return errors.Wrap(err, "decode RepoFacetPageAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OrgAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoFacetPageAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OrgAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoFacetPageAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *PatchRepoCIWebhookInputBody) Encode(e *jx.Encoder) {
+func (s *RepoGrant) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *PatchRepoCIWebhookInputBody) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
+func (s *RepoGrant) encodeFields(e *jx.Encoder) {
 	{
-		if s.DisplayName.Set {
-			e.FieldStart("display_name")
-			s.DisplayName.Encode(e)
-		}
+		e.FieldStart("granteeId")
+		e.Str(s.GranteeId)
 	}
 	{
-		if s.Enabled.Set {
-			e.FieldStart("enabled")
-			s.Enabled.Encode(e)
+		if s.GranteeName.Set {
+			e.FieldStart("granteeName")
+			s.GranteeName.Encode(e)
 		}
 	}
 	{
-		if s.Events != nil {
-			e.FieldStart("events")
-			e.ArrStart()
-			for _, elem := range s.Events {
-				e.Str(elem)
-			}
-			e.ArrEnd()
-		}
+		e.FieldStart("granteeType")
+		e.Str(s.GranteeType)
 	}
 	{
-		if s.RefFilter.Set {
-			e.FieldStart("ref_filter")
-			s.RefFilter.Encode(e)
-		}
+		e.FieldStart("role")
+		e.Str(s.Role)
+	}
+	{
+		e.FieldStart("source")
+		e.Str(s.Source)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -18588,81 +27779,81 @@ func (s *PatchRepoCIWebhookInputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfPatchRepoCIWebhookInputBody = [5]string{
-	0: "$schema",
-	1: "display_name",
-	2: "enabled",
-	3: "events",
-	4: "ref_filter",
+var jsonFieldsNameOfRepoGrant = [5]string{
+	0: "granteeId",
+	1: "granteeName",
+	2: "granteeType",
+	3: "role",
+	4: "source",
 }
 
-// Decode decodes PatchRepoCIWebhookInputBody from json.
-func (s *PatchRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
+// Decode decodes RepoGrant from json.
+func (s *RepoGrant) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode PatchRepoCIWebhookInputBody to nil")
+		return errors.New("invalid: unable to decode RepoGrant to nil")
 	}
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "granteeId":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				v, err := d.Str()
+				s.GranteeId = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"granteeId\"")
 			}
-		case "display_name":
+		case "granteeName":
 			if err := func() error {
-				s.DisplayName.Reset()
-				if err := s.DisplayName.Decode(d); err != nil {
+				s.GranteeName.Reset()
+				if err := s.GranteeName.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"display_name\"")
+				return errors.Wrap(err, "decode field \"granteeName\"")
 			}
-		case "enabled":
+		case "granteeType":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Enabled.Reset()
-				if err := s.Enabled.Decode(d); err != nil {
+				v, err := d.Str()
+				s.GranteeType = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"enabled\"")
+				return errors.Wrap(err, "decode field \"granteeType\"")
 			}
-		case "events":
+		case "role":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.Events = make([]string, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem string
-					v, err := d.Str()
-					elem = string(v)
-					if err != nil {
-						return err
-					}
-					s.Events = append(s.Events, elem)
-					return nil
-				}); err != nil {
+				v, err := d.Str()
+				s.Role = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"events\"")
+				return errors.Wrap(err, "decode field \"role\"")
 			}
-		case "ref_filter":
+		case "source":
+			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				s.RefFilter.Reset()
-				if err := s.RefFilter.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Source = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ref_filter\"")
+				return errors.Wrap(err, "decode field \"source\"")
 			}
 		default:
 			var elem jx.Raw
@@ -18680,34 +27871,66 @@ func (s *PatchRepoCIWebhookInputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode PatchRepoCIWebhookInputBody")
+		return errors.Wrap(err, "decode RepoGrant")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00011101,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRepoGrant) {
+					name = jsonFieldsNameOfRepoGrant[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
+				}
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
+			}
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *PatchRepoCIWebhookInputBody) MarshalJSON() ([]byte, error) {
+func (s *RepoGrant) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *PatchRepoCIWebhookInputBody) UnmarshalJSON(data []byte) error {
+func (s *RepoGrant) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s PatchRepoCIWebhookInputBodyAdditional) Encode(e *jx.Encoder) {
+func (s RepoGrantAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s PatchRepoCIWebhookInputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoGrantAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -18717,10 +27940,10 @@ func (s PatchRepoCIWebhookInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes PatchRepoCIWebhookInputBodyAdditional from json.
-func (s *PatchRepoCIWebhookInputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoGrantAdditional from json.
+func (s *RepoGrantAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode PatchRepoCIWebhookInputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode RepoGrantAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -18738,63 +27961,53 @@ func (s *PatchRepoCIWebhookInputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode PatchRepoCIWebhookInputBodyAdditional")
+		return errors.Wrap(err, "decode RepoGrantAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s PatchRepoCIWebhookInputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoGrantAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *PatchRepoCIWebhookInputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoGrantAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Project) Encode(e *jx.Encoder) {
+func (s *RepoIDResolution) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Project) encodeFields(e *jx.Encoder) {
+func (s *RepoIDResolution) encodeFields(e *jx.Encoder) {
 	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
+		if s.FullName.Set {
+			e.FieldStart("fullName")
+			s.FullName.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("createdAt")
-		json.EncodeDateTime(e, s.CreatedAt)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("name")
-		e.Str(s.Name)
-	}
-	{
-		e.FieldStart("ownerId")
-		e.Str(s.OwnerId)
+		if s.Provider.Set {
+			e.FieldStart("provider")
+			s.Provider.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("ownerType")
-		s.OwnerType.Encode(e)
+		e.FieldStart("repoId")
+		e.Str(s.RepoId)
 	}
 	{
-		e.FieldStart("region")
-		e.Str(s.Region)
+		e.FieldStart("status")
+		s.Status.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -18805,105 +28018,64 @@ func (s *Project) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfProject = [7]string{
-	0: "$schema",
-	1: "createdAt",
-	2: "id",
-	3: "name",
-	4: "ownerId",
-	5: "ownerType",
-	6: "region",
+var jsonFieldsNameOfRepoIDResolution = [4]string{
+	0: "fullName",
+	1: "provider",
+	2: "repoId",
+	3: "status",
 }
 
-// Decode decodes Project from json.
-func (s *Project) Decode(d *jx.Decoder) error {
+// Decode decodes RepoIDResolution from json.
+func (s *RepoIDResolution) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Project to nil")
+		return errors.New("invalid: unable to decode RepoIDResolution to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
+		case "fullName":
 			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
+				s.FullName.Reset()
+				if err := s.FullName.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
+				return errors.Wrap(err, "decode field \"fullName\"")
 			}
-		case "createdAt":
-			requiredBitSet[0] |= 1 << 1
+		case "provider":
 			if err := func() error {
-				v, err := json.DecodeDateTime(d)
-				s.CreatedAt = v
-				if err != nil {
+				s.Provider.Reset()
+				if err := s.Provider.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"createdAt\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
-		case "id":
+		case "repoId":
 			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
-				s.ID = string(v)
+				s.RepoId = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
+				return errors.Wrap(err, "decode field \"repoId\"")
 			}
-		case "name":
+		case "status":
 			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
-			}
-		case "ownerId":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.OwnerId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ownerId\"")
-			}
-		case "ownerType":
-			requiredBitSet[0] |= 1 << 5
-			if err := func() error {
-				if err := s.OwnerType.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"ownerType\"")
-			}
-		case "region":
-			requiredBitSet[0] |= 1 << 6
-			if err := func() error {
-				v, err := d.Str()
-				s.Region = string(v)
-				if err != nil {
+				if err := s.Status.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"region\"")
+				return errors.Wrap(err, "decode field \"status\"")
 			}
 		default:
 			var elem jx.Raw
@@ -18921,12 +28093,12 @@ func (s *Project) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Project")
+		return errors.Wrap(err, "decode RepoIDResolution")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b01111110,
+		0b00001100,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -18938,8 +28110,8 @@ func (s *Project) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfProject) {
-					name = jsonFieldsNameOfProject[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfRepoIDResolution) {
+					name = jsonFieldsNameOfRepoIDResolution[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -18960,27 +28132,27 @@ func (s *Project) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Project) MarshalJSON() ([]byte, error) {
+func (s *RepoIDResolution) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Project) UnmarshalJSON(data []byte) error {
+func (s *RepoIDResolution) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ProjectAdditional) Encode(e *jx.Encoder) {
+func (s RepoIDResolutionAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ProjectAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoIDResolutionAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -18990,10 +28162,10 @@ func (s ProjectAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ProjectAdditional from json.
-func (s *ProjectAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoIDResolutionAdditional from json.
+func (s *RepoIDResolutionAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ProjectAdditional to nil")
+		return errors.New("invalid: unable to decode RepoIDResolutionAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -19011,55 +28183,195 @@ func (s *ProjectAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ProjectAdditional")
+		return errors.Wrap(err, "decode RepoIDResolutionAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ProjectAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoIDResolutionAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ProjectAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoIDResolutionAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoIDResolutionStatus as json.
+func (s RepoIDResolutionStatus) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes RepoIDResolutionStatus from json.
+func (s *RepoIDResolutionStatus) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoIDResolutionStatus to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch RepoIDResolutionStatus(v) {
+	case RepoIDResolutionStatusResolved:
+		*s = RepoIDResolutionStatusResolved
+	case RepoIDResolutionStatusUnavailable:
+		*s = RepoIDResolutionStatusUnavailable
+	default:
+		*s = RepoIDResolutionStatus(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s RepoIDResolutionStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RepoIDResolutionStatus) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ProjectGrant) Encode(e *jx.Encoder) {
+func (s *RepoIndexEntry) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ProjectGrant) encodeFields(e *jx.Encoder) {
+func (s *RepoIndexEntry) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("granteeId")
-		e.Str(s.GranteeId)
+		if s.ActivityHotness.Set {
+			e.FieldStart("activityHotness")
+			s.ActivityHotness.Encode(e)
+		}
 	}
 	{
-		if s.GranteeName.Set {
-			e.FieldStart("granteeName")
-			s.GranteeName.Encode(e)
+		if s.Archived.Set {
+			e.FieldStart("archived")
+			s.Archived.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("granteeType")
-		e.Str(s.GranteeType)
+		if s.Candidate.Set {
+			e.FieldStart("candidate")
+			s.Candidate.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("role")
-		e.Str(s.Role)
+		e.FieldStart("cell")
+		e.Str(s.Cell)
 	}
 	{
-		e.FieldStart("source")
-		e.Str(s.Source)
+		if s.CheckpointCount.Set {
+			e.FieldStart("checkpointCount")
+			s.CheckpointCount.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("clusterSlug")
+		e.Str(s.ClusterSlug)
+	}
+	{
+		if s.Forks.Set {
+			e.FieldStart("forks")
+			s.Forks.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("full_name")
+		e.Str(s.FullName)
+	}
+	{
+		e.FieldStart("id")
+		e.Str(s.ID)
+	}
+	{
+		e.FieldStart("jurisdiction")
+		e.Str(s.Jurisdiction)
+	}
+	{
+		if s.Language.Set {
+			e.FieldStart("language")
+			s.Language.Encode(e)
+		}
+	}
+	{
+		if s.LastActivityAt.Set {
+			e.FieldStart("lastActivityAt")
+			s.LastActivityAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		if s.LastPushedAt.Set {
+			e.FieldStart("lastPushedAt")
+			s.LastPushedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		e.FieldStart("name")
+		e.Str(s.Name)
+	}
+	{
+		if s.OpenPrCount.Set {
+			e.FieldStart("openPrCount")
+			s.OpenPrCount.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("org")
+		e.Str(s.Org)
+	}
+	{
+		if s.Permission.Set {
+			e.FieldStart("permission")
+			s.Permission.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("placements")
+		e.ArrStart()
+		for _, elem := range s.Placements {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
+	}
+	{
+		if s.Primaries.Set {
+			e.FieldStart("primaries")
+			s.Primaries.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		if s.PushedAt.Set {
+			e.FieldStart("pushedAt")
+			s.PushedAt.Encode(e, json.EncodeDateTime)
+		}
+	}
+	{
+		if s.Stars.Set {
+			e.FieldStart("stars")
+			s.Stars.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("visibility")
+		e.Str(s.Visibility)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -19070,81 +28382,297 @@ func (s *ProjectGrant) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfProjectGrant = [5]string{
-	0: "granteeId",
-	1: "granteeName",
-	2: "granteeType",
-	3: "role",
-	4: "source",
+var jsonFieldsNameOfRepoIndexEntry = [23]string{
+	0:  "activityHotness",
+	1:  "archived",
+	2:  "candidate",
+	3:  "cell",
+	4:  "checkpointCount",
+	5:  "clusterSlug",
+	6:  "forks",
+	7:  "full_name",
+	8:  "id",
+	9:  "jurisdiction",
+	10: "language",
+	11: "lastActivityAt",
+	12: "lastPushedAt",
+	13: "name",
+	14: "openPrCount",
+	15: "org",
+	16: "permission",
+	17: "placements",
+	18: "primaries",
+	19: "provider",
+	20: "pushedAt",
+	21: "stars",
+	22: "visibility",
 }
 
-// Decode decodes ProjectGrant from json.
-func (s *ProjectGrant) Decode(d *jx.Decoder) error {
+// Decode decodes RepoIndexEntry from json.
+func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ProjectGrant to nil")
+		return errors.New("invalid: unable to decode RepoIndexEntry to nil")
 	}
-	var requiredBitSet [1]uint8
+	var requiredBitSet [3]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "granteeId":
-			requiredBitSet[0] |= 1 << 0
+		case "activityHotness":
+			if err := func() error {
+				s.ActivityHotness.Reset()
+				if err := s.ActivityHotness.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"activityHotness\"")
+			}
+		case "archived":
+			if err := func() error {
+				s.Archived.Reset()
+				if err := s.Archived.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"archived\"")
+			}
+		case "candidate":
+			if err := func() error {
+				s.Candidate.Reset()
+				if err := s.Candidate.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"candidate\"")
+			}
+		case "cell":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.GranteeId = string(v)
+				s.Cell = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"cell\"")
+			}
+		case "checkpointCount":
+			if err := func() error {
+				s.CheckpointCount.Reset()
+				if err := s.CheckpointCount.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"checkpointCount\"")
+			}
+		case "clusterSlug":
+			requiredBitSet[0] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.ClusterSlug = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"clusterSlug\"")
+			}
+		case "forks":
+			if err := func() error {
+				s.Forks.Reset()
+				if err := s.Forks.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"forks\"")
+			}
+		case "full_name":
+			requiredBitSet[0] |= 1 << 7
+			if err := func() error {
+				v, err := d.Str()
+				s.FullName = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"full_name\"")
+			}
+		case "id":
+			requiredBitSet[1] |= 1 << 0
+			if err := func() error {
+				v, err := d.Str()
+				s.ID = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"id\"")
+			}
+		case "jurisdiction":
+			requiredBitSet[1] |= 1 << 1
+			if err := func() error {
+				v, err := d.Str()
+				s.Jurisdiction = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "language":
+			if err := func() error {
+				s.Language.Reset()
+				if err := s.Language.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"language\"")
+			}
+		case "lastActivityAt":
+			if err := func() error {
+				s.LastActivityAt.Reset()
+				if err := s.LastActivityAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"lastActivityAt\"")
+			}
+		case "lastPushedAt":
+			if err := func() error {
+				s.LastPushedAt.Reset()
+				if err := s.LastPushedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"lastPushedAt\"")
+			}
+		case "name":
+			requiredBitSet[1] |= 1 << 5
+			if err := func() error {
+				v, err := d.Str()
+				s.Name = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeId\"")
+				return errors.Wrap(err, "decode field \"name\"")
 			}
-		case "granteeName":
+		case "openPrCount":
 			if err := func() error {
-				s.GranteeName.Reset()
-				if err := s.GranteeName.Decode(d); err != nil {
+				s.OpenPrCount.Reset()
+				if err := s.OpenPrCount.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeName\"")
+				return errors.Wrap(err, "decode field \"openPrCount\"")
 			}
-		case "granteeType":
-			requiredBitSet[0] |= 1 << 2
+		case "org":
+			requiredBitSet[1] |= 1 << 7
 			if err := func() error {
 				v, err := d.Str()
-				s.GranteeType = string(v)
+				s.Org = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeType\"")
+				return errors.Wrap(err, "decode field \"org\"")
 			}
-		case "role":
-			requiredBitSet[0] |= 1 << 3
+		case "permission":
+			if err := func() error {
+				s.Permission.Reset()
+				if err := s.Permission.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"permission\"")
+			}
+		case "placements":
+			requiredBitSet[2] |= 1 << 1
+			if err := func() error {
+				s.Placements = make([]RepoPlacement, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoPlacement
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Placements = append(s.Placements, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"placements\"")
+			}
+		case "primaries":
+			if err := func() error {
+				s.Primaries.Reset()
+				if err := s.Primaries.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"primaries\"")
+			}
+		case "provider":
+			requiredBitSet[2] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.Role = string(v)
+				s.Provider = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
-		case "source":
-			requiredBitSet[0] |= 1 << 4
+		case "pushedAt":
+			if err := func() error {
+				s.PushedAt.Reset()
+				if err := s.PushedAt.Decode(d, json.DecodeDateTime); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"pushedAt\"")
+			}
+		case "stars":
+			if err := func() error {
+				s.Stars.Reset()
+				if err := s.Stars.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"stars\"")
+			}
+		case "visibility":
+			requiredBitSet[2] |= 1 << 6
 			if err := func() error {
 				v, err := d.Str()
-				s.Source = string(v)
+				s.Visibility = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"source\"")
+				return errors.Wrap(err, "decode field \"visibility\"")
 			}
 		default:
 			var elem jx.Raw
@@ -19162,12 +28690,14 @@ func (s *ProjectGrant) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ProjectGrant")
+		return errors.Wrap(err, "decode RepoIndexEntry")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [1]uint8{
-		0b00011101,
+	for i, mask := range [3]uint8{
+		0b10101000,
+		0b10100011,
+		0b01001010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -19179,8 +28709,8 @@ func (s *ProjectGrant) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfProjectGrant) {
-					name = jsonFieldsNameOfProjectGrant[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfRepoIndexEntry) {
+					name = jsonFieldsNameOfRepoIndexEntry[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -19201,27 +28731,27 @@ func (s *ProjectGrant) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ProjectGrant) MarshalJSON() ([]byte, error) {
+func (s *RepoIndexEntry) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ProjectGrant) UnmarshalJSON(data []byte) error {
+func (s *RepoIndexEntry) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ProjectGrantAdditional) Encode(e *jx.Encoder) {
+func (s RepoIndexEntryAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ProjectGrantAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoIndexEntryAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -19231,10 +28761,10 @@ func (s ProjectGrantAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ProjectGrantAdditional from json.
-func (s *ProjectGrantAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoIndexEntryAdditional from json.
+func (s *RepoIndexEntryAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ProjectGrantAdditional to nil")
+		return errors.New("invalid: unable to decode RepoIndexEntryAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -19252,163 +28782,99 @@ func (s *ProjectGrantAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ProjectGrantAdditional")
+		return errors.Wrap(err, "decode RepoIndexEntryAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ProjectGrantAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoIndexEntryAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ProjectGrantAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoIndexEntryAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes ProjectOwnerType as json.
-func (s ProjectOwnerType) Encode(e *jx.Encoder) {
+// Encode encodes RepoIndexEntryPermission as json.
+func (s RepoIndexEntryPermission) Encode(e *jx.Encoder) {
 	e.Str(string(s))
 }
 
-// Decode decodes ProjectOwnerType from json.
-func (s *ProjectOwnerType) Decode(d *jx.Decoder) error {
+// Decode decodes RepoIndexEntryPermission from json.
+func (s *RepoIndexEntryPermission) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ProjectOwnerType to nil")
+		return errors.New("invalid: unable to decode RepoIndexEntryPermission to nil")
 	}
 	v, err := d.StrBytes()
 	if err != nil {
 		return err
 	}
 	// Try to use constant string.
-	switch ProjectOwnerType(v) {
-	case ProjectOwnerTypeOrg:
-		*s = ProjectOwnerTypeOrg
-	case ProjectOwnerTypeAccount:
-		*s = ProjectOwnerTypeAccount
+	switch RepoIndexEntryPermission(v) {
+	case RepoIndexEntryPermissionRead:
+		*s = RepoIndexEntryPermissionRead
+	case RepoIndexEntryPermissionWrite:
+		*s = RepoIndexEntryPermissionWrite
+	case RepoIndexEntryPermissionAdmin:
+		*s = RepoIndexEntryPermissionAdmin
 	default:
-		*s = ProjectOwnerType(v)
+		*s = RepoIndexEntryPermission(v)
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ProjectOwnerType) MarshalJSON() ([]byte, error) {
+func (s RepoIndexEntryPermission) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ProjectOwnerType) UnmarshalJSON(data []byte) error {
+func (s *RepoIndexEntryPermission) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *Repo) Encode(e *jx.Encoder) {
+func (s *RepoPlacement) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *Repo) encodeFields(e *jx.Encoder) {
-	{
-		if s.Schema.Set {
-			e.FieldStart("$schema")
-			s.Schema.Encode(e)
-		}
-	}
-	{
-		if s.ClusterHost.Set {
-			e.FieldStart("clusterHost")
-			s.ClusterHost.Encode(e)
-		}
-	}
+func (s *RepoPlacement) encodeFields(e *jx.Encoder) {
 	{
-		if s.Foreign.Set {
-			e.FieldStart("foreign")
-			s.Foreign.Encode(e)
-		}
+		e.FieldStart("cell")
+		e.Str(s.Cell)
 	}
 	{
-		if s.FullName.Set {
-			e.FieldStart("fullName")
-			s.FullName.Encode(e)
-		}
+		e.FieldStart("clusterSlug")
+		e.Str(s.ClusterSlug)
 	}
 	{
 		e.FieldStart("id")
 		e.Str(s.ID)
 	}
 	{
-		if s.MirrorSuspended.Set {
-			e.FieldStart("mirrorSuspended")
-			s.MirrorSuspended.Encode(e)
-		}
-	}
-	{
-		if s.MirrorSuspendedAt.Set {
-			e.FieldStart("mirrorSuspendedAt")
-			s.MirrorSuspendedAt.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("name")
-		e.Str(s.Name)
-	}
-	{
-		if s.ObjectFormat.Set {
-			e.FieldStart("objectFormat")
-			s.ObjectFormat.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("owningProjectId")
-		e.Str(s.OwningProjectId)
-	}
-	{
-		if s.Path.Set {
-			e.FieldStart("path")
-			s.Path.Encode(e)
-		}
-	}
-	{
-		if s.ProvisionAttempts.Set {
-			e.FieldStart("provisionAttempts")
-			s.ProvisionAttempts.Encode(e)
-		}
-	}
-	{
-		if s.ProvisionReason.Set {
-			e.FieldStart("provisionReason")
-			s.ProvisionReason.Encode(e)
-		}
-	}
-	{
-		if s.RepoGroupId.Set {
-			e.FieldStart("repoGroupId")
-			s.RepoGroupId.Encode(e)
-		}
+		e.FieldStart("jurisdiction")
+		e.Str(s.Jurisdiction)
 	}
 	{
-		if s.State.Set {
-			e.FieldStart("state")
-			s.State.Encode(e)
-		}
+		e.FieldStart("mirror")
+		e.Bool(s.Mirror)
 	}
 	{
-		if s.Visibility.Set {
-			e.FieldStart("visibility")
-			s.Visibility.Encode(e)
-		}
+		e.FieldStart("status")
+		s.Status.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -19419,77 +28885,51 @@ func (s *Repo) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfRepo = [16]string{
-	0:  "$schema",
-	1:  "clusterHost",
-	2:  "foreign",
-	3:  "fullName",
-	4:  "id",
-	5:  "mirrorSuspended",
-	6:  "mirrorSuspendedAt",
-	7:  "name",
-	8:  "objectFormat",
-	9:  "owningProjectId",
-	10: "path",
-	11: "provisionAttempts",
-	12: "provisionReason",
-	13: "repoGroupId",
-	14: "state",
-	15: "visibility",
+var jsonFieldsNameOfRepoPlacement = [6]string{
+	0: "cell",
+	1: "clusterSlug",
+	2: "id",
+	3: "jurisdiction",
+	4: "mirror",
+	5: "status",
 }
 
-// Decode decodes Repo from json.
-func (s *Repo) Decode(d *jx.Decoder) error {
+// Decode decodes RepoPlacement from json.
+func (s *RepoPlacement) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode Repo to nil")
+		return errors.New("invalid: unable to decode RepoPlacement to nil")
 	}
-	var requiredBitSet [2]uint8
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "$schema":
-			if err := func() error {
-				s.Schema.Reset()
-				if err := s.Schema.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"$schema\"")
-			}
-		case "clusterHost":
-			if err := func() error {
-				s.ClusterHost.Reset()
-				if err := s.ClusterHost.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterHost\"")
-			}
-		case "foreign":
+		case "cell":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.Foreign.Reset()
-				if err := s.Foreign.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Cell = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"foreign\"")
+				return errors.Wrap(err, "decode field \"cell\"")
 			}
-		case "fullName":
+		case "clusterSlug":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.FullName.Reset()
-				if err := s.FullName.Decode(d); err != nil {
+				v, err := d.Str()
+				s.ClusterSlug = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"fullName\"")
+				return errors.Wrap(err, "decode field \"clusterSlug\"")
 			}
 		case "id":
-			requiredBitSet[0] |= 1 << 4
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
 				v, err := d.Str()
 				s.ID = string(v)
@@ -19500,119 +28940,305 @@ func (s *Repo) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"id\"")
 			}
-		case "mirrorSuspended":
-			if err := func() error {
-				s.MirrorSuspended.Reset()
-				if err := s.MirrorSuspended.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorSuspended\"")
-			}
-		case "mirrorSuspendedAt":
+		case "jurisdiction":
+			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
-				s.MirrorSuspendedAt.Reset()
-				if err := s.MirrorSuspendedAt.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Jurisdiction = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorSuspendedAt\"")
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
 			}
-		case "name":
-			requiredBitSet[0] |= 1 << 7
+		case "mirror":
+			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
+				v, err := d.Bool()
+				s.Mirror = bool(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
+				return errors.Wrap(err, "decode field \"mirror\"")
 			}
-		case "objectFormat":
+		case "status":
+			requiredBitSet[0] |= 1 << 5
 			if err := func() error {
-				s.ObjectFormat.Reset()
-				if err := s.ObjectFormat.Decode(d); err != nil {
+				if err := s.Status.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"objectFormat\"")
+				return errors.Wrap(err, "decode field \"status\"")
 			}
-		case "owningProjectId":
-			requiredBitSet[1] |= 1 << 1
+		default:
+			var elem jx.Raw
 			if err := func() error {
-				v, err := d.Str()
-				s.OwningProjectId = string(v)
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"owningProjectId\"")
+				return errors.Wrapf(err, "decode field %q", k)
 			}
-		case "path":
-			if err := func() error {
-				s.Path.Reset()
-				if err := s.Path.Decode(d); err != nil {
-					return err
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoPlacement")
+	}
+	// Validate required fields.
+	var failures []validate.FieldError
+	for i, mask := range [1]uint8{
+		0b00111111,
+	} {
+		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
+			// Mask only required fields and check equality to mask using XOR.
+			//
+			// If XOR result is not zero, result is not equal to expected, so some fields are missed.
+			// Bits of fields which would be set are actually bits of missed fields.
+			missed := bits.OnesCount8(result)
+			for bitN := 0; bitN < missed; bitN++ {
+				bitIdx := bits.TrailingZeros8(result)
+				fieldIdx := i*8 + bitIdx
+				var name string
+				if fieldIdx < len(jsonFieldsNameOfRepoPlacement) {
+					name = jsonFieldsNameOfRepoPlacement[fieldIdx]
+				} else {
+					name = strconv.Itoa(fieldIdx)
 				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"path\"")
+				failures = append(failures, validate.FieldError{
+					Name:  name,
+					Error: validate.ErrFieldRequired,
+				})
+				// Reset bit.
+				result &^= 1 << bitIdx
 			}
-		case "provisionAttempts":
-			if err := func() error {
-				s.ProvisionAttempts.Reset()
-				if err := s.ProvisionAttempts.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provisionAttempts\"")
+		}
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *RepoPlacement) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RepoPlacement) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s RepoPlacementAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s RepoPlacementAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes RepoPlacementAdditional from json.
+func (s *RepoPlacementAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoPlacementAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
 			}
-		case "provisionReason":
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode RepoPlacementAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s RepoPlacementAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RepoPlacementAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoPlacementStatus as json.
+func (s RepoPlacementStatus) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes RepoPlacementStatus from json.
+func (s *RepoPlacementStatus) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoPlacementStatus to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch RepoPlacementStatus(v) {
+	case RepoPlacementStatusProcessing:
+		*s = RepoPlacementStatusProcessing
+	case RepoPlacementStatusReady:
+		*s = RepoPlacementStatusReady
+	case RepoPlacementStatusFailed:
+		*s = RepoPlacementStatusFailed
+	case RepoPlacementStatusSuspended:
+		*s = RepoPlacementStatusSuspended
+	default:
+		*s = RepoPlacementStatus(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s RepoPlacementStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RepoPlacementStatus) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s *RepoPrimaries) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *RepoPrimaries) encodeFields(e *jx.Encoder) {
+	{
+		e.FieldStart("data_primary")
+		s.DataPrimary.Encode(e)
+	}
+	{
+		e.FieldStart("git_data")
+		e.Str(s.GitData)
+	}
+	{
+		e.FieldStart("processing")
+		e.Str(s.Processing)
+	}
+	{
+		if s.ProcessingPrimary.Set {
+			e.FieldStart("processing_primary")
+			s.ProcessingPrimary.Encode(e)
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfRepoPrimaries = [4]string{
+	0: "data_primary",
+	1: "git_data",
+	2: "processing",
+	3: "processing_primary",
+}
+
+// Decode decodes RepoPrimaries from json.
+func (s *RepoPrimaries) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoPrimaries to nil")
+	}
+	var requiredBitSet [1]uint8
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "data_primary":
+			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				s.ProvisionReason.Reset()
-				if err := s.ProvisionReason.Decode(d); err != nil {
+				if err := s.DataPrimary.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provisionReason\"")
+				return errors.Wrap(err, "decode field \"data_primary\"")
 			}
-		case "repoGroupId":
+		case "git_data":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.RepoGroupId.Reset()
-				if err := s.RepoGroupId.Decode(d); err != nil {
+				v, err := d.Str()
+				s.GitData = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"repoGroupId\"")
+				return errors.Wrap(err, "decode field \"git_data\"")
 			}
-		case "state":
+		case "processing":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.State.Reset()
-				if err := s.State.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Processing = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"state\"")
+				return errors.Wrap(err, "decode field \"processing\"")
 			}
-		case "visibility":
+		case "processing_primary":
 			if err := func() error {
-				s.Visibility.Reset()
-				if err := s.Visibility.Decode(d); err != nil {
+				s.ProcessingPrimary.Reset()
+				if err := s.ProcessingPrimary.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"visibility\"")
+				return errors.Wrap(err, "decode field \"processing_primary\"")
 			}
 		default:
 			var elem jx.Raw
@@ -19630,13 +29256,12 @@ func (s *Repo) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode Repo")
+		return errors.Wrap(err, "decode RepoPrimaries")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [2]uint8{
-		0b10010000,
-		0b00000010,
+	for i, mask := range [1]uint8{
+		0b00000111,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -19648,8 +29273,8 @@ func (s *Repo) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfRepo) {
-					name = jsonFieldsNameOfRepo[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfRepoPrimaries) {
+					name = jsonFieldsNameOfRepoPrimaries[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -19670,27 +29295,27 @@ func (s *Repo) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *Repo) MarshalJSON() ([]byte, error) {
+func (s *RepoPrimaries) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *Repo) UnmarshalJSON(data []byte) error {
+func (s *RepoPrimaries) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s RepoAdditional) Encode(e *jx.Encoder) {
+func (s RepoPrimariesAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s RepoAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoPrimariesAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -19700,10 +29325,10 @@ func (s RepoAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes RepoAdditional from json.
-func (s *RepoAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoPrimariesAdditional from json.
+func (s *RepoPrimariesAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoAdditional to nil")
+		return errors.New("invalid: unable to decode RepoPrimariesAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -19721,41 +29346,41 @@ func (s *RepoAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoAdditional")
+		return errors.Wrap(err, "decode RepoPrimariesAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s RepoAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoPrimariesAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoPrimariesAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *RepoCandidate) Encode(e *jx.Encoder) {
+func (s *RepoReference) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *RepoCandidate) encodeFields(e *jx.Encoder) {
+func (s *RepoReference) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("access")
-		s.Access.Encode(e)
+		e.FieldStart("fullName")
+		e.Str(s.FullName)
 	}
 	{
-		e.FieldStart("onboardable")
-		e.Bool(s.Onboardable)
+		e.FieldStart("provider")
+		e.Str(s.Provider)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -19766,42 +29391,44 @@ func (s *RepoCandidate) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfRepoCandidate = [2]string{
-	0: "access",
-	1: "onboardable",
+var jsonFieldsNameOfRepoReference = [2]string{
+	0: "fullName",
+	1: "provider",
 }
 
-// Decode decodes RepoCandidate from json.
-func (s *RepoCandidate) Decode(d *jx.Decoder) error {
+// Decode decodes RepoReference from json.
+func (s *RepoReference) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoCandidate to nil")
+		return errors.New("invalid: unable to decode RepoReference to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "access":
+		case "fullName":
 			requiredBitSet[0] |= 1 << 0
 			if err := func() error {
-				if err := s.Access.Decode(d); err != nil {
+				v, err := d.Str()
+				s.FullName = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"access\"")
+				return errors.Wrap(err, "decode field \"fullName\"")
 			}
-		case "onboardable":
+		case "provider":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Bool()
-				s.Onboardable = bool(v)
+				v, err := d.Str()
+				s.Provider = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"onboardable\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
 		default:
 			var elem jx.Raw
@@ -19819,7 +29446,7 @@ func (s *RepoCandidate) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoCandidate")
+		return errors.Wrap(err, "decode RepoReference")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -19836,8 +29463,8 @@ func (s *RepoCandidate) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfRepoCandidate) {
-					name = jsonFieldsNameOfRepoCandidate[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfRepoReference) {
+					name = jsonFieldsNameOfRepoReference[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -19858,69 +29485,27 @@ func (s *RepoCandidate) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *RepoCandidate) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoCandidate) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes RepoCandidateAccess as json.
-func (s RepoCandidateAccess) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes RepoCandidateAccess from json.
-func (s *RepoCandidateAccess) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode RepoCandidateAccess to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch RepoCandidateAccess(v) {
-	case RepoCandidateAccessRead:
-		*s = RepoCandidateAccessRead
-	case RepoCandidateAccessWrite:
-		*s = RepoCandidateAccessWrite
-	case RepoCandidateAccessAdmin:
-		*s = RepoCandidateAccessAdmin
-	default:
-		*s = RepoCandidateAccess(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s RepoCandidateAccess) MarshalJSON() ([]byte, error) {
+func (s *RepoReference) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoCandidateAccess) UnmarshalJSON(data []byte) error {
+func (s *RepoReference) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s RepoCandidateAdditional) Encode(e *jx.Encoder) {
+func (s RepoReferenceAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s RepoCandidateAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoReferenceAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -19930,10 +29515,10 @@ func (s RepoCandidateAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes RepoCandidateAdditional from json.
-func (s *RepoCandidateAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoReferenceAdditional from json.
+func (s *RepoReferenceAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoCandidateAdditional to nil")
+		return errors.New("invalid: unable to decode RepoReferenceAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -19951,55 +29536,79 @@ func (s *RepoCandidateAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoCandidateAdditional")
+		return errors.Wrap(err, "decode RepoReferenceAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s RepoCandidateAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoReferenceAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoCandidateAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoReferenceAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *RepoGrant) Encode(e *jx.Encoder) {
+func (s *RepoResolution) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *RepoGrant) encodeFields(e *jx.Encoder) {
+func (s *RepoResolution) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("granteeId")
-		e.Str(s.GranteeId)
+		if s.Candidate.Set {
+			e.FieldStart("candidate")
+			s.Candidate.Encode(e)
+		}
 	}
 	{
-		if s.GranteeName.Set {
-			e.FieldStart("granteeName")
-			s.GranteeName.Encode(e)
+		if s.FullName.Set {
+			e.FieldStart("fullName")
+			s.FullName.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("granteeType")
-		e.Str(s.GranteeType)
+		if s.Placements != nil {
+			e.FieldStart("placements")
+			e.ArrStart()
+			for _, elem := range s.Placements {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
+		}
 	}
 	{
-		e.FieldStart("role")
-		e.Str(s.Role)
+		if s.Primaries.Set {
+			e.FieldStart("primaries")
+			s.Primaries.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("source")
-		e.Str(s.Source)
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		if s.RepoId.Set {
+			e.FieldStart("repoId")
+			s.RepoId.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("requestedFullName")
+		e.Str(s.RequestedFullName)
+	}
+	{
+		e.FieldStart("status")
+		s.Status.Encode(e)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -20010,81 +29619,117 @@ func (s *RepoGrant) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfRepoGrant = [5]string{
-	0: "granteeId",
-	1: "granteeName",
-	2: "granteeType",
-	3: "role",
-	4: "source",
+var jsonFieldsNameOfRepoResolution = [8]string{
+	0: "candidate",
+	1: "fullName",
+	2: "placements",
+	3: "primaries",
+	4: "provider",
+	5: "repoId",
+	6: "requestedFullName",
+	7: "status",
 }
 
-// Decode decodes RepoGrant from json.
-func (s *RepoGrant) Decode(d *jx.Decoder) error {
+// Decode decodes RepoResolution from json.
+func (s *RepoResolution) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoGrant to nil")
+		return errors.New("invalid: unable to decode RepoResolution to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "granteeId":
-			requiredBitSet[0] |= 1 << 0
+		case "candidate":
+			if err := func() error {
+				s.Candidate.Reset()
+				if err := s.Candidate.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"candidate\"")
+			}
+		case "fullName":
+			if err := func() error {
+				s.FullName.Reset()
+				if err := s.FullName.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"fullName\"")
+			}
+		case "placements":
+			if err := func() error {
+				s.Placements = make([]RepoPlacement, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoPlacement
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Placements = append(s.Placements, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"placements\"")
+			}
+		case "primaries":
 			if err := func() error {
-				v, err := d.Str()
-				s.GranteeId = string(v)
-				if err != nil {
+				s.Primaries.Reset()
+				if err := s.Primaries.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeId\"")
+				return errors.Wrap(err, "decode field \"primaries\"")
 			}
-		case "granteeName":
+		case "provider":
+			requiredBitSet[0] |= 1 << 4
 			if err := func() error {
-				s.GranteeName.Reset()
-				if err := s.GranteeName.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Provider = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeName\"")
+				return errors.Wrap(err, "decode field \"provider\"")
 			}
-		case "granteeType":
-			requiredBitSet[0] |= 1 << 2
+		case "repoId":
 			if err := func() error {
-				v, err := d.Str()
-				s.GranteeType = string(v)
-				if err != nil {
+				s.RepoId.Reset()
+				if err := s.RepoId.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"granteeType\"")
+				return errors.Wrap(err, "decode field \"repoId\"")
 			}
-		case "role":
-			requiredBitSet[0] |= 1 << 3
+		case "requestedFullName":
+			requiredBitSet[0] |= 1 << 6
 			if err := func() error {
 				v, err := d.Str()
-				s.Role = string(v)
+				s.RequestedFullName = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"role\"")
+				return errors.Wrap(err, "decode field \"requestedFullName\"")
 			}
-		case "source":
-			requiredBitSet[0] |= 1 << 4
+		case "status":
+			requiredBitSet[0] |= 1 << 7
 			if err := func() error {
-				v, err := d.Str()
-				s.Source = string(v)
-				if err != nil {
+				if err := s.Status.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"source\"")
+				return errors.Wrap(err, "decode field \"status\"")
 			}
 		default:
 			var elem jx.Raw
@@ -20102,12 +29747,12 @@ func (s *RepoGrant) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoGrant")
+		return errors.Wrap(err, "decode RepoResolution")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011101,
+		0b11010000,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -20119,8 +29764,8 @@ func (s *RepoGrant) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfRepoGrant) {
-					name = jsonFieldsNameOfRepoGrant[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfRepoResolution) {
+					name = jsonFieldsNameOfRepoResolution[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -20141,27 +29786,27 @@ func (s *RepoGrant) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *RepoGrant) MarshalJSON() ([]byte, error) {
+func (s *RepoResolution) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoGrant) UnmarshalJSON(data []byte) error {
+func (s *RepoResolution) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s RepoGrantAdditional) Encode(e *jx.Encoder) {
+func (s RepoResolutionAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s RepoGrantAdditional) encodeFields(e *jx.Encoder) {
+func (s RepoResolutionAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -20171,10 +29816,10 @@ func (s RepoGrantAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes RepoGrantAdditional from json.
-func (s *RepoGrantAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes RepoResolutionAdditional from json.
+func (s *RepoResolutionAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoGrantAdditional to nil")
+		return errors.New("invalid: unable to decode RepoResolutionAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -20192,64 +29837,84 @@ func (s *RepoGrantAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoGrantAdditional")
+		return errors.Wrap(err, "decode RepoResolutionAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s RepoGrantAdditional) MarshalJSON() ([]byte, error) {
+func (s RepoResolutionAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoGrantAdditional) UnmarshalJSON(data []byte) error {
+func (s *RepoResolutionAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode encodes RepoResolutionStatus as json.
+func (s RepoResolutionStatus) Encode(e *jx.Encoder) {
+	e.Str(string(s))
+}
+
+// Decode decodes RepoResolutionStatus from json.
+func (s *RepoResolutionStatus) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode RepoResolutionStatus to nil")
+	}
+	v, err := d.StrBytes()
+	if err != nil {
+		return err
+	}
+	// Try to use constant string.
+	switch RepoResolutionStatus(v) {
+	case RepoResolutionStatusReady:
+		*s = RepoResolutionStatusReady
+	case RepoResolutionStatusProcessing:
+		*s = RepoResolutionStatusProcessing
+	case RepoResolutionStatusNoMirror:
+		*s = RepoResolutionStatusNoMirror
+	case RepoResolutionStatusUnavailable:
+		*s = RepoResolutionStatusUnavailable
+	default:
+		*s = RepoResolutionStatus(v)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s RepoResolutionStatus) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *RepoResolutionStatus) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *RepoIndexEntry) Encode(e *jx.Encoder) {
+func (s *ResolvePlacementsOutputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *RepoIndexEntry) encodeFields(e *jx.Encoder) {
+func (s *ResolvePlacementsOutputBody) encodeFields(e *jx.Encoder) {
 	{
-		if s.Candidate.Set {
-			e.FieldStart("candidate")
-			s.Candidate.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
-	{
-		e.FieldStart("cell")
-		e.Str(s.Cell)
-	}
-	{
-		e.FieldStart("clusterSlug")
-		e.Str(s.ClusterSlug)
-	}
-	{
-		e.FieldStart("full_name")
-		e.Str(s.FullName)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("jurisdiction")
-		e.Str(s.Jurisdiction)
-	}
-	{
-		e.FieldStart("name")
-		e.Str(s.Name)
-	}
 	{
 		e.FieldStart("placements")
 		e.ArrStart()
@@ -20258,22 +29923,6 @@ func (s *RepoIndexEntry) encodeFields(e *jx.Encoder) {
 		}
 		e.ArrEnd()
 	}
-	{
-		if s.Primaries.Set {
-			e.FieldStart("primaries")
-			s.Primaries.Encode(e)
-		}
-	}
-	{
-		if s.Stars.Set {
-			e.FieldStart("stars")
-			s.Stars.Encode(e)
-		}
-	}
-	{
-		e.FieldStart("visibility")
-		e.Str(s.Visibility)
-	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
 
@@ -20283,161 +29932,48 @@ func (s *RepoIndexEntry) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfRepoIndexEntry = [11]string{
-	0:  "candidate",
-	1:  "cell",
-	2:  "clusterSlug",
-	3:  "full_name",
-	4:  "id",
-	5:  "jurisdiction",
-	6:  "name",
-	7:  "placements",
-	8:  "primaries",
-	9:  "stars",
-	10: "visibility",
+var jsonFieldsNameOfResolvePlacementsOutputBody = [2]string{
+	0: "$schema",
+	1: "placements",
 }
 
-// Decode decodes RepoIndexEntry from json.
-func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
+// Decode decodes ResolvePlacementsOutputBody from json.
+func (s *ResolvePlacementsOutputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoIndexEntry to nil")
+		return errors.New("invalid: unable to decode ResolvePlacementsOutputBody to nil")
 	}
-	var requiredBitSet [2]uint8
+	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
-		switch string(k) {
-		case "candidate":
-			if err := func() error {
-				s.Candidate.Reset()
-				if err := s.Candidate.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"candidate\"")
-			}
-		case "cell":
-			requiredBitSet[0] |= 1 << 1
-			if err := func() error {
-				v, err := d.Str()
-				s.Cell = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cell\"")
-			}
-		case "clusterSlug":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.ClusterSlug = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterSlug\"")
-			}
-		case "full_name":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.FullName = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"full_name\"")
-			}
-		case "id":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
-			}
-		case "jurisdiction":
-			requiredBitSet[0] |= 1 << 5
-			if err := func() error {
-				v, err := d.Str()
-				s.Jurisdiction = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
-			}
-		case "name":
-			requiredBitSet[0] |= 1 << 6
-			if err := func() error {
-				v, err := d.Str()
-				s.Name = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"name\"")
-			}
-		case "placements":
-			requiredBitSet[0] |= 1 << 7
-			if err := func() error {
-				s.Placements = make([]RepoPlacement, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem RepoPlacement
-					if err := elem.Decode(d); err != nil {
-						return err
-					}
-					s.Placements = append(s.Placements, elem)
-					return nil
-				}); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"placements\"")
-			}
-		case "primaries":
-			if err := func() error {
-				s.Primaries.Reset()
-				if err := s.Primaries.Decode(d); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"primaries\"")
-			}
-		case "stars":
+		switch string(k) {
+		case "$schema":
 			if err := func() error {
-				s.Stars.Reset()
-				if err := s.Stars.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"stars\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "visibility":
-			requiredBitSet[1] |= 1 << 2
+		case "placements":
+			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Visibility = string(v)
-				if err != nil {
+				s.Placements = make([]ResolvedPlacement, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem ResolvedPlacement
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Placements = append(s.Placements, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"visibility\"")
+				return errors.Wrap(err, "decode field \"placements\"")
 			}
 		default:
 			var elem jx.Raw
@@ -20455,13 +29991,12 @@ func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoIndexEntry")
+		return errors.Wrap(err, "decode ResolvePlacementsOutputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
-	for i, mask := range [2]uint8{
-		0b11111110,
-		0b00000100,
+	for i, mask := range [1]uint8{
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -20473,8 +30008,8 @@ func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfRepoIndexEntry) {
-					name = jsonFieldsNameOfRepoIndexEntry[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolvePlacementsOutputBody) {
+					name = jsonFieldsNameOfResolvePlacementsOutputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -20495,27 +30030,27 @@ func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *RepoIndexEntry) MarshalJSON() ([]byte, error) {
+func (s *ResolvePlacementsOutputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoIndexEntry) UnmarshalJSON(data []byte) error {
+func (s *ResolvePlacementsOutputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s RepoIndexEntryAdditional) Encode(e *jx.Encoder) {
+func (s ResolvePlacementsOutputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s RepoIndexEntryAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolvePlacementsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -20525,10 +30060,10 @@ func (s RepoIndexEntryAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes RepoIndexEntryAdditional from json.
-func (s *RepoIndexEntryAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolvePlacementsOutputBodyAdditional from json.
+func (s *ResolvePlacementsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoIndexEntryAdditional to nil")
+		return errors.New("invalid: unable to decode ResolvePlacementsOutputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -20546,57 +30081,47 @@ func (s *RepoIndexEntryAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoIndexEntryAdditional")
+		return errors.Wrap(err, "decode ResolvePlacementsOutputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s RepoIndexEntryAdditional) MarshalJSON() ([]byte, error) {
+func (s ResolvePlacementsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoIndexEntryAdditional) UnmarshalJSON(data []byte) error {
+func (s *ResolvePlacementsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *RepoPlacement) Encode(e *jx.Encoder) {
+func (s *ResolveRepoIDsInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *RepoPlacement) encodeFields(e *jx.Encoder) {
-	{
-		e.FieldStart("cell")
-		e.Str(s.Cell)
-	}
-	{
-		e.FieldStart("clusterSlug")
-		e.Str(s.ClusterSlug)
-	}
-	{
-		e.FieldStart("id")
-		e.Str(s.ID)
-	}
-	{
-		e.FieldStart("jurisdiction")
-		e.Str(s.Jurisdiction)
-	}
+func (s *ResolveRepoIDsInputBody) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("mirror")
-		e.Bool(s.Mirror)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("status")
-		s.Status.Encode(e)
+		e.FieldStart("repoIds")
+		e.ArrStart()
+		for _, elem := range s.RepoIds {
+			e.Str(elem)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -20607,94 +30132,50 @@ func (s *RepoPlacement) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfRepoPlacement = [6]string{
-	0: "cell",
-	1: "clusterSlug",
-	2: "id",
-	3: "jurisdiction",
-	4: "mirror",
-	5: "status",
+var jsonFieldsNameOfResolveRepoIDsInputBody = [2]string{
+	0: "$schema",
+	1: "repoIds",
 }
 
-// Decode decodes RepoPlacement from json.
-func (s *RepoPlacement) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveRepoIDsInputBody from json.
+func (s *ResolveRepoIDsInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoPlacement to nil")
+		return errors.New("invalid: unable to decode ResolveRepoIDsInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "cell":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.Cell = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cell\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "clusterSlug":
+		case "repoIds":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.ClusterSlug = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterSlug\"")
-			}
-		case "id":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.ID = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"id\"")
-			}
-		case "jurisdiction":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.Jurisdiction = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
-			}
-		case "mirror":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Bool()
-				s.Mirror = bool(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirror\"")
-			}
-		case "status":
-			requiredBitSet[0] |= 1 << 5
-			if err := func() error {
-				if err := s.Status.Decode(d); err != nil {
+				s.RepoIds = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.RepoIds = append(s.RepoIds, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"status\"")
+				return errors.Wrap(err, "decode field \"repoIds\"")
 			}
 		default:
 			var elem jx.Raw
@@ -20712,12 +30193,12 @@ func (s *RepoPlacement) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoPlacement")
+		return errors.Wrap(err, "decode ResolveRepoIDsInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00111111,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -20729,8 +30210,8 @@ func (s *RepoPlacement) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfRepoPlacement) {
-					name = jsonFieldsNameOfRepoPlacement[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolveRepoIDsInputBody) {
+					name = jsonFieldsNameOfResolveRepoIDsInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -20751,27 +30232,27 @@ func (s *RepoPlacement) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *RepoPlacement) MarshalJSON() ([]byte, error) {
+func (s *ResolveRepoIDsInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoPlacement) UnmarshalJSON(data []byte) error {
+func (s *ResolveRepoIDsInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s RepoPlacementAdditional) Encode(e *jx.Encoder) {
+func (s ResolveRepoIDsInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s RepoPlacementAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolveRepoIDsInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -20781,10 +30262,10 @@ func (s RepoPlacementAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes RepoPlacementAdditional from json.
-func (s *RepoPlacementAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveRepoIDsInputBodyAdditional from json.
+func (s *ResolveRepoIDsInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoPlacementAdditional to nil")
+		return errors.New("invalid: unable to decode ResolveRepoIDsInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -20802,85 +30283,47 @@ func (s *RepoPlacementAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoPlacementAdditional")
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s RepoPlacementAdditional) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoPlacementAdditional) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
-// Encode encodes RepoPlacementStatus as json.
-func (s RepoPlacementStatus) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes RepoPlacementStatus from json.
-func (s *RepoPlacementStatus) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode RepoPlacementStatus to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch RepoPlacementStatus(v) {
-	case RepoPlacementStatusProcessing:
-		*s = RepoPlacementStatusProcessing
-	case RepoPlacementStatusReady:
-		*s = RepoPlacementStatusReady
-	case RepoPlacementStatusFailed:
-		*s = RepoPlacementStatusFailed
-	case RepoPlacementStatusSuspended:
-		*s = RepoPlacementStatusSuspended
-	default:
-		*s = RepoPlacementStatus(v)
+		return errors.Wrap(err, "decode ResolveRepoIDsInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s RepoPlacementStatus) MarshalJSON() ([]byte, error) {
+func (s ResolveRepoIDsInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoPlacementStatus) UnmarshalJSON(data []byte) error {
+func (s *ResolveRepoIDsInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *RepoPrimaries) Encode(e *jx.Encoder) {
+func (s *ResolveRepoIDsResponse) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *RepoPrimaries) encodeFields(e *jx.Encoder) {
+func (s *ResolveRepoIDsResponse) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("git_data")
-		e.Str(s.GitData)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
 	}
 	{
-		e.FieldStart("processing")
-		e.Str(s.Processing)
+		e.FieldStart("resolutions")
+		e.ArrStart()
+		for _, elem := range s.Resolutions {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -20891,44 +30334,48 @@ func (s *RepoPrimaries) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfRepoPrimaries = [2]string{
-	0: "git_data",
-	1: "processing",
+var jsonFieldsNameOfResolveRepoIDsResponse = [2]string{
+	0: "$schema",
+	1: "resolutions",
 }
 
-// Decode decodes RepoPrimaries from json.
-func (s *RepoPrimaries) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveRepoIDsResponse from json.
+func (s *ResolveRepoIDsResponse) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoPrimaries to nil")
+		return errors.New("invalid: unable to decode ResolveRepoIDsResponse to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "git_data":
-			requiredBitSet[0] |= 1 << 0
+		case "$schema":
 			if err := func() error {
-				v, err := d.Str()
-				s.GitData = string(v)
-				if err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"git_data\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "processing":
+		case "resolutions":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.Processing = string(v)
-				if err != nil {
+				s.Resolutions = make([]RepoIDResolution, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoIDResolution
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Resolutions = append(s.Resolutions, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"processing\"")
+				return errors.Wrap(err, "decode field \"resolutions\"")
 			}
 		default:
 			var elem jx.Raw
@@ -20946,12 +30393,12 @@ func (s *RepoPrimaries) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoPrimaries")
+		return errors.Wrap(err, "decode ResolveRepoIDsResponse")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000011,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -20963,8 +30410,8 @@ func (s *RepoPrimaries) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfRepoPrimaries) {
-					name = jsonFieldsNameOfRepoPrimaries[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolveRepoIDsResponse) {
+					name = jsonFieldsNameOfResolveRepoIDsResponse[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -20985,27 +30432,27 @@ func (s *RepoPrimaries) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *RepoPrimaries) MarshalJSON() ([]byte, error) {
+func (s *ResolveRepoIDsResponse) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoPrimaries) UnmarshalJSON(data []byte) error {
+func (s *ResolveRepoIDsResponse) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s RepoPrimariesAdditional) Encode(e *jx.Encoder) {
+func (s ResolveRepoIDsResponseAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s RepoPrimariesAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolveRepoIDsResponseAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -21015,10 +30462,10 @@ func (s RepoPrimariesAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes RepoPrimariesAdditional from json.
-func (s *RepoPrimariesAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveRepoIDsResponseAdditional from json.
+func (s *ResolveRepoIDsResponseAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode RepoPrimariesAdditional to nil")
+		return errors.New("invalid: unable to decode ResolveRepoIDsResponseAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -21036,34 +30483,34 @@ func (s *RepoPrimariesAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode RepoPrimariesAdditional")
+		return errors.Wrap(err, "decode ResolveRepoIDsResponseAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s RepoPrimariesAdditional) MarshalJSON() ([]byte, error) {
+func (s ResolveRepoIDsResponseAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoPrimariesAdditional) UnmarshalJSON(data []byte) error {
+func (s *ResolveRepoIDsResponseAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ResolvePlacementsOutputBody) Encode(e *jx.Encoder) {
+func (s *ResolveReposInputBody) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ResolvePlacementsOutputBody) encodeFields(e *jx.Encoder) {
+func (s *ResolveReposInputBody) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -21071,9 +30518,9 @@ func (s *ResolvePlacementsOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("placements")
+		e.FieldStart("repositories")
 		e.ArrStart()
-		for _, elem := range s.Placements {
+		for _, elem := range s.Repositories {
 			elem.Encode(e)
 		}
 		e.ArrEnd()
@@ -21087,15 +30534,15 @@ func (s *ResolvePlacementsOutputBody) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfResolvePlacementsOutputBody = [2]string{
+var jsonFieldsNameOfResolveReposInputBody = [2]string{
 	0: "$schema",
-	1: "placements",
+	1: "repositories",
 }
 
-// Decode decodes ResolvePlacementsOutputBody from json.
-func (s *ResolvePlacementsOutputBody) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveReposInputBody from json.
+func (s *ResolveReposInputBody) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResolvePlacementsOutputBody to nil")
+		return errors.New("invalid: unable to decode ResolveReposInputBody to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -21112,23 +30559,23 @@ func (s *ResolvePlacementsOutputBody) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "placements":
+		case "repositories":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				s.Placements = make([]ResolvedPlacement, 0)
+				s.Repositories = make([]RepoReference, 0)
 				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem ResolvedPlacement
+					var elem RepoReference
 					if err := elem.Decode(d); err != nil {
 						return err
 					}
-					s.Placements = append(s.Placements, elem)
+					s.Repositories = append(s.Repositories, elem)
 					return nil
 				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"placements\"")
+				return errors.Wrap(err, "decode field \"repositories\"")
 			}
 		default:
 			var elem jx.Raw
@@ -21146,7 +30593,7 @@ func (s *ResolvePlacementsOutputBody) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResolvePlacementsOutputBody")
+		return errors.Wrap(err, "decode ResolveReposInputBody")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
@@ -21163,8 +30610,8 @@ func (s *ResolvePlacementsOutputBody) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfResolvePlacementsOutputBody) {
-					name = jsonFieldsNameOfResolvePlacementsOutputBody[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolveReposInputBody) {
+					name = jsonFieldsNameOfResolveReposInputBody[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -21185,27 +30632,27 @@ func (s *ResolvePlacementsOutputBody) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ResolvePlacementsOutputBody) MarshalJSON() ([]byte, error) {
+func (s *ResolveReposInputBody) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResolvePlacementsOutputBody) UnmarshalJSON(data []byte) error {
+func (s *ResolveReposInputBody) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ResolvePlacementsOutputBodyAdditional) Encode(e *jx.Encoder) {
+func (s ResolveReposInputBodyAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ResolvePlacementsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolveReposInputBodyAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -21215,10 +30662,10 @@ func (s ResolvePlacementsOutputBodyAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ResolvePlacementsOutputBodyAdditional from json.
-func (s *ResolvePlacementsOutputBodyAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveReposInputBodyAdditional from json.
+func (s *ResolveReposInputBodyAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResolvePlacementsOutputBodyAdditional to nil")
+		return errors.New("invalid: unable to decode ResolveReposInputBodyAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -21236,34 +30683,34 @@ func (s *ResolvePlacementsOutputBodyAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResolvePlacementsOutputBodyAdditional")
+		return errors.Wrap(err, "decode ResolveReposInputBodyAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ResolvePlacementsOutputBodyAdditional) MarshalJSON() ([]byte, error) {
+func (s ResolveReposInputBodyAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResolvePlacementsOutputBodyAdditional) UnmarshalJSON(data []byte) error {
+func (s *ResolveReposInputBodyAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ResolvedIdentity) Encode(e *jx.Encoder) {
+func (s *ResolveReposResponse) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ResolvedIdentity) encodeFields(e *jx.Encoder) {
+func (s *ResolveReposResponse) encodeFields(e *jx.Encoder) {
 	{
 		if s.Schema.Set {
 			e.FieldStart("$schema")
@@ -21271,20 +30718,12 @@ func (s *ResolvedIdentity) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("accountId")
-		e.Str(s.AccountId)
-	}
-	{
-		e.FieldStart("handle")
-		e.Str(s.Handle)
-	}
-	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
-	}
-	{
-		e.FieldStart("providerUserId")
-		e.Str(s.ProviderUserId)
+		e.FieldStart("resolutions")
+		e.ArrStart()
+		for _, elem := range s.Resolutions {
+			elem.Encode(e)
+		}
+		e.ArrEnd()
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -21295,18 +30734,15 @@ func (s *ResolvedIdentity) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfResolvedIdentity = [5]string{
+var jsonFieldsNameOfResolveReposResponse = [2]string{
 	0: "$schema",
-	1: "accountId",
-	2: "handle",
-	3: "provider",
-	4: "providerUserId",
+	1: "resolutions",
 }
 
-// Decode decodes ResolvedIdentity from json.
-func (s *ResolvedIdentity) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveReposResponse from json.
+func (s *ResolveReposResponse) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResolvedIdentity to nil")
+		return errors.New("invalid: unable to decode ResolveReposResponse to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
@@ -21323,53 +30759,23 @@ func (s *ResolvedIdentity) Decode(d *jx.Decoder) error {
 			}(); err != nil {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "accountId":
+		case "resolutions":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Str()
-				s.AccountId = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"accountId\"")
-			}
-		case "handle":
-			requiredBitSet[0] |= 1 << 2
-			if err := func() error {
-				v, err := d.Str()
-				s.Handle = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"handle\"")
-			}
-		case "provider":
-			requiredBitSet[0] |= 1 << 3
-			if err := func() error {
-				v, err := d.Str()
-				s.Provider = string(v)
-				if err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return errors.Wrap(err, "decode field \"provider\"")
-			}
-		case "providerUserId":
-			requiredBitSet[0] |= 1 << 4
-			if err := func() error {
-				v, err := d.Str()
-				s.ProviderUserId = string(v)
-				if err != nil {
+				s.Resolutions = make([]RepoResolution, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem RepoResolution
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.Resolutions = append(s.Resolutions, elem)
+					return nil
+				}); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"providerUserId\"")
+				return errors.Wrap(err, "decode field \"resolutions\"")
 			}
 		default:
 			var elem jx.Raw
@@ -21387,12 +30793,12 @@ func (s *ResolvedIdentity) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResolvedIdentity")
+		return errors.Wrap(err, "decode ResolveReposResponse")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011110,
+		0b00000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -21404,8 +30810,8 @@ func (s *ResolvedIdentity) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfResolvedIdentity) {
-					name = jsonFieldsNameOfResolvedIdentity[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolveReposResponse) {
+					name = jsonFieldsNameOfResolveReposResponse[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -21426,27 +30832,27 @@ func (s *ResolvedIdentity) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ResolvedIdentity) MarshalJSON() ([]byte, error) {
+func (s *ResolveReposResponse) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResolvedIdentity) UnmarshalJSON(data []byte) error {
+func (s *ResolveReposResponse) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ResolvedIdentityAdditional) Encode(e *jx.Encoder) {
+func (s ResolveReposResponseAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ResolvedIdentityAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolveReposResponseAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -21456,10 +30862,10 @@ func (s ResolvedIdentityAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ResolvedIdentityAdditional from json.
-func (s *ResolvedIdentityAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolveReposResponseAdditional from json.
+func (s *ResolveReposResponseAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResolvedIdentityAdditional to nil")
+		return errors.New("invalid: unable to decode ResolveReposResponseAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -21477,53 +30883,55 @@ func (s *ResolvedIdentityAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResolvedIdentityAdditional")
+		return errors.Wrap(err, "decode ResolveReposResponseAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ResolvedIdentityAdditional) MarshalJSON() ([]byte, error) {
+func (s ResolveReposResponseAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResolvedIdentityAdditional) UnmarshalJSON(data []byte) error {
+func (s *ResolveReposResponseAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ResolvedPlacement) Encode(e *jx.Encoder) {
+func (s *ResolvedIdentity) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ResolvedPlacement) encodeFields(e *jx.Encoder) {
+func (s *ResolvedIdentity) encodeFields(e *jx.Encoder) {
 	{
-		if s.Cell.Set {
-			e.FieldStart("cell")
-			s.Cell.Encode(e)
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
 		}
 	}
 	{
-		e.FieldStart("clusterHost")
-		e.Str(s.ClusterHost)
+		e.FieldStart("accountId")
+		e.Str(s.AccountId)
 	}
 	{
-		if s.Jurisdiction.Set {
-			e.FieldStart("jurisdiction")
-			s.Jurisdiction.Encode(e)
-		}
+		e.FieldStart("handle")
+		e.Str(s.Handle)
 	}
 	{
-		e.FieldStart("mirrorId")
-		e.Str(s.MirrorId)
+		e.FieldStart("provider")
+		e.Str(s.Provider)
+	}
+	{
+		e.FieldStart("providerUserId")
+		e.Str(s.ProviderUserId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -21534,66 +30942,81 @@ func (s *ResolvedPlacement) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfResolvedPlacement = [4]string{
-	0: "cell",
-	1: "clusterHost",
-	2: "jurisdiction",
-	3: "mirrorId",
+var jsonFieldsNameOfResolvedIdentity = [5]string{
+	0: "$schema",
+	1: "accountId",
+	2: "handle",
+	3: "provider",
+	4: "providerUserId",
 }
 
-// Decode decodes ResolvedPlacement from json.
-func (s *ResolvedPlacement) Decode(d *jx.Decoder) error {
+// Decode decodes ResolvedIdentity from json.
+func (s *ResolvedIdentity) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResolvedPlacement to nil")
+		return errors.New("invalid: unable to decode ResolvedIdentity to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "cell":
+		case "$schema":
 			if err := func() error {
-				s.Cell.Reset()
-				if err := s.Cell.Decode(d); err != nil {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"cell\"")
+				return errors.Wrap(err, "decode field \"$schema\"")
 			}
-		case "clusterHost":
+		case "accountId":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.ClusterHost = string(v)
+				s.AccountId = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"clusterHost\"")
+				return errors.Wrap(err, "decode field \"accountId\"")
 			}
-		case "jurisdiction":
+		case "handle":
+			requiredBitSet[0] |= 1 << 2
 			if err := func() error {
-				s.Jurisdiction.Reset()
-				if err := s.Jurisdiction.Decode(d); err != nil {
+				v, err := d.Str()
+				s.Handle = string(v)
+				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"jurisdiction\"")
+				return errors.Wrap(err, "decode field \"handle\"")
 			}
-		case "mirrorId":
+		case "provider":
 			requiredBitSet[0] |= 1 << 3
 			if err := func() error {
 				v, err := d.Str()
-				s.MirrorId = string(v)
+				s.Provider = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"mirrorId\"")
+				return errors.Wrap(err, "decode field \"provider\"")
+			}
+		case "providerUserId":
+			requiredBitSet[0] |= 1 << 4
+			if err := func() error {
+				v, err := d.Str()
+				s.ProviderUserId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"providerUserId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -21611,12 +31034,12 @@ func (s *ResolvedPlacement) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResolvedPlacement")
+		return errors.Wrap(err, "decode ResolvedIdentity")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00001010,
+		0b00011110,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -21628,8 +31051,8 @@ func (s *ResolvedPlacement) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfResolvedPlacement) {
-					name = jsonFieldsNameOfResolvedPlacement[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolvedIdentity) {
+					name = jsonFieldsNameOfResolvedIdentity[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -21650,27 +31073,27 @@ func (s *ResolvedPlacement) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ResolvedPlacement) MarshalJSON() ([]byte, error) {
+func (s *ResolvedIdentity) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResolvedPlacement) UnmarshalJSON(data []byte) error {
+func (s *ResolvedIdentity) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ResolvedPlacementAdditional) Encode(e *jx.Encoder) {
+func (s ResolvedIdentityAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ResolvedPlacementAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolvedIdentityAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -21680,10 +31103,10 @@ func (s ResolvedPlacementAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ResolvedPlacementAdditional from json.
-func (s *ResolvedPlacementAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolvedIdentityAdditional from json.
+func (s *ResolvedIdentityAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResolvedPlacementAdditional to nil")
+		return errors.New("invalid: unable to decode ResolvedIdentityAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -21701,45 +31124,53 @@ func (s *ResolvedPlacementAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResolvedPlacementAdditional")
+		return errors.Wrap(err, "decode ResolvedIdentityAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ResolvedPlacementAdditional) MarshalJSON() ([]byte, error) {
+func (s ResolvedIdentityAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResolvedPlacementAdditional) UnmarshalJSON(data []byte) error {
+func (s *ResolvedIdentityAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s *ResourceAccess) Encode(e *jx.Encoder) {
+func (s *ResolvedPlacement) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields encodes fields.
-func (s *ResourceAccess) encodeFields(e *jx.Encoder) {
+func (s *ResolvedPlacement) encodeFields(e *jx.Encoder) {
 	{
-		e.FieldStart("permissions")
-		e.ArrStart()
-		for _, elem := range s.Permissions {
-			e.Str(elem)
+		if s.Cell.Set {
+			e.FieldStart("cell")
+			s.Cell.Encode(e)
 		}
-		e.ArrEnd()
 	}
 	{
-		e.FieldStart("resourceId")
-		e.Str(s.ResourceId)
+		e.FieldStart("clusterHost")
+		e.Str(s.ClusterHost)
+	}
+	{
+		if s.Jurisdiction.Set {
+			e.FieldStart("jurisdiction")
+			s.Jurisdiction.Encode(e)
+		}
+	}
+	{
+		e.FieldStart("mirrorId")
+		e.Str(s.MirrorId)
 	}
 	for k, elem := range s.AdditionalProps {
 		e.FieldStart(k)
@@ -21750,52 +31181,66 @@ func (s *ResourceAccess) encodeFields(e *jx.Encoder) {
 	}
 }
 
-var jsonFieldsNameOfResourceAccess = [2]string{
-	0: "permissions",
-	1: "resourceId",
+var jsonFieldsNameOfResolvedPlacement = [4]string{
+	0: "cell",
+	1: "clusterHost",
+	2: "jurisdiction",
+	3: "mirrorId",
 }
 
-// Decode decodes ResourceAccess from json.
-func (s *ResourceAccess) Decode(d *jx.Decoder) error {
+// Decode decodes ResolvedPlacement from json.
+func (s *ResolvedPlacement) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResourceAccess to nil")
+		return errors.New("invalid: unable to decode ResolvedPlacement to nil")
 	}
 	var requiredBitSet [1]uint8
 	s.AdditionalProps = map[string]jx.Raw{}
 
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
 		switch string(k) {
-		case "permissions":
-			requiredBitSet[0] |= 1 << 0
+		case "cell":
 			if err := func() error {
-				s.Permissions = make([]string, 0)
-				if err := d.Arr(func(d *jx.Decoder) error {
-					var elem string
-					v, err := d.Str()
-					elem = string(v)
-					if err != nil {
-						return err
-					}
-					s.Permissions = append(s.Permissions, elem)
-					return nil
-				}); err != nil {
+				s.Cell.Reset()
+				if err := s.Cell.Decode(d); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"permissions\"")
+				return errors.Wrap(err, "decode field \"cell\"")
 			}
-		case "resourceId":
+		case "clusterHost":
 			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
 				v, err := d.Str()
-				s.ResourceId = string(v)
+				s.ClusterHost = string(v)
 				if err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return errors.Wrap(err, "decode field \"resourceId\"")
+				return errors.Wrap(err, "decode field \"clusterHost\"")
+			}
+		case "jurisdiction":
+			if err := func() error {
+				s.Jurisdiction.Reset()
+				if err := s.Jurisdiction.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"jurisdiction\"")
+			}
+		case "mirrorId":
+			requiredBitSet[0] |= 1 << 3
+			if err := func() error {
+				v, err := d.Str()
+				s.MirrorId = string(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"mirrorId\"")
 			}
 		default:
 			var elem jx.Raw
@@ -21813,12 +31258,12 @@ func (s *ResourceAccess) Decode(d *jx.Decoder) error {
 		}
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResourceAccess")
+		return errors.Wrap(err, "decode ResolvedPlacement")
 	}
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00000011,
+		0b00001010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -21830,8 +31275,8 @@ func (s *ResourceAccess) Decode(d *jx.Decoder) error {
 				bitIdx := bits.TrailingZeros8(result)
 				fieldIdx := i*8 + bitIdx
 				var name string
-				if fieldIdx < len(jsonFieldsNameOfResourceAccess) {
-					name = jsonFieldsNameOfResourceAccess[fieldIdx]
+				if fieldIdx < len(jsonFieldsNameOfResolvedPlacement) {
+					name = jsonFieldsNameOfResolvedPlacement[fieldIdx]
 				} else {
 					name = strconv.Itoa(fieldIdx)
 				}
@@ -21852,27 +31297,27 @@ func (s *ResourceAccess) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s *ResourceAccess) MarshalJSON() ([]byte, error) {
+func (s *ResolvedPlacement) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResourceAccess) UnmarshalJSON(data []byte) error {
+func (s *ResolvedPlacement) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
 // Encode implements json.Marshaler.
-func (s ResourceAccessAdditional) Encode(e *jx.Encoder) {
+func (s ResolvedPlacementAdditional) Encode(e *jx.Encoder) {
 	e.ObjStart()
 	s.encodeFields(e)
 	e.ObjEnd()
 }
 
 // encodeFields implements json.Marshaler.
-func (s ResourceAccessAdditional) encodeFields(e *jx.Encoder) {
+func (s ResolvedPlacementAdditional) encodeFields(e *jx.Encoder) {
 	for k, elem := range s {
 		e.FieldStart(k)
 
@@ -21882,10 +31327,10 @@ func (s ResourceAccessAdditional) encodeFields(e *jx.Encoder) {
 	}
 }
 
-// Decode decodes ResourceAccessAdditional from json.
-func (s *ResourceAccessAdditional) Decode(d *jx.Decoder) error {
+// Decode decodes ResolvedPlacementAdditional from json.
+func (s *ResolvedPlacementAdditional) Decode(d *jx.Decoder) error {
 	if s == nil {
-		return errors.New("invalid: unable to decode ResourceAccessAdditional to nil")
+		return errors.New("invalid: unable to decode ResolvedPlacementAdditional to nil")
 	}
 	m := s.init()
 	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
@@ -21903,21 +31348,21 @@ func (s *ResourceAccessAdditional) Decode(d *jx.Decoder) error {
 		m[string(k)] = elem
 		return nil
 	}); err != nil {
-		return errors.Wrap(err, "decode ResourceAccessAdditional")
+		return errors.Wrap(err, "decode ResolvedPlacementAdditional")
 	}
 
 	return nil
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s ResourceAccessAdditional) MarshalJSON() ([]byte, error) {
+func (s ResolvedPlacementAdditional) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *ResourceAccessAdditional) UnmarshalJSON(data []byte) error {
+func (s *ResolvedPlacementAdditional) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
@@ -23839,6 +33284,204 @@ func (s *TopologyRegionAdditional) UnmarshalJSON(data []byte) error {
 	return s.Decode(d)
 }
 
+// Encode implements json.Marshaler.
+func (s *UpdateBranchProtectionInputBody) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields encodes fields.
+func (s *UpdateBranchProtectionInputBody) encodeFields(e *jx.Encoder) {
+	{
+		if s.Schema.Set {
+			e.FieldStart("$schema")
+			s.Schema.Encode(e)
+		}
+	}
+	{
+		if s.AddRules != nil {
+			e.FieldStart("addRules")
+			e.ArrStart()
+			for _, elem := range s.AddRules {
+				elem.Encode(e)
+			}
+			e.ArrEnd()
+		}
+	}
+	{
+		if s.RemoveRefs != nil {
+			e.FieldStart("removeRefs")
+			e.ArrStart()
+			for _, elem := range s.RemoveRefs {
+				e.Str(elem)
+			}
+			e.ArrEnd()
+		}
+	}
+	for k, elem := range s.AdditionalProps {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+var jsonFieldsNameOfUpdateBranchProtectionInputBody = [3]string{
+	0: "$schema",
+	1: "addRules",
+	2: "removeRefs",
+}
+
+// Decode decodes UpdateBranchProtectionInputBody from json.
+func (s *UpdateBranchProtectionInputBody) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode UpdateBranchProtectionInputBody to nil")
+	}
+	s.AdditionalProps = map[string]jx.Raw{}
+
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		switch string(k) {
+		case "$schema":
+			if err := func() error {
+				s.Schema.Reset()
+				if err := s.Schema.Decode(d); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"$schema\"")
+			}
+		case "addRules":
+			if err := func() error {
+				s.AddRules = make([]BranchRule, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem BranchRule
+					if err := elem.Decode(d); err != nil {
+						return err
+					}
+					s.AddRules = append(s.AddRules, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"addRules\"")
+			}
+		case "removeRefs":
+			if err := func() error {
+				s.RemoveRefs = make([]string, 0)
+				if err := d.Arr(func(d *jx.Decoder) error {
+					var elem string
+					v, err := d.Str()
+					elem = string(v)
+					if err != nil {
+						return err
+					}
+					s.RemoveRefs = append(s.RemoveRefs, elem)
+					return nil
+				}); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrap(err, "decode field \"removeRefs\"")
+			}
+		default:
+			var elem jx.Raw
+			if err := func() error {
+				v, err := d.RawAppend(nil)
+				elem = jx.Raw(v)
+				if err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return errors.Wrapf(err, "decode field %q", k)
+			}
+			s.AdditionalProps[string(k)] = elem
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode UpdateBranchProtectionInputBody")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s *UpdateBranchProtectionInputBody) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *UpdateBranchProtectionInputBody) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
+// Encode implements json.Marshaler.
+func (s UpdateBranchProtectionInputBodyAdditional) Encode(e *jx.Encoder) {
+	e.ObjStart()
+	s.encodeFields(e)
+	e.ObjEnd()
+}
+
+// encodeFields implements json.Marshaler.
+func (s UpdateBranchProtectionInputBodyAdditional) encodeFields(e *jx.Encoder) {
+	for k, elem := range s {
+		e.FieldStart(k)
+
+		if len(elem) != 0 {
+			e.Raw(elem)
+		}
+	}
+}
+
+// Decode decodes UpdateBranchProtectionInputBodyAdditional from json.
+func (s *UpdateBranchProtectionInputBodyAdditional) Decode(d *jx.Decoder) error {
+	if s == nil {
+		return errors.New("invalid: unable to decode UpdateBranchProtectionInputBodyAdditional to nil")
+	}
+	m := s.init()
+	if err := d.ObjBytes(func(d *jx.Decoder, k []byte) error {
+		var elem jx.Raw
+		if err := func() error {
+			v, err := d.RawAppend(nil)
+			elem = jx.Raw(v)
+			if err != nil {
+				return err
+			}
+			return nil
+		}(); err != nil {
+			return errors.Wrapf(err, "decode field %q", k)
+		}
+		m[string(k)] = elem
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "decode UpdateBranchProtectionInputBodyAdditional")
+	}
+
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s UpdateBranchProtectionInputBodyAdditional) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *UpdateBranchProtectionInputBodyAdditional) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
 // Encode implements json.Marshaler.
 func (s *WillDeleteStruct) Encode(e *jx.Encoder) {
 	e.ObjStart()
diff --git a/internal/coreapi/oas_operations_gen.go b/internal/coreapi/oas_operations_gen.go
index 9a4e52c858..606f7e9546 100644
--- a/internal/coreapi/oas_operations_gen.go
+++ b/internal/coreapi/oas_operations_gen.go
@@ -6,70 +6,90 @@ package coreapi
 type OperationName = string
 
 const (
-	AddOrgMemberOperation                  OperationName = "AddOrgMember"
-	BatchLookupOperation                   OperationName = "BatchLookup"
-	CancelDeletionOperation                OperationName = "CancelDeletion"
-	CompleteOnboardingOperation            OperationName = "CompleteOnboarding"
-	CreateBindingOperation                 OperationName = "CreateBinding"
-	CreateMirrorOperation                  OperationName = "CreateMirror"
-	CreateMirrorRequestOperation           OperationName = "CreateMirrorRequest"
-	CreateOrgOperation                     OperationName = "CreateOrg"
-	CreateProjectOperation                 OperationName = "CreateProject"
-	CreateRepoOperation                    OperationName = "CreateRepo"
-	CreateRepoCIWebhookOperation           OperationName = "CreateRepoCIWebhook"
-	CreateServiceAccountOperation          OperationName = "CreateServiceAccount"
-	DeleteBindingOperation                 OperationName = "DeleteBinding"
-	DeleteMeOperation                      OperationName = "DeleteMe"
-	DeleteMirrorOperation                  OperationName = "DeleteMirror"
-	DeleteOrgOperation                     OperationName = "DeleteOrg"
-	DeleteProjectOperation                 OperationName = "DeleteProject"
-	DeleteRepoOperation                    OperationName = "DeleteRepo"
-	DeleteRepoCIWebhookOperation           OperationName = "DeleteRepoCIWebhook"
-	DeleteServiceAccountOperation          OperationName = "DeleteServiceAccount"
-	GetDeletionPreviewOperation            OperationName = "GetDeletionPreview"
-	GetMeOperation                         OperationName = "GetMe"
-	GetMirrorOperation                     OperationName = "GetMirror"
-	GetMirrorRequestOperation              OperationName = "GetMirrorRequest"
-	GetOnboardingStatusOperation           OperationName = "GetOnboardingStatus"
-	GetOrgOperation                        OperationName = "GetOrg"
-	GetPermissionsOperation                OperationName = "GetPermissions"
-	GetProjectOperation                    OperationName = "GetProject"
-	GetRepoOperation                       OperationName = "GetRepo"
-	GetRepoVisibilityOperation             OperationName = "GetRepoVisibility"
-	GetServiceAccountOperation             OperationName = "GetServiceAccount"
-	GetTopologyOperation                   OperationName = "GetTopology"
-	GetVersionOperation                    OperationName = "GetVersion"
-	GrantProjectAccessOperation            OperationName = "GrantProjectAccess"
-	GrantRepoAccessOperation               OperationName = "GrantRepoAccess"
-	GrantServiceAccountAccessOperation     OperationName = "GrantServiceAccountAccess"
-	ListAuditEventsOperation               OperationName = "ListAuditEvents"
-	ListAvailableMirrorsOperation          OperationName = "ListAvailableMirrors"
-	ListBindingsOperation                  OperationName = "ListBindings"
-	ListClustersOperation                  OperationName = "ListClusters"
-	ListMirrorCollaboratorsOperation       OperationName = "ListMirrorCollaborators"
-	ListMirrorsOperation                   OperationName = "ListMirrors"
-	ListOIDCProvidersOperation             OperationName = "ListOIDCProviders"
-	ListOrgMembersOperation                OperationName = "ListOrgMembers"
-	ListOrgProjectsOperation               OperationName = "ListOrgProjects"
-	ListOrgsOperation                      OperationName = "ListOrgs"
-	ListProjectMembersOperation            OperationName = "ListProjectMembers"
-	ListProjectReposOperation              OperationName = "ListProjectRepos"
-	ListProjectsOperation                  OperationName = "ListProjects"
-	ListRepoCIWebhooksOperation            OperationName = "ListRepoCIWebhooks"
-	ListRepoGrantsOperation                OperationName = "ListRepoGrants"
-	ListReposOperation                     OperationName = "ListRepos"
-	ListServiceAccountGrantsOperation      OperationName = "ListServiceAccountGrants"
-	ListServiceAccountsOperation           OperationName = "ListServiceAccounts"
-	LookupRepoBySlugOperation              OperationName = "LookupRepoBySlug"
-	LookupResourcesOperation               OperationName = "LookupResources"
-	PatchRepoCIWebhookOperation            OperationName = "PatchRepoCIWebhook"
-	RemoveOrgMemberOperation               OperationName = "RemoveOrgMember"
-	ResolveHandleOperation                 OperationName = "ResolveHandle"
-	ResolveMirrorPlacementsOperation       OperationName = "ResolveMirrorPlacements"
-	RevokeProjectAccessOperation           OperationName = "RevokeProjectAccess"
-	RevokeProjectAccessByProviderOperation OperationName = "RevokeProjectAccessByProvider"
-	RevokeRepoAccessOperation              OperationName = "RevokeRepoAccess"
-	RevokeRepoAccessByProviderOperation    OperationName = "RevokeRepoAccessByProvider"
-	RevokeServiceAccountAccessOperation    OperationName = "RevokeServiceAccountAccess"
-	SetRepoVisibilityOperation             OperationName = "SetRepoVisibility"
+	AddOrgMemberOperation                      OperationName = "AddOrgMember"
+	CancelDeletionOperation                    OperationName = "CancelDeletion"
+	CompleteOnboardingOperation                OperationName = "CompleteOnboarding"
+	ConnectOrgCIBuildkiteCredentialOperation   OperationName = "ConnectOrgCIBuildkiteCredential"
+	CreateBindingOperation                     OperationName = "CreateBinding"
+	CreateMirrorOperation                      OperationName = "CreateMirror"
+	CreateMirrorRequestOperation               OperationName = "CreateMirrorRequest"
+	CreateNativeMirrorOperation                OperationName = "CreateNativeMirror"
+	CreateOrgOperation                         OperationName = "CreateOrg"
+	CreateProjectOperation                     OperationName = "CreateProject"
+	CreateRepoOperation                        OperationName = "CreateRepo"
+	CreateRepoCIWebhookOperation               OperationName = "CreateRepoCIWebhook"
+	CreateServiceAccountOperation              OperationName = "CreateServiceAccount"
+	DeleteBindingOperation                     OperationName = "DeleteBinding"
+	DeleteMeOperation                          OperationName = "DeleteMe"
+	DeleteMirrorOperation                      OperationName = "DeleteMirror"
+	DeleteNativeMirrorOperation                OperationName = "DeleteNativeMirror"
+	DeleteOrgOperation                         OperationName = "DeleteOrg"
+	DeleteOrgCIBuildkiteClusterOperation       OperationName = "DeleteOrgCIBuildkiteCluster"
+	DeleteOrgCIBuildkiteCredentialOperation    OperationName = "DeleteOrgCIBuildkiteCredential"
+	DeleteProjectOperation                     OperationName = "DeleteProject"
+	DeleteRepoOperation                        OperationName = "DeleteRepo"
+	DeleteRepoCIWebhookOperation               OperationName = "DeleteRepoCIWebhook"
+	DeleteServiceAccountOperation              OperationName = "DeleteServiceAccount"
+	GetBranchProtectionOperation               OperationName = "GetBranchProtection"
+	GetDeletionPreviewOperation                OperationName = "GetDeletionPreview"
+	GetMeOperation                             OperationName = "GetMe"
+	GetMirrorOperation                         OperationName = "GetMirror"
+	GetMirrorRequestOperation                  OperationName = "GetMirrorRequest"
+	GetOnboardingStatusOperation               OperationName = "GetOnboardingStatus"
+	GetOrgOperation                            OperationName = "GetOrg"
+	GetPermissionsOperation                    OperationName = "GetPermissions"
+	GetProjectOperation                        OperationName = "GetProject"
+	GetRepoOperation                           OperationName = "GetRepo"
+	GetRepoVisibilityOperation                 OperationName = "GetRepoVisibility"
+	GetServiceAccountOperation                 OperationName = "GetServiceAccount"
+	GetTopologyOperation                       OperationName = "GetTopology"
+	GetVersionOperation                        OperationName = "GetVersion"
+	GrantProjectAccessOperation                OperationName = "GrantProjectAccess"
+	GrantRepoAccessOperation                   OperationName = "GrantRepoAccess"
+	GrantServiceAccountAccessOperation         OperationName = "GrantServiceAccountAccess"
+	ListAuditEventsOperation                   OperationName = "ListAuditEvents"
+	ListAvailableMirrorsOperation              OperationName = "ListAvailableMirrors"
+	ListBindingsOperation                      OperationName = "ListBindings"
+	ListClustersOperation                      OperationName = "ListClusters"
+	ListMirrorCollaboratorsOperation           OperationName = "ListMirrorCollaborators"
+	ListMirrorsOperation                       OperationName = "ListMirrors"
+	ListNativeMirrorsOperation                 OperationName = "ListNativeMirrors"
+	ListOIDCProvidersOperation                 OperationName = "ListOIDCProviders"
+	ListOrgCIBuildkiteClustersOperation        OperationName = "ListOrgCIBuildkiteClusters"
+	ListOrgCIBuildkiteCredentialsOperation     OperationName = "ListOrgCIBuildkiteCredentials"
+	ListOrgMembersOperation                    OperationName = "ListOrgMembers"
+	ListOrgProjectsOperation                   OperationName = "ListOrgProjects"
+	ListOrgsOperation                          OperationName = "ListOrgs"
+	ListProjectMembersOperation                OperationName = "ListProjectMembers"
+	ListProjectReposOperation                  OperationName = "ListProjectRepos"
+	ListProjectsOperation                      OperationName = "ListProjects"
+	ListRepoCIBuildsOperation                  OperationName = "ListRepoCIBuilds"
+	ListRepoCIProvidersOperation               OperationName = "ListRepoCIProviders"
+	ListRepoCIWebhookAuditOperation            OperationName = "ListRepoCIWebhookAudit"
+	ListRepoCIWebhooksOperation                OperationName = "ListRepoCIWebhooks"
+	ListRepoCollaboratorsOperation             OperationName = "ListRepoCollaborators"
+	ListRepoGrantsOperation                    OperationName = "ListRepoGrants"
+	ListRepoLanguageFacetsOperation            OperationName = "ListRepoLanguageFacets"
+	ListRepoOrgFacetsOperation                 OperationName = "ListRepoOrgFacets"
+	ListReposOperation                         OperationName = "ListRepos"
+	ListServiceAccountGrantsOperation          OperationName = "ListServiceAccountGrants"
+	ListServiceAccountsOperation               OperationName = "ListServiceAccounts"
+	LookupRepoBySlugOperation                  OperationName = "LookupRepoBySlug"
+	MintOrgCIGitHubActionsCredentialOperation  OperationName = "MintOrgCIGitHubActionsCredential"
+	PatchRepoCIWebhookOperation                OperationName = "PatchRepoCIWebhook"
+	RegisterOrgCIBuildkiteClusterOperation     OperationName = "RegisterOrgCIBuildkiteCluster"
+	RemoveOrgMemberOperation                   OperationName = "RemoveOrgMember"
+	ResolveHandleOperation                     OperationName = "ResolveHandle"
+	ResolveMirrorPlacementsOperation           OperationName = "ResolveMirrorPlacements"
+	ResolveRepoIDsOperation                    OperationName = "ResolveRepoIDs"
+	ResolveReposOperation                      OperationName = "ResolveRepos"
+	RevokeProjectAccessOperation               OperationName = "RevokeProjectAccess"
+	RevokeProjectAccessByProviderOperation     OperationName = "RevokeProjectAccessByProvider"
+	RevokeRepoAccessOperation                  OperationName = "RevokeRepoAccess"
+	RevokeRepoAccessByProviderOperation        OperationName = "RevokeRepoAccessByProvider"
+	RevokeServiceAccountAccessOperation        OperationName = "RevokeServiceAccountAccess"
+	RotateOrgCIBuildkiteInboundSecretOperation OperationName = "RotateOrgCIBuildkiteInboundSecret"
+	SetBranchProtectionOperation               OperationName = "SetBranchProtection"
+	SetRepoVisibilityOperation                 OperationName = "SetRepoVisibility"
+	UpdateBranchProtectionOperation            OperationName = "UpdateBranchProtection"
 )
diff --git a/internal/coreapi/oas_parameters_gen.go b/internal/coreapi/oas_parameters_gen.go
index 213484ffa5..b0796d2a1d 100644
--- a/internal/coreapi/oas_parameters_gen.go
+++ b/internal/coreapi/oas_parameters_gen.go
@@ -11,11 +11,21 @@ type AddOrgMemberParams struct {
 	OrgId string
 }
 
+// ConnectOrgCIBuildkiteCredentialParams is parameters of connectOrgCIBuildkiteCredential operation.
+type ConnectOrgCIBuildkiteCredentialParams struct {
+	OrgId string
+}
+
 // CreateBindingParams is parameters of createBinding operation.
 type CreateBindingParams struct {
 	AccountId string
 }
 
+// CreateNativeMirrorParams is parameters of createNativeMirror operation.
+type CreateNativeMirrorParams struct {
+	RepoId string
+}
+
 // CreateRepoCIWebhookParams is parameters of createRepoCIWebhook operation.
 type CreateRepoCIWebhookParams struct {
 	RepoId string
@@ -36,11 +46,30 @@ type DeleteMirrorParams struct {
 	ClusterHost string
 }
 
+// DeleteNativeMirrorParams is parameters of deleteNativeMirror operation.
+type DeleteNativeMirrorParams struct {
+	RepoId      string
+	ClusterSlug string
+}
+
 // DeleteOrgParams is parameters of deleteOrg operation.
 type DeleteOrgParams struct {
 	OrgId string
 }
 
+// DeleteOrgCIBuildkiteClusterParams is parameters of deleteOrgCIBuildkiteCluster operation.
+type DeleteOrgCIBuildkiteClusterParams struct {
+	OrgId       string
+	BkOrg       string
+	BkClusterId string
+}
+
+// DeleteOrgCIBuildkiteCredentialParams is parameters of deleteOrgCIBuildkiteCredential operation.
+type DeleteOrgCIBuildkiteCredentialParams struct {
+	OrgId string
+	BkOrg string
+}
+
 // DeleteProjectParams is parameters of deleteProject operation.
 type DeleteProjectParams struct {
 	ProjectId string
@@ -53,9 +82,9 @@ type DeleteRepoParams struct {
 
 // DeleteRepoCIWebhookParams is parameters of deleteRepoCIWebhook operation.
 type DeleteRepoCIWebhookParams struct {
-	RepoId   string
-	ID       string
-	Teardown OptBool `json:",omitempty,omitzero"`
+	RepoId       string
+	ID           string
+	KeepIdentity OptBool `json:",omitempty,omitzero"`
 }
 
 // DeleteServiceAccountParams is parameters of deleteServiceAccount operation.
@@ -63,6 +92,11 @@ type DeleteServiceAccountParams struct {
 	AccountId string
 }
 
+// GetBranchProtectionParams is parameters of getBranchProtection operation.
+type GetBranchProtectionParams struct {
+	RepoId string
+}
+
 // GetMirrorParams is parameters of getMirror operation.
 type GetMirrorParams struct {
 	MirrorId string
@@ -168,6 +202,11 @@ type ListMirrorsParams struct {
 	Owner OptString `json:",omitempty,omitzero"`
 }
 
+// ListNativeMirrorsParams is parameters of listNativeMirrors operation.
+type ListNativeMirrorsParams struct {
+	RepoId string
+}
+
 // ListOIDCProvidersParams is parameters of listOIDCProviders operation.
 type ListOIDCProvidersParams struct {
 	// Maximum entries to return; server may cap further.
@@ -176,6 +215,17 @@ type ListOIDCProvidersParams struct {
 	PageToken OptString `json:",omitempty,omitzero"`
 }
 
+// ListOrgCIBuildkiteClustersParams is parameters of listOrgCIBuildkiteClusters operation.
+type ListOrgCIBuildkiteClustersParams struct {
+	OrgId          string
+	BkOrganization OptString `json:",omitempty,omitzero"`
+}
+
+// ListOrgCIBuildkiteCredentialsParams is parameters of listOrgCIBuildkiteCredentials operation.
+type ListOrgCIBuildkiteCredentialsParams struct {
+	OrgId string
+}
+
 // ListOrgMembersParams is parameters of listOrgMembers operation.
 type ListOrgMembersParams struct {
 	// Maximum entries to return; server may cap further.
@@ -237,11 +287,42 @@ type ListProjectsParams struct {
 	Name OptString `json:",omitempty,omitzero"`
 }
 
+// ListRepoCIBuildsParams is parameters of listRepoCIBuilds operation.
+type ListRepoCIBuildsParams struct {
+	RepoId      string
+	Commit      OptString `json:",omitempty,omitzero"`
+	Pipeline    OptString `json:",omitempty,omitzero"`
+	BuildNumber OptInt64  `json:",omitempty,omitzero"`
+	Limit       OptInt64  `json:",omitempty,omitzero"`
+}
+
+// ListRepoCIProvidersParams is parameters of listRepoCIProviders operation.
+type ListRepoCIProvidersParams struct {
+	RepoId string
+}
+
+// ListRepoCIWebhookAuditParams is parameters of listRepoCIWebhookAudit operation.
+type ListRepoCIWebhookAuditParams struct {
+	RepoId    string
+	EventType OptString `json:",omitempty,omitzero"`
+	Limit     OptInt64  `json:",omitempty,omitzero"`
+	Offset    OptInt64  `json:",omitempty,omitzero"`
+}
+
 // ListRepoCIWebhooksParams is parameters of listRepoCIWebhooks operation.
 type ListRepoCIWebhooksParams struct {
 	RepoId string
 }
 
+// ListRepoCollaboratorsParams is parameters of listRepoCollaborators operation.
+type ListRepoCollaboratorsParams struct {
+	// Maximum entries to return; server may cap further.
+	PageSize OptInt32 `json:",omitempty,omitzero"`
+	// Opaque cursor from a previous response's nextPageToken.
+	PageToken OptString `json:",omitempty,omitzero"`
+	RepoId    string
+}
+
 // ListRepoGrantsParams is parameters of listRepoGrants operation.
 type ListRepoGrantsParams struct {
 	// Maximum entries to return; server may cap further.
@@ -251,6 +332,26 @@ type ListRepoGrantsParams struct {
 	RepoId    string
 }
 
+// ListRepoLanguageFacetsParams is parameters of listRepoLanguageFacets operation.
+type ListRepoLanguageFacetsParams struct {
+	// Maximum facet values to return.
+	PageSize OptInt32 `json:",omitempty,omitzero"`
+	// Opaque cursor from a previous response's nextPageToken.
+	PageToken OptString `json:",omitempty,omitzero"`
+	// Case-insensitive substring match over facet values.
+	Q OptString `json:",omitempty,omitzero"`
+}
+
+// ListRepoOrgFacetsParams is parameters of listRepoOrgFacets operation.
+type ListRepoOrgFacetsParams struct {
+	// Maximum facet values to return.
+	PageSize OptInt32 `json:",omitempty,omitzero"`
+	// Opaque cursor from a previous response's nextPageToken.
+	PageToken OptString `json:",omitempty,omitzero"`
+	// Case-insensitive substring match over facet values.
+	Q OptString `json:",omitempty,omitzero"`
+}
+
 // ListReposParams is parameters of listRepos operation.
 type ListReposParams struct {
 	// Maximum entries to return; server may cap further.
@@ -260,8 +361,35 @@ type ListReposParams struct {
 	// Onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.
 	Scope OptListReposScope `json:",omitempty,omitzero"`
 	// Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one
-	// entries; pagination and scope are ignored.
+	// entries; pagination and scope are ignored, but the fact filters below still apply (a repo whose
+	// facts don't match returns empty).
 	Filter OptString `json:",omitempty,omitzero"`
+	// Multi-key sort spec, e.g. org:asc,stars:desc. Keys: name,org,language,candidacy,stars,forks,
+	// pushed_at,last_activity_at,last_pushed_at,activity_hotness,checkpoint_count,open_pr_count. A
+	// single bare key uses the order param. Encoded into the cursor (authoritative on continuation).
+	Sort OptString `json:",omitempty,omitzero"`
+	// Direction for a single bare sort key; defaults to asc. Ignored when sort carries per-key
+	// :asc/:desc suffixes. Encoded into the cursor (authoritative on continuation).
+	Order OptListReposOrder `json:",omitempty,omitzero"`
+	// Exact-match repo_facts.language. Also accepts language[eq]/language[ne] (bare is sugar for [eq]).
+	Language OptString `json:",omitempty,omitzero"`
+	// Filter on the observed repo_facts.private fact (public: private=false; private: private=true).
+	// Also accepts visibility[eq]/visibility[ne].
+	Visibility OptListReposVisibility `json:",omitempty,omitzero"`
+	// Filter on repo_facts.archived.
+	Archived OptListReposArchived `json:",omitempty,omitzero"`
+	// True: repo_facts.checkpoint_count > 0; false: no checkpoints (0 or unobserved).
+	HasCheckpoints OptListReposHasCheckpoints `json:",omitempty,omitzero"`
+	// Exact-match owner/project org (case-insensitive). Also accepts org[eq]/org[ne].
+	Org OptString `json:",omitempty,omitzero"`
+	// Literal case-insensitive substring match on the full name (owner/repo).
+	Q OptString `json:",omitempty,omitzero"`
+	// Filter on placement/candidacy lifecycle. inactive requires scope=all. Also accepts
+	// status[eq]/status[ne].
+	Status OptListReposStatus `json:",omitempty,omitzero"`
+	// Minimum caller access tier: read (all), write (write+admin), or admin. Also accepts permission[eq];
+	//  permission[ne] is rejected.
+	Permission OptListReposPermission `json:",omitempty,omitzero"`
 }
 
 // ListServiceAccountGrantsParams is parameters of listServiceAccountGrants operation.
@@ -288,17 +416,9 @@ type LookupRepoBySlugParams struct {
 	Slug string
 }
 
-// LookupResourcesParams is parameters of lookupResources operation.
-type LookupResourcesParams struct {
-	// Maximum entries to return; server may cap further.
-	PageSize OptInt32 `json:",omitempty,omitzero"`
-	// Opaque cursor from a previous response's nextPageToken.
-	PageToken OptString `json:",omitempty,omitzero"`
-	// SpiceDB resource type (e.g. "repo", "project", "org").
-	ResourceType string
-	// Optional: only list resources where the caller has this permission. pageSize/pageToken apply only
-	// when set.
-	Permission OptString `json:",omitempty,omitzero"`
+// MintOrgCIGitHubActionsCredentialParams is parameters of mintOrgCIGitHubActionsCredential operation.
+type MintOrgCIGitHubActionsCredentialParams struct {
+	OrgId string
 }
 
 // PatchRepoCIWebhookParams is parameters of patchRepoCIWebhook operation.
@@ -307,6 +427,11 @@ type PatchRepoCIWebhookParams struct {
 	ID     string
 }
 
+// RegisterOrgCIBuildkiteClusterParams is parameters of registerOrgCIBuildkiteCluster operation.
+type RegisterOrgCIBuildkiteClusterParams struct {
+	OrgId string
+}
+
 // RemoveOrgMemberParams is parameters of removeOrgMember operation.
 type RemoveOrgMemberParams struct {
 	OrgId          string
@@ -366,7 +491,23 @@ type RevokeServiceAccountAccessParams struct {
 	ResourceId   string
 }
 
+// RotateOrgCIBuildkiteInboundSecretParams is parameters of rotateOrgCIBuildkiteInboundSecret operation.
+type RotateOrgCIBuildkiteInboundSecretParams struct {
+	OrgId string
+	BkOrg string
+}
+
+// SetBranchProtectionParams is parameters of setBranchProtection operation.
+type SetBranchProtectionParams struct {
+	RepoId string
+}
+
 // SetRepoVisibilityParams is parameters of setRepoVisibility operation.
 type SetRepoVisibilityParams struct {
 	RepoId string
 }
+
+// UpdateBranchProtectionParams is parameters of updateBranchProtection operation.
+type UpdateBranchProtectionParams struct {
+	RepoId string
+}
diff --git a/internal/coreapi/oas_request_encoders_gen.go b/internal/coreapi/oas_request_encoders_gen.go
index 3d4f156d98..4b672c4e64 100644
--- a/internal/coreapi/oas_request_encoders_gen.go
+++ b/internal/coreapi/oas_request_encoders_gen.go
@@ -24,8 +24,8 @@ func encodeAddOrgMemberRequest(
 	return nil
 }
 
-func encodeBatchLookupRequest(
-	req *BatchLookupInputBody,
+func encodeConnectOrgCIBuildkiteCredentialRequest(
+	req *ConnectOrgCIBuildkiteCredentialInputBody,
 	r *http.Request,
 ) error {
 	const contentType = "application/json"
@@ -80,6 +80,20 @@ func encodeCreateMirrorRequestRequest(
 	return nil
 }
 
+func encodeCreateNativeMirrorRequest(
+	req *CreateNativeMirrorInputBody,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
+
 func encodeCreateOrgRequest(
 	req *CreateOrgInputBody,
 	r *http.Request,
@@ -192,6 +206,20 @@ func encodeGrantServiceAccountAccessRequest(
 	return nil
 }
 
+func encodeMintOrgCIGitHubActionsCredentialRequest(
+	req *MintOrgCIGitHubActionsCredentialInputBody,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
+
 func encodePatchRepoCIWebhookRequest(
 	req *PatchRepoCIWebhookInputBody,
 	r *http.Request,
@@ -206,6 +234,62 @@ func encodePatchRepoCIWebhookRequest(
 	return nil
 }
 
+func encodeRegisterOrgCIBuildkiteClusterRequest(
+	req *RegisterOrgCIBuildkiteClusterInputBody,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
+
+func encodeResolveRepoIDsRequest(
+	req *ResolveRepoIDsInputBody,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
+
+func encodeResolveReposRequest(
+	req *ResolveReposInputBody,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
+
+func encodeSetBranchProtectionRequest(
+	req *BranchProtection,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
+
 func encodeSetRepoVisibilityRequest(
 	req *SetRepoVisibilityInputBody,
 	r *http.Request,
@@ -219,3 +303,17 @@ func encodeSetRepoVisibilityRequest(
 	ht.SetBody(r, bytes.NewReader(encoded), contentType)
 	return nil
 }
+
+func encodeUpdateBranchProtectionRequest(
+	req *UpdateBranchProtectionInputBody,
+	r *http.Request,
+) error {
+	const contentType = "application/json"
+	e := new(jx.Encoder)
+	{
+		req.Encode(e)
+	}
+	encoded := e.Bytes()
+	ht.SetBody(r, bytes.NewReader(encoded), contentType)
+	return nil
+}
diff --git a/internal/coreapi/oas_response_decoders_gen.go b/internal/coreapi/oas_response_decoders_gen.go
index 3cbe45b9d7..84f7ddd7b2 100644
--- a/internal/coreapi/oas_response_decoders_gen.go
+++ b/internal/coreapi/oas_response_decoders_gen.go
@@ -98,23 +98,27 @@ func decodeAddOrgMemberResponse(resp *http.Response) (res *Membership, _ error)
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeBatchLookupResponse(resp *http.Response) (res *BatchLookupOutputBody, _ error) {
+func decodeCancelDeletionResponse(resp *http.Response) (res *CancelDeletionOK, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
+		return &CancelDeletionOK{}, nil
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/json":
+		case ct == "application/problem+json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response BatchLookupOutputBody
+			var response ErrorModel
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -131,35 +135,37 @@ func decodeBatchLookupResponse(resp *http.Response) (res *BatchLookupOutputBody,
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
-			return &response, nil
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
 	}
-	// Convenient error response.
-	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeCompleteOnboardingResponse(resp *http.Response) (res *CompleteOnboardingOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/problem+json":
+		case ct == "application/json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ErrorModel
+			var response CompleteOnboardingOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -176,25 +182,10 @@ func decodeBatchLookupResponse(resp *http.Response) (res *BatchLookupOutputBody,
 				}
 				return res, err
 			}
-			return &ErrorModelStatusCode{
-				StatusCode: resp.StatusCode,
-				Response:   response,
-			}, nil
+			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
-	}()
-	if err != nil {
-		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
-	}
-	return res, errors.Wrap(defRes, "error")
-}
-
-func decodeCancelDeletionResponse(resp *http.Response) (res *CancelDeletionOK, _ error) {
-	switch resp.StatusCode {
-	case 200:
-		// Code 200.
-		return &CancelDeletionOK{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -241,10 +232,10 @@ func decodeCancelDeletionResponse(resp *http.Response) (res *CancelDeletionOK, _
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeCompleteOnboardingResponse(resp *http.Response) (res *CompleteOnboardingOutputBody, _ error) {
+func decodeConnectOrgCIBuildkiteCredentialResponse(resp *http.Response) (res *OrgCIBuildkiteCredentialView, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 201:
+		// Code 201.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -257,7 +248,7 @@ func decodeCompleteOnboardingResponse(resp *http.Response) (res *CompleteOnboard
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response CompleteOnboardingOutputBody
+			var response OrgCIBuildkiteCredentialView
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -622,6 +613,98 @@ func decodeCreateMirrorRequestResponse(resp *http.Response) (res *MirrorRequestH
 	return res, errors.Wrap(defRes, "error")
 }
 
+func decodeCreateNativeMirrorResponse(resp *http.Response) (res *NativeMirrorPlacement, _ error) {
+	switch resp.StatusCode {
+	case 202:
+		// Code 202.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response NativeMirrorPlacement
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
 func decodeCreateOrgResponse(resp *http.Response) (res *Org, _ error) {
 	switch resp.StatusCode {
 	case 201:
@@ -880,7 +963,7 @@ func decodeCreateRepoResponse(resp *http.Response) (res *Repo, _ error) {
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeCreateRepoCIWebhookResponse(resp *http.Response) (res *CIWebhookView, _ error) {
+func decodeCreateRepoCIWebhookResponse(resp *http.Response) (res *CreateRepoCIWebhookBody, _ error) {
 	switch resp.StatusCode {
 	case 201:
 		// Code 201.
@@ -896,7 +979,7 @@ func decodeCreateRepoCIWebhookResponse(resp *http.Response) (res *CIWebhookView,
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response CIWebhookView
+			var response CreateRepoCIWebhookBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1208,27 +1291,23 @@ func decodeDeleteMirrorResponse(resp *http.Response) (res *DeleteMirrorNoContent
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeDeleteOrgResponse(resp *http.Response) (res *DeleteOrgNoContent, _ error) {
+func decodeDeleteNativeMirrorResponse(resp *http.Response) (res *NativeMirrorPlacement, _ error) {
 	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &DeleteOrgNoContent{}, nil
-	}
-	// Convenient error response.
-	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+	case 202:
+		// Code 202.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/problem+json":
+		case ct == "application/json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ErrorModel
+			var response NativeMirrorPlacement
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1245,25 +1324,19 @@ func decodeDeleteOrgResponse(resp *http.Response) (res *DeleteOrgNoContent, _ er
 				}
 				return res, err
 			}
-			return &ErrorModelStatusCode{
-				StatusCode: resp.StatusCode,
-				Response:   response,
-			}, nil
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
-	}()
-	if err != nil {
-		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
-	}
-	return res, errors.Wrap(defRes, "error")
-}
-
-func decodeDeleteProjectResponse(resp *http.Response) (res *DeleteProjectNoContent, _ error) {
-	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &DeleteProjectNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -1310,11 +1383,11 @@ func decodeDeleteProjectResponse(resp *http.Response) (res *DeleteProjectNoConte
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeDeleteRepoResponse(resp *http.Response) (res *DeleteRepoNoContent, _ error) {
+func decodeDeleteOrgResponse(resp *http.Response) (res *DeleteOrgNoContent, _ error) {
 	switch resp.StatusCode {
 	case 204:
 		// Code 204.
-		return &DeleteRepoNoContent{}, nil
+		return &DeleteOrgNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -1361,11 +1434,11 @@ func decodeDeleteRepoResponse(resp *http.Response) (res *DeleteRepoNoContent, _
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeDeleteRepoCIWebhookResponse(resp *http.Response) (res *DeleteRepoCIWebhookNoContent, _ error) {
+func decodeDeleteOrgCIBuildkiteClusterResponse(resp *http.Response) (res *DeleteOrgCIBuildkiteClusterNoContent, _ error) {
 	switch resp.StatusCode {
 	case 204:
 		// Code 204.
-		return &DeleteRepoCIWebhookNoContent{}, nil
+		return &DeleteOrgCIBuildkiteClusterNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -1412,11 +1485,11 @@ func decodeDeleteRepoCIWebhookResponse(resp *http.Response) (res *DeleteRepoCIWe
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeDeleteServiceAccountResponse(resp *http.Response) (res *DeleteServiceAccountNoContent, _ error) {
+func decodeDeleteOrgCIBuildkiteCredentialResponse(resp *http.Response) (res *DeleteOrgCIBuildkiteCredentialNoContent, _ error) {
 	switch resp.StatusCode {
 	case 204:
 		// Code 204.
-		return &DeleteServiceAccountNoContent{}, nil
+		return &DeleteOrgCIBuildkiteCredentialNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -1463,23 +1536,27 @@ func decodeDeleteServiceAccountResponse(resp *http.Response) (res *DeleteService
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetDeletionPreviewResponse(resp *http.Response) (res *GetDeletionPreviewOutputBody, _ error) {
+func decodeDeleteProjectResponse(resp *http.Response) (res *DeleteProjectNoContent, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 204:
+		// Code 204.
+		return &DeleteProjectNoContent{}, nil
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/json":
+		case ct == "application/problem+json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetDeletionPreviewOutputBody
+			var response ErrorModel
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1496,19 +1573,25 @@ func decodeGetDeletionPreviewResponse(resp *http.Response) (res *GetDeletionPrev
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
-			return &response, nil
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeDeleteRepoResponse(resp *http.Response) (res *DeleteRepoNoContent, _ error) {
+	switch resp.StatusCode {
+	case 204:
+		// Code 204.
+		return &DeleteRepoNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -1555,23 +1638,27 @@ func decodeGetDeletionPreviewResponse(resp *http.Response) (res *GetDeletionPrev
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetMeResponse(resp *http.Response) (res *GetMeOutputBody, _ error) {
+func decodeDeleteRepoCIWebhookResponse(resp *http.Response) (res *DeleteRepoCIWebhookNoContent, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 204:
+		// Code 204.
+		return &DeleteRepoCIWebhookNoContent{}, nil
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/json":
+		case ct == "application/problem+json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetMeOutputBody
+			var response ErrorModel
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1588,19 +1675,25 @@ func decodeGetMeResponse(resp *http.Response) (res *GetMeOutputBody, _ error) {
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
-			return &response, nil
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeDeleteServiceAccountResponse(resp *http.Response) (res *DeleteServiceAccountNoContent, _ error) {
+	switch resp.StatusCode {
+	case 204:
+		// Code 204.
+		return &DeleteServiceAccountNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -1647,7 +1740,7 @@ func decodeGetMeResponse(resp *http.Response) (res *GetMeOutputBody, _ error) {
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetMirrorResponse(resp *http.Response) (res *Mirror, _ error) {
+func decodeGetBranchProtectionResponse(resp *http.Response) (res *BranchProtection, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -1663,7 +1756,7 @@ func decodeGetMirrorResponse(resp *http.Response) (res *Mirror, _ error) {
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response Mirror
+			var response BranchProtection
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1739,7 +1832,7 @@ func decodeGetMirrorResponse(resp *http.Response) (res *Mirror, _ error) {
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetMirrorRequestResponse(resp *http.Response) (res *MirrorRequest, _ error) {
+func decodeGetDeletionPreviewResponse(resp *http.Response) (res *GetDeletionPreviewOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -1755,7 +1848,7 @@ func decodeGetMirrorRequestResponse(resp *http.Response) (res *MirrorRequest, _
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response MirrorRequest
+			var response GetDeletionPreviewOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1831,7 +1924,7 @@ func decodeGetMirrorRequestResponse(resp *http.Response) (res *MirrorRequest, _
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetOnboardingStatusResponse(resp *http.Response) (res *GetOnboardingStatusOutputBody, _ error) {
+func decodeGetMeResponse(resp *http.Response) (res *GetMeOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -1847,7 +1940,7 @@ func decodeGetOnboardingStatusResponse(resp *http.Response) (res *GetOnboardingS
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetOnboardingStatusOutputBody
+			var response GetMeOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1864,6 +1957,15 @@ func decodeGetOnboardingStatusResponse(resp *http.Response) (res *GetOnboardingS
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -1914,7 +2016,7 @@ func decodeGetOnboardingStatusResponse(resp *http.Response) (res *GetOnboardingS
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetOrgResponse(resp *http.Response) (res *Org, _ error) {
+func decodeGetMirrorResponse(resp *http.Response) (res *Mirror, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -1930,7 +2032,7 @@ func decodeGetOrgResponse(resp *http.Response) (res *Org, _ error) {
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response Org
+			var response Mirror
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -1947,6 +2049,15 @@ func decodeGetOrgResponse(resp *http.Response) (res *Org, _ error) {
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -1997,7 +2108,7 @@ func decodeGetOrgResponse(resp *http.Response) (res *Org, _ error) {
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetPermissionsResponse(resp *http.Response) (res *GetPermissionsOutputBody, _ error) {
+func decodeGetMirrorRequestResponse(resp *http.Response) (res *MirrorRequest, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2013,7 +2124,7 @@ func decodeGetPermissionsResponse(resp *http.Response) (res *GetPermissionsOutpu
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetPermissionsOutputBody
+			var response MirrorRequest
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2030,6 +2141,15 @@ func decodeGetPermissionsResponse(resp *http.Response) (res *GetPermissionsOutpu
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2080,7 +2200,7 @@ func decodeGetPermissionsResponse(resp *http.Response) (res *GetPermissionsOutpu
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetProjectResponse(resp *http.Response) (res *Project, _ error) {
+func decodeGetOnboardingStatusResponse(resp *http.Response) (res *GetOnboardingStatusOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2096,7 +2216,7 @@ func decodeGetProjectResponse(resp *http.Response) (res *Project, _ error) {
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response Project
+			var response GetOnboardingStatusOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2113,15 +2233,6 @@ func decodeGetProjectResponse(resp *http.Response) (res *Project, _ error) {
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2172,7 +2283,7 @@ func decodeGetProjectResponse(resp *http.Response) (res *Project, _ error) {
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetRepoResponse(resp *http.Response) (res *Repo, _ error) {
+func decodeGetOrgResponse(resp *http.Response) (res *Org, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2188,7 +2299,7 @@ func decodeGetRepoResponse(resp *http.Response) (res *Repo, _ error) {
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response Repo
+			var response Org
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2255,7 +2366,7 @@ func decodeGetRepoResponse(resp *http.Response) (res *Repo, _ error) {
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetRepoVisibilityResponse(resp *http.Response) (res *GetRepoVisibilityOutputBody, _ error) {
+func decodeGetPermissionsResponse(resp *http.Response) (res *GetPermissionsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2271,7 +2382,7 @@ func decodeGetRepoVisibilityResponse(resp *http.Response) (res *GetRepoVisibilit
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetRepoVisibilityOutputBody
+			var response GetPermissionsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2347,7 +2458,7 @@ func decodeGetRepoVisibilityResponse(resp *http.Response) (res *GetRepoVisibilit
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetServiceAccountResponse(resp *http.Response) (res *ServiceAccount, _ error) {
+func decodeGetProjectResponse(resp *http.Response) (res *Project, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2363,7 +2474,7 @@ func decodeGetServiceAccountResponse(resp *http.Response) (res *ServiceAccount,
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ServiceAccount
+			var response Project
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2380,6 +2491,15 @@ func decodeGetServiceAccountResponse(resp *http.Response) (res *ServiceAccount,
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2430,7 +2550,7 @@ func decodeGetServiceAccountResponse(resp *http.Response) (res *ServiceAccount,
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetTopologyResponse(resp *http.Response) (res *GetTopologyOutputBody, _ error) {
+func decodeGetRepoResponse(resp *http.Response) (res *Repo, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2446,7 +2566,7 @@ func decodeGetTopologyResponse(resp *http.Response) (res *GetTopologyOutputBody,
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetTopologyOutputBody
+			var response Repo
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2463,15 +2583,6 @@ func decodeGetTopologyResponse(resp *http.Response) (res *GetTopologyOutputBody,
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2522,7 +2633,7 @@ func decodeGetTopologyResponse(resp *http.Response) (res *GetTopologyOutputBody,
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGetVersionResponse(resp *http.Response) (res *GetVersionOutputBody, _ error) {
+func decodeGetRepoVisibilityResponse(resp *http.Response) (res *GetRepoVisibilityOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -2538,7 +2649,7 @@ func decodeGetVersionResponse(resp *http.Response) (res *GetVersionOutputBody, _
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GetVersionOutputBody
+			var response GetRepoVisibilityOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2614,10 +2725,10 @@ func decodeGetVersionResponse(resp *http.Response) (res *GetVersionOutputBody, _
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGrantProjectAccessResponse(resp *http.Response) (res *GrantProjectAccessOutputBody, _ error) {
+func decodeGetServiceAccountResponse(resp *http.Response) (res *ServiceAccount, _ error) {
 	switch resp.StatusCode {
-	case 201:
-		// Code 201.
+	case 200:
+		// Code 200.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -2630,7 +2741,7 @@ func decodeGrantProjectAccessResponse(resp *http.Response) (res *GrantProjectAcc
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GrantProjectAccessOutputBody
+			var response ServiceAccount
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2697,10 +2808,10 @@ func decodeGrantProjectAccessResponse(resp *http.Response) (res *GrantProjectAcc
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGrantRepoAccessResponse(resp *http.Response) (res *GrantRepoAccessOutputBody, _ error) {
+func decodeGetTopologyResponse(resp *http.Response) (res *GetTopologyOutputBody, _ error) {
 	switch resp.StatusCode {
-	case 201:
-		// Code 201.
+	case 200:
+		// Code 200.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -2713,7 +2824,7 @@ func decodeGrantRepoAccessResponse(resp *http.Response) (res *GrantRepoAccessOut
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GrantRepoAccessOutputBody
+			var response GetTopologyOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2730,6 +2841,15 @@ func decodeGrantRepoAccessResponse(resp *http.Response) (res *GrantRepoAccessOut
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2780,10 +2900,10 @@ func decodeGrantRepoAccessResponse(resp *http.Response) (res *GrantRepoAccessOut
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeGrantServiceAccountAccessResponse(resp *http.Response) (res *GrantServiceAccountAccessOutputBody, _ error) {
+func decodeGetVersionResponse(resp *http.Response) (res *GetVersionOutputBody, _ error) {
 	switch resp.StatusCode {
-	case 201:
-		// Code 201.
+	case 200:
+		// Code 200.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -2796,7 +2916,7 @@ func decodeGrantServiceAccountAccessResponse(resp *http.Response) (res *GrantSer
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response GrantServiceAccountAccessOutputBody
+			var response GetVersionOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2813,6 +2933,15 @@ func decodeGrantServiceAccountAccessResponse(resp *http.Response) (res *GrantSer
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2863,10 +2992,10 @@ func decodeGrantServiceAccountAccessResponse(resp *http.Response) (res *GrantSer
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListAuditEventsResponse(resp *http.Response) (res *ListAuditEventsOutputBody, _ error) {
+func decodeGrantProjectAccessResponse(resp *http.Response) (res *GrantProjectAccessOutputBody, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 201:
+		// Code 201.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -2879,7 +3008,7 @@ func decodeListAuditEventsResponse(resp *http.Response) (res *ListAuditEventsOut
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListAuditEventsOutputBody
+			var response GrantProjectAccessOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2896,15 +3025,6 @@ func decodeListAuditEventsResponse(resp *http.Response) (res *ListAuditEventsOut
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -2955,10 +3075,10 @@ func decodeListAuditEventsResponse(resp *http.Response) (res *ListAuditEventsOut
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListAvailableMirrorsResponse(resp *http.Response) (res *ListAvailableMirrorsOutputBody, _ error) {
+func decodeGrantRepoAccessResponse(resp *http.Response) (res *GrantRepoAccessOutputBody, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 201:
+		// Code 201.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -2971,7 +3091,7 @@ func decodeListAvailableMirrorsResponse(resp *http.Response) (res *ListAvailable
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListAvailableMirrorsOutputBody
+			var response GrantRepoAccessOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -2988,15 +3108,6 @@ func decodeListAvailableMirrorsResponse(resp *http.Response) (res *ListAvailable
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -3047,10 +3158,10 @@ func decodeListAvailableMirrorsResponse(resp *http.Response) (res *ListAvailable
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListBindingsResponse(resp *http.Response) (res *ListBindingsOutputBody, _ error) {
+func decodeGrantServiceAccountAccessResponse(resp *http.Response) (res *GrantServiceAccountAccessOutputBody, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 201:
+		// Code 201.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -3063,7 +3174,7 @@ func decodeListBindingsResponse(resp *http.Response) (res *ListBindingsOutputBod
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListBindingsOutputBody
+			var response GrantServiceAccountAccessOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3080,15 +3191,6 @@ func decodeListBindingsResponse(resp *http.Response) (res *ListBindingsOutputBod
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -3139,7 +3241,7 @@ func decodeListBindingsResponse(resp *http.Response) (res *ListBindingsOutputBod
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListClustersResponse(resp *http.Response) (res *ListClustersOutputBody, _ error) {
+func decodeListAuditEventsResponse(resp *http.Response) (res *ListAuditEventsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3155,7 +3257,7 @@ func decodeListClustersResponse(resp *http.Response) (res *ListClustersOutputBod
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListClustersOutputBody
+			var response ListAuditEventsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3231,7 +3333,7 @@ func decodeListClustersResponse(resp *http.Response) (res *ListClustersOutputBod
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListMirrorCollaboratorsResponse(resp *http.Response) (res *ListMirrorCollaboratorsOutputBody, _ error) {
+func decodeListAvailableMirrorsResponse(resp *http.Response) (res *ListAvailableMirrorsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3247,7 +3349,7 @@ func decodeListMirrorCollaboratorsResponse(resp *http.Response) (res *ListMirror
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListMirrorCollaboratorsOutputBody
+			var response ListAvailableMirrorsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3323,7 +3425,7 @@ func decodeListMirrorCollaboratorsResponse(resp *http.Response) (res *ListMirror
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListMirrorsResponse(resp *http.Response) (res *ListMirrorsOutputBody, _ error) {
+func decodeListBindingsResponse(resp *http.Response) (res *ListBindingsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3339,7 +3441,7 @@ func decodeListMirrorsResponse(resp *http.Response) (res *ListMirrorsOutputBody,
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListMirrorsOutputBody
+			var response ListBindingsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3415,7 +3517,7 @@ func decodeListMirrorsResponse(resp *http.Response) (res *ListMirrorsOutputBody,
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListOIDCProvidersResponse(resp *http.Response) (res *ListOIDCProvidersOutputBody, _ error) {
+func decodeListClustersResponse(resp *http.Response) (res *ListClustersOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3431,7 +3533,7 @@ func decodeListOIDCProvidersResponse(resp *http.Response) (res *ListOIDCProvider
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListOIDCProvidersOutputBody
+			var response ListClustersOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3507,7 +3609,7 @@ func decodeListOIDCProvidersResponse(resp *http.Response) (res *ListOIDCProvider
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListOrgMembersResponse(resp *http.Response) (res *ListOrgMembersOutputBody, _ error) {
+func decodeListMirrorCollaboratorsResponse(resp *http.Response) (res *ListMirrorCollaboratorsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3523,7 +3625,7 @@ func decodeListOrgMembersResponse(resp *http.Response) (res *ListOrgMembersOutpu
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListOrgMembersOutputBody
+			var response ListMirrorCollaboratorsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3599,7 +3701,7 @@ func decodeListOrgMembersResponse(resp *http.Response) (res *ListOrgMembersOutpu
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListOrgProjectsResponse(resp *http.Response) (res *ListOrgProjectsOutputBody, _ error) {
+func decodeListMirrorsResponse(resp *http.Response) (res *ListMirrorsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3615,7 +3717,7 @@ func decodeListOrgProjectsResponse(resp *http.Response) (res *ListOrgProjectsOut
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListOrgProjectsOutputBody
+			var response ListMirrorsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3691,7 +3793,7 @@ func decodeListOrgProjectsResponse(resp *http.Response) (res *ListOrgProjectsOut
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListOrgsResponse(resp *http.Response) (res *ListOrgsOutputBodyHeaders, _ error) {
+func decodeListNativeMirrorsResponse(resp *http.Response) (res *ListNativeMirrorsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3707,7 +3809,7 @@ func decodeListOrgsResponse(resp *http.Response) (res *ListOrgsOutputBodyHeaders
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListOrgsOutputBody
+			var response ListNativeMirrorsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3724,121 +3826,1676 @@ func decodeListOrgsResponse(resp *http.Response) (res *ListOrgsOutputBodyHeaders
 				}
 				return res, err
 			}
-			var wrapper ListOrgsOutputBodyHeaders
-			wrapper.Response = response
-			h := uri.NewHeaderDecoder(resp.Header)
-			// Parse "Cache-Control" header.
-			{
-				cfg := uri.HeaderParameterDecodingConfig{
-					Name:    "Cache-Control",
-					Explode: false,
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
 				}
-				if err := func() error {
-					if err := h.HasParam(cfg); err == nil {
-						if err := h.DecodeParam(cfg, func(d uri.Decoder) error {
-							var wrapperDotCacheControlVal string
-							if err := func() error {
-								val, err := d.DecodeValue()
-								if err != nil {
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListOIDCProvidersResponse(resp *http.Response) (res *ListOIDCProvidersOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListOIDCProvidersOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListOrgCIBuildkiteClustersResponse(resp *http.Response) (res *ListOrgCIBuildkiteClustersOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListOrgCIBuildkiteClustersOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListOrgCIBuildkiteCredentialsResponse(resp *http.Response) (res *ListOrgCIBuildkiteCredentialsOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListOrgCIBuildkiteCredentialsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListOrgMembersResponse(resp *http.Response) (res *ListOrgMembersOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListOrgMembersOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListOrgProjectsResponse(resp *http.Response) (res *ListOrgProjectsOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListOrgProjectsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListOrgsResponse(resp *http.Response) (res *ListOrgsOutputBodyHeaders, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListOrgsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			var wrapper ListOrgsOutputBodyHeaders
+			wrapper.Response = response
+			h := uri.NewHeaderDecoder(resp.Header)
+			// Parse "Cache-Control" header.
+			{
+				cfg := uri.HeaderParameterDecodingConfig{
+					Name:    "Cache-Control",
+					Explode: false,
+				}
+				if err := func() error {
+					if err := h.HasParam(cfg); err == nil {
+						if err := h.DecodeParam(cfg, func(d uri.Decoder) error {
+							var wrapperDotCacheControlVal string
+							if err := func() error {
+								val, err := d.DecodeValue()
+								if err != nil {
+									return err
+								}
+
+								c, err := conv.ToString(val)
+								if err != nil {
+									return err
+								}
+
+								wrapperDotCacheControlVal = c
+								return nil
+							}(); err != nil {
+								return err
+							}
+							wrapper.CacheControl.SetTo(wrapperDotCacheControlVal)
+							return nil
+						}); err != nil {
+							return err
+						}
+					}
+					return nil
+				}(); err != nil {
+					return res, errors.Wrap(err, "parse Cache-Control header")
+				}
+			}
+			// Parse "ETag" header.
+			{
+				cfg := uri.HeaderParameterDecodingConfig{
+					Name:    "ETag",
+					Explode: false,
+				}
+				if err := func() error {
+					if err := h.HasParam(cfg); err == nil {
+						if err := h.DecodeParam(cfg, func(d uri.Decoder) error {
+							var wrapperDotETagVal string
+							if err := func() error {
+								val, err := d.DecodeValue()
+								if err != nil {
+									return err
+								}
+
+								c, err := conv.ToString(val)
+								if err != nil {
+									return err
+								}
+
+								wrapperDotETagVal = c
+								return nil
+							}(); err != nil {
+								return err
+							}
+							wrapper.ETag.SetTo(wrapperDotETagVal)
+							return nil
+						}); err != nil {
+							return err
+						}
+					}
+					return nil
+				}(); err != nil {
+					return res, errors.Wrap(err, "parse ETag header")
+				}
+			}
+			// Parse "Vary" header.
+			{
+				cfg := uri.HeaderParameterDecodingConfig{
+					Name:    "Vary",
+					Explode: false,
+				}
+				if err := func() error {
+					if err := h.HasParam(cfg); err == nil {
+						if err := h.DecodeParam(cfg, func(d uri.Decoder) error {
+							var wrapperDotVaryVal string
+							if err := func() error {
+								val, err := d.DecodeValue()
+								if err != nil {
+									return err
+								}
+
+								c, err := conv.ToString(val)
+								if err != nil {
 									return err
 								}
 
-								c, err := conv.ToString(val)
-								if err != nil {
-									return err
-								}
+								wrapperDotVaryVal = c
+								return nil
+							}(); err != nil {
+								return err
+							}
+							wrapper.Vary.SetTo(wrapperDotVaryVal)
+							return nil
+						}); err != nil {
+							return err
+						}
+					}
+					return nil
+				}(); err != nil {
+					return res, errors.Wrap(err, "parse Vary header")
+				}
+			}
+			return &wrapper, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListProjectMembersResponse(resp *http.Response) (res *ListProjectMembersOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListProjectMembersOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListProjectReposResponse(resp *http.Response) (res *ListProjectReposOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListProjectReposOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListProjectsResponse(resp *http.Response) (res *ListProjectsOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListProjectsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoCIBuildsResponse(resp *http.Response) (res *ListRepoCIBuildsOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListRepoCIBuildsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoCIProvidersResponse(resp *http.Response) (res *ListRepoCIProvidersOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListRepoCIProvidersOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoCIWebhookAuditResponse(resp *http.Response) (res *ListRepoCIWebhookAuditOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListRepoCIWebhookAuditOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoCIWebhooksResponse(resp *http.Response) (res *ListRepoCIWebhooksOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListRepoCIWebhooksOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoCollaboratorsResponse(resp *http.Response) (res *ListRepoCollaboratorsOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListRepoCollaboratorsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoGrantsResponse(resp *http.Response) (res *ListRepoGrantsOutputBody, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ListRepoGrantsOutputBody
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoLanguageFacetsResponse(resp *http.Response) (res *RepoFacetPage, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response RepoFacetPage
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeListRepoOrgFacetsResponse(resp *http.Response) (res *RepoFacetPage, _ error) {
+	switch resp.StatusCode {
+	case 200:
+		// Code 200.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
 
-								wrapperDotCacheControlVal = c
-								return nil
-							}(); err != nil {
-								return err
-							}
-							wrapper.CacheControl.SetTo(wrapperDotCacheControlVal)
-							return nil
-						}); err != nil {
-							return err
-						}
-					}
-					return nil
-				}(); err != nil {
-					return res, errors.Wrap(err, "parse Cache-Control header")
+			var response RepoFacetPage
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
 				}
-			}
-			// Parse "ETag" header.
-			{
-				cfg := uri.HeaderParameterDecodingConfig{
-					Name:    "ETag",
-					Explode: false,
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
 				}
-				if err := func() error {
-					if err := h.HasParam(cfg); err == nil {
-						if err := h.DecodeParam(cfg, func(d uri.Decoder) error {
-							var wrapperDotETagVal string
-							if err := func() error {
-								val, err := d.DecodeValue()
-								if err != nil {
-									return err
-								}
-
-								c, err := conv.ToString(val)
-								if err != nil {
-									return err
-								}
-
-								wrapperDotETagVal = c
-								return nil
-							}(); err != nil {
-								return err
-							}
-							wrapper.ETag.SetTo(wrapperDotETagVal)
-							return nil
-						}); err != nil {
-							return err
-						}
-					}
-					return nil
-				}(); err != nil {
-					return res, errors.Wrap(err, "parse ETag header")
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
 				}
+				return res, err
 			}
-			// Parse "Vary" header.
-			{
-				cfg := uri.HeaderParameterDecodingConfig{
-					Name:    "Vary",
-					Explode: false,
-				}
-				if err := func() error {
-					if err := h.HasParam(cfg); err == nil {
-						if err := h.DecodeParam(cfg, func(d uri.Decoder) error {
-							var wrapperDotVaryVal string
-							if err := func() error {
-								val, err := d.DecodeValue()
-								if err != nil {
-									return err
-								}
-
-								c, err := conv.ToString(val)
-								if err != nil {
-									return err
-								}
-
-								wrapperDotVaryVal = c
-								return nil
-							}(); err != nil {
-								return err
-							}
-							wrapper.Vary.SetTo(wrapperDotVaryVal)
-							return nil
-						}); err != nil {
-							return err
-						}
-					}
-					return nil
-				}(); err != nil {
-					return res, errors.Wrap(err, "parse Vary header")
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
 				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
 			}
-			return &wrapper, nil
+			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
@@ -3888,7 +5545,7 @@ func decodeListOrgsResponse(resp *http.Response) (res *ListOrgsOutputBodyHeaders
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListProjectMembersResponse(resp *http.Response) (res *ListProjectMembersOutputBody, _ error) {
+func decodeListReposResponse(resp *http.Response) (res *ListReposOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3904,7 +5561,7 @@ func decodeListProjectMembersResponse(resp *http.Response) (res *ListProjectMemb
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListProjectMembersOutputBody
+			var response ListReposOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -3980,7 +5637,7 @@ func decodeListProjectMembersResponse(resp *http.Response) (res *ListProjectMemb
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListProjectReposResponse(resp *http.Response) (res *ListProjectReposOutputBody, _ error) {
+func decodeListServiceAccountGrantsResponse(resp *http.Response) (res *ListServiceAccountGrantsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -3996,7 +5653,7 @@ func decodeListProjectReposResponse(resp *http.Response) (res *ListProjectReposO
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListProjectReposOutputBody
+			var response ListServiceAccountGrantsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4013,6 +5670,15 @@ func decodeListProjectReposResponse(resp *http.Response) (res *ListProjectReposO
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -4063,7 +5729,7 @@ func decodeListProjectReposResponse(resp *http.Response) (res *ListProjectReposO
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListProjectsResponse(resp *http.Response) (res *ListProjectsOutputBody, _ error) {
+func decodeListServiceAccountsResponse(resp *http.Response) (res *ListServiceAccountsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4079,7 +5745,7 @@ func decodeListProjectsResponse(resp *http.Response) (res *ListProjectsOutputBod
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListProjectsOutputBody
+			var response ListServiceAccountsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4155,7 +5821,7 @@ func decodeListProjectsResponse(resp *http.Response) (res *ListProjectsOutputBod
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListRepoCIWebhooksResponse(resp *http.Response) (res *ListRepoCIWebhooksOutputBody, _ error) {
+func decodeLookupRepoBySlugResponse(resp *http.Response) (res *LookupBySlugOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4171,7 +5837,7 @@ func decodeListRepoCIWebhooksResponse(resp *http.Response) (res *ListRepoCIWebho
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListRepoCIWebhooksOutputBody
+			var response LookupBySlugOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4188,14 +5854,88 @@ func decodeListRepoCIWebhooksResponse(resp *http.Response) (res *ListRepoCIWebho
 				}
 				return res, err
 			}
-			// Validate response.
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
 			if err := func() error {
-				if err := response.Validate(); err != nil {
+				if err := response.Decode(d); err != nil {
 					return err
 				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
 				return nil
 			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
+			}
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeMintOrgCIGitHubActionsCredentialResponse(resp *http.Response) (res *OrgCIGitHubActionsCredentialView, _ error) {
+	switch resp.StatusCode {
+	case 201:
+		// Code 201.
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response OrgCIGitHubActionsCredentialView
+			if err := func() error {
+				if err := response.Decode(d); err != nil {
+					return err
+				}
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
 			}
 			return &response, nil
 		default:
@@ -4247,7 +5987,7 @@ func decodeListRepoCIWebhooksResponse(resp *http.Response) (res *ListRepoCIWebho
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListRepoGrantsResponse(resp *http.Response) (res *ListRepoGrantsOutputBody, _ error) {
+func decodePatchRepoCIWebhookResponse(resp *http.Response) (res *CIWebhookView, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4263,7 +6003,7 @@ func decodeListRepoGrantsResponse(resp *http.Response) (res *ListRepoGrantsOutpu
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListRepoGrantsOutputBody
+			var response CIWebhookView
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4339,10 +6079,10 @@ func decodeListRepoGrantsResponse(resp *http.Response) (res *ListRepoGrantsOutpu
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListReposResponse(resp *http.Response) (res *ListReposOutputBody, _ error) {
+func decodeRegisterOrgCIBuildkiteClusterResponse(resp *http.Response) (res *OrgCIBuildkiteClusterView, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 201:
+		// Code 201.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
@@ -4355,7 +6095,7 @@ func decodeListReposResponse(resp *http.Response) (res *ListReposOutputBody, _ e
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListReposOutputBody
+			var response OrgCIBuildkiteClusterView
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4372,19 +6112,61 @@ func decodeListReposResponse(resp *http.Response) (res *ListReposOutputBody, _ e
 				}
 				return res, err
 			}
-			// Validate response.
+			return &response, nil
+		default:
+			return res, validate.InvalidContentType(ct)
+		}
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+		if err != nil {
+			return res, errors.Wrap(err, "parse media type")
+		}
+		switch {
+		case ct == "application/problem+json":
+			buf, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return res, err
+			}
+			d := jx.DecodeBytes(buf)
+
+			var response ErrorModel
 			if err := func() error {
-				if err := response.Validate(); err != nil {
+				if err := response.Decode(d); err != nil {
 					return err
 				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
+				if err := d.Skip(); err != io.EOF {
+					return errors.New("unexpected trailing data")
+				}
+				return nil
+			}(); err != nil {
+				err = &ogenerrors.DecodeBodyError{
+					ContentType: ct,
+					Body:        buf,
+					Err:         err,
+				}
+				return res, err
 			}
-			return &response, nil
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeRemoveOrgMemberResponse(resp *http.Response) (res *RemoveOrgMemberNoContent, _ error) {
+	switch resp.StatusCode {
+	case 204:
+		// Code 204.
+		return &RemoveOrgMemberNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -4431,7 +6213,7 @@ func decodeListReposResponse(resp *http.Response) (res *ListReposOutputBody, _ e
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListServiceAccountGrantsResponse(resp *http.Response) (res *ListServiceAccountGrantsOutputBody, _ error) {
+func decodeResolveHandleResponse(resp *http.Response) (res *ResolvedIdentity, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4447,7 +6229,7 @@ func decodeListServiceAccountGrantsResponse(resp *http.Response) (res *ListServi
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListServiceAccountGrantsOutputBody
+			var response ResolvedIdentity
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4464,15 +6246,6 @@ func decodeListServiceAccountGrantsResponse(resp *http.Response) (res *ListServi
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -4523,7 +6296,7 @@ func decodeListServiceAccountGrantsResponse(resp *http.Response) (res *ListServi
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeListServiceAccountsResponse(resp *http.Response) (res *ListServiceAccountsOutputBody, _ error) {
+func decodeResolveMirrorPlacementsResponse(resp *http.Response) (res *ResolvePlacementsOutputBody, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4539,7 +6312,7 @@ func decodeListServiceAccountsResponse(resp *http.Response) (res *ListServiceAcc
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ListServiceAccountsOutputBody
+			var response ResolvePlacementsOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4615,7 +6388,7 @@ func decodeListServiceAccountsResponse(resp *http.Response) (res *ListServiceAcc
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeLookupRepoBySlugResponse(resp *http.Response) (res *LookupBySlugOutputBody, _ error) {
+func decodeResolveRepoIDsResponse(resp *http.Response) (res *ResolveRepoIDsResponse, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4631,7 +6404,7 @@ func decodeLookupRepoBySlugResponse(resp *http.Response) (res *LookupBySlugOutpu
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response LookupBySlugOutputBody
+			var response ResolveRepoIDsResponse
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4648,6 +6421,15 @@ func decodeLookupRepoBySlugResponse(resp *http.Response) (res *LookupBySlugOutpu
 				}
 				return res, err
 			}
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -4698,7 +6480,7 @@ func decodeLookupRepoBySlugResponse(resp *http.Response) (res *LookupBySlugOutpu
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeLookupResourcesResponse(resp *http.Response) (res *LookupResourcesOutputBody, _ error) {
+func decodeResolveReposResponse(resp *http.Response) (res *ResolveReposResponse, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -4714,7 +6496,7 @@ func decodeLookupResourcesResponse(resp *http.Response) (res *LookupResourcesOut
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response LookupResourcesOutputBody
+			var response ResolveReposResponse
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4790,23 +6572,27 @@ func decodeLookupResourcesResponse(resp *http.Response) (res *LookupResourcesOut
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodePatchRepoCIWebhookResponse(resp *http.Response) (res *CIWebhookView, _ error) {
+func decodeRevokeProjectAccessResponse(resp *http.Response) (res *RevokeProjectAccessNoContent, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 204:
+		// Code 204.
+		return &RevokeProjectAccessNoContent{}, nil
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/json":
+		case ct == "application/problem+json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response CIWebhookView
+			var response ErrorModel
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4823,19 +6609,25 @@ func decodePatchRepoCIWebhookResponse(resp *http.Response) (res *CIWebhookView,
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
-			return &response, nil
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeRevokeProjectAccessByProviderResponse(resp *http.Response) (res *RevokeProjectAccessByProviderNoContent, _ error) {
+	switch resp.StatusCode {
+	case 204:
+		// Code 204.
+		return &RevokeProjectAccessByProviderNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -4882,11 +6674,11 @@ func decodePatchRepoCIWebhookResponse(resp *http.Response) (res *CIWebhookView,
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeRemoveOrgMemberResponse(resp *http.Response) (res *RemoveOrgMemberNoContent, _ error) {
+func decodeRevokeRepoAccessResponse(resp *http.Response) (res *RevokeRepoAccessNoContent, _ error) {
 	switch resp.StatusCode {
 	case 204:
 		// Code 204.
-		return &RemoveOrgMemberNoContent{}, nil
+		return &RevokeRepoAccessNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -4933,23 +6725,27 @@ func decodeRemoveOrgMemberResponse(resp *http.Response) (res *RemoveOrgMemberNoC
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeResolveHandleResponse(resp *http.Response) (res *ResolvedIdentity, _ error) {
+func decodeRevokeRepoAccessByProviderResponse(resp *http.Response) (res *RevokeRepoAccessByProviderNoContent, _ error) {
 	switch resp.StatusCode {
-	case 200:
-		// Code 200.
+	case 204:
+		// Code 204.
+		return &RevokeRepoAccessByProviderNoContent{}, nil
+	}
+	// Convenient error response.
+	defRes, err := func() (res *ErrorModelStatusCode, err error) {
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/json":
+		case ct == "application/problem+json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ResolvedIdentity
+			var response ErrorModel
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -4966,10 +6762,25 @@ func decodeResolveHandleResponse(resp *http.Response) (res *ResolvedIdentity, _
 				}
 				return res, err
 			}
-			return &response, nil
+			return &ErrorModelStatusCode{
+				StatusCode: resp.StatusCode,
+				Response:   response,
+			}, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
+	}()
+	if err != nil {
+		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
+	}
+	return res, errors.Wrap(defRes, "error")
+}
+
+func decodeRevokeServiceAccountAccessResponse(resp *http.Response) (res *RevokeServiceAccountAccessNoContent, _ error) {
+	switch resp.StatusCode {
+	case 204:
+		// Code 204.
+		return &RevokeServiceAccountAccessNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -5016,7 +6827,7 @@ func decodeResolveHandleResponse(resp *http.Response) (res *ResolvedIdentity, _
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeResolveMirrorPlacementsResponse(resp *http.Response) (res *ResolvePlacementsOutputBody, _ error) {
+func decodeRotateOrgCIBuildkiteInboundSecretResponse(resp *http.Response) (res *OrgCIBuildkiteCredentialView, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -5032,7 +6843,7 @@ func decodeResolveMirrorPlacementsResponse(resp *http.Response) (res *ResolvePla
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ResolvePlacementsOutputBody
+			var response OrgCIBuildkiteCredentialView
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -5049,15 +6860,6 @@ func decodeResolveMirrorPlacementsResponse(resp *http.Response) (res *ResolvePla
 				}
 				return res, err
 			}
-			// Validate response.
-			if err := func() error {
-				if err := response.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return res, errors.Wrap(err, "validate")
-			}
 			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
@@ -5108,27 +6910,23 @@ func decodeResolveMirrorPlacementsResponse(resp *http.Response) (res *ResolvePla
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeRevokeProjectAccessResponse(resp *http.Response) (res *RevokeProjectAccessNoContent, _ error) {
+func decodeSetBranchProtectionResponse(resp *http.Response) (res *BranchProtection, _ error) {
 	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &RevokeProjectAccessNoContent{}, nil
-	}
-	// Convenient error response.
-	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+	case 200:
+		// Code 200.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/problem+json":
+		case ct == "application/json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ErrorModel
+			var response BranchProtection
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -5145,76 +6943,19 @@ func decodeRevokeProjectAccessResponse(resp *http.Response) (res *RevokeProjectA
 				}
 				return res, err
 			}
-			return &ErrorModelStatusCode{
-				StatusCode: resp.StatusCode,
-				Response:   response,
-			}, nil
-		default:
-			return res, validate.InvalidContentType(ct)
-		}
-	}()
-	if err != nil {
-		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
-	}
-	return res, errors.Wrap(defRes, "error")
-}
-
-func decodeRevokeProjectAccessByProviderResponse(resp *http.Response) (res *RevokeProjectAccessByProviderNoContent, _ error) {
-	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &RevokeProjectAccessByProviderNoContent{}, nil
-	}
-	// Convenient error response.
-	defRes, err := func() (res *ErrorModelStatusCode, err error) {
-		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
-		if err != nil {
-			return res, errors.Wrap(err, "parse media type")
-		}
-		switch {
-		case ct == "application/problem+json":
-			buf, err := io.ReadAll(resp.Body)
-			if err != nil {
-				return res, err
-			}
-			d := jx.DecodeBytes(buf)
-
-			var response ErrorModel
+			// Validate response.
 			if err := func() error {
-				if err := response.Decode(d); err != nil {
+				if err := response.Validate(); err != nil {
 					return err
 				}
-				if err := d.Skip(); err != io.EOF {
-					return errors.New("unexpected trailing data")
-				}
 				return nil
 			}(); err != nil {
-				err = &ogenerrors.DecodeBodyError{
-					ContentType: ct,
-					Body:        buf,
-					Err:         err,
-				}
-				return res, err
+				return res, errors.Wrap(err, "validate")
 			}
-			return &ErrorModelStatusCode{
-				StatusCode: resp.StatusCode,
-				Response:   response,
-			}, nil
+			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
-	}()
-	if err != nil {
-		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
-	}
-	return res, errors.Wrap(defRes, "error")
-}
-
-func decodeRevokeRepoAccessResponse(resp *http.Response) (res *RevokeRepoAccessNoContent, _ error) {
-	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &RevokeRepoAccessNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -5261,27 +7002,23 @@ func decodeRevokeRepoAccessResponse(resp *http.Response) (res *RevokeRepoAccessN
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeRevokeRepoAccessByProviderResponse(resp *http.Response) (res *RevokeRepoAccessByProviderNoContent, _ error) {
+func decodeSetRepoVisibilityResponse(resp *http.Response) (res *SetRepoVisibilityOutputBody, _ error) {
 	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &RevokeRepoAccessByProviderNoContent{}, nil
-	}
-	// Convenient error response.
-	defRes, err := func() (res *ErrorModelStatusCode, err error) {
+	case 200:
+		// Code 200.
 		ct, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
 		if err != nil {
 			return res, errors.Wrap(err, "parse media type")
 		}
 		switch {
-		case ct == "application/problem+json":
+		case ct == "application/json":
 			buf, err := io.ReadAll(resp.Body)
 			if err != nil {
 				return res, err
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response ErrorModel
+			var response SetRepoVisibilityOutputBody
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
@@ -5298,25 +7035,19 @@ func decodeRevokeRepoAccessByProviderResponse(resp *http.Response) (res *RevokeR
 				}
 				return res, err
 			}
-			return &ErrorModelStatusCode{
-				StatusCode: resp.StatusCode,
-				Response:   response,
-			}, nil
+			// Validate response.
+			if err := func() error {
+				if err := response.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return res, errors.Wrap(err, "validate")
+			}
+			return &response, nil
 		default:
 			return res, validate.InvalidContentType(ct)
 		}
-	}()
-	if err != nil {
-		return res, errors.Wrapf(err, "default (code %d)", resp.StatusCode)
-	}
-	return res, errors.Wrap(defRes, "error")
-}
-
-func decodeRevokeServiceAccountAccessResponse(resp *http.Response) (res *RevokeServiceAccountAccessNoContent, _ error) {
-	switch resp.StatusCode {
-	case 204:
-		// Code 204.
-		return &RevokeServiceAccountAccessNoContent{}, nil
 	}
 	// Convenient error response.
 	defRes, err := func() (res *ErrorModelStatusCode, err error) {
@@ -5363,7 +7094,7 @@ func decodeRevokeServiceAccountAccessResponse(resp *http.Response) (res *RevokeS
 	return res, errors.Wrap(defRes, "error")
 }
 
-func decodeSetRepoVisibilityResponse(resp *http.Response) (res *SetRepoVisibilityOutputBody, _ error) {
+func decodeUpdateBranchProtectionResponse(resp *http.Response) (res *BranchProtection, _ error) {
 	switch resp.StatusCode {
 	case 200:
 		// Code 200.
@@ -5379,7 +7110,7 @@ func decodeSetRepoVisibilityResponse(resp *http.Response) (res *SetRepoVisibilit
 			}
 			d := jx.DecodeBytes(buf)
 
-			var response SetRepoVisibilityOutputBody
+			var response BranchProtection
 			if err := func() error {
 				if err := response.Decode(d); err != nil {
 					return err
diff --git a/internal/coreapi/oas_schemas_gen.go b/internal/coreapi/oas_schemas_gen.go
index d07378deeb..87557b5d32 100644
--- a/internal/coreapi/oas_schemas_gen.go
+++ b/internal/coreapi/oas_schemas_gen.go
@@ -248,7 +248,9 @@ type AvailableMirror struct {
 	IsArchived OptBool               `json:"isArchived"`
 	IsPrivate  OptBool               `json:"isPrivate"`
 	Owner      string                `json:"owner"`
-	Repo       string                `json:"repo"`
+	// Time of the latest push to the upstream repository.
+	PushedAt OptDateTime `json:"pushedAt"`
+	Repo     string      `json:"repo"`
 	// Available (can onboard), mirrored (already mirrored), or owner-only (personal repo of another
 	// user).
 	Status          AvailableMirrorStatus `json:"status"`
@@ -275,6 +277,11 @@ func (s *AvailableMirror) GetOwner() string {
 	return s.Owner
 }
 
+// GetPushedAt returns the value of PushedAt.
+func (s *AvailableMirror) GetPushedAt() OptDateTime {
+	return s.PushedAt
+}
+
 // GetRepo returns the value of Repo.
 func (s *AvailableMirror) GetRepo() string {
 	return s.Repo
@@ -310,6 +317,11 @@ func (s *AvailableMirror) SetOwner(val string) {
 	s.Owner = val
 }
 
+// SetPushedAt sets the value of PushedAt.
+func (s *AvailableMirror) SetPushedAt(val OptDateTime) {
+	s.PushedAt = val
+}
+
 // SetRepo sets the value of Repo.
 func (s *AvailableMirror) SetRepo(val string) {
 	s.Repo = val
@@ -435,104 +447,6 @@ func (s *AvailableMirrorStatus) UnmarshalText(data []byte) error {
 	}
 }
 
-// Ref: #/components/schemas/BatchLookupInputBody
-type BatchLookupInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI      `json:"$schema"`
-	Refs            []LookupRef `json:"refs"`
-	AdditionalProps BatchLookupInputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *BatchLookupInputBody) GetSchema() OptURI {
-	return s.Schema
-}
-
-// GetRefs returns the value of Refs.
-func (s *BatchLookupInputBody) GetRefs() []LookupRef {
-	return s.Refs
-}
-
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *BatchLookupInputBody) GetAdditionalProps() BatchLookupInputBodyAdditional {
-	return s.AdditionalProps
-}
-
-// SetSchema sets the value of Schema.
-func (s *BatchLookupInputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
-
-// SetRefs sets the value of Refs.
-func (s *BatchLookupInputBody) SetRefs(val []LookupRef) {
-	s.Refs = val
-}
-
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *BatchLookupInputBody) SetAdditionalProps(val BatchLookupInputBodyAdditional) {
-	s.AdditionalProps = val
-}
-
-type BatchLookupInputBodyAdditional map[string]jx.Raw
-
-func (s *BatchLookupInputBodyAdditional) init() BatchLookupInputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
-}
-
-// Ref: #/components/schemas/BatchLookupOutputBody
-type BatchLookupOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI            `json:"$schema"`
-	Refs            []LookupRefResult `json:"refs"`
-	AdditionalProps BatchLookupOutputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *BatchLookupOutputBody) GetSchema() OptURI {
-	return s.Schema
-}
-
-// GetRefs returns the value of Refs.
-func (s *BatchLookupOutputBody) GetRefs() []LookupRefResult {
-	return s.Refs
-}
-
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *BatchLookupOutputBody) GetAdditionalProps() BatchLookupOutputBodyAdditional {
-	return s.AdditionalProps
-}
-
-// SetSchema sets the value of Schema.
-func (s *BatchLookupOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
-
-// SetRefs sets the value of Refs.
-func (s *BatchLookupOutputBody) SetRefs(val []LookupRefResult) {
-	s.Refs = val
-}
-
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *BatchLookupOutputBody) SetAdditionalProps(val BatchLookupOutputBodyAdditional) {
-	s.AdditionalProps = val
-}
-
-type BatchLookupOutputBodyAdditional map[string]jx.Raw
-
-func (s *BatchLookupOutputBodyAdditional) init() BatchLookupOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
-}
-
 type BearerAuth struct {
 	Token string
 	Roles []string
@@ -651,157 +565,323 @@ func (s *BindingAdditional) init() BindingAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/CIWebhookView
-type CIWebhookView struct {
+// Ref: #/components/schemas/BranchProtection
+type BranchProtection struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI    `json:"$schema"`
-	BkOrganization  string    `json:"bk_organization"`
-	BkPipeline      string    `json:"bk_pipeline"`
-	CreatedAt       time.Time `json:"created_at"`
-	DisplayName     string    `json:"display_name"`
-	Enabled         bool      `json:"enabled"`
-	Events          []string  `json:"events"`
-	ID              string    `json:"id"`
-	Provider        string    `json:"provider"`
-	RefFilter       string    `json:"ref_filter"`
-	RepoID          string    `json:"repo_id"`
-	UpdatedAt       time.Time `json:"updated_at"`
-	AdditionalProps CIWebhookViewAdditional
+	Schema OptURI `json:"$schema"`
+	// Protection rules, one per pattern; each ref at most once. Empty protects nothing.
+	Rules           []BranchRule `json:"rules"`
+	AdditionalProps BranchProtectionAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *CIWebhookView) GetSchema() OptURI {
+func (s *BranchProtection) GetSchema() OptURI {
 	return s.Schema
 }
 
+// GetRules returns the value of Rules.
+func (s *BranchProtection) GetRules() []BranchRule {
+	return s.Rules
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *BranchProtection) GetAdditionalProps() BranchProtectionAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *BranchProtection) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetRules sets the value of Rules.
+func (s *BranchProtection) SetRules(val []BranchRule) {
+	s.Rules = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *BranchProtection) SetAdditionalProps(val BranchProtectionAdditional) {
+	s.AdditionalProps = val
+}
+
+type BranchProtectionAdditional map[string]jx.Raw
+
+func (s *BranchProtectionAdditional) init() BranchProtectionAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/BranchRule
+type BranchRule struct {
+	// "HEAD" or a refs/heads/ name, fnmatch wildcards allowed.
+	Ref string `json:"ref"`
+	// The branch moves only through a server-side merge by Entire; every direct write, fast-forward
+	// included, is refused. Defaults to false.
+	ServerSideMergeOnly OptBool `json:"serverSideMergeOnly"`
+	AdditionalProps     BranchRuleAdditional
+}
+
+// GetRef returns the value of Ref.
+func (s *BranchRule) GetRef() string {
+	return s.Ref
+}
+
+// GetServerSideMergeOnly returns the value of ServerSideMergeOnly.
+func (s *BranchRule) GetServerSideMergeOnly() OptBool {
+	return s.ServerSideMergeOnly
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *BranchRule) GetAdditionalProps() BranchRuleAdditional {
+	return s.AdditionalProps
+}
+
+// SetRef sets the value of Ref.
+func (s *BranchRule) SetRef(val string) {
+	s.Ref = val
+}
+
+// SetServerSideMergeOnly sets the value of ServerSideMergeOnly.
+func (s *BranchRule) SetServerSideMergeOnly(val OptBool) {
+	s.ServerSideMergeOnly = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *BranchRule) SetAdditionalProps(val BranchRuleAdditional) {
+	s.AdditionalProps = val
+}
+
+type BranchRuleAdditional map[string]jx.Raw
+
+func (s *BranchRuleAdditional) init() BranchRuleAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/CIBuildView
+type CIBuildView struct {
+	BkBuildUUID     string      `json:"bk_build_uuid"`
+	BkOrganization  string      `json:"bk_organization"`
+	BkPipeline      string      `json:"bk_pipeline"`
+	Branch          string      `json:"branch"`
+	BuildNumber     int64       `json:"build_number"`
+	Commit          string      `json:"commit"`
+	CreatedAt       OptDateTime `json:"created_at"`
+	EventAt         time.Time   `json:"event_at"`
+	FinishedAt      OptDateTime `json:"finished_at"`
+	Jobs            []CIJobView `json:"jobs"`
+	LastEvent       string      `json:"last_event"`
+	Message         string      `json:"message"`
+	Stale           bool        `json:"stale"`
+	StartedAt       OptDateTime `json:"started_at"`
+	State           string      `json:"state"`
+	Terminal        bool        `json:"terminal"`
+	UpdatedAt       time.Time   `json:"updated_at"`
+	WebURL          string      `json:"web_url"`
+	AdditionalProps CIBuildViewAdditional
+}
+
+// GetBkBuildUUID returns the value of BkBuildUUID.
+func (s *CIBuildView) GetBkBuildUUID() string {
+	return s.BkBuildUUID
+}
+
 // GetBkOrganization returns the value of BkOrganization.
-func (s *CIWebhookView) GetBkOrganization() string {
+func (s *CIBuildView) GetBkOrganization() string {
 	return s.BkOrganization
 }
 
 // GetBkPipeline returns the value of BkPipeline.
-func (s *CIWebhookView) GetBkPipeline() string {
+func (s *CIBuildView) GetBkPipeline() string {
 	return s.BkPipeline
 }
 
+// GetBranch returns the value of Branch.
+func (s *CIBuildView) GetBranch() string {
+	return s.Branch
+}
+
+// GetBuildNumber returns the value of BuildNumber.
+func (s *CIBuildView) GetBuildNumber() int64 {
+	return s.BuildNumber
+}
+
+// GetCommit returns the value of Commit.
+func (s *CIBuildView) GetCommit() string {
+	return s.Commit
+}
+
 // GetCreatedAt returns the value of CreatedAt.
-func (s *CIWebhookView) GetCreatedAt() time.Time {
+func (s *CIBuildView) GetCreatedAt() OptDateTime {
 	return s.CreatedAt
 }
 
-// GetDisplayName returns the value of DisplayName.
-func (s *CIWebhookView) GetDisplayName() string {
-	return s.DisplayName
+// GetEventAt returns the value of EventAt.
+func (s *CIBuildView) GetEventAt() time.Time {
+	return s.EventAt
 }
 
-// GetEnabled returns the value of Enabled.
-func (s *CIWebhookView) GetEnabled() bool {
-	return s.Enabled
+// GetFinishedAt returns the value of FinishedAt.
+func (s *CIBuildView) GetFinishedAt() OptDateTime {
+	return s.FinishedAt
 }
 
-// GetEvents returns the value of Events.
-func (s *CIWebhookView) GetEvents() []string {
-	return s.Events
+// GetJobs returns the value of Jobs.
+func (s *CIBuildView) GetJobs() []CIJobView {
+	return s.Jobs
 }
 
-// GetID returns the value of ID.
-func (s *CIWebhookView) GetID() string {
-	return s.ID
+// GetLastEvent returns the value of LastEvent.
+func (s *CIBuildView) GetLastEvent() string {
+	return s.LastEvent
 }
 
-// GetProvider returns the value of Provider.
-func (s *CIWebhookView) GetProvider() string {
-	return s.Provider
+// GetMessage returns the value of Message.
+func (s *CIBuildView) GetMessage() string {
+	return s.Message
 }
 
-// GetRefFilter returns the value of RefFilter.
-func (s *CIWebhookView) GetRefFilter() string {
-	return s.RefFilter
+// GetStale returns the value of Stale.
+func (s *CIBuildView) GetStale() bool {
+	return s.Stale
 }
 
-// GetRepoID returns the value of RepoID.
-func (s *CIWebhookView) GetRepoID() string {
-	return s.RepoID
+// GetStartedAt returns the value of StartedAt.
+func (s *CIBuildView) GetStartedAt() OptDateTime {
+	return s.StartedAt
+}
+
+// GetState returns the value of State.
+func (s *CIBuildView) GetState() string {
+	return s.State
+}
+
+// GetTerminal returns the value of Terminal.
+func (s *CIBuildView) GetTerminal() bool {
+	return s.Terminal
 }
 
 // GetUpdatedAt returns the value of UpdatedAt.
-func (s *CIWebhookView) GetUpdatedAt() time.Time {
+func (s *CIBuildView) GetUpdatedAt() time.Time {
 	return s.UpdatedAt
 }
 
+// GetWebURL returns the value of WebURL.
+func (s *CIBuildView) GetWebURL() string {
+	return s.WebURL
+}
+
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CIWebhookView) GetAdditionalProps() CIWebhookViewAdditional {
+func (s *CIBuildView) GetAdditionalProps() CIBuildViewAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CIWebhookView) SetSchema(val OptURI) {
-	s.Schema = val
+// SetBkBuildUUID sets the value of BkBuildUUID.
+func (s *CIBuildView) SetBkBuildUUID(val string) {
+	s.BkBuildUUID = val
 }
 
 // SetBkOrganization sets the value of BkOrganization.
-func (s *CIWebhookView) SetBkOrganization(val string) {
+func (s *CIBuildView) SetBkOrganization(val string) {
 	s.BkOrganization = val
 }
 
 // SetBkPipeline sets the value of BkPipeline.
-func (s *CIWebhookView) SetBkPipeline(val string) {
+func (s *CIBuildView) SetBkPipeline(val string) {
 	s.BkPipeline = val
 }
 
+// SetBranch sets the value of Branch.
+func (s *CIBuildView) SetBranch(val string) {
+	s.Branch = val
+}
+
+// SetBuildNumber sets the value of BuildNumber.
+func (s *CIBuildView) SetBuildNumber(val int64) {
+	s.BuildNumber = val
+}
+
+// SetCommit sets the value of Commit.
+func (s *CIBuildView) SetCommit(val string) {
+	s.Commit = val
+}
+
 // SetCreatedAt sets the value of CreatedAt.
-func (s *CIWebhookView) SetCreatedAt(val time.Time) {
+func (s *CIBuildView) SetCreatedAt(val OptDateTime) {
 	s.CreatedAt = val
 }
 
-// SetDisplayName sets the value of DisplayName.
-func (s *CIWebhookView) SetDisplayName(val string) {
-	s.DisplayName = val
+// SetEventAt sets the value of EventAt.
+func (s *CIBuildView) SetEventAt(val time.Time) {
+	s.EventAt = val
 }
 
-// SetEnabled sets the value of Enabled.
-func (s *CIWebhookView) SetEnabled(val bool) {
-	s.Enabled = val
+// SetFinishedAt sets the value of FinishedAt.
+func (s *CIBuildView) SetFinishedAt(val OptDateTime) {
+	s.FinishedAt = val
 }
 
-// SetEvents sets the value of Events.
-func (s *CIWebhookView) SetEvents(val []string) {
-	s.Events = val
+// SetJobs sets the value of Jobs.
+func (s *CIBuildView) SetJobs(val []CIJobView) {
+	s.Jobs = val
 }
 
-// SetID sets the value of ID.
-func (s *CIWebhookView) SetID(val string) {
-	s.ID = val
+// SetLastEvent sets the value of LastEvent.
+func (s *CIBuildView) SetLastEvent(val string) {
+	s.LastEvent = val
 }
 
-// SetProvider sets the value of Provider.
-func (s *CIWebhookView) SetProvider(val string) {
-	s.Provider = val
+// SetMessage sets the value of Message.
+func (s *CIBuildView) SetMessage(val string) {
+	s.Message = val
 }
 
-// SetRefFilter sets the value of RefFilter.
-func (s *CIWebhookView) SetRefFilter(val string) {
-	s.RefFilter = val
+// SetStale sets the value of Stale.
+func (s *CIBuildView) SetStale(val bool) {
+	s.Stale = val
 }
 
-// SetRepoID sets the value of RepoID.
-func (s *CIWebhookView) SetRepoID(val string) {
-	s.RepoID = val
+// SetStartedAt sets the value of StartedAt.
+func (s *CIBuildView) SetStartedAt(val OptDateTime) {
+	s.StartedAt = val
+}
+
+// SetState sets the value of State.
+func (s *CIBuildView) SetState(val string) {
+	s.State = val
+}
+
+// SetTerminal sets the value of Terminal.
+func (s *CIBuildView) SetTerminal(val bool) {
+	s.Terminal = val
 }
 
 // SetUpdatedAt sets the value of UpdatedAt.
-func (s *CIWebhookView) SetUpdatedAt(val time.Time) {
+func (s *CIBuildView) SetUpdatedAt(val time.Time) {
 	s.UpdatedAt = val
 }
 
+// SetWebURL sets the value of WebURL.
+func (s *CIBuildView) SetWebURL(val string) {
+	s.WebURL = val
+}
+
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CIWebhookView) SetAdditionalProps(val CIWebhookViewAdditional) {
+func (s *CIBuildView) SetAdditionalProps(val CIBuildViewAdditional) {
 	s.AdditionalProps = val
 }
 
-type CIWebhookViewAdditional map[string]jx.Raw
+type CIBuildViewAdditional map[string]jx.Raw
 
-func (s *CIWebhookViewAdditional) init() CIWebhookViewAdditional {
+func (s *CIBuildViewAdditional) init() CIBuildViewAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -810,82 +890,112 @@ func (s *CIWebhookViewAdditional) init() CIWebhookViewAdditional {
 	return m
 }
 
-// CancelDeletionOK is response for CancelDeletion operation.
-type CancelDeletionOK struct{}
+// Ref: #/components/schemas/CIJobView
+type CIJobView struct {
+	BkJobID         string      `json:"bk_job_id"`
+	ExitStatus      OptInt64    `json:"exit_status"`
+	FinishedAt      OptDateTime `json:"finished_at"`
+	Name            string      `json:"name"`
+	StartedAt       OptDateTime `json:"started_at"`
+	State           string      `json:"state"`
+	StepKey         string      `json:"step_key"`
+	Type            string      `json:"type"`
+	AdditionalProps CIJobViewAdditional
+}
 
-// Ref: #/components/schemas/Cluster
-type Cluster struct {
-	ApiUrl          OptString `json:"apiUrl"`
-	IsDefault       bool      `json:"isDefault"`
-	Jurisdiction    string    `json:"jurisdiction"`
-	PublicUrl       string    `json:"publicUrl"`
-	Slug            string    `json:"slug"`
-	AdditionalProps ClusterAdditional
+// GetBkJobID returns the value of BkJobID.
+func (s *CIJobView) GetBkJobID() string {
+	return s.BkJobID
 }
 
-// GetApiUrl returns the value of ApiUrl.
-func (s *Cluster) GetApiUrl() OptString {
-	return s.ApiUrl
+// GetExitStatus returns the value of ExitStatus.
+func (s *CIJobView) GetExitStatus() OptInt64 {
+	return s.ExitStatus
 }
 
-// GetIsDefault returns the value of IsDefault.
-func (s *Cluster) GetIsDefault() bool {
-	return s.IsDefault
+// GetFinishedAt returns the value of FinishedAt.
+func (s *CIJobView) GetFinishedAt() OptDateTime {
+	return s.FinishedAt
 }
 
-// GetJurisdiction returns the value of Jurisdiction.
-func (s *Cluster) GetJurisdiction() string {
-	return s.Jurisdiction
+// GetName returns the value of Name.
+func (s *CIJobView) GetName() string {
+	return s.Name
 }
 
-// GetPublicUrl returns the value of PublicUrl.
-func (s *Cluster) GetPublicUrl() string {
-	return s.PublicUrl
+// GetStartedAt returns the value of StartedAt.
+func (s *CIJobView) GetStartedAt() OptDateTime {
+	return s.StartedAt
 }
 
-// GetSlug returns the value of Slug.
-func (s *Cluster) GetSlug() string {
-	return s.Slug
+// GetState returns the value of State.
+func (s *CIJobView) GetState() string {
+	return s.State
+}
+
+// GetStepKey returns the value of StepKey.
+func (s *CIJobView) GetStepKey() string {
+	return s.StepKey
+}
+
+// GetType returns the value of Type.
+func (s *CIJobView) GetType() string {
+	return s.Type
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *Cluster) GetAdditionalProps() ClusterAdditional {
+func (s *CIJobView) GetAdditionalProps() CIJobViewAdditional {
 	return s.AdditionalProps
 }
 
-// SetApiUrl sets the value of ApiUrl.
-func (s *Cluster) SetApiUrl(val OptString) {
-	s.ApiUrl = val
+// SetBkJobID sets the value of BkJobID.
+func (s *CIJobView) SetBkJobID(val string) {
+	s.BkJobID = val
 }
 
-// SetIsDefault sets the value of IsDefault.
-func (s *Cluster) SetIsDefault(val bool) {
-	s.IsDefault = val
+// SetExitStatus sets the value of ExitStatus.
+func (s *CIJobView) SetExitStatus(val OptInt64) {
+	s.ExitStatus = val
 }
 
-// SetJurisdiction sets the value of Jurisdiction.
-func (s *Cluster) SetJurisdiction(val string) {
-	s.Jurisdiction = val
+// SetFinishedAt sets the value of FinishedAt.
+func (s *CIJobView) SetFinishedAt(val OptDateTime) {
+	s.FinishedAt = val
 }
 
-// SetPublicUrl sets the value of PublicUrl.
-func (s *Cluster) SetPublicUrl(val string) {
-	s.PublicUrl = val
+// SetName sets the value of Name.
+func (s *CIJobView) SetName(val string) {
+	s.Name = val
 }
 
-// SetSlug sets the value of Slug.
-func (s *Cluster) SetSlug(val string) {
-	s.Slug = val
+// SetStartedAt sets the value of StartedAt.
+func (s *CIJobView) SetStartedAt(val OptDateTime) {
+	s.StartedAt = val
+}
+
+// SetState sets the value of State.
+func (s *CIJobView) SetState(val string) {
+	s.State = val
+}
+
+// SetStepKey sets the value of StepKey.
+func (s *CIJobView) SetStepKey(val string) {
+	s.StepKey = val
+}
+
+// SetType sets the value of Type.
+func (s *CIJobView) SetType(val string) {
+	s.Type = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *Cluster) SetAdditionalProps(val ClusterAdditional) {
+func (s *CIJobView) SetAdditionalProps(val CIJobViewAdditional) {
 	s.AdditionalProps = val
 }
 
-type ClusterAdditional map[string]jx.Raw
+type CIJobViewAdditional map[string]jx.Raw
 
-func (s *ClusterAdditional) init() ClusterAdditional {
+func (s *CIJobViewAdditional) init() CIJobViewAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -894,48 +1004,96 @@ func (s *ClusterAdditional) init() ClusterAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/CompleteOnboardingOutputBody
-type CompleteOnboardingOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Always false after onboarding completion is recorded.
-	NeedsOnboarding bool `json:"needsOnboarding"`
-	AdditionalProps CompleteOnboardingOutputBodyAdditional
+// Ref: #/components/schemas/CIProviderDescriptor
+type CIProviderDescriptor struct {
+	// Whether this org can enrol into this provider right now.
+	Enrollable bool `json:"enrollable"`
+	// Form fields, in the order a client should render them.
+	Fields []CIProviderField `json:"fields"`
+	// Human-readable provider name.
+	Label string `json:"label"`
+	// Ways of enrolling; exactly one is marked default.
+	Modes []CIProviderMode `json:"modes"`
+	// Provider key, posted back as the request's provider.
+	Name string `json:"name"`
+	// Why enrolment is unavailable; set only when enrollable is false.
+	Reason          OptString `json:"reason"`
+	AdditionalProps CIProviderDescriptorAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *CompleteOnboardingOutputBody) GetSchema() OptURI {
-	return s.Schema
+// GetEnrollable returns the value of Enrollable.
+func (s *CIProviderDescriptor) GetEnrollable() bool {
+	return s.Enrollable
 }
 
-// GetNeedsOnboarding returns the value of NeedsOnboarding.
-func (s *CompleteOnboardingOutputBody) GetNeedsOnboarding() bool {
-	return s.NeedsOnboarding
+// GetFields returns the value of Fields.
+func (s *CIProviderDescriptor) GetFields() []CIProviderField {
+	return s.Fields
+}
+
+// GetLabel returns the value of Label.
+func (s *CIProviderDescriptor) GetLabel() string {
+	return s.Label
+}
+
+// GetModes returns the value of Modes.
+func (s *CIProviderDescriptor) GetModes() []CIProviderMode {
+	return s.Modes
+}
+
+// GetName returns the value of Name.
+func (s *CIProviderDescriptor) GetName() string {
+	return s.Name
+}
+
+// GetReason returns the value of Reason.
+func (s *CIProviderDescriptor) GetReason() OptString {
+	return s.Reason
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CompleteOnboardingOutputBody) GetAdditionalProps() CompleteOnboardingOutputBodyAdditional {
+func (s *CIProviderDescriptor) GetAdditionalProps() CIProviderDescriptorAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CompleteOnboardingOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetEnrollable sets the value of Enrollable.
+func (s *CIProviderDescriptor) SetEnrollable(val bool) {
+	s.Enrollable = val
 }
 
-// SetNeedsOnboarding sets the value of NeedsOnboarding.
-func (s *CompleteOnboardingOutputBody) SetNeedsOnboarding(val bool) {
-	s.NeedsOnboarding = val
+// SetFields sets the value of Fields.
+func (s *CIProviderDescriptor) SetFields(val []CIProviderField) {
+	s.Fields = val
+}
+
+// SetLabel sets the value of Label.
+func (s *CIProviderDescriptor) SetLabel(val string) {
+	s.Label = val
+}
+
+// SetModes sets the value of Modes.
+func (s *CIProviderDescriptor) SetModes(val []CIProviderMode) {
+	s.Modes = val
+}
+
+// SetName sets the value of Name.
+func (s *CIProviderDescriptor) SetName(val string) {
+	s.Name = val
+}
+
+// SetReason sets the value of Reason.
+func (s *CIProviderDescriptor) SetReason(val OptString) {
+	s.Reason = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CompleteOnboardingOutputBody) SetAdditionalProps(val CompleteOnboardingOutputBodyAdditional) {
+func (s *CIProviderDescriptor) SetAdditionalProps(val CIProviderDescriptorAdditional) {
 	s.AdditionalProps = val
 }
 
-type CompleteOnboardingOutputBodyAdditional map[string]jx.Raw
+type CIProviderDescriptorAdditional map[string]jx.Raw
 
-func (s *CompleteOnboardingOutputBodyAdditional) init() CompleteOnboardingOutputBodyAdditional {
+func (s *CIProviderDescriptorAdditional) init() CIProviderDescriptorAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -944,59 +1102,120 @@ func (s *CompleteOnboardingOutputBodyAdditional) init() CompleteOnboardingOutput
 	return m
 }
 
-// Ref: #/components/schemas/CreateBindingInputBody
-type CreateBindingInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Exact-match key/value map; empty filter matches any token.
-	AttributeFilter jx.Raw `json:"attributeFilter"`
-	ProviderId      string `json:"providerId"`
-	AdditionalProps CreateBindingInputBodyAdditional
+// Ref: #/components/schemas/CIProviderField
+type CIProviderField struct {
+	// Longer explanation shown beneath the field.
+	Help OptString `json:"help"`
+	// Body key this field's value posts under.
+	Key string `json:"key"`
+	// Widget to render: text, select, secret, bool.
+	Kind string `json:"kind"`
+	// Human-readable field label.
+	Label string `json:"label"`
+	// Choices for a select field; absent for every other kind.
+	Options []CIProviderOption `json:"options"`
+	// Placeholder text for an empty field.
+	Placeholder OptString `json:"placeholder"`
+	// Mode keys this field is required in; empty means never required.
+	RequiredIn []string `json:"required_in"`
+	// Where the value goes: body (top level) or config (opaque map).
+	Target          string `json:"target"`
+	AdditionalProps CIProviderFieldAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *CreateBindingInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetHelp returns the value of Help.
+func (s *CIProviderField) GetHelp() OptString {
+	return s.Help
 }
 
-// GetAttributeFilter returns the value of AttributeFilter.
-func (s *CreateBindingInputBody) GetAttributeFilter() jx.Raw {
-	return s.AttributeFilter
+// GetKey returns the value of Key.
+func (s *CIProviderField) GetKey() string {
+	return s.Key
 }
 
-// GetProviderId returns the value of ProviderId.
-func (s *CreateBindingInputBody) GetProviderId() string {
-	return s.ProviderId
+// GetKind returns the value of Kind.
+func (s *CIProviderField) GetKind() string {
+	return s.Kind
+}
+
+// GetLabel returns the value of Label.
+func (s *CIProviderField) GetLabel() string {
+	return s.Label
+}
+
+// GetOptions returns the value of Options.
+func (s *CIProviderField) GetOptions() []CIProviderOption {
+	return s.Options
+}
+
+// GetPlaceholder returns the value of Placeholder.
+func (s *CIProviderField) GetPlaceholder() OptString {
+	return s.Placeholder
+}
+
+// GetRequiredIn returns the value of RequiredIn.
+func (s *CIProviderField) GetRequiredIn() []string {
+	return s.RequiredIn
+}
+
+// GetTarget returns the value of Target.
+func (s *CIProviderField) GetTarget() string {
+	return s.Target
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateBindingInputBody) GetAdditionalProps() CreateBindingInputBodyAdditional {
+func (s *CIProviderField) GetAdditionalProps() CIProviderFieldAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CreateBindingInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetHelp sets the value of Help.
+func (s *CIProviderField) SetHelp(val OptString) {
+	s.Help = val
 }
 
-// SetAttributeFilter sets the value of AttributeFilter.
-func (s *CreateBindingInputBody) SetAttributeFilter(val jx.Raw) {
-	s.AttributeFilter = val
+// SetKey sets the value of Key.
+func (s *CIProviderField) SetKey(val string) {
+	s.Key = val
 }
 
-// SetProviderId sets the value of ProviderId.
-func (s *CreateBindingInputBody) SetProviderId(val string) {
-	s.ProviderId = val
+// SetKind sets the value of Kind.
+func (s *CIProviderField) SetKind(val string) {
+	s.Kind = val
+}
+
+// SetLabel sets the value of Label.
+func (s *CIProviderField) SetLabel(val string) {
+	s.Label = val
+}
+
+// SetOptions sets the value of Options.
+func (s *CIProviderField) SetOptions(val []CIProviderOption) {
+	s.Options = val
+}
+
+// SetPlaceholder sets the value of Placeholder.
+func (s *CIProviderField) SetPlaceholder(val OptString) {
+	s.Placeholder = val
+}
+
+// SetRequiredIn sets the value of RequiredIn.
+func (s *CIProviderField) SetRequiredIn(val []string) {
+	s.RequiredIn = val
+}
+
+// SetTarget sets the value of Target.
+func (s *CIProviderField) SetTarget(val string) {
+	s.Target = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateBindingInputBody) SetAdditionalProps(val CreateBindingInputBodyAdditional) {
+func (s *CIProviderField) SetAdditionalProps(val CIProviderFieldAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateBindingInputBodyAdditional map[string]jx.Raw
+type CIProviderFieldAdditional map[string]jx.Raw
 
-func (s *CreateBindingInputBodyAdditional) init() CreateBindingInputBodyAdditional {
+func (s *CIProviderFieldAdditional) init() CIProviderFieldAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1005,81 +1224,72 @@ func (s *CreateBindingInputBodyAdditional) init() CreateBindingInputBodyAddition
 	return m
 }
 
-// Ref: #/components/schemas/CreateMirrorInputBody
-type CreateMirrorInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.
-	ClusterHost     string                        `json:"clusterHost"`
-	Owner           string                        `json:"owner"`
-	Provider        CreateMirrorInputBodyProvider `json:"provider"`
-	Repo            string                        `json:"repo"`
-	AdditionalProps CreateMirrorInputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *CreateMirrorInputBody) GetSchema() OptURI {
-	return s.Schema
+// Ref: #/components/schemas/CIProviderMode
+type CIProviderMode struct {
+	// Whether a client should preselect this mode.
+	Default OptBool `json:"default"`
+	// Longer explanation of what this mode does.
+	Help OptString `json:"help"`
+	// Mode key to post back as the request's mode.
+	Key string `json:"key"`
+	// Human-readable label.
+	Label           string `json:"label"`
+	AdditionalProps CIProviderModeAdditional
 }
 
-// GetClusterHost returns the value of ClusterHost.
-func (s *CreateMirrorInputBody) GetClusterHost() string {
-	return s.ClusterHost
+// GetDefault returns the value of Default.
+func (s *CIProviderMode) GetDefault() OptBool {
+	return s.Default
 }
 
-// GetOwner returns the value of Owner.
-func (s *CreateMirrorInputBody) GetOwner() string {
-	return s.Owner
+// GetHelp returns the value of Help.
+func (s *CIProviderMode) GetHelp() OptString {
+	return s.Help
 }
 
-// GetProvider returns the value of Provider.
-func (s *CreateMirrorInputBody) GetProvider() CreateMirrorInputBodyProvider {
-	return s.Provider
+// GetKey returns the value of Key.
+func (s *CIProviderMode) GetKey() string {
+	return s.Key
 }
 
-// GetRepo returns the value of Repo.
-func (s *CreateMirrorInputBody) GetRepo() string {
-	return s.Repo
+// GetLabel returns the value of Label.
+func (s *CIProviderMode) GetLabel() string {
+	return s.Label
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateMirrorInputBody) GetAdditionalProps() CreateMirrorInputBodyAdditional {
+func (s *CIProviderMode) GetAdditionalProps() CIProviderModeAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CreateMirrorInputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
-
-// SetClusterHost sets the value of ClusterHost.
-func (s *CreateMirrorInputBody) SetClusterHost(val string) {
-	s.ClusterHost = val
+// SetDefault sets the value of Default.
+func (s *CIProviderMode) SetDefault(val OptBool) {
+	s.Default = val
 }
 
-// SetOwner sets the value of Owner.
-func (s *CreateMirrorInputBody) SetOwner(val string) {
-	s.Owner = val
+// SetHelp sets the value of Help.
+func (s *CIProviderMode) SetHelp(val OptString) {
+	s.Help = val
 }
 
-// SetProvider sets the value of Provider.
-func (s *CreateMirrorInputBody) SetProvider(val CreateMirrorInputBodyProvider) {
-	s.Provider = val
+// SetKey sets the value of Key.
+func (s *CIProviderMode) SetKey(val string) {
+	s.Key = val
 }
 
-// SetRepo sets the value of Repo.
-func (s *CreateMirrorInputBody) SetRepo(val string) {
-	s.Repo = val
+// SetLabel sets the value of Label.
+func (s *CIProviderMode) SetLabel(val string) {
+	s.Label = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateMirrorInputBody) SetAdditionalProps(val CreateMirrorInputBodyAdditional) {
+func (s *CIProviderMode) SetAdditionalProps(val CIProviderModeAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateMirrorInputBodyAdditional map[string]jx.Raw
+type CIProviderModeAdditional map[string]jx.Raw
 
-func (s *CreateMirrorInputBodyAdditional) init() CreateMirrorInputBodyAdditional {
+func (s *CIProviderModeAdditional) init() CIProviderModeAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1088,115 +1298,110 @@ func (s *CreateMirrorInputBodyAdditional) init() CreateMirrorInputBodyAdditional
 	return m
 }
 
-type CreateMirrorInputBodyProvider string
-
-const (
-	CreateMirrorInputBodyProviderGithub CreateMirrorInputBodyProvider = "github"
-)
+// Ref: #/components/schemas/CIProviderOption
+type CIProviderOption struct {
+	// Human-readable label.
+	Label string `json:"label"`
+	// Value to post back for this choice.
+	Value           string `json:"value"`
+	AdditionalProps CIProviderOptionAdditional
+}
 
-// AllValues returns all CreateMirrorInputBodyProvider values.
-func (CreateMirrorInputBodyProvider) AllValues() []CreateMirrorInputBodyProvider {
-	return []CreateMirrorInputBodyProvider{
-		CreateMirrorInputBodyProviderGithub,
-	}
+// GetLabel returns the value of Label.
+func (s *CIProviderOption) GetLabel() string {
+	return s.Label
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s CreateMirrorInputBodyProvider) MarshalText() ([]byte, error) {
-	switch s {
-	case CreateMirrorInputBodyProviderGithub:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// GetValue returns the value of Value.
+func (s *CIProviderOption) GetValue() string {
+	return s.Value
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *CreateMirrorInputBodyProvider) UnmarshalText(data []byte) error {
-	switch CreateMirrorInputBodyProvider(data) {
-	case CreateMirrorInputBodyProviderGithub:
-		*s = CreateMirrorInputBodyProviderGithub
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CIProviderOption) GetAdditionalProps() CIProviderOptionAdditional {
+	return s.AdditionalProps
 }
 
-// Ref: #/components/schemas/CreateMirrorRequestInputBody
-type CreateMirrorRequestInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.
-	ClusterHost     string                               `json:"clusterHost"`
-	Owner           string                               `json:"owner"`
-	Provider        CreateMirrorRequestInputBodyProvider `json:"provider"`
-	Repo            string                               `json:"repo"`
-	AdditionalProps CreateMirrorRequestInputBodyAdditional
+// SetLabel sets the value of Label.
+func (s *CIProviderOption) SetLabel(val string) {
+	s.Label = val
 }
 
-// GetSchema returns the value of Schema.
-func (s *CreateMirrorRequestInputBody) GetSchema() OptURI {
-	return s.Schema
+// SetValue sets the value of Value.
+func (s *CIProviderOption) SetValue(val string) {
+	s.Value = val
 }
 
-// GetClusterHost returns the value of ClusterHost.
-func (s *CreateMirrorRequestInputBody) GetClusterHost() string {
-	return s.ClusterHost
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *CIProviderOption) SetAdditionalProps(val CIProviderOptionAdditional) {
+	s.AdditionalProps = val
 }
 
-// GetOwner returns the value of Owner.
-func (s *CreateMirrorRequestInputBody) GetOwner() string {
-	return s.Owner
+type CIProviderOptionAdditional map[string]jx.Raw
+
+func (s *CIProviderOptionAdditional) init() CIProviderOptionAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// GetProvider returns the value of Provider.
-func (s *CreateMirrorRequestInputBody) GetProvider() CreateMirrorRequestInputBodyProvider {
-	return s.Provider
+// Ref: #/components/schemas/CISetupBlock
+type CISetupBlock struct {
+	// The content itself, ready to use verbatim.
+	Content string `json:"content"`
+	// The content's syntax, for highlighting: yaml, json.
+	Format string `json:"format"`
+	// Short instruction naming what to do with the content.
+	Heading         string `json:"heading"`
+	AdditionalProps CISetupBlockAdditional
 }
 
-// GetRepo returns the value of Repo.
-func (s *CreateMirrorRequestInputBody) GetRepo() string {
-	return s.Repo
+// GetContent returns the value of Content.
+func (s *CISetupBlock) GetContent() string {
+	return s.Content
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateMirrorRequestInputBody) GetAdditionalProps() CreateMirrorRequestInputBodyAdditional {
-	return s.AdditionalProps
+// GetFormat returns the value of Format.
+func (s *CISetupBlock) GetFormat() string {
+	return s.Format
 }
 
-// SetSchema sets the value of Schema.
-func (s *CreateMirrorRequestInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// GetHeading returns the value of Heading.
+func (s *CISetupBlock) GetHeading() string {
+	return s.Heading
 }
 
-// SetClusterHost sets the value of ClusterHost.
-func (s *CreateMirrorRequestInputBody) SetClusterHost(val string) {
-	s.ClusterHost = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CISetupBlock) GetAdditionalProps() CISetupBlockAdditional {
+	return s.AdditionalProps
 }
 
-// SetOwner sets the value of Owner.
-func (s *CreateMirrorRequestInputBody) SetOwner(val string) {
-	s.Owner = val
+// SetContent sets the value of Content.
+func (s *CISetupBlock) SetContent(val string) {
+	s.Content = val
 }
 
-// SetProvider sets the value of Provider.
-func (s *CreateMirrorRequestInputBody) SetProvider(val CreateMirrorRequestInputBodyProvider) {
-	s.Provider = val
+// SetFormat sets the value of Format.
+func (s *CISetupBlock) SetFormat(val string) {
+	s.Format = val
 }
 
-// SetRepo sets the value of Repo.
-func (s *CreateMirrorRequestInputBody) SetRepo(val string) {
-	s.Repo = val
+// SetHeading sets the value of Heading.
+func (s *CISetupBlock) SetHeading(val string) {
+	s.Heading = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateMirrorRequestInputBody) SetAdditionalProps(val CreateMirrorRequestInputBodyAdditional) {
+func (s *CISetupBlock) SetAdditionalProps(val CISetupBlockAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateMirrorRequestInputBodyAdditional map[string]jx.Raw
+type CISetupBlockAdditional map[string]jx.Raw
 
-func (s *CreateMirrorRequestInputBodyAdditional) init() CreateMirrorRequestInputBodyAdditional {
+func (s *CISetupBlockAdditional) init() CISetupBlockAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1205,94 +1410,60 @@ func (s *CreateMirrorRequestInputBodyAdditional) init() CreateMirrorRequestInput
 	return m
 }
 
-type CreateMirrorRequestInputBodyProvider string
-
-const (
-	CreateMirrorRequestInputBodyProviderGithub CreateMirrorRequestInputBodyProvider = "github"
-)
-
-// AllValues returns all CreateMirrorRequestInputBodyProvider values.
-func (CreateMirrorRequestInputBodyProvider) AllValues() []CreateMirrorRequestInputBodyProvider {
-	return []CreateMirrorRequestInputBodyProvider{
-		CreateMirrorRequestInputBodyProviderGithub,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s CreateMirrorRequestInputBodyProvider) MarshalText() ([]byte, error) {
-	switch s {
-	case CreateMirrorRequestInputBodyProviderGithub:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *CreateMirrorRequestInputBodyProvider) UnmarshalText(data []byte) error {
-	switch CreateMirrorRequestInputBodyProvider(data) {
-	case CreateMirrorRequestInputBodyProviderGithub:
-		*s = CreateMirrorRequestInputBodyProviderGithub
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
-}
-
-// Ref: #/components/schemas/CreateOrgInputBody
-type CreateOrgInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Display name.
-	Name string `json:"name"`
-	// Jurisdiction slug; defaults to the server's home jurisdiction.
-	Region          OptString `json:"region"`
-	AdditionalProps CreateOrgInputBodyAdditional
+// Ref: #/components/schemas/CIWebhookAuditActor
+type CIWebhookAuditActor struct {
+	// Entire account ULID that performed the action.
+	AccountID string `json:"account_id"`
+	// Actor's primary handle; empty when they have none.
+	Handle OptString `json:"handle"`
+	// Provider the handle came from: github, workos, system.
+	HandleProvider  OptString `json:"handle_provider"`
+	AdditionalProps CIWebhookAuditActorAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *CreateOrgInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetAccountID returns the value of AccountID.
+func (s *CIWebhookAuditActor) GetAccountID() string {
+	return s.AccountID
 }
 
-// GetName returns the value of Name.
-func (s *CreateOrgInputBody) GetName() string {
-	return s.Name
+// GetHandle returns the value of Handle.
+func (s *CIWebhookAuditActor) GetHandle() OptString {
+	return s.Handle
 }
 
-// GetRegion returns the value of Region.
-func (s *CreateOrgInputBody) GetRegion() OptString {
-	return s.Region
+// GetHandleProvider returns the value of HandleProvider.
+func (s *CIWebhookAuditActor) GetHandleProvider() OptString {
+	return s.HandleProvider
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateOrgInputBody) GetAdditionalProps() CreateOrgInputBodyAdditional {
+func (s *CIWebhookAuditActor) GetAdditionalProps() CIWebhookAuditActorAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CreateOrgInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetAccountID sets the value of AccountID.
+func (s *CIWebhookAuditActor) SetAccountID(val string) {
+	s.AccountID = val
 }
 
-// SetName sets the value of Name.
-func (s *CreateOrgInputBody) SetName(val string) {
-	s.Name = val
+// SetHandle sets the value of Handle.
+func (s *CIWebhookAuditActor) SetHandle(val OptString) {
+	s.Handle = val
 }
 
-// SetRegion sets the value of Region.
-func (s *CreateOrgInputBody) SetRegion(val OptString) {
-	s.Region = val
+// SetHandleProvider sets the value of HandleProvider.
+func (s *CIWebhookAuditActor) SetHandleProvider(val OptString) {
+	s.HandleProvider = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateOrgInputBody) SetAdditionalProps(val CreateOrgInputBodyAdditional) {
+func (s *CIWebhookAuditActor) SetAdditionalProps(val CIWebhookAuditActorAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateOrgInputBodyAdditional map[string]jx.Raw
+type CIWebhookAuditActorAdditional map[string]jx.Raw
 
-func (s *CreateOrgInputBodyAdditional) init() CreateOrgInputBodyAdditional {
+func (s *CIWebhookAuditActorAdditional) init() CIWebhookAuditActorAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1301,80 +1472,85 @@ func (s *CreateOrgInputBodyAdditional) init() CreateOrgInputBodyAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/CreateProjectInputBody
-type CreateProjectInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI                          `json:"$schema"`
-	Name            string                          `json:"name"`
-	OwnerId         string                          `json:"ownerId"`
-	OwnerType       CreateProjectInputBodyOwnerType `json:"ownerType"`
-	Region          OptString                       `json:"region"`
-	AdditionalProps CreateProjectInputBodyAdditional
+// Ref: #/components/schemas/CIWebhookAuditEventView
+type CIWebhookAuditEventView struct {
+	// Who performed the action.
+	Actor CIWebhookAuditActor `json:"actor"`
+	// Ci_webhook_enrolled | ci_webhook_updated | ci_webhook_deleted | ci_webhook_identity_rolled_back |
+	// ci_webhook_identity_orphaned.
+	EventType string `json:"event_type"`
+	// Audit event ULID.
+	ID string `json:"id"`
+	// Event detail as recorded, e.g. bk_organization/bk_pipeline.
+	Metadata OptCIWebhookAuditEventViewMetadata `json:"metadata"`
+	// When the action was recorded (UTC).
+	OccurredAt      time.Time `json:"occurred_at"`
+	AdditionalProps CIWebhookAuditEventViewAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *CreateProjectInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetActor returns the value of Actor.
+func (s *CIWebhookAuditEventView) GetActor() CIWebhookAuditActor {
+	return s.Actor
 }
 
-// GetName returns the value of Name.
-func (s *CreateProjectInputBody) GetName() string {
-	return s.Name
+// GetEventType returns the value of EventType.
+func (s *CIWebhookAuditEventView) GetEventType() string {
+	return s.EventType
 }
 
-// GetOwnerId returns the value of OwnerId.
-func (s *CreateProjectInputBody) GetOwnerId() string {
-	return s.OwnerId
+// GetID returns the value of ID.
+func (s *CIWebhookAuditEventView) GetID() string {
+	return s.ID
 }
 
-// GetOwnerType returns the value of OwnerType.
-func (s *CreateProjectInputBody) GetOwnerType() CreateProjectInputBodyOwnerType {
-	return s.OwnerType
+// GetMetadata returns the value of Metadata.
+func (s *CIWebhookAuditEventView) GetMetadata() OptCIWebhookAuditEventViewMetadata {
+	return s.Metadata
 }
 
-// GetRegion returns the value of Region.
-func (s *CreateProjectInputBody) GetRegion() OptString {
-	return s.Region
+// GetOccurredAt returns the value of OccurredAt.
+func (s *CIWebhookAuditEventView) GetOccurredAt() time.Time {
+	return s.OccurredAt
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateProjectInputBody) GetAdditionalProps() CreateProjectInputBodyAdditional {
+func (s *CIWebhookAuditEventView) GetAdditionalProps() CIWebhookAuditEventViewAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CreateProjectInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetActor sets the value of Actor.
+func (s *CIWebhookAuditEventView) SetActor(val CIWebhookAuditActor) {
+	s.Actor = val
 }
 
-// SetName sets the value of Name.
-func (s *CreateProjectInputBody) SetName(val string) {
-	s.Name = val
+// SetEventType sets the value of EventType.
+func (s *CIWebhookAuditEventView) SetEventType(val string) {
+	s.EventType = val
 }
 
-// SetOwnerId sets the value of OwnerId.
-func (s *CreateProjectInputBody) SetOwnerId(val string) {
-	s.OwnerId = val
+// SetID sets the value of ID.
+func (s *CIWebhookAuditEventView) SetID(val string) {
+	s.ID = val
 }
 
-// SetOwnerType sets the value of OwnerType.
-func (s *CreateProjectInputBody) SetOwnerType(val CreateProjectInputBodyOwnerType) {
-	s.OwnerType = val
+// SetMetadata sets the value of Metadata.
+func (s *CIWebhookAuditEventView) SetMetadata(val OptCIWebhookAuditEventViewMetadata) {
+	s.Metadata = val
 }
 
-// SetRegion sets the value of Region.
-func (s *CreateProjectInputBody) SetRegion(val OptString) {
-	s.Region = val
+// SetOccurredAt sets the value of OccurredAt.
+func (s *CIWebhookAuditEventView) SetOccurredAt(val time.Time) {
+	s.OccurredAt = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateProjectInputBody) SetAdditionalProps(val CreateProjectInputBodyAdditional) {
+func (s *CIWebhookAuditEventView) SetAdditionalProps(val CIWebhookAuditEventViewAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateProjectInputBodyAdditional map[string]jx.Raw
+type CIWebhookAuditEventViewAdditional map[string]jx.Raw
 
-func (s *CreateProjectInputBodyAdditional) init() CreateProjectInputBodyAdditional {
+func (s *CIWebhookAuditEventViewAdditional) init() CIWebhookAuditEventViewAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1383,154 +1559,180 @@ func (s *CreateProjectInputBodyAdditional) init() CreateProjectInputBodyAddition
 	return m
 }
 
-type CreateProjectInputBodyOwnerType string
-
-const (
-	CreateProjectInputBodyOwnerTypeOrg     CreateProjectInputBodyOwnerType = "org"
-	CreateProjectInputBodyOwnerTypeAccount CreateProjectInputBodyOwnerType = "account"
-)
-
-// AllValues returns all CreateProjectInputBodyOwnerType values.
-func (CreateProjectInputBodyOwnerType) AllValues() []CreateProjectInputBodyOwnerType {
-	return []CreateProjectInputBodyOwnerType{
-		CreateProjectInputBodyOwnerTypeOrg,
-		CreateProjectInputBodyOwnerTypeAccount,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s CreateProjectInputBodyOwnerType) MarshalText() ([]byte, error) {
-	switch s {
-	case CreateProjectInputBodyOwnerTypeOrg:
-		return []byte(s), nil
-	case CreateProjectInputBodyOwnerTypeAccount:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
+// Event detail as recorded, e.g. bk_organization/bk_pipeline.
+type CIWebhookAuditEventViewMetadata map[string]jx.Raw
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *CreateProjectInputBodyOwnerType) UnmarshalText(data []byte) error {
-	switch CreateProjectInputBodyOwnerType(data) {
-	case CreateProjectInputBodyOwnerTypeOrg:
-		*s = CreateProjectInputBodyOwnerTypeOrg
-		return nil
-	case CreateProjectInputBodyOwnerTypeAccount:
-		*s = CreateProjectInputBodyOwnerTypeAccount
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
+func (s *CIWebhookAuditEventViewMetadata) init() CIWebhookAuditEventViewMetadata {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
 	}
+	return m
 }
 
-// Ref: #/components/schemas/CreateRepoCIWebhookInputBody
-type CreateRepoCIWebhookInputBody struct {
+// Ref: #/components/schemas/CIWebhookView
+type CIWebhookView struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI                               `json:"$schema"`
-	BkClusterID     string                               `json:"bk_cluster_id"`
-	BkOrganization  string                               `json:"bk_organization"`
-	BkPipeline      OptString                            `json:"bk_pipeline"`
-	DisplayName     OptString                            `json:"display_name"`
-	Events          []string                             `json:"events"`
-	Provider        CreateRepoCIWebhookInputBodyProvider `json:"provider"`
-	RefFilter       OptString                            `json:"ref_filter"`
-	AdditionalProps CreateRepoCIWebhookInputBodyAdditional
+	Schema          OptURI    `json:"$schema"`
+	BkOrganization  string    `json:"bk_organization"`
+	BkPipeline      string    `json:"bk_pipeline"`
+	CreatedAt       time.Time `json:"created_at"`
+	DisplayName     string    `json:"display_name"`
+	Enabled         bool      `json:"enabled"`
+	Events          []string  `json:"events"`
+	ID              string    `json:"id"`
+	Provider        string    `json:"provider"`
+	PublishChecks   bool      `json:"publish_checks"`
+	RefFilter       string    `json:"ref_filter"`
+	RepoID          string    `json:"repo_id"`
+	UpdatedAt       time.Time `json:"updated_at"`
+	AdditionalProps CIWebhookViewAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *CreateRepoCIWebhookInputBody) GetSchema() OptURI {
+func (s *CIWebhookView) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetBkClusterID returns the value of BkClusterID.
-func (s *CreateRepoCIWebhookInputBody) GetBkClusterID() string {
-	return s.BkClusterID
-}
-
 // GetBkOrganization returns the value of BkOrganization.
-func (s *CreateRepoCIWebhookInputBody) GetBkOrganization() string {
+func (s *CIWebhookView) GetBkOrganization() string {
 	return s.BkOrganization
 }
 
 // GetBkPipeline returns the value of BkPipeline.
-func (s *CreateRepoCIWebhookInputBody) GetBkPipeline() OptString {
+func (s *CIWebhookView) GetBkPipeline() string {
 	return s.BkPipeline
 }
 
+// GetCreatedAt returns the value of CreatedAt.
+func (s *CIWebhookView) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
 // GetDisplayName returns the value of DisplayName.
-func (s *CreateRepoCIWebhookInputBody) GetDisplayName() OptString {
+func (s *CIWebhookView) GetDisplayName() string {
 	return s.DisplayName
 }
 
-// GetEvents returns the value of Events.
-func (s *CreateRepoCIWebhookInputBody) GetEvents() []string {
-	return s.Events
+// GetEnabled returns the value of Enabled.
+func (s *CIWebhookView) GetEnabled() bool {
+	return s.Enabled
 }
 
-// GetProvider returns the value of Provider.
-func (s *CreateRepoCIWebhookInputBody) GetProvider() CreateRepoCIWebhookInputBodyProvider {
-	return s.Provider
+// GetEvents returns the value of Events.
+func (s *CIWebhookView) GetEvents() []string {
+	return s.Events
+}
+
+// GetID returns the value of ID.
+func (s *CIWebhookView) GetID() string {
+	return s.ID
+}
+
+// GetProvider returns the value of Provider.
+func (s *CIWebhookView) GetProvider() string {
+	return s.Provider
+}
+
+// GetPublishChecks returns the value of PublishChecks.
+func (s *CIWebhookView) GetPublishChecks() bool {
+	return s.PublishChecks
 }
 
 // GetRefFilter returns the value of RefFilter.
-func (s *CreateRepoCIWebhookInputBody) GetRefFilter() OptString {
+func (s *CIWebhookView) GetRefFilter() string {
 	return s.RefFilter
 }
 
+// GetRepoID returns the value of RepoID.
+func (s *CIWebhookView) GetRepoID() string {
+	return s.RepoID
+}
+
+// GetUpdatedAt returns the value of UpdatedAt.
+func (s *CIWebhookView) GetUpdatedAt() time.Time {
+	return s.UpdatedAt
+}
+
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateRepoCIWebhookInputBody) GetAdditionalProps() CreateRepoCIWebhookInputBodyAdditional {
+func (s *CIWebhookView) GetAdditionalProps() CIWebhookViewAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *CreateRepoCIWebhookInputBody) SetSchema(val OptURI) {
+func (s *CIWebhookView) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetBkClusterID sets the value of BkClusterID.
-func (s *CreateRepoCIWebhookInputBody) SetBkClusterID(val string) {
-	s.BkClusterID = val
-}
-
 // SetBkOrganization sets the value of BkOrganization.
-func (s *CreateRepoCIWebhookInputBody) SetBkOrganization(val string) {
+func (s *CIWebhookView) SetBkOrganization(val string) {
 	s.BkOrganization = val
 }
 
 // SetBkPipeline sets the value of BkPipeline.
-func (s *CreateRepoCIWebhookInputBody) SetBkPipeline(val OptString) {
+func (s *CIWebhookView) SetBkPipeline(val string) {
 	s.BkPipeline = val
 }
 
+// SetCreatedAt sets the value of CreatedAt.
+func (s *CIWebhookView) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
 // SetDisplayName sets the value of DisplayName.
-func (s *CreateRepoCIWebhookInputBody) SetDisplayName(val OptString) {
+func (s *CIWebhookView) SetDisplayName(val string) {
 	s.DisplayName = val
 }
 
+// SetEnabled sets the value of Enabled.
+func (s *CIWebhookView) SetEnabled(val bool) {
+	s.Enabled = val
+}
+
 // SetEvents sets the value of Events.
-func (s *CreateRepoCIWebhookInputBody) SetEvents(val []string) {
+func (s *CIWebhookView) SetEvents(val []string) {
 	s.Events = val
 }
 
+// SetID sets the value of ID.
+func (s *CIWebhookView) SetID(val string) {
+	s.ID = val
+}
+
 // SetProvider sets the value of Provider.
-func (s *CreateRepoCIWebhookInputBody) SetProvider(val CreateRepoCIWebhookInputBodyProvider) {
+func (s *CIWebhookView) SetProvider(val string) {
 	s.Provider = val
 }
 
+// SetPublishChecks sets the value of PublishChecks.
+func (s *CIWebhookView) SetPublishChecks(val bool) {
+	s.PublishChecks = val
+}
+
 // SetRefFilter sets the value of RefFilter.
-func (s *CreateRepoCIWebhookInputBody) SetRefFilter(val OptString) {
+func (s *CIWebhookView) SetRefFilter(val string) {
 	s.RefFilter = val
 }
 
+// SetRepoID sets the value of RepoID.
+func (s *CIWebhookView) SetRepoID(val string) {
+	s.RepoID = val
+}
+
+// SetUpdatedAt sets the value of UpdatedAt.
+func (s *CIWebhookView) SetUpdatedAt(val time.Time) {
+	s.UpdatedAt = val
+}
+
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateRepoCIWebhookInputBody) SetAdditionalProps(val CreateRepoCIWebhookInputBodyAdditional) {
+func (s *CIWebhookView) SetAdditionalProps(val CIWebhookViewAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateRepoCIWebhookInputBodyAdditional map[string]jx.Raw
+type CIWebhookViewAdditional map[string]jx.Raw
 
-func (s *CreateRepoCIWebhookInputBodyAdditional) init() CreateRepoCIWebhookInputBodyAdditional {
+func (s *CIWebhookViewAdditional) init() CIWebhookViewAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1539,117 +1741,82 @@ func (s *CreateRepoCIWebhookInputBodyAdditional) init() CreateRepoCIWebhookInput
 	return m
 }
 
-type CreateRepoCIWebhookInputBodyProvider string
-
-const (
-	CreateRepoCIWebhookInputBodyProviderBuildkite CreateRepoCIWebhookInputBodyProvider = "buildkite"
-)
-
-// AllValues returns all CreateRepoCIWebhookInputBodyProvider values.
-func (CreateRepoCIWebhookInputBodyProvider) AllValues() []CreateRepoCIWebhookInputBodyProvider {
-	return []CreateRepoCIWebhookInputBodyProvider{
-		CreateRepoCIWebhookInputBodyProviderBuildkite,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s CreateRepoCIWebhookInputBodyProvider) MarshalText() ([]byte, error) {
-	switch s {
-	case CreateRepoCIWebhookInputBodyProviderBuildkite:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *CreateRepoCIWebhookInputBodyProvider) UnmarshalText(data []byte) error {
-	switch CreateRepoCIWebhookInputBodyProvider(data) {
-	case CreateRepoCIWebhookInputBodyProviderBuildkite:
-		*s = CreateRepoCIWebhookInputBodyProviderBuildkite
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
-}
+// CancelDeletionOK is response for CancelDeletion operation.
+type CancelDeletionOK struct{}
 
-// Ref: #/components/schemas/CreateRepoInputBody
-type CreateRepoInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Public host of the cluster to pin the repo to (e.g. royalcanin.partial.to); empty lands on the
-	// jurisdiction default.
-	ClusterHost OptString `json:"clusterHost"`
-	Name        string    `json:"name"`
-	// Hash format; defaults to sha1.
-	ObjectFormat    OptCreateRepoInputBodyObjectFormat `json:"objectFormat"`
-	ProjectId       string                             `json:"projectId"`
-	AdditionalProps CreateRepoInputBodyAdditional
+// Ref: #/components/schemas/Cluster
+type Cluster struct {
+	ApiUrl          OptString `json:"apiUrl"`
+	IsDefault       bool      `json:"isDefault"`
+	Jurisdiction    string    `json:"jurisdiction"`
+	PublicUrl       string    `json:"publicUrl"`
+	Slug            string    `json:"slug"`
+	AdditionalProps ClusterAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *CreateRepoInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetApiUrl returns the value of ApiUrl.
+func (s *Cluster) GetApiUrl() OptString {
+	return s.ApiUrl
 }
 
-// GetClusterHost returns the value of ClusterHost.
-func (s *CreateRepoInputBody) GetClusterHost() OptString {
-	return s.ClusterHost
+// GetIsDefault returns the value of IsDefault.
+func (s *Cluster) GetIsDefault() bool {
+	return s.IsDefault
 }
 
-// GetName returns the value of Name.
-func (s *CreateRepoInputBody) GetName() string {
-	return s.Name
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *Cluster) GetJurisdiction() string {
+	return s.Jurisdiction
 }
 
-// GetObjectFormat returns the value of ObjectFormat.
-func (s *CreateRepoInputBody) GetObjectFormat() OptCreateRepoInputBodyObjectFormat {
-	return s.ObjectFormat
+// GetPublicUrl returns the value of PublicUrl.
+func (s *Cluster) GetPublicUrl() string {
+	return s.PublicUrl
 }
 
-// GetProjectId returns the value of ProjectId.
-func (s *CreateRepoInputBody) GetProjectId() string {
-	return s.ProjectId
+// GetSlug returns the value of Slug.
+func (s *Cluster) GetSlug() string {
+	return s.Slug
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateRepoInputBody) GetAdditionalProps() CreateRepoInputBodyAdditional {
+func (s *Cluster) GetAdditionalProps() ClusterAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *CreateRepoInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetApiUrl sets the value of ApiUrl.
+func (s *Cluster) SetApiUrl(val OptString) {
+	s.ApiUrl = val
 }
 
-// SetClusterHost sets the value of ClusterHost.
-func (s *CreateRepoInputBody) SetClusterHost(val OptString) {
-	s.ClusterHost = val
+// SetIsDefault sets the value of IsDefault.
+func (s *Cluster) SetIsDefault(val bool) {
+	s.IsDefault = val
 }
 
-// SetName sets the value of Name.
-func (s *CreateRepoInputBody) SetName(val string) {
-	s.Name = val
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *Cluster) SetJurisdiction(val string) {
+	s.Jurisdiction = val
 }
 
-// SetObjectFormat sets the value of ObjectFormat.
-func (s *CreateRepoInputBody) SetObjectFormat(val OptCreateRepoInputBodyObjectFormat) {
-	s.ObjectFormat = val
+// SetPublicUrl sets the value of PublicUrl.
+func (s *Cluster) SetPublicUrl(val string) {
+	s.PublicUrl = val
 }
 
-// SetProjectId sets the value of ProjectId.
-func (s *CreateRepoInputBody) SetProjectId(val string) {
-	s.ProjectId = val
+// SetSlug sets the value of Slug.
+func (s *Cluster) SetSlug(val string) {
+	s.Slug = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateRepoInputBody) SetAdditionalProps(val CreateRepoInputBodyAdditional) {
+func (s *Cluster) SetAdditionalProps(val ClusterAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateRepoInputBodyAdditional map[string]jx.Raw
+type ClusterAdditional map[string]jx.Raw
 
-func (s *CreateRepoInputBodyAdditional) init() CreateRepoInputBodyAdditional {
+func (s *ClusterAdditional) init() ClusterAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1658,100 +1825,48 @@ func (s *CreateRepoInputBodyAdditional) init() CreateRepoInputBodyAdditional {
 	return m
 }
 
-// Hash format; defaults to sha1.
-type CreateRepoInputBodyObjectFormat string
-
-const (
-	CreateRepoInputBodyObjectFormatSHA1   CreateRepoInputBodyObjectFormat = "sha1"
-	CreateRepoInputBodyObjectFormatSHA256 CreateRepoInputBodyObjectFormat = "sha256"
-)
-
-// AllValues returns all CreateRepoInputBodyObjectFormat values.
-func (CreateRepoInputBodyObjectFormat) AllValues() []CreateRepoInputBodyObjectFormat {
-	return []CreateRepoInputBodyObjectFormat{
-		CreateRepoInputBodyObjectFormatSHA1,
-		CreateRepoInputBodyObjectFormatSHA256,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s CreateRepoInputBodyObjectFormat) MarshalText() ([]byte, error) {
-	switch s {
-	case CreateRepoInputBodyObjectFormatSHA1:
-		return []byte(s), nil
-	case CreateRepoInputBodyObjectFormatSHA256:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *CreateRepoInputBodyObjectFormat) UnmarshalText(data []byte) error {
-	switch CreateRepoInputBodyObjectFormat(data) {
-	case CreateRepoInputBodyObjectFormatSHA1:
-		*s = CreateRepoInputBodyObjectFormatSHA1
-		return nil
-	case CreateRepoInputBodyObjectFormatSHA256:
-		*s = CreateRepoInputBodyObjectFormatSHA256
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
-}
-
-// Ref: #/components/schemas/CreateServiceAccountInputBody
-type CreateServiceAccountInputBody struct {
+// Ref: #/components/schemas/CompleteOnboardingOutputBody
+type CompleteOnboardingOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI `json:"$schema"`
-	Name            string `json:"name"`
-	OrgId           string `json:"orgId"`
-	AdditionalProps CreateServiceAccountInputBodyAdditional
+	Schema OptURI `json:"$schema"`
+	// Always false after onboarding completion is recorded.
+	NeedsOnboarding bool `json:"needsOnboarding"`
+	AdditionalProps CompleteOnboardingOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *CreateServiceAccountInputBody) GetSchema() OptURI {
+func (s *CompleteOnboardingOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetName returns the value of Name.
-func (s *CreateServiceAccountInputBody) GetName() string {
-	return s.Name
-}
-
-// GetOrgId returns the value of OrgId.
-func (s *CreateServiceAccountInputBody) GetOrgId() string {
-	return s.OrgId
+// GetNeedsOnboarding returns the value of NeedsOnboarding.
+func (s *CompleteOnboardingOutputBody) GetNeedsOnboarding() bool {
+	return s.NeedsOnboarding
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreateServiceAccountInputBody) GetAdditionalProps() CreateServiceAccountInputBodyAdditional {
+func (s *CompleteOnboardingOutputBody) GetAdditionalProps() CompleteOnboardingOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *CreateServiceAccountInputBody) SetSchema(val OptURI) {
+func (s *CompleteOnboardingOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetName sets the value of Name.
-func (s *CreateServiceAccountInputBody) SetName(val string) {
-	s.Name = val
-}
-
-// SetOrgId sets the value of OrgId.
-func (s *CreateServiceAccountInputBody) SetOrgId(val string) {
-	s.OrgId = val
+// SetNeedsOnboarding sets the value of NeedsOnboarding.
+func (s *CompleteOnboardingOutputBody) SetNeedsOnboarding(val bool) {
+	s.NeedsOnboarding = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreateServiceAccountInputBody) SetAdditionalProps(val CreateServiceAccountInputBodyAdditional) {
+func (s *CompleteOnboardingOutputBody) SetAdditionalProps(val CompleteOnboardingOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreateServiceAccountInputBodyAdditional map[string]jx.Raw
+type CompleteOnboardingOutputBodyAdditional map[string]jx.Raw
 
-func (s *CreateServiceAccountInputBodyAdditional) init() CreateServiceAccountInputBodyAdditional {
+func (s *CompleteOnboardingOutputBodyAdditional) init() CompleteOnboardingOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1760,106 +1875,202 @@ func (s *CreateServiceAccountInputBodyAdditional) init() CreateServiceAccountInp
 	return m
 }
 
-// Ref: #/components/schemas/CreatedMirror
-type CreatedMirror struct {
+// Ref: #/components/schemas/ConnectOrgCIBuildkiteCredentialInputBody
+type ConnectOrgCIBuildkiteCredentialInputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// True on fresh creation; false when an existing mirror was returned.
-	Created bool `json:"created"`
-	// Deprecated: always false. Poll the mirror status instead — an empty upstream still reaches
-	// 'ready'.
-	Empty     bool   `json:"empty"`
-	MirrorId  string `json:"mirrorId"`
-	MirrorUrl string `json:"mirrorUrl"`
-	PublicUrl string `json:"publicUrl"`
-	// True when an existing placement was returned that an admin suspended.
-	Suspended       bool `json:"suspended"`
-	AdditionalProps CreatedMirrorAdditional
+	Schema          OptURI `json:"$schema"`
+	BkAPIToken      string `json:"bk_api_token"`
+	BkOrganization  string `json:"bk_organization"`
+	AdditionalProps ConnectOrgCIBuildkiteCredentialInputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *CreatedMirror) GetSchema() OptURI {
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetCreated returns the value of Created.
-func (s *CreatedMirror) GetCreated() bool {
-	return s.Created
+// GetBkAPIToken returns the value of BkAPIToken.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) GetBkAPIToken() string {
+	return s.BkAPIToken
 }
 
-// GetEmpty returns the value of Empty.
-func (s *CreatedMirror) GetEmpty() bool {
-	return s.Empty
+// GetBkOrganization returns the value of BkOrganization.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) GetBkOrganization() string {
+	return s.BkOrganization
 }
 
-// GetMirrorId returns the value of MirrorId.
-func (s *CreatedMirror) GetMirrorId() string {
-	return s.MirrorId
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) GetAdditionalProps() ConnectOrgCIBuildkiteCredentialInputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetMirrorUrl returns the value of MirrorUrl.
-func (s *CreatedMirror) GetMirrorUrl() string {
-	return s.MirrorUrl
+// SetSchema sets the value of Schema.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetPublicUrl returns the value of PublicUrl.
-func (s *CreatedMirror) GetPublicUrl() string {
-	return s.PublicUrl
+// SetBkAPIToken sets the value of BkAPIToken.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) SetBkAPIToken(val string) {
+	s.BkAPIToken = val
 }
 
-// GetSuspended returns the value of Suspended.
-func (s *CreatedMirror) GetSuspended() bool {
-	return s.Suspended
+// SetBkOrganization sets the value of BkOrganization.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) SetBkOrganization(val string) {
+	s.BkOrganization = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) SetAdditionalProps(val ConnectOrgCIBuildkiteCredentialInputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ConnectOrgCIBuildkiteCredentialInputBodyAdditional map[string]jx.Raw
+
+func (s *ConnectOrgCIBuildkiteCredentialInputBodyAdditional) init() ConnectOrgCIBuildkiteCredentialInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/CreateBindingInputBody
+type CreateBindingInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Exact-match key/value map; empty filter matches any token.
+	AttributeFilter jx.Raw `json:"attributeFilter"`
+	ProviderId      string `json:"providerId"`
+	AdditionalProps CreateBindingInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *CreateBindingInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetAttributeFilter returns the value of AttributeFilter.
+func (s *CreateBindingInputBody) GetAttributeFilter() jx.Raw {
+	return s.AttributeFilter
+}
+
+// GetProviderId returns the value of ProviderId.
+func (s *CreateBindingInputBody) GetProviderId() string {
+	return s.ProviderId
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *CreatedMirror) GetAdditionalProps() CreatedMirrorAdditional {
+func (s *CreateBindingInputBody) GetAdditionalProps() CreateBindingInputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *CreatedMirror) SetSchema(val OptURI) {
+func (s *CreateBindingInputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetCreated sets the value of Created.
-func (s *CreatedMirror) SetCreated(val bool) {
-	s.Created = val
+// SetAttributeFilter sets the value of AttributeFilter.
+func (s *CreateBindingInputBody) SetAttributeFilter(val jx.Raw) {
+	s.AttributeFilter = val
 }
 
-// SetEmpty sets the value of Empty.
-func (s *CreatedMirror) SetEmpty(val bool) {
-	s.Empty = val
+// SetProviderId sets the value of ProviderId.
+func (s *CreateBindingInputBody) SetProviderId(val string) {
+	s.ProviderId = val
 }
 
-// SetMirrorId sets the value of MirrorId.
-func (s *CreatedMirror) SetMirrorId(val string) {
-	s.MirrorId = val
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *CreateBindingInputBody) SetAdditionalProps(val CreateBindingInputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// SetMirrorUrl sets the value of MirrorUrl.
-func (s *CreatedMirror) SetMirrorUrl(val string) {
-	s.MirrorUrl = val
+type CreateBindingInputBodyAdditional map[string]jx.Raw
+
+func (s *CreateBindingInputBodyAdditional) init() CreateBindingInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// SetPublicUrl sets the value of PublicUrl.
-func (s *CreatedMirror) SetPublicUrl(val string) {
-	s.PublicUrl = val
+// Ref: #/components/schemas/CreateMirrorInputBody
+type CreateMirrorInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.
+	ClusterHost     string                        `json:"clusterHost"`
+	Owner           string                        `json:"owner"`
+	Provider        CreateMirrorInputBodyProvider `json:"provider"`
+	Repo            string                        `json:"repo"`
+	AdditionalProps CreateMirrorInputBodyAdditional
 }
 
-// SetSuspended sets the value of Suspended.
-func (s *CreatedMirror) SetSuspended(val bool) {
-	s.Suspended = val
+// GetSchema returns the value of Schema.
+func (s *CreateMirrorInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetClusterHost returns the value of ClusterHost.
+func (s *CreateMirrorInputBody) GetClusterHost() string {
+	return s.ClusterHost
+}
+
+// GetOwner returns the value of Owner.
+func (s *CreateMirrorInputBody) GetOwner() string {
+	return s.Owner
+}
+
+// GetProvider returns the value of Provider.
+func (s *CreateMirrorInputBody) GetProvider() CreateMirrorInputBodyProvider {
+	return s.Provider
+}
+
+// GetRepo returns the value of Repo.
+func (s *CreateMirrorInputBody) GetRepo() string {
+	return s.Repo
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CreateMirrorInputBody) GetAdditionalProps() CreateMirrorInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *CreateMirrorInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetClusterHost sets the value of ClusterHost.
+func (s *CreateMirrorInputBody) SetClusterHost(val string) {
+	s.ClusterHost = val
+}
+
+// SetOwner sets the value of Owner.
+func (s *CreateMirrorInputBody) SetOwner(val string) {
+	s.Owner = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *CreateMirrorInputBody) SetProvider(val CreateMirrorInputBodyProvider) {
+	s.Provider = val
+}
+
+// SetRepo sets the value of Repo.
+func (s *CreateMirrorInputBody) SetRepo(val string) {
+	s.Repo = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *CreatedMirror) SetAdditionalProps(val CreatedMirrorAdditional) {
+func (s *CreateMirrorInputBody) SetAdditionalProps(val CreateMirrorInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type CreatedMirrorAdditional map[string]jx.Raw
+type CreateMirrorInputBodyAdditional map[string]jx.Raw
 
-func (s *CreatedMirrorAdditional) init() CreatedMirrorAdditional {
+func (s *CreateMirrorInputBodyAdditional) init() CreateMirrorInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -1868,32 +2079,23 @@ func (s *CreatedMirrorAdditional) init() CreatedMirrorAdditional {
 	return m
 }
 
-// DeleteBindingNoContent is response for DeleteBinding operation.
-type DeleteBindingNoContent struct{}
-
-// DeleteMeAccepted is response for DeleteMe operation.
-type DeleteMeAccepted struct{}
-
-// DeleteMirrorNoContent is response for DeleteMirror operation.
-type DeleteMirrorNoContent struct{}
-
-type DeleteMirrorProvider string
+type CreateMirrorInputBodyProvider string
 
 const (
-	DeleteMirrorProviderGithub DeleteMirrorProvider = "github"
+	CreateMirrorInputBodyProviderGithub CreateMirrorInputBodyProvider = "github"
 )
 
-// AllValues returns all DeleteMirrorProvider values.
-func (DeleteMirrorProvider) AllValues() []DeleteMirrorProvider {
-	return []DeleteMirrorProvider{
-		DeleteMirrorProviderGithub,
+// AllValues returns all CreateMirrorInputBodyProvider values.
+func (CreateMirrorInputBodyProvider) AllValues() []CreateMirrorInputBodyProvider {
+	return []CreateMirrorInputBodyProvider{
+		CreateMirrorInputBodyProviderGithub,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s DeleteMirrorProvider) MarshalText() ([]byte, error) {
+func (s CreateMirrorInputBodyProvider) MarshalText() ([]byte, error) {
 	switch s {
-	case DeleteMirrorProviderGithub:
+	case CreateMirrorInputBodyProviderGithub:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -1901,111 +2103,91 @@ func (s DeleteMirrorProvider) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *DeleteMirrorProvider) UnmarshalText(data []byte) error {
-	switch DeleteMirrorProvider(data) {
-	case DeleteMirrorProviderGithub:
-		*s = DeleteMirrorProviderGithub
+func (s *CreateMirrorInputBodyProvider) UnmarshalText(data []byte) error {
+	switch CreateMirrorInputBodyProvider(data) {
+	case CreateMirrorInputBodyProviderGithub:
+		*s = CreateMirrorInputBodyProviderGithub
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// DeleteOrgNoContent is response for DeleteOrg operation.
-type DeleteOrgNoContent struct{}
-
-// DeleteProjectNoContent is response for DeleteProject operation.
-type DeleteProjectNoContent struct{}
+// Ref: #/components/schemas/CreateMirrorRequestInputBody
+type CreateMirrorRequestInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.
+	ClusterHost     string                               `json:"clusterHost"`
+	Owner           string                               `json:"owner"`
+	Provider        CreateMirrorRequestInputBodyProvider `json:"provider"`
+	Repo            string                               `json:"repo"`
+	AdditionalProps CreateMirrorRequestInputBodyAdditional
+}
 
-// DeleteRepoCIWebhookNoContent is response for DeleteRepoCIWebhook operation.
-type DeleteRepoCIWebhookNoContent struct{}
-
-// DeleteRepoNoContent is response for DeleteRepo operation.
-type DeleteRepoNoContent struct{}
-
-// DeleteServiceAccountNoContent is response for DeleteServiceAccount operation.
-type DeleteServiceAccountNoContent struct{}
-
-// Ref: #/components/schemas/DeletionBlocker
-type DeletionBlocker struct {
-	// True when the account can self-serve delete this org (it is the only member and the org has no
-	// projects). When false, the org has other members or data and must be transferred/removed via
-	// support. The UI should offer a delete action only when this is true.
-	Deletable bool `json:"deletable"`
-	// Resource ID (org ULID).
-	ID string `json:"id"`
-	// Blocker kind. Currently always 'owned_org'.
-	Kind DeletionBlockerKind `json:"kind"`
-	// Copy explaining how to clear the blocker.
-	Message string `json:"message"`
-	// Human-readable resource name.
-	Name            string `json:"name"`
-	AdditionalProps DeletionBlockerAdditional
-}
-
-// GetDeletable returns the value of Deletable.
-func (s *DeletionBlocker) GetDeletable() bool {
-	return s.Deletable
+// GetSchema returns the value of Schema.
+func (s *CreateMirrorRequestInputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetID returns the value of ID.
-func (s *DeletionBlocker) GetID() string {
-	return s.ID
+// GetClusterHost returns the value of ClusterHost.
+func (s *CreateMirrorRequestInputBody) GetClusterHost() string {
+	return s.ClusterHost
 }
 
-// GetKind returns the value of Kind.
-func (s *DeletionBlocker) GetKind() DeletionBlockerKind {
-	return s.Kind
+// GetOwner returns the value of Owner.
+func (s *CreateMirrorRequestInputBody) GetOwner() string {
+	return s.Owner
 }
 
-// GetMessage returns the value of Message.
-func (s *DeletionBlocker) GetMessage() string {
-	return s.Message
+// GetProvider returns the value of Provider.
+func (s *CreateMirrorRequestInputBody) GetProvider() CreateMirrorRequestInputBodyProvider {
+	return s.Provider
 }
 
-// GetName returns the value of Name.
-func (s *DeletionBlocker) GetName() string {
-	return s.Name
+// GetRepo returns the value of Repo.
+func (s *CreateMirrorRequestInputBody) GetRepo() string {
+	return s.Repo
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *DeletionBlocker) GetAdditionalProps() DeletionBlockerAdditional {
+func (s *CreateMirrorRequestInputBody) GetAdditionalProps() CreateMirrorRequestInputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetDeletable sets the value of Deletable.
-func (s *DeletionBlocker) SetDeletable(val bool) {
-	s.Deletable = val
+// SetSchema sets the value of Schema.
+func (s *CreateMirrorRequestInputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetID sets the value of ID.
-func (s *DeletionBlocker) SetID(val string) {
-	s.ID = val
+// SetClusterHost sets the value of ClusterHost.
+func (s *CreateMirrorRequestInputBody) SetClusterHost(val string) {
+	s.ClusterHost = val
 }
 
-// SetKind sets the value of Kind.
-func (s *DeletionBlocker) SetKind(val DeletionBlockerKind) {
-	s.Kind = val
+// SetOwner sets the value of Owner.
+func (s *CreateMirrorRequestInputBody) SetOwner(val string) {
+	s.Owner = val
 }
 
-// SetMessage sets the value of Message.
-func (s *DeletionBlocker) SetMessage(val string) {
-	s.Message = val
+// SetProvider sets the value of Provider.
+func (s *CreateMirrorRequestInputBody) SetProvider(val CreateMirrorRequestInputBodyProvider) {
+	s.Provider = val
 }
 
-// SetName sets the value of Name.
-func (s *DeletionBlocker) SetName(val string) {
-	s.Name = val
+// SetRepo sets the value of Repo.
+func (s *CreateMirrorRequestInputBody) SetRepo(val string) {
+	s.Repo = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *DeletionBlocker) SetAdditionalProps(val DeletionBlockerAdditional) {
+func (s *CreateMirrorRequestInputBody) SetAdditionalProps(val CreateMirrorRequestInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type DeletionBlockerAdditional map[string]jx.Raw
+type CreateMirrorRequestInputBodyAdditional map[string]jx.Raw
 
-func (s *DeletionBlockerAdditional) init() DeletionBlockerAdditional {
+func (s *CreateMirrorRequestInputBodyAdditional) init() CreateMirrorRequestInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2014,24 +2196,23 @@ func (s *DeletionBlockerAdditional) init() DeletionBlockerAdditional {
 	return m
 }
 
-// Blocker kind. Currently always 'owned_org'.
-type DeletionBlockerKind string
+type CreateMirrorRequestInputBodyProvider string
 
 const (
-	DeletionBlockerKindOwnedOrg DeletionBlockerKind = "owned_org"
+	CreateMirrorRequestInputBodyProviderGithub CreateMirrorRequestInputBodyProvider = "github"
 )
 
-// AllValues returns all DeletionBlockerKind values.
-func (DeletionBlockerKind) AllValues() []DeletionBlockerKind {
-	return []DeletionBlockerKind{
-		DeletionBlockerKindOwnedOrg,
+// AllValues returns all CreateMirrorRequestInputBodyProvider values.
+func (CreateMirrorRequestInputBodyProvider) AllValues() []CreateMirrorRequestInputBodyProvider {
+	return []CreateMirrorRequestInputBodyProvider{
+		CreateMirrorRequestInputBodyProviderGithub,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s DeletionBlockerKind) MarshalText() ([]byte, error) {
+func (s CreateMirrorRequestInputBodyProvider) MarshalText() ([]byte, error) {
 	switch s {
-	case DeletionBlockerKindOwnedOrg:
+	case CreateMirrorRequestInputBodyProviderGithub:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -2039,94 +2220,119 @@ func (s DeletionBlockerKind) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *DeletionBlockerKind) UnmarshalText(data []byte) error {
-	switch DeletionBlockerKind(data) {
-	case DeletionBlockerKindOwnedOrg:
-		*s = DeletionBlockerKindOwnedOrg
+func (s *CreateMirrorRequestInputBodyProvider) UnmarshalText(data []byte) error {
+	switch CreateMirrorRequestInputBodyProvider(data) {
+	case CreateMirrorRequestInputBodyProviderGithub:
+		*s = CreateMirrorRequestInputBodyProviderGithub
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/DeletionGrant
-type DeletionGrant struct {
-	// Region the repo lives in (us/eu/au); empty for project grants.
-	Jurisdiction OptString `json:"jurisdiction"`
-	// Granted resource ULID.
-	ResourceId string `json:"resourceId"`
-	// Granted resource name.
-	ResourceName string `json:"resourceName"`
-	// Granted resource type.
-	ResourceType DeletionGrantResourceType `json:"resourceType"`
-	// Granted role.
-	Role            string `json:"role"`
-	AdditionalProps DeletionGrantAdditional
+// Ref: #/components/schemas/CreateNativeMirrorInputBody
+type CreateNativeMirrorInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI `json:"$schema"`
+	ClusterSlug     string `json:"clusterSlug"`
+	AdditionalProps CreateNativeMirrorInputBodyAdditional
 }
 
-// GetJurisdiction returns the value of Jurisdiction.
-func (s *DeletionGrant) GetJurisdiction() OptString {
-	return s.Jurisdiction
+// GetSchema returns the value of Schema.
+func (s *CreateNativeMirrorInputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetResourceId returns the value of ResourceId.
-func (s *DeletionGrant) GetResourceId() string {
-	return s.ResourceId
+// GetClusterSlug returns the value of ClusterSlug.
+func (s *CreateNativeMirrorInputBody) GetClusterSlug() string {
+	return s.ClusterSlug
 }
 
-// GetResourceName returns the value of ResourceName.
-func (s *DeletionGrant) GetResourceName() string {
-	return s.ResourceName
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CreateNativeMirrorInputBody) GetAdditionalProps() CreateNativeMirrorInputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetResourceType returns the value of ResourceType.
-func (s *DeletionGrant) GetResourceType() DeletionGrantResourceType {
-	return s.ResourceType
+// SetSchema sets the value of Schema.
+func (s *CreateNativeMirrorInputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetRole returns the value of Role.
-func (s *DeletionGrant) GetRole() string {
-	return s.Role
+// SetClusterSlug sets the value of ClusterSlug.
+func (s *CreateNativeMirrorInputBody) SetClusterSlug(val string) {
+	s.ClusterSlug = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *DeletionGrant) GetAdditionalProps() DeletionGrantAdditional {
-	return s.AdditionalProps
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *CreateNativeMirrorInputBody) SetAdditionalProps(val CreateNativeMirrorInputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// SetJurisdiction sets the value of Jurisdiction.
-func (s *DeletionGrant) SetJurisdiction(val OptString) {
-	s.Jurisdiction = val
+type CreateNativeMirrorInputBodyAdditional map[string]jx.Raw
+
+func (s *CreateNativeMirrorInputBodyAdditional) init() CreateNativeMirrorInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// SetResourceId sets the value of ResourceId.
-func (s *DeletionGrant) SetResourceId(val string) {
-	s.ResourceId = val
+// Ref: #/components/schemas/CreateOrgInputBody
+type CreateOrgInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Display name.
+	Name string `json:"name"`
+	// Jurisdiction slug; defaults to the server's home jurisdiction.
+	Region          OptString `json:"region"`
+	AdditionalProps CreateOrgInputBodyAdditional
 }
 
-// SetResourceName sets the value of ResourceName.
-func (s *DeletionGrant) SetResourceName(val string) {
-	s.ResourceName = val
+// GetSchema returns the value of Schema.
+func (s *CreateOrgInputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetResourceType sets the value of ResourceType.
-func (s *DeletionGrant) SetResourceType(val DeletionGrantResourceType) {
-	s.ResourceType = val
+// GetName returns the value of Name.
+func (s *CreateOrgInputBody) GetName() string {
+	return s.Name
 }
 
-// SetRole sets the value of Role.
-func (s *DeletionGrant) SetRole(val string) {
-	s.Role = val
+// GetRegion returns the value of Region.
+func (s *CreateOrgInputBody) GetRegion() OptString {
+	return s.Region
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CreateOrgInputBody) GetAdditionalProps() CreateOrgInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *CreateOrgInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetName sets the value of Name.
+func (s *CreateOrgInputBody) SetName(val string) {
+	s.Name = val
+}
+
+// SetRegion sets the value of Region.
+func (s *CreateOrgInputBody) SetRegion(val OptString) {
+	s.Region = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *DeletionGrant) SetAdditionalProps(val DeletionGrantAdditional) {
+func (s *CreateOrgInputBody) SetAdditionalProps(val CreateOrgInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type DeletionGrantAdditional map[string]jx.Raw
+type CreateOrgInputBodyAdditional map[string]jx.Raw
 
-func (s *DeletionGrantAdditional) init() DeletionGrantAdditional {
+func (s *CreateOrgInputBodyAdditional) init() CreateOrgInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2135,90 +2341,80 @@ func (s *DeletionGrantAdditional) init() DeletionGrantAdditional {
 	return m
 }
 
-// Granted resource type.
-type DeletionGrantResourceType string
-
-const (
-	DeletionGrantResourceTypeProject DeletionGrantResourceType = "project"
-	DeletionGrantResourceTypeRepo    DeletionGrantResourceType = "repo"
-)
+// Ref: #/components/schemas/CreateProjectInputBody
+type CreateProjectInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI                          `json:"$schema"`
+	Name            string                          `json:"name"`
+	OwnerId         string                          `json:"ownerId"`
+	OwnerType       CreateProjectInputBodyOwnerType `json:"ownerType"`
+	Region          OptString                       `json:"region"`
+	AdditionalProps CreateProjectInputBodyAdditional
+}
 
-// AllValues returns all DeletionGrantResourceType values.
-func (DeletionGrantResourceType) AllValues() []DeletionGrantResourceType {
-	return []DeletionGrantResourceType{
-		DeletionGrantResourceTypeProject,
-		DeletionGrantResourceTypeRepo,
-	}
+// GetSchema returns the value of Schema.
+func (s *CreateProjectInputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s DeletionGrantResourceType) MarshalText() ([]byte, error) {
-	switch s {
-	case DeletionGrantResourceTypeProject:
-		return []byte(s), nil
-	case DeletionGrantResourceTypeRepo:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *DeletionGrantResourceType) UnmarshalText(data []byte) error {
-	switch DeletionGrantResourceType(data) {
-	case DeletionGrantResourceTypeProject:
-		*s = DeletionGrantResourceTypeProject
-		return nil
-	case DeletionGrantResourceTypeRepo:
-		*s = DeletionGrantResourceTypeRepo
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
+// GetName returns the value of Name.
+func (s *CreateProjectInputBody) GetName() string {
+	return s.Name
 }
 
-// Ref: #/components/schemas/DeletionMembership
-type DeletionMembership struct {
-	// Org name.
-	Name string `json:"name"`
-	// Org ULID.
-	OrgId           string `json:"orgId"`
-	AdditionalProps DeletionMembershipAdditional
+// GetOwnerId returns the value of OwnerId.
+func (s *CreateProjectInputBody) GetOwnerId() string {
+	return s.OwnerId
 }
 
-// GetName returns the value of Name.
-func (s *DeletionMembership) GetName() string {
-	return s.Name
+// GetOwnerType returns the value of OwnerType.
+func (s *CreateProjectInputBody) GetOwnerType() CreateProjectInputBodyOwnerType {
+	return s.OwnerType
 }
 
-// GetOrgId returns the value of OrgId.
-func (s *DeletionMembership) GetOrgId() string {
-	return s.OrgId
+// GetRegion returns the value of Region.
+func (s *CreateProjectInputBody) GetRegion() OptString {
+	return s.Region
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *DeletionMembership) GetAdditionalProps() DeletionMembershipAdditional {
+func (s *CreateProjectInputBody) GetAdditionalProps() CreateProjectInputBodyAdditional {
 	return s.AdditionalProps
 }
 
+// SetSchema sets the value of Schema.
+func (s *CreateProjectInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
 // SetName sets the value of Name.
-func (s *DeletionMembership) SetName(val string) {
+func (s *CreateProjectInputBody) SetName(val string) {
 	s.Name = val
 }
 
-// SetOrgId sets the value of OrgId.
-func (s *DeletionMembership) SetOrgId(val string) {
-	s.OrgId = val
+// SetOwnerId sets the value of OwnerId.
+func (s *CreateProjectInputBody) SetOwnerId(val string) {
+	s.OwnerId = val
+}
+
+// SetOwnerType sets the value of OwnerType.
+func (s *CreateProjectInputBody) SetOwnerType(val CreateProjectInputBodyOwnerType) {
+	s.OwnerType = val
+}
+
+// SetRegion sets the value of Region.
+func (s *CreateProjectInputBody) SetRegion(val OptString) {
+	s.Region = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *DeletionMembership) SetAdditionalProps(val DeletionMembershipAdditional) {
+func (s *CreateProjectInputBody) SetAdditionalProps(val CreateProjectInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type DeletionMembershipAdditional map[string]jx.Raw
+type CreateProjectInputBodyAdditional map[string]jx.Raw
 
-func (s *DeletionMembershipAdditional) init() DeletionMembershipAdditional {
+func (s *CreateProjectInputBodyAdditional) init() CreateProjectInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2227,233 +2423,260 @@ func (s *DeletionMembershipAdditional) init() DeletionMembershipAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/DeletionRepo
-type DeletionRepo struct {
-	// Cluster slug the repo is placed on, if known.
-	Cluster OptString `json:"cluster"`
-	// Repo ULID.
-	ID string `json:"id"`
-	// Repo name.
-	Name            string `json:"name"`
-	AdditionalProps DeletionRepoAdditional
-}
+type CreateProjectInputBodyOwnerType string
 
-// GetCluster returns the value of Cluster.
-func (s *DeletionRepo) GetCluster() OptString {
-	return s.Cluster
+const (
+	CreateProjectInputBodyOwnerTypeOrg     CreateProjectInputBodyOwnerType = "org"
+	CreateProjectInputBodyOwnerTypeAccount CreateProjectInputBodyOwnerType = "account"
+)
+
+// AllValues returns all CreateProjectInputBodyOwnerType values.
+func (CreateProjectInputBodyOwnerType) AllValues() []CreateProjectInputBodyOwnerType {
+	return []CreateProjectInputBodyOwnerType{
+		CreateProjectInputBodyOwnerTypeOrg,
+		CreateProjectInputBodyOwnerTypeAccount,
+	}
 }
 
-// GetID returns the value of ID.
-func (s *DeletionRepo) GetID() string {
-	return s.ID
+// MarshalText implements encoding.TextMarshaler.
+func (s CreateProjectInputBodyOwnerType) MarshalText() ([]byte, error) {
+	switch s {
+	case CreateProjectInputBodyOwnerTypeOrg:
+		return []byte(s), nil
+	case CreateProjectInputBodyOwnerTypeAccount:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-// GetName returns the value of Name.
-func (s *DeletionRepo) GetName() string {
-	return s.Name
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *CreateProjectInputBodyOwnerType) UnmarshalText(data []byte) error {
+	switch CreateProjectInputBodyOwnerType(data) {
+	case CreateProjectInputBodyOwnerTypeOrg:
+		*s = CreateProjectInputBodyOwnerTypeOrg
+		return nil
+	case CreateProjectInputBodyOwnerTypeAccount:
+		*s = CreateProjectInputBodyOwnerTypeAccount
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *DeletionRepo) GetAdditionalProps() DeletionRepoAdditional {
-	return s.AdditionalProps
+// Ref: #/components/schemas/CreateRepoCIWebhookBody
+type CreateRepoCIWebhookBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Entire-core-auth Buildkite plugin ref this pipeline is built with: the registered cluster's
+	// override, else the pinned default; goes in the bootstrap config's plugins list.
+	AuthPluginRef string `json:"auth_plugin_ref"`
+	// Automation (aut_<ulid>) the enrolled pipeline's builds exchange their OIDC token for; goes in the
+	// bootstrap config as the automation:<id> resource (ENTIRE_CORE_AUTH_RESOURCE).
+	AutomationID   string `json:"automation_id"`
+	BkOrganization string `json:"bk_organization"`
+	BkPipeline     string `json:"bk_pipeline"`
+	// Entire-core base URL the bootstrap auth plugin talks to; goes in the bootstrap config as
+	// ENTIRE_CORE_AUTH_URL.
+	CoreURL       string    `json:"core_url"`
+	CreatedAt     time.Time `json:"created_at"`
+	DisplayName   string    `json:"display_name"`
+	Enabled       bool      `json:"enabled"`
+	Events        []string  `json:"events"`
+	ID            string    `json:"id"`
+	Provider      string    `json:"provider"`
+	PublishChecks bool      `json:"publish_checks"`
+	RefFilter     string    `json:"ref_filter"`
+	RepoID        string    `json:"repo_id"`
+	// What to do next, rendered ready to use. Present on a self-managed enrolment.
+	Setup           OptCISetupBlock `json:"setup"`
+	UpdatedAt       time.Time       `json:"updated_at"`
+	AdditionalProps CreateRepoCIWebhookBodyAdditional
 }
 
-// SetCluster sets the value of Cluster.
-func (s *DeletionRepo) SetCluster(val OptString) {
-	s.Cluster = val
+// GetSchema returns the value of Schema.
+func (s *CreateRepoCIWebhookBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetID sets the value of ID.
-func (s *DeletionRepo) SetID(val string) {
-	s.ID = val
+// GetAuthPluginRef returns the value of AuthPluginRef.
+func (s *CreateRepoCIWebhookBody) GetAuthPluginRef() string {
+	return s.AuthPluginRef
 }
 
-// SetName sets the value of Name.
-func (s *DeletionRepo) SetName(val string) {
-	s.Name = val
+// GetAutomationID returns the value of AutomationID.
+func (s *CreateRepoCIWebhookBody) GetAutomationID() string {
+	return s.AutomationID
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *DeletionRepo) SetAdditionalProps(val DeletionRepoAdditional) {
-	s.AdditionalProps = val
+// GetBkOrganization returns the value of BkOrganization.
+func (s *CreateRepoCIWebhookBody) GetBkOrganization() string {
+	return s.BkOrganization
 }
 
-type DeletionRepoAdditional map[string]jx.Raw
+// GetBkPipeline returns the value of BkPipeline.
+func (s *CreateRepoCIWebhookBody) GetBkPipeline() string {
+	return s.BkPipeline
+}
 
-func (s *DeletionRepoAdditional) init() DeletionRepoAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
+// GetCoreURL returns the value of CoreURL.
+func (s *CreateRepoCIWebhookBody) GetCoreURL() string {
+	return s.CoreURL
 }
 
-// Ref: #/components/schemas/ErrorDetail
-type ErrorDetail struct {
-	// Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'.
-	Location OptString `json:"location"`
-	// Error message text.
-	Message OptString `json:"message"`
-	// The value at the given location.
-	Value           jx.Raw `json:"value"`
-	AdditionalProps ErrorDetailAdditional
+// GetCreatedAt returns the value of CreatedAt.
+func (s *CreateRepoCIWebhookBody) GetCreatedAt() time.Time {
+	return s.CreatedAt
 }
 
-// GetLocation returns the value of Location.
-func (s *ErrorDetail) GetLocation() OptString {
-	return s.Location
+// GetDisplayName returns the value of DisplayName.
+func (s *CreateRepoCIWebhookBody) GetDisplayName() string {
+	return s.DisplayName
 }
 
-// GetMessage returns the value of Message.
-func (s *ErrorDetail) GetMessage() OptString {
-	return s.Message
+// GetEnabled returns the value of Enabled.
+func (s *CreateRepoCIWebhookBody) GetEnabled() bool {
+	return s.Enabled
 }
 
-// GetValue returns the value of Value.
-func (s *ErrorDetail) GetValue() jx.Raw {
-	return s.Value
+// GetEvents returns the value of Events.
+func (s *CreateRepoCIWebhookBody) GetEvents() []string {
+	return s.Events
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ErrorDetail) GetAdditionalProps() ErrorDetailAdditional {
-	return s.AdditionalProps
+// GetID returns the value of ID.
+func (s *CreateRepoCIWebhookBody) GetID() string {
+	return s.ID
 }
 
-// SetLocation sets the value of Location.
-func (s *ErrorDetail) SetLocation(val OptString) {
-	s.Location = val
+// GetProvider returns the value of Provider.
+func (s *CreateRepoCIWebhookBody) GetProvider() string {
+	return s.Provider
 }
 
-// SetMessage sets the value of Message.
-func (s *ErrorDetail) SetMessage(val OptString) {
-	s.Message = val
+// GetPublishChecks returns the value of PublishChecks.
+func (s *CreateRepoCIWebhookBody) GetPublishChecks() bool {
+	return s.PublishChecks
 }
 
-// SetValue sets the value of Value.
-func (s *ErrorDetail) SetValue(val jx.Raw) {
-	s.Value = val
+// GetRefFilter returns the value of RefFilter.
+func (s *CreateRepoCIWebhookBody) GetRefFilter() string {
+	return s.RefFilter
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ErrorDetail) SetAdditionalProps(val ErrorDetailAdditional) {
-	s.AdditionalProps = val
+// GetRepoID returns the value of RepoID.
+func (s *CreateRepoCIWebhookBody) GetRepoID() string {
+	return s.RepoID
 }
 
-type ErrorDetailAdditional map[string]jx.Raw
+// GetSetup returns the value of Setup.
+func (s *CreateRepoCIWebhookBody) GetSetup() OptCISetupBlock {
+	return s.Setup
+}
 
-func (s *ErrorDetailAdditional) init() ErrorDetailAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
+// GetUpdatedAt returns the value of UpdatedAt.
+func (s *CreateRepoCIWebhookBody) GetUpdatedAt() time.Time {
+	return s.UpdatedAt
 }
 
-// Ref: #/components/schemas/ErrorModel
-type ErrorModel struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// A human-readable explanation specific to this occurrence of the problem.
-	Detail OptString `json:"detail"`
-	// Optional list of individual error details.
-	Errors []ErrorDetail `json:"errors"`
-	// A URI reference that identifies the specific occurrence of the problem.
-	Instance OptURI `json:"instance"`
-	// HTTP status code.
-	Status OptInt64 `json:"status"`
-	// A short, human-readable summary of the problem type. This value should not change between
-	// occurrences of the error.
-	Title OptString `json:"title"`
-	// A URI reference to human-readable documentation for the error.
-	Type            OptURI `json:"type"`
-	AdditionalProps ErrorModelAdditional
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CreateRepoCIWebhookBody) GetAdditionalProps() CreateRepoCIWebhookBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetSchema returns the value of Schema.
-func (s *ErrorModel) GetSchema() OptURI {
-	return s.Schema
+// SetSchema sets the value of Schema.
+func (s *CreateRepoCIWebhookBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetDetail returns the value of Detail.
-func (s *ErrorModel) GetDetail() OptString {
-	return s.Detail
+// SetAuthPluginRef sets the value of AuthPluginRef.
+func (s *CreateRepoCIWebhookBody) SetAuthPluginRef(val string) {
+	s.AuthPluginRef = val
 }
 
-// GetErrors returns the value of Errors.
-func (s *ErrorModel) GetErrors() []ErrorDetail {
-	return s.Errors
+// SetAutomationID sets the value of AutomationID.
+func (s *CreateRepoCIWebhookBody) SetAutomationID(val string) {
+	s.AutomationID = val
 }
 
-// GetInstance returns the value of Instance.
-func (s *ErrorModel) GetInstance() OptURI {
-	return s.Instance
+// SetBkOrganization sets the value of BkOrganization.
+func (s *CreateRepoCIWebhookBody) SetBkOrganization(val string) {
+	s.BkOrganization = val
 }
 
-// GetStatus returns the value of Status.
-func (s *ErrorModel) GetStatus() OptInt64 {
-	return s.Status
+// SetBkPipeline sets the value of BkPipeline.
+func (s *CreateRepoCIWebhookBody) SetBkPipeline(val string) {
+	s.BkPipeline = val
 }
 
-// GetTitle returns the value of Title.
-func (s *ErrorModel) GetTitle() OptString {
-	return s.Title
+// SetCoreURL sets the value of CoreURL.
+func (s *CreateRepoCIWebhookBody) SetCoreURL(val string) {
+	s.CoreURL = val
 }
 
-// GetType returns the value of Type.
-func (s *ErrorModel) GetType() OptURI {
-	return s.Type
+// SetCreatedAt sets the value of CreatedAt.
+func (s *CreateRepoCIWebhookBody) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ErrorModel) GetAdditionalProps() ErrorModelAdditional {
-	return s.AdditionalProps
+// SetDisplayName sets the value of DisplayName.
+func (s *CreateRepoCIWebhookBody) SetDisplayName(val string) {
+	s.DisplayName = val
 }
 
-// SetSchema sets the value of Schema.
-func (s *ErrorModel) SetSchema(val OptURI) {
-	s.Schema = val
+// SetEnabled sets the value of Enabled.
+func (s *CreateRepoCIWebhookBody) SetEnabled(val bool) {
+	s.Enabled = val
 }
 
-// SetDetail sets the value of Detail.
-func (s *ErrorModel) SetDetail(val OptString) {
-	s.Detail = val
+// SetEvents sets the value of Events.
+func (s *CreateRepoCIWebhookBody) SetEvents(val []string) {
+	s.Events = val
 }
 
-// SetErrors sets the value of Errors.
-func (s *ErrorModel) SetErrors(val []ErrorDetail) {
-	s.Errors = val
+// SetID sets the value of ID.
+func (s *CreateRepoCIWebhookBody) SetID(val string) {
+	s.ID = val
 }
 
-// SetInstance sets the value of Instance.
-func (s *ErrorModel) SetInstance(val OptURI) {
-	s.Instance = val
+// SetProvider sets the value of Provider.
+func (s *CreateRepoCIWebhookBody) SetProvider(val string) {
+	s.Provider = val
 }
 
-// SetStatus sets the value of Status.
-func (s *ErrorModel) SetStatus(val OptInt64) {
-	s.Status = val
+// SetPublishChecks sets the value of PublishChecks.
+func (s *CreateRepoCIWebhookBody) SetPublishChecks(val bool) {
+	s.PublishChecks = val
 }
 
-// SetTitle sets the value of Title.
-func (s *ErrorModel) SetTitle(val OptString) {
-	s.Title = val
+// SetRefFilter sets the value of RefFilter.
+func (s *CreateRepoCIWebhookBody) SetRefFilter(val string) {
+	s.RefFilter = val
 }
 
-// SetType sets the value of Type.
-func (s *ErrorModel) SetType(val OptURI) {
-	s.Type = val
+// SetRepoID sets the value of RepoID.
+func (s *CreateRepoCIWebhookBody) SetRepoID(val string) {
+	s.RepoID = val
+}
+
+// SetSetup sets the value of Setup.
+func (s *CreateRepoCIWebhookBody) SetSetup(val OptCISetupBlock) {
+	s.Setup = val
+}
+
+// SetUpdatedAt sets the value of UpdatedAt.
+func (s *CreateRepoCIWebhookBody) SetUpdatedAt(val time.Time) {
+	s.UpdatedAt = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ErrorModel) SetAdditionalProps(val ErrorModelAdditional) {
+func (s *CreateRepoCIWebhookBody) SetAdditionalProps(val CreateRepoCIWebhookBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ErrorModelAdditional map[string]jx.Raw
+type CreateRepoCIWebhookBodyAdditional map[string]jx.Raw
 
-func (s *ErrorModelAdditional) init() ErrorModelAdditional {
+func (s *CreateRepoCIWebhookBodyAdditional) init() CreateRepoCIWebhookBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2462,224 +2685,303 @@ func (s *ErrorModelAdditional) init() ErrorModelAdditional {
 	return m
 }
 
-// ErrorModelStatusCode wraps ErrorModel with StatusCode.
-type ErrorModelStatusCode struct {
-	StatusCode int
-	Response   ErrorModel
-}
-
-// GetStatusCode returns the value of StatusCode.
-func (s *ErrorModelStatusCode) GetStatusCode() int {
-	return s.StatusCode
+// Ref: #/components/schemas/CreateRepoCIWebhookInputBody
+type CreateRepoCIWebhookInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema      OptURI    `json:"$schema"`
+	BkClusterID OptString `json:"bk_cluster_id"`
+	// Overwrite an existing pipeline's configuration with the generated bootstrap step, DISCARDING
+	// manual edits. Repairs a pipeline left naming an automation that a teardown retired. Requires
+	// bk_provisioning_token; refused on a self-managed pipeline.
+	BkForceRescaffold OptBool   `json:"bk_force_rescaffold"`
+	BkOrganization    OptString `json:"bk_organization"`
+	BkPipeline        OptString `json:"bk_pipeline"`
+	// The customer created and maintains this Buildkite pipeline. entire never creates, reconciles or
+	// reads it, and bk_provisioning_token is neither required nor accepted.
+	BkPipelineSelfManaged OptBool `json:"bk_pipeline_self_managed"`
+	// Transient Buildkite token (write_pipelines) to create the pipeline; write-only, never stored.
+	// Required on first enroll; omit on a routing-only re-enroll. Refused for an existing pipeline
+	// unless bk_force_rescaffold is also set.
+	BkProvisioningToken OptString `json:"bk_provisioning_token"`
+	// Provider-specific values from the providers listing; opaque to core. For buildkite: cluster_id,
+	// provisioning_token, force_rescaffold.
+	Config      OptCreateRepoCIWebhookInputBodyConfig `json:"config"`
+	DisplayName OptString                             `json:"display_name"`
+	Events      []string                              `json:"events"`
+	// How to enrol, from the chosen provider's modes. For buildkite: self_managed or provisioned.
+	Mode     OptString `json:"mode"`
+	Provider string    `json:"provider"`
+	// Vendor-side account to enrol against (for buildkite, the organization slug). Use with
+	// provider/mode/config; omit when sending the bk_* fields.
+	ProviderAccount OptString `json:"provider_account"`
+	RefFilter       OptString `json:"ref_filter"`
+	// Vendor-side build target (for buildkite, the pipeline slug). Defaults to a slug derived from the
+	// repo.
+	TargetRef       OptString `json:"target_ref"`
+	AdditionalProps CreateRepoCIWebhookInputBodyAdditional
 }
 
-// GetResponse returns the value of Response.
-func (s *ErrorModelStatusCode) GetResponse() ErrorModel {
-	return s.Response
+// GetSchema returns the value of Schema.
+func (s *CreateRepoCIWebhookInputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetStatusCode sets the value of StatusCode.
-func (s *ErrorModelStatusCode) SetStatusCode(val int) {
-	s.StatusCode = val
+// GetBkClusterID returns the value of BkClusterID.
+func (s *CreateRepoCIWebhookInputBody) GetBkClusterID() OptString {
+	return s.BkClusterID
 }
 
-// SetResponse sets the value of Response.
-func (s *ErrorModelStatusCode) SetResponse(val ErrorModel) {
-	s.Response = val
+// GetBkForceRescaffold returns the value of BkForceRescaffold.
+func (s *CreateRepoCIWebhookInputBody) GetBkForceRescaffold() OptBool {
+	return s.BkForceRescaffold
 }
 
-// Ref: #/components/schemas/GetDeletionPreviewOutputBody
-type GetDeletionPreviewOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// True when Blockers is non-empty: DELETE /me will be refused with 409.
-	Blocked bool `json:"blocked"`
-	// Resources that must be resolved before deletion (owned orgs).
-	Blockers        []DeletionBlocker `json:"blockers"`
-	WillDelete      WillDeleteStruct  `json:"willDelete"`
-	WillUnlink      WillUnlinkStruct  `json:"willUnlink"`
-	AdditionalProps GetDeletionPreviewOutputBodyAdditional
+// GetBkOrganization returns the value of BkOrganization.
+func (s *CreateRepoCIWebhookInputBody) GetBkOrganization() OptString {
+	return s.BkOrganization
 }
 
-// GetSchema returns the value of Schema.
-func (s *GetDeletionPreviewOutputBody) GetSchema() OptURI {
-	return s.Schema
+// GetBkPipeline returns the value of BkPipeline.
+func (s *CreateRepoCIWebhookInputBody) GetBkPipeline() OptString {
+	return s.BkPipeline
 }
 
-// GetBlocked returns the value of Blocked.
-func (s *GetDeletionPreviewOutputBody) GetBlocked() bool {
-	return s.Blocked
+// GetBkPipelineSelfManaged returns the value of BkPipelineSelfManaged.
+func (s *CreateRepoCIWebhookInputBody) GetBkPipelineSelfManaged() OptBool {
+	return s.BkPipelineSelfManaged
 }
 
-// GetBlockers returns the value of Blockers.
-func (s *GetDeletionPreviewOutputBody) GetBlockers() []DeletionBlocker {
-	return s.Blockers
+// GetBkProvisioningToken returns the value of BkProvisioningToken.
+func (s *CreateRepoCIWebhookInputBody) GetBkProvisioningToken() OptString {
+	return s.BkProvisioningToken
 }
 
-// GetWillDelete returns the value of WillDelete.
-func (s *GetDeletionPreviewOutputBody) GetWillDelete() WillDeleteStruct {
-	return s.WillDelete
+// GetConfig returns the value of Config.
+func (s *CreateRepoCIWebhookInputBody) GetConfig() OptCreateRepoCIWebhookInputBodyConfig {
+	return s.Config
 }
 
-// GetWillUnlink returns the value of WillUnlink.
-func (s *GetDeletionPreviewOutputBody) GetWillUnlink() WillUnlinkStruct {
-	return s.WillUnlink
+// GetDisplayName returns the value of DisplayName.
+func (s *CreateRepoCIWebhookInputBody) GetDisplayName() OptString {
+	return s.DisplayName
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetDeletionPreviewOutputBody) GetAdditionalProps() GetDeletionPreviewOutputBodyAdditional {
-	return s.AdditionalProps
+// GetEvents returns the value of Events.
+func (s *CreateRepoCIWebhookInputBody) GetEvents() []string {
+	return s.Events
 }
 
-// SetSchema sets the value of Schema.
-func (s *GetDeletionPreviewOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// GetMode returns the value of Mode.
+func (s *CreateRepoCIWebhookInputBody) GetMode() OptString {
+	return s.Mode
 }
 
-// SetBlocked sets the value of Blocked.
-func (s *GetDeletionPreviewOutputBody) SetBlocked(val bool) {
-	s.Blocked = val
+// GetProvider returns the value of Provider.
+func (s *CreateRepoCIWebhookInputBody) GetProvider() string {
+	return s.Provider
 }
 
-// SetBlockers sets the value of Blockers.
-func (s *GetDeletionPreviewOutputBody) SetBlockers(val []DeletionBlocker) {
-	s.Blockers = val
+// GetProviderAccount returns the value of ProviderAccount.
+func (s *CreateRepoCIWebhookInputBody) GetProviderAccount() OptString {
+	return s.ProviderAccount
 }
 
-// SetWillDelete sets the value of WillDelete.
-func (s *GetDeletionPreviewOutputBody) SetWillDelete(val WillDeleteStruct) {
-	s.WillDelete = val
+// GetRefFilter returns the value of RefFilter.
+func (s *CreateRepoCIWebhookInputBody) GetRefFilter() OptString {
+	return s.RefFilter
 }
 
-// SetWillUnlink sets the value of WillUnlink.
-func (s *GetDeletionPreviewOutputBody) SetWillUnlink(val WillUnlinkStruct) {
-	s.WillUnlink = val
+// GetTargetRef returns the value of TargetRef.
+func (s *CreateRepoCIWebhookInputBody) GetTargetRef() OptString {
+	return s.TargetRef
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetDeletionPreviewOutputBody) SetAdditionalProps(val GetDeletionPreviewOutputBodyAdditional) {
-	s.AdditionalProps = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CreateRepoCIWebhookInputBody) GetAdditionalProps() CreateRepoCIWebhookInputBodyAdditional {
+	return s.AdditionalProps
 }
 
-type GetDeletionPreviewOutputBodyAdditional map[string]jx.Raw
-
-func (s *GetDeletionPreviewOutputBodyAdditional) init() GetDeletionPreviewOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
+// SetSchema sets the value of Schema.
+func (s *CreateRepoCIWebhookInputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// Ref: #/components/schemas/GetMeOutputBody
-type GetMeOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	Auth   MeAuth `json:"auth"`
-	// Present only when a deletion is pending; carries the cooldown window.
-	Deletion            OptMeDeletion            `json:"deletion"`
-	Global              MeGlobal                 `json:"global"`
-	Jurisdiction        OptString                `json:"jurisdiction"`
-	Mode                OptGetMeOutputBodyMode   `json:"mode"`
-	Regional            OptMeRegional            `json:"regional"`
-	RegionalUnavailable OptMeRegionalUnavailable `json:"regionalUnavailable"`
-	AdditionalProps     GetMeOutputBodyAdditional
+// SetBkClusterID sets the value of BkClusterID.
+func (s *CreateRepoCIWebhookInputBody) SetBkClusterID(val OptString) {
+	s.BkClusterID = val
 }
 
-// GetSchema returns the value of Schema.
-func (s *GetMeOutputBody) GetSchema() OptURI {
-	return s.Schema
+// SetBkForceRescaffold sets the value of BkForceRescaffold.
+func (s *CreateRepoCIWebhookInputBody) SetBkForceRescaffold(val OptBool) {
+	s.BkForceRescaffold = val
 }
 
-// GetAuth returns the value of Auth.
-func (s *GetMeOutputBody) GetAuth() MeAuth {
-	return s.Auth
+// SetBkOrganization sets the value of BkOrganization.
+func (s *CreateRepoCIWebhookInputBody) SetBkOrganization(val OptString) {
+	s.BkOrganization = val
 }
 
-// GetDeletion returns the value of Deletion.
-func (s *GetMeOutputBody) GetDeletion() OptMeDeletion {
-	return s.Deletion
+// SetBkPipeline sets the value of BkPipeline.
+func (s *CreateRepoCIWebhookInputBody) SetBkPipeline(val OptString) {
+	s.BkPipeline = val
 }
 
-// GetGlobal returns the value of Global.
-func (s *GetMeOutputBody) GetGlobal() MeGlobal {
-	return s.Global
+// SetBkPipelineSelfManaged sets the value of BkPipelineSelfManaged.
+func (s *CreateRepoCIWebhookInputBody) SetBkPipelineSelfManaged(val OptBool) {
+	s.BkPipelineSelfManaged = val
 }
 
-// GetJurisdiction returns the value of Jurisdiction.
-func (s *GetMeOutputBody) GetJurisdiction() OptString {
-	return s.Jurisdiction
+// SetBkProvisioningToken sets the value of BkProvisioningToken.
+func (s *CreateRepoCIWebhookInputBody) SetBkProvisioningToken(val OptString) {
+	s.BkProvisioningToken = val
 }
 
-// GetMode returns the value of Mode.
-func (s *GetMeOutputBody) GetMode() OptGetMeOutputBodyMode {
-	return s.Mode
+// SetConfig sets the value of Config.
+func (s *CreateRepoCIWebhookInputBody) SetConfig(val OptCreateRepoCIWebhookInputBodyConfig) {
+	s.Config = val
 }
 
-// GetRegional returns the value of Regional.
-func (s *GetMeOutputBody) GetRegional() OptMeRegional {
-	return s.Regional
+// SetDisplayName sets the value of DisplayName.
+func (s *CreateRepoCIWebhookInputBody) SetDisplayName(val OptString) {
+	s.DisplayName = val
 }
 
-// GetRegionalUnavailable returns the value of RegionalUnavailable.
-func (s *GetMeOutputBody) GetRegionalUnavailable() OptMeRegionalUnavailable {
-	return s.RegionalUnavailable
+// SetEvents sets the value of Events.
+func (s *CreateRepoCIWebhookInputBody) SetEvents(val []string) {
+	s.Events = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetMeOutputBody) GetAdditionalProps() GetMeOutputBodyAdditional {
-	return s.AdditionalProps
+// SetMode sets the value of Mode.
+func (s *CreateRepoCIWebhookInputBody) SetMode(val OptString) {
+	s.Mode = val
 }
 
-// SetSchema sets the value of Schema.
-func (s *GetMeOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetProvider sets the value of Provider.
+func (s *CreateRepoCIWebhookInputBody) SetProvider(val string) {
+	s.Provider = val
 }
 
-// SetAuth sets the value of Auth.
-func (s *GetMeOutputBody) SetAuth(val MeAuth) {
-	s.Auth = val
+// SetProviderAccount sets the value of ProviderAccount.
+func (s *CreateRepoCIWebhookInputBody) SetProviderAccount(val OptString) {
+	s.ProviderAccount = val
 }
 
-// SetDeletion sets the value of Deletion.
-func (s *GetMeOutputBody) SetDeletion(val OptMeDeletion) {
-	s.Deletion = val
+// SetRefFilter sets the value of RefFilter.
+func (s *CreateRepoCIWebhookInputBody) SetRefFilter(val OptString) {
+	s.RefFilter = val
 }
 
-// SetGlobal sets the value of Global.
-func (s *GetMeOutputBody) SetGlobal(val MeGlobal) {
-	s.Global = val
+// SetTargetRef sets the value of TargetRef.
+func (s *CreateRepoCIWebhookInputBody) SetTargetRef(val OptString) {
+	s.TargetRef = val
 }
 
-// SetJurisdiction sets the value of Jurisdiction.
-func (s *GetMeOutputBody) SetJurisdiction(val OptString) {
-	s.Jurisdiction = val
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *CreateRepoCIWebhookInputBody) SetAdditionalProps(val CreateRepoCIWebhookInputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// SetMode sets the value of Mode.
-func (s *GetMeOutputBody) SetMode(val OptGetMeOutputBodyMode) {
-	s.Mode = val
-}
+type CreateRepoCIWebhookInputBodyAdditional map[string]jx.Raw
 
-// SetRegional sets the value of Regional.
-func (s *GetMeOutputBody) SetRegional(val OptMeRegional) {
-	s.Regional = val
+func (s *CreateRepoCIWebhookInputBodyAdditional) init() CreateRepoCIWebhookInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// SetRegionalUnavailable sets the value of RegionalUnavailable.
-func (s *GetMeOutputBody) SetRegionalUnavailable(val OptMeRegionalUnavailable) {
-	s.RegionalUnavailable = val
+// Provider-specific values from the providers listing; opaque to core. For buildkite: cluster_id,
+// provisioning_token, force_rescaffold.
+type CreateRepoCIWebhookInputBodyConfig map[string]string
+
+func (s *CreateRepoCIWebhookInputBodyConfig) init() CreateRepoCIWebhookInputBodyConfig {
+	m := *s
+	if m == nil {
+		m = map[string]string{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/CreateRepoInputBody
+type CreateRepoInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Public host of the cluster to pin the repo to (e.g. royalcanin.partial.to); empty lands on the
+	// jurisdiction default.
+	ClusterHost OptString `json:"clusterHost"`
+	Name        string    `json:"name"`
+	// Hash format; defaults to sha1.
+	ObjectFormat    OptCreateRepoInputBodyObjectFormat `json:"objectFormat"`
+	ProjectId       string                             `json:"projectId"`
+	AdditionalProps CreateRepoInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *CreateRepoInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetClusterHost returns the value of ClusterHost.
+func (s *CreateRepoInputBody) GetClusterHost() OptString {
+	return s.ClusterHost
+}
+
+// GetName returns the value of Name.
+func (s *CreateRepoInputBody) GetName() string {
+	return s.Name
+}
+
+// GetObjectFormat returns the value of ObjectFormat.
+func (s *CreateRepoInputBody) GetObjectFormat() OptCreateRepoInputBodyObjectFormat {
+	return s.ObjectFormat
+}
+
+// GetProjectId returns the value of ProjectId.
+func (s *CreateRepoInputBody) GetProjectId() string {
+	return s.ProjectId
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *CreateRepoInputBody) GetAdditionalProps() CreateRepoInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *CreateRepoInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetClusterHost sets the value of ClusterHost.
+func (s *CreateRepoInputBody) SetClusterHost(val OptString) {
+	s.ClusterHost = val
+}
+
+// SetName sets the value of Name.
+func (s *CreateRepoInputBody) SetName(val string) {
+	s.Name = val
+}
+
+// SetObjectFormat sets the value of ObjectFormat.
+func (s *CreateRepoInputBody) SetObjectFormat(val OptCreateRepoInputBodyObjectFormat) {
+	s.ObjectFormat = val
+}
+
+// SetProjectId sets the value of ProjectId.
+func (s *CreateRepoInputBody) SetProjectId(val string) {
+	s.ProjectId = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetMeOutputBody) SetAdditionalProps(val GetMeOutputBodyAdditional) {
+func (s *CreateRepoInputBody) SetAdditionalProps(val CreateRepoInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type GetMeOutputBodyAdditional map[string]jx.Raw
+type CreateRepoInputBodyAdditional map[string]jx.Raw
 
-func (s *GetMeOutputBodyAdditional) init() GetMeOutputBodyAdditional {
+func (s *CreateRepoInputBodyAdditional) init() CreateRepoInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2688,31 +2990,28 @@ func (s *GetMeOutputBodyAdditional) init() GetMeOutputBodyAdditional {
 	return m
 }
 
-type GetMeOutputBodyMode string
+// Hash format; defaults to sha1.
+type CreateRepoInputBodyObjectFormat string
 
 const (
-	GetMeOutputBodyModeStandalone GetMeOutputBodyMode = "standalone"
-	GetMeOutputBodyModeGlobal     GetMeOutputBodyMode = "global"
-	GetMeOutputBodyModeRegional   GetMeOutputBodyMode = "regional"
+	CreateRepoInputBodyObjectFormatSHA1   CreateRepoInputBodyObjectFormat = "sha1"
+	CreateRepoInputBodyObjectFormatSHA256 CreateRepoInputBodyObjectFormat = "sha256"
 )
 
-// AllValues returns all GetMeOutputBodyMode values.
-func (GetMeOutputBodyMode) AllValues() []GetMeOutputBodyMode {
-	return []GetMeOutputBodyMode{
-		GetMeOutputBodyModeStandalone,
-		GetMeOutputBodyModeGlobal,
-		GetMeOutputBodyModeRegional,
+// AllValues returns all CreateRepoInputBodyObjectFormat values.
+func (CreateRepoInputBodyObjectFormat) AllValues() []CreateRepoInputBodyObjectFormat {
+	return []CreateRepoInputBodyObjectFormat{
+		CreateRepoInputBodyObjectFormatSHA1,
+		CreateRepoInputBodyObjectFormatSHA256,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s GetMeOutputBodyMode) MarshalText() ([]byte, error) {
+func (s CreateRepoInputBodyObjectFormat) MarshalText() ([]byte, error) {
 	switch s {
-	case GetMeOutputBodyModeStandalone:
-		return []byte(s), nil
-	case GetMeOutputBodyModeGlobal:
+	case CreateRepoInputBodyObjectFormatSHA1:
 		return []byte(s), nil
-	case GetMeOutputBodyModeRegional:
+	case CreateRepoInputBodyObjectFormatSHA256:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -2720,64 +3019,71 @@ func (s GetMeOutputBodyMode) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GetMeOutputBodyMode) UnmarshalText(data []byte) error {
-	switch GetMeOutputBodyMode(data) {
-	case GetMeOutputBodyModeStandalone:
-		*s = GetMeOutputBodyModeStandalone
-		return nil
-	case GetMeOutputBodyModeGlobal:
-		*s = GetMeOutputBodyModeGlobal
+func (s *CreateRepoInputBodyObjectFormat) UnmarshalText(data []byte) error {
+	switch CreateRepoInputBodyObjectFormat(data) {
+	case CreateRepoInputBodyObjectFormatSHA1:
+		*s = CreateRepoInputBodyObjectFormatSHA1
 		return nil
-	case GetMeOutputBodyModeRegional:
-		*s = GetMeOutputBodyModeRegional
+	case CreateRepoInputBodyObjectFormatSHA256:
+		*s = CreateRepoInputBodyObjectFormatSHA256
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/GetOnboardingStatusOutputBody
-type GetOnboardingStatusOutputBody struct {
+// Ref: #/components/schemas/CreateServiceAccountInputBody
+type CreateServiceAccountInputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// True until the account completes web onboarding at least once.
-	NeedsOnboarding bool `json:"needsOnboarding"`
-	AdditionalProps GetOnboardingStatusOutputBodyAdditional
+	Schema          OptURI `json:"$schema"`
+	Name            string `json:"name"`
+	OrgId           string `json:"orgId"`
+	AdditionalProps CreateServiceAccountInputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *GetOnboardingStatusOutputBody) GetSchema() OptURI {
+func (s *CreateServiceAccountInputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetNeedsOnboarding returns the value of NeedsOnboarding.
-func (s *GetOnboardingStatusOutputBody) GetNeedsOnboarding() bool {
-	return s.NeedsOnboarding
+// GetName returns the value of Name.
+func (s *CreateServiceAccountInputBody) GetName() string {
+	return s.Name
+}
+
+// GetOrgId returns the value of OrgId.
+func (s *CreateServiceAccountInputBody) GetOrgId() string {
+	return s.OrgId
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetOnboardingStatusOutputBody) GetAdditionalProps() GetOnboardingStatusOutputBodyAdditional {
+func (s *CreateServiceAccountInputBody) GetAdditionalProps() CreateServiceAccountInputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *GetOnboardingStatusOutputBody) SetSchema(val OptURI) {
+func (s *CreateServiceAccountInputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetNeedsOnboarding sets the value of NeedsOnboarding.
-func (s *GetOnboardingStatusOutputBody) SetNeedsOnboarding(val bool) {
-	s.NeedsOnboarding = val
+// SetName sets the value of Name.
+func (s *CreateServiceAccountInputBody) SetName(val string) {
+	s.Name = val
+}
+
+// SetOrgId sets the value of OrgId.
+func (s *CreateServiceAccountInputBody) SetOrgId(val string) {
+	s.OrgId = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetOnboardingStatusOutputBody) SetAdditionalProps(val GetOnboardingStatusOutputBodyAdditional) {
+func (s *CreateServiceAccountInputBody) SetAdditionalProps(val CreateServiceAccountInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type GetOnboardingStatusOutputBodyAdditional map[string]jx.Raw
+type CreateServiceAccountInputBodyAdditional map[string]jx.Raw
 
-func (s *GetOnboardingStatusOutputBodyAdditional) init() GetOnboardingStatusOutputBodyAdditional {
+func (s *CreateServiceAccountInputBodyAdditional) init() CreateServiceAccountInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2786,140 +3092,106 @@ func (s *GetOnboardingStatusOutputBodyAdditional) init() GetOnboardingStatusOutp
 	return m
 }
 
-// Ref: #/components/schemas/GetPermissionsOutputBody
-type GetPermissionsOutputBody struct {
+// Ref: #/components/schemas/CreatedMirror
+type CreatedMirror struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI                             `json:"$schema"`
-	Explain         OptGetPermissionsOutputBodyExplain `json:"explain"`
-	Permissions     []string                           `json:"permissions"`
-	ResourceId      string                             `json:"resourceId"`
-	ResourceType    string                             `json:"resourceType"`
-	AdditionalProps GetPermissionsOutputBodyAdditional
+	Schema OptURI `json:"$schema"`
+	// True on fresh creation; false when an existing mirror was returned.
+	Created bool `json:"created"`
+	// Deprecated: always false. Poll the mirror status instead — an empty upstream still reaches
+	// 'ready'.
+	Empty     bool   `json:"empty"`
+	MirrorId  string `json:"mirrorId"`
+	MirrorUrl string `json:"mirrorUrl"`
+	PublicUrl string `json:"publicUrl"`
+	// True when an existing placement was returned that an admin suspended.
+	Suspended       bool `json:"suspended"`
+	AdditionalProps CreatedMirrorAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *GetPermissionsOutputBody) GetSchema() OptURI {
+func (s *CreatedMirror) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetExplain returns the value of Explain.
-func (s *GetPermissionsOutputBody) GetExplain() OptGetPermissionsOutputBodyExplain {
-	return s.Explain
+// GetCreated returns the value of Created.
+func (s *CreatedMirror) GetCreated() bool {
+	return s.Created
 }
 
-// GetPermissions returns the value of Permissions.
-func (s *GetPermissionsOutputBody) GetPermissions() []string {
-	return s.Permissions
+// GetEmpty returns the value of Empty.
+func (s *CreatedMirror) GetEmpty() bool {
+	return s.Empty
 }
 
-// GetResourceId returns the value of ResourceId.
-func (s *GetPermissionsOutputBody) GetResourceId() string {
-	return s.ResourceId
+// GetMirrorId returns the value of MirrorId.
+func (s *CreatedMirror) GetMirrorId() string {
+	return s.MirrorId
 }
 
-// GetResourceType returns the value of ResourceType.
-func (s *GetPermissionsOutputBody) GetResourceType() string {
-	return s.ResourceType
+// GetMirrorUrl returns the value of MirrorUrl.
+func (s *CreatedMirror) GetMirrorUrl() string {
+	return s.MirrorUrl
+}
+
+// GetPublicUrl returns the value of PublicUrl.
+func (s *CreatedMirror) GetPublicUrl() string {
+	return s.PublicUrl
+}
+
+// GetSuspended returns the value of Suspended.
+func (s *CreatedMirror) GetSuspended() bool {
+	return s.Suspended
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetPermissionsOutputBody) GetAdditionalProps() GetPermissionsOutputBodyAdditional {
+func (s *CreatedMirror) GetAdditionalProps() CreatedMirrorAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *GetPermissionsOutputBody) SetSchema(val OptURI) {
+func (s *CreatedMirror) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetExplain sets the value of Explain.
-func (s *GetPermissionsOutputBody) SetExplain(val OptGetPermissionsOutputBodyExplain) {
-	s.Explain = val
+// SetCreated sets the value of Created.
+func (s *CreatedMirror) SetCreated(val bool) {
+	s.Created = val
 }
 
-// SetPermissions sets the value of Permissions.
-func (s *GetPermissionsOutputBody) SetPermissions(val []string) {
-	s.Permissions = val
+// SetEmpty sets the value of Empty.
+func (s *CreatedMirror) SetEmpty(val bool) {
+	s.Empty = val
 }
 
-// SetResourceId sets the value of ResourceId.
-func (s *GetPermissionsOutputBody) SetResourceId(val string) {
-	s.ResourceId = val
+// SetMirrorId sets the value of MirrorId.
+func (s *CreatedMirror) SetMirrorId(val string) {
+	s.MirrorId = val
 }
 
-// SetResourceType sets the value of ResourceType.
-func (s *GetPermissionsOutputBody) SetResourceType(val string) {
-	s.ResourceType = val
+// SetMirrorUrl sets the value of MirrorUrl.
+func (s *CreatedMirror) SetMirrorUrl(val string) {
+	s.MirrorUrl = val
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetPermissionsOutputBody) SetAdditionalProps(val GetPermissionsOutputBodyAdditional) {
-	s.AdditionalProps = val
-}
-
-type GetPermissionsOutputBodyAdditional map[string]jx.Raw
-
-func (s *GetPermissionsOutputBodyAdditional) init() GetPermissionsOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
-}
-
-type GetPermissionsOutputBodyExplain map[string]jx.Raw
-
-func (s *GetPermissionsOutputBodyExplain) init() GetPermissionsOutputBodyExplain {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
-}
-
-// Ref: #/components/schemas/GetRepoVisibilityOutputBody
-type GetRepoVisibilityOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI                                `json:"$schema"`
-	Visibility      GetRepoVisibilityOutputBodyVisibility `json:"visibility"`
-	AdditionalProps GetRepoVisibilityOutputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *GetRepoVisibilityOutputBody) GetSchema() OptURI {
-	return s.Schema
-}
-
-// GetVisibility returns the value of Visibility.
-func (s *GetRepoVisibilityOutputBody) GetVisibility() GetRepoVisibilityOutputBodyVisibility {
-	return s.Visibility
-}
-
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetRepoVisibilityOutputBody) GetAdditionalProps() GetRepoVisibilityOutputBodyAdditional {
-	return s.AdditionalProps
-}
-
-// SetSchema sets the value of Schema.
-func (s *GetRepoVisibilityOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetPublicUrl sets the value of PublicUrl.
+func (s *CreatedMirror) SetPublicUrl(val string) {
+	s.PublicUrl = val
 }
 
-// SetVisibility sets the value of Visibility.
-func (s *GetRepoVisibilityOutputBody) SetVisibility(val GetRepoVisibilityOutputBodyVisibility) {
-	s.Visibility = val
+// SetSuspended sets the value of Suspended.
+func (s *CreatedMirror) SetSuspended(val bool) {
+	s.Suspended = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetRepoVisibilityOutputBody) SetAdditionalProps(val GetRepoVisibilityOutputBodyAdditional) {
+func (s *CreatedMirror) SetAdditionalProps(val CreatedMirrorAdditional) {
 	s.AdditionalProps = val
 }
 
-type GetRepoVisibilityOutputBodyAdditional map[string]jx.Raw
+type CreatedMirrorAdditional map[string]jx.Raw
 
-func (s *GetRepoVisibilityOutputBodyAdditional) init() GetRepoVisibilityOutputBodyAdditional {
+func (s *CreatedMirrorAdditional) init() CreatedMirrorAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -2928,27 +3200,32 @@ func (s *GetRepoVisibilityOutputBodyAdditional) init() GetRepoVisibilityOutputBo
 	return m
 }
 
-type GetRepoVisibilityOutputBodyVisibility string
+// DeleteBindingNoContent is response for DeleteBinding operation.
+type DeleteBindingNoContent struct{}
+
+// DeleteMeAccepted is response for DeleteMe operation.
+type DeleteMeAccepted struct{}
+
+// DeleteMirrorNoContent is response for DeleteMirror operation.
+type DeleteMirrorNoContent struct{}
+
+type DeleteMirrorProvider string
 
 const (
-	GetRepoVisibilityOutputBodyVisibilityPublic  GetRepoVisibilityOutputBodyVisibility = "public"
-	GetRepoVisibilityOutputBodyVisibilityPrivate GetRepoVisibilityOutputBodyVisibility = "private"
+	DeleteMirrorProviderGithub DeleteMirrorProvider = "github"
 )
 
-// AllValues returns all GetRepoVisibilityOutputBodyVisibility values.
-func (GetRepoVisibilityOutputBodyVisibility) AllValues() []GetRepoVisibilityOutputBodyVisibility {
-	return []GetRepoVisibilityOutputBodyVisibility{
-		GetRepoVisibilityOutputBodyVisibilityPublic,
-		GetRepoVisibilityOutputBodyVisibilityPrivate,
+// AllValues returns all DeleteMirrorProvider values.
+func (DeleteMirrorProvider) AllValues() []DeleteMirrorProvider {
+	return []DeleteMirrorProvider{
+		DeleteMirrorProviderGithub,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s GetRepoVisibilityOutputBodyVisibility) MarshalText() ([]byte, error) {
+func (s DeleteMirrorProvider) MarshalText() ([]byte, error) {
 	switch s {
-	case GetRepoVisibilityOutputBodyVisibilityPublic:
-		return []byte(s), nil
-	case GetRepoVisibilityOutputBodyVisibilityPrivate:
+	case DeleteMirrorProviderGithub:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -2956,122 +3233,117 @@ func (s GetRepoVisibilityOutputBodyVisibility) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GetRepoVisibilityOutputBodyVisibility) UnmarshalText(data []byte) error {
-	switch GetRepoVisibilityOutputBodyVisibility(data) {
-	case GetRepoVisibilityOutputBodyVisibilityPublic:
-		*s = GetRepoVisibilityOutputBodyVisibilityPublic
-		return nil
-	case GetRepoVisibilityOutputBodyVisibilityPrivate:
-		*s = GetRepoVisibilityOutputBodyVisibilityPrivate
+func (s *DeleteMirrorProvider) UnmarshalText(data []byte) error {
+	switch DeleteMirrorProvider(data) {
+	case DeleteMirrorProviderGithub:
+		*s = DeleteMirrorProviderGithub
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/GetTopologyOutputBody
-type GetTopologyOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI                 `json:"$schema"`
-	Jurisdictions   []TopologyJurisdiction `json:"jurisdictions"`
-	AdditionalProps GetTopologyOutputBodyAdditional
-}
+// DeleteOrgCIBuildkiteClusterNoContent is response for DeleteOrgCIBuildkiteCluster operation.
+type DeleteOrgCIBuildkiteClusterNoContent struct{}
 
-// GetSchema returns the value of Schema.
-func (s *GetTopologyOutputBody) GetSchema() OptURI {
-	return s.Schema
-}
+// DeleteOrgCIBuildkiteCredentialNoContent is response for DeleteOrgCIBuildkiteCredential operation.
+type DeleteOrgCIBuildkiteCredentialNoContent struct{}
 
-// GetJurisdictions returns the value of Jurisdictions.
-func (s *GetTopologyOutputBody) GetJurisdictions() []TopologyJurisdiction {
-	return s.Jurisdictions
-}
+// DeleteOrgNoContent is response for DeleteOrg operation.
+type DeleteOrgNoContent struct{}
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetTopologyOutputBody) GetAdditionalProps() GetTopologyOutputBodyAdditional {
-	return s.AdditionalProps
-}
+// DeleteProjectNoContent is response for DeleteProject operation.
+type DeleteProjectNoContent struct{}
 
-// SetSchema sets the value of Schema.
-func (s *GetTopologyOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
+// DeleteRepoCIWebhookNoContent is response for DeleteRepoCIWebhook operation.
+type DeleteRepoCIWebhookNoContent struct{}
 
-// SetJurisdictions sets the value of Jurisdictions.
-func (s *GetTopologyOutputBody) SetJurisdictions(val []TopologyJurisdiction) {
-	s.Jurisdictions = val
-}
+// DeleteRepoNoContent is response for DeleteRepo operation.
+type DeleteRepoNoContent struct{}
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetTopologyOutputBody) SetAdditionalProps(val GetTopologyOutputBodyAdditional) {
-	s.AdditionalProps = val
-}
+// DeleteServiceAccountNoContent is response for DeleteServiceAccount operation.
+type DeleteServiceAccountNoContent struct{}
 
-type GetTopologyOutputBodyAdditional map[string]jx.Raw
+// Ref: #/components/schemas/DeletionBlocker
+type DeletionBlocker struct {
+	// True when the account can self-serve delete this org (it is the only member and the org has no
+	// projects). When false, the org has other members or data and must be transferred/removed via
+	// support. The UI should offer a delete action only when this is true.
+	Deletable bool `json:"deletable"`
+	// Resource ID (org ULID).
+	ID string `json:"id"`
+	// Blocker kind. Currently always 'owned_org'.
+	Kind DeletionBlockerKind `json:"kind"`
+	// Copy explaining how to clear the blocker.
+	Message string `json:"message"`
+	// Human-readable resource name.
+	Name            string `json:"name"`
+	AdditionalProps DeletionBlockerAdditional
+}
 
-func (s *GetTopologyOutputBodyAdditional) init() GetTopologyOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
+// GetDeletable returns the value of Deletable.
+func (s *DeletionBlocker) GetDeletable() bool {
+	return s.Deletable
 }
 
-// Ref: #/components/schemas/GetVersionOutputBody
-type GetVersionOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Server mode.
-	Mode OptGetVersionOutputBodyMode `json:"mode"`
-	// Git commit SHA of the running entire-core binary, or "dev" for an untagged local build.
-	Version         string `json:"version"`
-	AdditionalProps GetVersionOutputBodyAdditional
+// GetID returns the value of ID.
+func (s *DeletionBlocker) GetID() string {
+	return s.ID
 }
 
-// GetSchema returns the value of Schema.
-func (s *GetVersionOutputBody) GetSchema() OptURI {
-	return s.Schema
+// GetKind returns the value of Kind.
+func (s *DeletionBlocker) GetKind() DeletionBlockerKind {
+	return s.Kind
 }
 
-// GetMode returns the value of Mode.
-func (s *GetVersionOutputBody) GetMode() OptGetVersionOutputBodyMode {
-	return s.Mode
+// GetMessage returns the value of Message.
+func (s *DeletionBlocker) GetMessage() string {
+	return s.Message
 }
 
-// GetVersion returns the value of Version.
-func (s *GetVersionOutputBody) GetVersion() string {
-	return s.Version
+// GetName returns the value of Name.
+func (s *DeletionBlocker) GetName() string {
+	return s.Name
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GetVersionOutputBody) GetAdditionalProps() GetVersionOutputBodyAdditional {
+func (s *DeletionBlocker) GetAdditionalProps() DeletionBlockerAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *GetVersionOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetDeletable sets the value of Deletable.
+func (s *DeletionBlocker) SetDeletable(val bool) {
+	s.Deletable = val
 }
 
-// SetMode sets the value of Mode.
-func (s *GetVersionOutputBody) SetMode(val OptGetVersionOutputBodyMode) {
-	s.Mode = val
+// SetID sets the value of ID.
+func (s *DeletionBlocker) SetID(val string) {
+	s.ID = val
 }
 
-// SetVersion sets the value of Version.
-func (s *GetVersionOutputBody) SetVersion(val string) {
-	s.Version = val
+// SetKind sets the value of Kind.
+func (s *DeletionBlocker) SetKind(val DeletionBlockerKind) {
+	s.Kind = val
+}
+
+// SetMessage sets the value of Message.
+func (s *DeletionBlocker) SetMessage(val string) {
+	s.Message = val
+}
+
+// SetName sets the value of Name.
+func (s *DeletionBlocker) SetName(val string) {
+	s.Name = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GetVersionOutputBody) SetAdditionalProps(val GetVersionOutputBodyAdditional) {
+func (s *DeletionBlocker) SetAdditionalProps(val DeletionBlockerAdditional) {
 	s.AdditionalProps = val
 }
 
-type GetVersionOutputBodyAdditional map[string]jx.Raw
+type DeletionBlockerAdditional map[string]jx.Raw
 
-func (s *GetVersionOutputBodyAdditional) init() GetVersionOutputBodyAdditional {
+func (s *DeletionBlockerAdditional) init() DeletionBlockerAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3080,32 +3352,24 @@ func (s *GetVersionOutputBodyAdditional) init() GetVersionOutputBodyAdditional {
 	return m
 }
 
-// Server mode.
-type GetVersionOutputBodyMode string
+// Blocker kind. Currently always 'owned_org'.
+type DeletionBlockerKind string
 
 const (
-	GetVersionOutputBodyModeStandalone GetVersionOutputBodyMode = "standalone"
-	GetVersionOutputBodyModeGlobal     GetVersionOutputBodyMode = "global"
-	GetVersionOutputBodyModeRegional   GetVersionOutputBodyMode = "regional"
+	DeletionBlockerKindOwnedOrg DeletionBlockerKind = "owned_org"
 )
 
-// AllValues returns all GetVersionOutputBodyMode values.
-func (GetVersionOutputBodyMode) AllValues() []GetVersionOutputBodyMode {
-	return []GetVersionOutputBodyMode{
-		GetVersionOutputBodyModeStandalone,
-		GetVersionOutputBodyModeGlobal,
-		GetVersionOutputBodyModeRegional,
+// AllValues returns all DeletionBlockerKind values.
+func (DeletionBlockerKind) AllValues() []DeletionBlockerKind {
+	return []DeletionBlockerKind{
+		DeletionBlockerKindOwnedOrg,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s GetVersionOutputBodyMode) MarshalText() ([]byte, error) {
+func (s DeletionBlockerKind) MarshalText() ([]byte, error) {
 	switch s {
-	case GetVersionOutputBodyModeStandalone:
-		return []byte(s), nil
-	case GetVersionOutputBodyModeGlobal:
-		return []byte(s), nil
-	case GetVersionOutputBodyModeRegional:
+	case DeletionBlockerKindOwnedOrg:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -3113,96 +3377,94 @@ func (s GetVersionOutputBodyMode) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GetVersionOutputBodyMode) UnmarshalText(data []byte) error {
-	switch GetVersionOutputBodyMode(data) {
-	case GetVersionOutputBodyModeStandalone:
-		*s = GetVersionOutputBodyModeStandalone
-		return nil
-	case GetVersionOutputBodyModeGlobal:
-		*s = GetVersionOutputBodyModeGlobal
-		return nil
-	case GetVersionOutputBodyModeRegional:
-		*s = GetVersionOutputBodyModeRegional
+func (s *DeletionBlockerKind) UnmarshalText(data []byte) error {
+	switch DeletionBlockerKind(data) {
+	case DeletionBlockerKindOwnedOrg:
+		*s = DeletionBlockerKindOwnedOrg
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/GrantProjectAccessInputBody
-type GrantProjectAccessInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI                                    `json:"$schema"`
-	GranteeType     OptGrantProjectAccessInputBodyGranteeType `json:"granteeType"`
-	Provider        string                                    `json:"provider"`
-	ProviderUserId  string                                    `json:"providerUserId"`
-	Role            GrantProjectAccessInputBodyRole           `json:"role"`
-	AdditionalProps GrantProjectAccessInputBodyAdditional
+// Ref: #/components/schemas/DeletionGrant
+type DeletionGrant struct {
+	// Region the repo lives in (us/eu/au); empty for project grants.
+	Jurisdiction OptString `json:"jurisdiction"`
+	// Granted resource ULID.
+	ResourceId string `json:"resourceId"`
+	// Granted resource name.
+	ResourceName string `json:"resourceName"`
+	// Granted resource type.
+	ResourceType DeletionGrantResourceType `json:"resourceType"`
+	// Granted role.
+	Role            string `json:"role"`
+	AdditionalProps DeletionGrantAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *GrantProjectAccessInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *DeletionGrant) GetJurisdiction() OptString {
+	return s.Jurisdiction
 }
 
-// GetGranteeType returns the value of GranteeType.
-func (s *GrantProjectAccessInputBody) GetGranteeType() OptGrantProjectAccessInputBodyGranteeType {
-	return s.GranteeType
+// GetResourceId returns the value of ResourceId.
+func (s *DeletionGrant) GetResourceId() string {
+	return s.ResourceId
 }
 
-// GetProvider returns the value of Provider.
-func (s *GrantProjectAccessInputBody) GetProvider() string {
-	return s.Provider
+// GetResourceName returns the value of ResourceName.
+func (s *DeletionGrant) GetResourceName() string {
+	return s.ResourceName
 }
 
-// GetProviderUserId returns the value of ProviderUserId.
-func (s *GrantProjectAccessInputBody) GetProviderUserId() string {
-	return s.ProviderUserId
+// GetResourceType returns the value of ResourceType.
+func (s *DeletionGrant) GetResourceType() DeletionGrantResourceType {
+	return s.ResourceType
 }
 
 // GetRole returns the value of Role.
-func (s *GrantProjectAccessInputBody) GetRole() GrantProjectAccessInputBodyRole {
+func (s *DeletionGrant) GetRole() string {
 	return s.Role
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GrantProjectAccessInputBody) GetAdditionalProps() GrantProjectAccessInputBodyAdditional {
+func (s *DeletionGrant) GetAdditionalProps() DeletionGrantAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *GrantProjectAccessInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *DeletionGrant) SetJurisdiction(val OptString) {
+	s.Jurisdiction = val
 }
 
-// SetGranteeType sets the value of GranteeType.
-func (s *GrantProjectAccessInputBody) SetGranteeType(val OptGrantProjectAccessInputBodyGranteeType) {
-	s.GranteeType = val
+// SetResourceId sets the value of ResourceId.
+func (s *DeletionGrant) SetResourceId(val string) {
+	s.ResourceId = val
 }
 
-// SetProvider sets the value of Provider.
-func (s *GrantProjectAccessInputBody) SetProvider(val string) {
-	s.Provider = val
+// SetResourceName sets the value of ResourceName.
+func (s *DeletionGrant) SetResourceName(val string) {
+	s.ResourceName = val
 }
 
-// SetProviderUserId sets the value of ProviderUserId.
-func (s *GrantProjectAccessInputBody) SetProviderUserId(val string) {
-	s.ProviderUserId = val
+// SetResourceType sets the value of ResourceType.
+func (s *DeletionGrant) SetResourceType(val DeletionGrantResourceType) {
+	s.ResourceType = val
 }
 
 // SetRole sets the value of Role.
-func (s *GrantProjectAccessInputBody) SetRole(val GrantProjectAccessInputBodyRole) {
+func (s *DeletionGrant) SetRole(val string) {
 	s.Role = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GrantProjectAccessInputBody) SetAdditionalProps(val GrantProjectAccessInputBodyAdditional) {
+func (s *DeletionGrant) SetAdditionalProps(val DeletionGrantAdditional) {
 	s.AdditionalProps = val
 }
 
-type GrantProjectAccessInputBodyAdditional map[string]jx.Raw
+type DeletionGrantAdditional map[string]jx.Raw
 
-func (s *GrantProjectAccessInputBodyAdditional) init() GrantProjectAccessInputBodyAdditional {
+func (s *DeletionGrantAdditional) init() DeletionGrantAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3211,65 +3473,28 @@ func (s *GrantProjectAccessInputBodyAdditional) init() GrantProjectAccessInputBo
 	return m
 }
 
-type GrantProjectAccessInputBodyGranteeType string
-
-const (
-	GrantProjectAccessInputBodyGranteeTypeAccount GrantProjectAccessInputBodyGranteeType = "account"
-)
-
-// AllValues returns all GrantProjectAccessInputBodyGranteeType values.
-func (GrantProjectAccessInputBodyGranteeType) AllValues() []GrantProjectAccessInputBodyGranteeType {
-	return []GrantProjectAccessInputBodyGranteeType{
-		GrantProjectAccessInputBodyGranteeTypeAccount,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s GrantProjectAccessInputBodyGranteeType) MarshalText() ([]byte, error) {
-	switch s {
-	case GrantProjectAccessInputBodyGranteeTypeAccount:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GrantProjectAccessInputBodyGranteeType) UnmarshalText(data []byte) error {
-	switch GrantProjectAccessInputBodyGranteeType(data) {
-	case GrantProjectAccessInputBodyGranteeTypeAccount:
-		*s = GrantProjectAccessInputBodyGranteeTypeAccount
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
-}
-
-type GrantProjectAccessInputBodyRole string
+// Granted resource type.
+type DeletionGrantResourceType string
 
 const (
-	GrantProjectAccessInputBodyRoleReader GrantProjectAccessInputBodyRole = "reader"
-	GrantProjectAccessInputBodyRoleWriter GrantProjectAccessInputBodyRole = "writer"
-	GrantProjectAccessInputBodyRoleAdmin  GrantProjectAccessInputBodyRole = "admin"
+	DeletionGrantResourceTypeProject DeletionGrantResourceType = "project"
+	DeletionGrantResourceTypeRepo    DeletionGrantResourceType = "repo"
 )
 
-// AllValues returns all GrantProjectAccessInputBodyRole values.
-func (GrantProjectAccessInputBodyRole) AllValues() []GrantProjectAccessInputBodyRole {
-	return []GrantProjectAccessInputBodyRole{
-		GrantProjectAccessInputBodyRoleReader,
-		GrantProjectAccessInputBodyRoleWriter,
-		GrantProjectAccessInputBodyRoleAdmin,
+// AllValues returns all DeletionGrantResourceType values.
+func (DeletionGrantResourceType) AllValues() []DeletionGrantResourceType {
+	return []DeletionGrantResourceType{
+		DeletionGrantResourceTypeProject,
+		DeletionGrantResourceTypeRepo,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s GrantProjectAccessInputBodyRole) MarshalText() ([]byte, error) {
+func (s DeletionGrantResourceType) MarshalText() ([]byte, error) {
 	switch s {
-	case GrantProjectAccessInputBodyRoleReader:
-		return []byte(s), nil
-	case GrantProjectAccessInputBodyRoleWriter:
+	case DeletionGrantResourceTypeProject:
 		return []byte(s), nil
-	case GrantProjectAccessInputBodyRoleAdmin:
+	case DeletionGrantResourceTypeRepo:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -3277,63 +3502,61 @@ func (s GrantProjectAccessInputBodyRole) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GrantProjectAccessInputBodyRole) UnmarshalText(data []byte) error {
-	switch GrantProjectAccessInputBodyRole(data) {
-	case GrantProjectAccessInputBodyRoleReader:
-		*s = GrantProjectAccessInputBodyRoleReader
-		return nil
-	case GrantProjectAccessInputBodyRoleWriter:
-		*s = GrantProjectAccessInputBodyRoleWriter
+func (s *DeletionGrantResourceType) UnmarshalText(data []byte) error {
+	switch DeletionGrantResourceType(data) {
+	case DeletionGrantResourceTypeProject:
+		*s = DeletionGrantResourceTypeProject
 		return nil
-	case GrantProjectAccessInputBodyRoleAdmin:
-		*s = GrantProjectAccessInputBodyRoleAdmin
+	case DeletionGrantResourceTypeRepo:
+		*s = DeletionGrantResourceTypeRepo
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/GrantProjectAccessOutputBody
-type GrantProjectAccessOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI `json:"$schema"`
-	Status          string `json:"status"`
-	AdditionalProps GrantProjectAccessOutputBodyAdditional
+// Ref: #/components/schemas/DeletionMembership
+type DeletionMembership struct {
+	// Org name.
+	Name string `json:"name"`
+	// Org ULID.
+	OrgId           string `json:"orgId"`
+	AdditionalProps DeletionMembershipAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *GrantProjectAccessOutputBody) GetSchema() OptURI {
-	return s.Schema
+// GetName returns the value of Name.
+func (s *DeletionMembership) GetName() string {
+	return s.Name
 }
 
-// GetStatus returns the value of Status.
-func (s *GrantProjectAccessOutputBody) GetStatus() string {
-	return s.Status
+// GetOrgId returns the value of OrgId.
+func (s *DeletionMembership) GetOrgId() string {
+	return s.OrgId
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GrantProjectAccessOutputBody) GetAdditionalProps() GrantProjectAccessOutputBodyAdditional {
+func (s *DeletionMembership) GetAdditionalProps() DeletionMembershipAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *GrantProjectAccessOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetName sets the value of Name.
+func (s *DeletionMembership) SetName(val string) {
+	s.Name = val
 }
 
-// SetStatus sets the value of Status.
-func (s *GrantProjectAccessOutputBody) SetStatus(val string) {
-	s.Status = val
+// SetOrgId sets the value of OrgId.
+func (s *DeletionMembership) SetOrgId(val string) {
+	s.OrgId = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GrantProjectAccessOutputBody) SetAdditionalProps(val GrantProjectAccessOutputBodyAdditional) {
+func (s *DeletionMembership) SetAdditionalProps(val DeletionMembershipAdditional) {
 	s.AdditionalProps = val
 }
 
-type GrantProjectAccessOutputBodyAdditional map[string]jx.Raw
+type DeletionMembershipAdditional map[string]jx.Raw
 
-func (s *GrantProjectAccessOutputBodyAdditional) init() GrantProjectAccessOutputBodyAdditional {
+func (s *DeletionMembershipAdditional) init() DeletionMembershipAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3342,80 +3565,60 @@ func (s *GrantProjectAccessOutputBodyAdditional) init() GrantProjectAccessOutput
 	return m
 }
 
-// Ref: #/components/schemas/GrantRepoAccessInputBody
-type GrantRepoAccessInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI                                 `json:"$schema"`
-	GranteeType     OptGrantRepoAccessInputBodyGranteeType `json:"granteeType"`
-	Provider        string                                 `json:"provider"`
-	ProviderUserId  string                                 `json:"providerUserId"`
-	Role            GrantRepoAccessInputBodyRole           `json:"role"`
-	AdditionalProps GrantRepoAccessInputBodyAdditional
+// Ref: #/components/schemas/DeletionRepo
+type DeletionRepo struct {
+	// Cluster slug the repo is placed on, if known.
+	Cluster OptString `json:"cluster"`
+	// Repo ULID.
+	ID string `json:"id"`
+	// Repo name.
+	Name            string `json:"name"`
+	AdditionalProps DeletionRepoAdditional
 }
 
-// GetSchema returns the value of Schema.
-func (s *GrantRepoAccessInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetCluster returns the value of Cluster.
+func (s *DeletionRepo) GetCluster() OptString {
+	return s.Cluster
 }
 
-// GetGranteeType returns the value of GranteeType.
-func (s *GrantRepoAccessInputBody) GetGranteeType() OptGrantRepoAccessInputBodyGranteeType {
-	return s.GranteeType
+// GetID returns the value of ID.
+func (s *DeletionRepo) GetID() string {
+	return s.ID
 }
 
-// GetProvider returns the value of Provider.
-func (s *GrantRepoAccessInputBody) GetProvider() string {
-	return s.Provider
-}
-
-// GetProviderUserId returns the value of ProviderUserId.
-func (s *GrantRepoAccessInputBody) GetProviderUserId() string {
-	return s.ProviderUserId
-}
-
-// GetRole returns the value of Role.
-func (s *GrantRepoAccessInputBody) GetRole() GrantRepoAccessInputBodyRole {
-	return s.Role
+// GetName returns the value of Name.
+func (s *DeletionRepo) GetName() string {
+	return s.Name
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GrantRepoAccessInputBody) GetAdditionalProps() GrantRepoAccessInputBodyAdditional {
+func (s *DeletionRepo) GetAdditionalProps() DeletionRepoAdditional {
 	return s.AdditionalProps
 }
 
-// SetSchema sets the value of Schema.
-func (s *GrantRepoAccessInputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
-
-// SetGranteeType sets the value of GranteeType.
-func (s *GrantRepoAccessInputBody) SetGranteeType(val OptGrantRepoAccessInputBodyGranteeType) {
-	s.GranteeType = val
-}
-
-// SetProvider sets the value of Provider.
-func (s *GrantRepoAccessInputBody) SetProvider(val string) {
-	s.Provider = val
+// SetCluster sets the value of Cluster.
+func (s *DeletionRepo) SetCluster(val OptString) {
+	s.Cluster = val
 }
 
-// SetProviderUserId sets the value of ProviderUserId.
-func (s *GrantRepoAccessInputBody) SetProviderUserId(val string) {
-	s.ProviderUserId = val
+// SetID sets the value of ID.
+func (s *DeletionRepo) SetID(val string) {
+	s.ID = val
 }
 
-// SetRole sets the value of Role.
-func (s *GrantRepoAccessInputBody) SetRole(val GrantRepoAccessInputBodyRole) {
-	s.Role = val
+// SetName sets the value of Name.
+func (s *DeletionRepo) SetName(val string) {
+	s.Name = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GrantRepoAccessInputBody) SetAdditionalProps(val GrantRepoAccessInputBodyAdditional) {
+func (s *DeletionRepo) SetAdditionalProps(val DeletionRepoAdditional) {
 	s.AdditionalProps = val
 }
 
-type GrantRepoAccessInputBodyAdditional map[string]jx.Raw
+type DeletionRepoAdditional map[string]jx.Raw
 
-func (s *GrantRepoAccessInputBodyAdditional) init() GrantRepoAccessInputBodyAdditional {
+func (s *DeletionRepoAdditional) init() DeletionRepoAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3424,136 +3627,171 @@ func (s *GrantRepoAccessInputBodyAdditional) init() GrantRepoAccessInputBodyAddi
 	return m
 }
 
-type GrantRepoAccessInputBodyGranteeType string
+// Ref: #/components/schemas/ErrorDetail
+type ErrorDetail struct {
+	// Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'.
+	Location OptString `json:"location"`
+	// Error message text.
+	Message OptString `json:"message"`
+	// The value at the given location.
+	Value           jx.Raw `json:"value"`
+	AdditionalProps ErrorDetailAdditional
+}
 
-const (
-	GrantRepoAccessInputBodyGranteeTypeAccount GrantRepoAccessInputBodyGranteeType = "account"
-)
+// GetLocation returns the value of Location.
+func (s *ErrorDetail) GetLocation() OptString {
+	return s.Location
+}
 
-// AllValues returns all GrantRepoAccessInputBodyGranteeType values.
-func (GrantRepoAccessInputBodyGranteeType) AllValues() []GrantRepoAccessInputBodyGranteeType {
-	return []GrantRepoAccessInputBodyGranteeType{
-		GrantRepoAccessInputBodyGranteeTypeAccount,
-	}
+// GetMessage returns the value of Message.
+func (s *ErrorDetail) GetMessage() OptString {
+	return s.Message
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s GrantRepoAccessInputBodyGranteeType) MarshalText() ([]byte, error) {
-	switch s {
-	case GrantRepoAccessInputBodyGranteeTypeAccount:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// GetValue returns the value of Value.
+func (s *ErrorDetail) GetValue() jx.Raw {
+	return s.Value
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GrantRepoAccessInputBodyGranteeType) UnmarshalText(data []byte) error {
-	switch GrantRepoAccessInputBodyGranteeType(data) {
-	case GrantRepoAccessInputBodyGranteeTypeAccount:
-		*s = GrantRepoAccessInputBodyGranteeTypeAccount
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ErrorDetail) GetAdditionalProps() ErrorDetailAdditional {
+	return s.AdditionalProps
 }
 
-type GrantRepoAccessInputBodyRole string
+// SetLocation sets the value of Location.
+func (s *ErrorDetail) SetLocation(val OptString) {
+	s.Location = val
+}
 
-const (
-	GrantRepoAccessInputBodyRoleReader    GrantRepoAccessInputBodyRole = "reader"
-	GrantRepoAccessInputBodyRoleWriter    GrantRepoAccessInputBodyRole = "writer"
-	GrantRepoAccessInputBodyRoleAdmin     GrantRepoAccessInputBodyRole = "admin"
-	GrantRepoAccessInputBodyRoleCiManager GrantRepoAccessInputBodyRole = "ci_manager"
-)
+// SetMessage sets the value of Message.
+func (s *ErrorDetail) SetMessage(val OptString) {
+	s.Message = val
+}
 
-// AllValues returns all GrantRepoAccessInputBodyRole values.
-func (GrantRepoAccessInputBodyRole) AllValues() []GrantRepoAccessInputBodyRole {
-	return []GrantRepoAccessInputBodyRole{
-		GrantRepoAccessInputBodyRoleReader,
-		GrantRepoAccessInputBodyRoleWriter,
-		GrantRepoAccessInputBodyRoleAdmin,
-		GrantRepoAccessInputBodyRoleCiManager,
-	}
+// SetValue sets the value of Value.
+func (s *ErrorDetail) SetValue(val jx.Raw) {
+	s.Value = val
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s GrantRepoAccessInputBodyRole) MarshalText() ([]byte, error) {
-	switch s {
-	case GrantRepoAccessInputBodyRoleReader:
-		return []byte(s), nil
-	case GrantRepoAccessInputBodyRoleWriter:
-		return []byte(s), nil
-	case GrantRepoAccessInputBodyRoleAdmin:
-		return []byte(s), nil
-	case GrantRepoAccessInputBodyRoleCiManager:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ErrorDetail) SetAdditionalProps(val ErrorDetailAdditional) {
+	s.AdditionalProps = val
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GrantRepoAccessInputBodyRole) UnmarshalText(data []byte) error {
-	switch GrantRepoAccessInputBodyRole(data) {
-	case GrantRepoAccessInputBodyRoleReader:
-		*s = GrantRepoAccessInputBodyRoleReader
-		return nil
-	case GrantRepoAccessInputBodyRoleWriter:
-		*s = GrantRepoAccessInputBodyRoleWriter
-		return nil
-	case GrantRepoAccessInputBodyRoleAdmin:
-		*s = GrantRepoAccessInputBodyRoleAdmin
-		return nil
-	case GrantRepoAccessInputBodyRoleCiManager:
-		*s = GrantRepoAccessInputBodyRoleCiManager
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
+type ErrorDetailAdditional map[string]jx.Raw
+
+func (s *ErrorDetailAdditional) init() ErrorDetailAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
 	}
+	return m
 }
 
-// Ref: #/components/schemas/GrantRepoAccessOutputBody
-type GrantRepoAccessOutputBody struct {
+// Ref: #/components/schemas/ErrorModel
+type ErrorModel struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI `json:"$schema"`
-	Status          string `json:"status"`
-	AdditionalProps GrantRepoAccessOutputBodyAdditional
+	Schema OptURI `json:"$schema"`
+	// A human-readable explanation specific to this occurrence of the problem.
+	Detail OptString `json:"detail"`
+	// Optional list of individual error details.
+	Errors []ErrorDetail `json:"errors"`
+	// A URI reference that identifies the specific occurrence of the problem.
+	Instance OptURI `json:"instance"`
+	// HTTP status code.
+	Status OptInt64 `json:"status"`
+	// A short, human-readable summary of the problem type. This value should not change between
+	// occurrences of the error.
+	Title OptString `json:"title"`
+	// A URI reference to human-readable documentation for the error.
+	Type            OptURI `json:"type"`
+	AdditionalProps ErrorModelAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *GrantRepoAccessOutputBody) GetSchema() OptURI {
+func (s *ErrorModel) GetSchema() OptURI {
 	return s.Schema
 }
 
+// GetDetail returns the value of Detail.
+func (s *ErrorModel) GetDetail() OptString {
+	return s.Detail
+}
+
+// GetErrors returns the value of Errors.
+func (s *ErrorModel) GetErrors() []ErrorDetail {
+	return s.Errors
+}
+
+// GetInstance returns the value of Instance.
+func (s *ErrorModel) GetInstance() OptURI {
+	return s.Instance
+}
+
 // GetStatus returns the value of Status.
-func (s *GrantRepoAccessOutputBody) GetStatus() string {
+func (s *ErrorModel) GetStatus() OptInt64 {
 	return s.Status
 }
 
+// GetTitle returns the value of Title.
+func (s *ErrorModel) GetTitle() OptString {
+	return s.Title
+}
+
+// GetType returns the value of Type.
+func (s *ErrorModel) GetType() OptURI {
+	return s.Type
+}
+
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *GrantRepoAccessOutputBody) GetAdditionalProps() GrantRepoAccessOutputBodyAdditional {
+func (s *ErrorModel) GetAdditionalProps() ErrorModelAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *GrantRepoAccessOutputBody) SetSchema(val OptURI) {
+func (s *ErrorModel) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
+// SetDetail sets the value of Detail.
+func (s *ErrorModel) SetDetail(val OptString) {
+	s.Detail = val
+}
+
+// SetErrors sets the value of Errors.
+func (s *ErrorModel) SetErrors(val []ErrorDetail) {
+	s.Errors = val
+}
+
+// SetInstance sets the value of Instance.
+func (s *ErrorModel) SetInstance(val OptURI) {
+	s.Instance = val
+}
+
 // SetStatus sets the value of Status.
-func (s *GrantRepoAccessOutputBody) SetStatus(val string) {
+func (s *ErrorModel) SetStatus(val OptInt64) {
 	s.Status = val
 }
 
+// SetTitle sets the value of Title.
+func (s *ErrorModel) SetTitle(val OptString) {
+	s.Title = val
+}
+
+// SetType sets the value of Type.
+func (s *ErrorModel) SetType(val OptURI) {
+	s.Type = val
+}
+
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GrantRepoAccessOutputBody) SetAdditionalProps(val GrantRepoAccessOutputBodyAdditional) {
+func (s *ErrorModel) SetAdditionalProps(val ErrorModelAdditional) {
 	s.AdditionalProps = val
 }
 
-type GrantRepoAccessOutputBodyAdditional map[string]jx.Raw
+type ErrorModelAdditional map[string]jx.Raw
 
-func (s *GrantRepoAccessOutputBodyAdditional) init() GrantRepoAccessOutputBodyAdditional {
+func (s *ErrorModelAdditional) init() ErrorModelAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3562,69 +3800,72 @@ func (s *GrantRepoAccessOutputBodyAdditional) init() GrantRepoAccessOutputBodyAd
 	return m
 }
 
-// Ref: #/components/schemas/GrantServiceAccountAccessInputBody
-type GrantServiceAccountAccessInputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI                                         `json:"$schema"`
-	ResourceId      string                                         `json:"resourceId"`
-	ResourceType    GrantServiceAccountAccessInputBodyResourceType `json:"resourceType"`
-	Role            GrantServiceAccountAccessInputBodyRole         `json:"role"`
-	AdditionalProps GrantServiceAccountAccessInputBodyAdditional
+// ErrorModelStatusCode wraps ErrorModel with StatusCode.
+type ErrorModelStatusCode struct {
+	StatusCode int
+	Response   ErrorModel
 }
 
-// GetSchema returns the value of Schema.
-func (s *GrantServiceAccountAccessInputBody) GetSchema() OptURI {
-	return s.Schema
+// GetStatusCode returns the value of StatusCode.
+func (s *ErrorModelStatusCode) GetStatusCode() int {
+	return s.StatusCode
 }
 
-// GetResourceId returns the value of ResourceId.
-func (s *GrantServiceAccountAccessInputBody) GetResourceId() string {
-	return s.ResourceId
+// GetResponse returns the value of Response.
+func (s *ErrorModelStatusCode) GetResponse() ErrorModel {
+	return s.Response
 }
 
-// GetResourceType returns the value of ResourceType.
-func (s *GrantServiceAccountAccessInputBody) GetResourceType() GrantServiceAccountAccessInputBodyResourceType {
-	return s.ResourceType
+// SetStatusCode sets the value of StatusCode.
+func (s *ErrorModelStatusCode) SetStatusCode(val int) {
+	s.StatusCode = val
 }
 
-// GetRole returns the value of Role.
-func (s *GrantServiceAccountAccessInputBody) GetRole() GrantServiceAccountAccessInputBodyRole {
-	return s.Role
+// SetResponse sets the value of Response.
+func (s *ErrorModelStatusCode) SetResponse(val ErrorModel) {
+	s.Response = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *GrantServiceAccountAccessInputBody) GetAdditionalProps() GrantServiceAccountAccessInputBodyAdditional {
-	return s.AdditionalProps
+// Ref: #/components/schemas/ForgeRepoIdentity
+type ForgeRepoIdentity struct {
+	Forge           string `json:"forge"`
+	RepoID          string `json:"repo_id"`
+	AdditionalProps ForgeRepoIdentityAdditional
 }
 
-// SetSchema sets the value of Schema.
-func (s *GrantServiceAccountAccessInputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// GetForge returns the value of Forge.
+func (s *ForgeRepoIdentity) GetForge() string {
+	return s.Forge
 }
 
-// SetResourceId sets the value of ResourceId.
-func (s *GrantServiceAccountAccessInputBody) SetResourceId(val string) {
-	s.ResourceId = val
+// GetRepoID returns the value of RepoID.
+func (s *ForgeRepoIdentity) GetRepoID() string {
+	return s.RepoID
 }
 
-// SetResourceType sets the value of ResourceType.
-func (s *GrantServiceAccountAccessInputBody) SetResourceType(val GrantServiceAccountAccessInputBodyResourceType) {
-	s.ResourceType = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ForgeRepoIdentity) GetAdditionalProps() ForgeRepoIdentityAdditional {
+	return s.AdditionalProps
 }
 
-// SetRole sets the value of Role.
-func (s *GrantServiceAccountAccessInputBody) SetRole(val GrantServiceAccountAccessInputBodyRole) {
-	s.Role = val
+// SetForge sets the value of Forge.
+func (s *ForgeRepoIdentity) SetForge(val string) {
+	s.Forge = val
+}
+
+// SetRepoID sets the value of RepoID.
+func (s *ForgeRepoIdentity) SetRepoID(val string) {
+	s.RepoID = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GrantServiceAccountAccessInputBody) SetAdditionalProps(val GrantServiceAccountAccessInputBodyAdditional) {
+func (s *ForgeRepoIdentity) SetAdditionalProps(val ForgeRepoIdentityAdditional) {
 	s.AdditionalProps = val
 }
 
-type GrantServiceAccountAccessInputBodyAdditional map[string]jx.Raw
+type ForgeRepoIdentityAdditional map[string]jx.Raw
 
-func (s *GrantServiceAccountAccessInputBodyAdditional) init() GrantServiceAccountAccessInputBodyAdditional {
+func (s *ForgeRepoIdentityAdditional) init() ForgeRepoIdentityAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3633,136 +3874,82 @@ func (s *GrantServiceAccountAccessInputBodyAdditional) init() GrantServiceAccoun
 	return m
 }
 
-type GrantServiceAccountAccessInputBodyResourceType string
-
-const (
-	GrantServiceAccountAccessInputBodyResourceTypeRepo    GrantServiceAccountAccessInputBodyResourceType = "repo"
-	GrantServiceAccountAccessInputBodyResourceTypeProject GrantServiceAccountAccessInputBodyResourceType = "project"
-)
-
-// AllValues returns all GrantServiceAccountAccessInputBodyResourceType values.
-func (GrantServiceAccountAccessInputBodyResourceType) AllValues() []GrantServiceAccountAccessInputBodyResourceType {
-	return []GrantServiceAccountAccessInputBodyResourceType{
-		GrantServiceAccountAccessInputBodyResourceTypeRepo,
-		GrantServiceAccountAccessInputBodyResourceTypeProject,
-	}
+// Ref: #/components/schemas/GetDeletionPreviewOutputBody
+type GetDeletionPreviewOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// True when Blockers is non-empty: DELETE /me will be refused with 409.
+	Blocked bool `json:"blocked"`
+	// Resources that must be resolved before deletion (owned orgs).
+	Blockers        []DeletionBlocker `json:"blockers"`
+	WillDelete      WillDeleteStruct  `json:"willDelete"`
+	WillUnlink      WillUnlinkStruct  `json:"willUnlink"`
+	AdditionalProps GetDeletionPreviewOutputBodyAdditional
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s GrantServiceAccountAccessInputBodyResourceType) MarshalText() ([]byte, error) {
-	switch s {
-	case GrantServiceAccountAccessInputBodyResourceTypeRepo:
-		return []byte(s), nil
-	case GrantServiceAccountAccessInputBodyResourceTypeProject:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// GetSchema returns the value of Schema.
+func (s *GetDeletionPreviewOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GrantServiceAccountAccessInputBodyResourceType) UnmarshalText(data []byte) error {
-	switch GrantServiceAccountAccessInputBodyResourceType(data) {
-	case GrantServiceAccountAccessInputBodyResourceTypeRepo:
-		*s = GrantServiceAccountAccessInputBodyResourceTypeRepo
-		return nil
-	case GrantServiceAccountAccessInputBodyResourceTypeProject:
-		*s = GrantServiceAccountAccessInputBodyResourceTypeProject
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
+// GetBlocked returns the value of Blocked.
+func (s *GetDeletionPreviewOutputBody) GetBlocked() bool {
+	return s.Blocked
 }
 
-type GrantServiceAccountAccessInputBodyRole string
-
-const (
-	GrantServiceAccountAccessInputBodyRoleReader GrantServiceAccountAccessInputBodyRole = "reader"
-	GrantServiceAccountAccessInputBodyRoleWriter GrantServiceAccountAccessInputBodyRole = "writer"
-	GrantServiceAccountAccessInputBodyRoleAdmin  GrantServiceAccountAccessInputBodyRole = "admin"
-)
-
-// AllValues returns all GrantServiceAccountAccessInputBodyRole values.
-func (GrantServiceAccountAccessInputBodyRole) AllValues() []GrantServiceAccountAccessInputBodyRole {
-	return []GrantServiceAccountAccessInputBodyRole{
-		GrantServiceAccountAccessInputBodyRoleReader,
-		GrantServiceAccountAccessInputBodyRoleWriter,
-		GrantServiceAccountAccessInputBodyRoleAdmin,
-	}
+// GetBlockers returns the value of Blockers.
+func (s *GetDeletionPreviewOutputBody) GetBlockers() []DeletionBlocker {
+	return s.Blockers
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s GrantServiceAccountAccessInputBodyRole) MarshalText() ([]byte, error) {
-	switch s {
-	case GrantServiceAccountAccessInputBodyRoleReader:
-		return []byte(s), nil
-	case GrantServiceAccountAccessInputBodyRoleWriter:
-		return []byte(s), nil
-	case GrantServiceAccountAccessInputBodyRoleAdmin:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// GetWillDelete returns the value of WillDelete.
+func (s *GetDeletionPreviewOutputBody) GetWillDelete() WillDeleteStruct {
+	return s.WillDelete
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *GrantServiceAccountAccessInputBodyRole) UnmarshalText(data []byte) error {
-	switch GrantServiceAccountAccessInputBodyRole(data) {
-	case GrantServiceAccountAccessInputBodyRoleReader:
-		*s = GrantServiceAccountAccessInputBodyRoleReader
-		return nil
-	case GrantServiceAccountAccessInputBodyRoleWriter:
-		*s = GrantServiceAccountAccessInputBodyRoleWriter
-		return nil
-	case GrantServiceAccountAccessInputBodyRoleAdmin:
-		*s = GrantServiceAccountAccessInputBodyRoleAdmin
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
+// GetWillUnlink returns the value of WillUnlink.
+func (s *GetDeletionPreviewOutputBody) GetWillUnlink() WillUnlinkStruct {
+	return s.WillUnlink
 }
 
-// Ref: #/components/schemas/GrantServiceAccountAccessOutputBody
-type GrantServiceAccountAccessOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI `json:"$schema"`
-	Status          string `json:"status"`
-	AdditionalProps GrantServiceAccountAccessOutputBodyAdditional
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *GetDeletionPreviewOutputBody) GetAdditionalProps() GetDeletionPreviewOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetSchema returns the value of Schema.
-func (s *GrantServiceAccountAccessOutputBody) GetSchema() OptURI {
-	return s.Schema
+// SetSchema sets the value of Schema.
+func (s *GetDeletionPreviewOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetStatus returns the value of Status.
-func (s *GrantServiceAccountAccessOutputBody) GetStatus() string {
-	return s.Status
+// SetBlocked sets the value of Blocked.
+func (s *GetDeletionPreviewOutputBody) SetBlocked(val bool) {
+	s.Blocked = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *GrantServiceAccountAccessOutputBody) GetAdditionalProps() GrantServiceAccountAccessOutputBodyAdditional {
-	return s.AdditionalProps
+// SetBlockers sets the value of Blockers.
+func (s *GetDeletionPreviewOutputBody) SetBlockers(val []DeletionBlocker) {
+	s.Blockers = val
 }
 
-// SetSchema sets the value of Schema.
-func (s *GrantServiceAccountAccessOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetWillDelete sets the value of WillDelete.
+func (s *GetDeletionPreviewOutputBody) SetWillDelete(val WillDeleteStruct) {
+	s.WillDelete = val
 }
 
-// SetStatus sets the value of Status.
-func (s *GrantServiceAccountAccessOutputBody) SetStatus(val string) {
-	s.Status = val
+// SetWillUnlink sets the value of WillUnlink.
+func (s *GetDeletionPreviewOutputBody) SetWillUnlink(val WillUnlinkStruct) {
+	s.WillUnlink = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *GrantServiceAccountAccessOutputBody) SetAdditionalProps(val GrantServiceAccountAccessOutputBodyAdditional) {
+func (s *GetDeletionPreviewOutputBody) SetAdditionalProps(val GetDeletionPreviewOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type GrantServiceAccountAccessOutputBodyAdditional map[string]jx.Raw
+type GetDeletionPreviewOutputBodyAdditional map[string]jx.Raw
 
-func (s *GrantServiceAccountAccessOutputBodyAdditional) init() GrantServiceAccountAccessOutputBodyAdditional {
+func (s *GetDeletionPreviewOutputBodyAdditional) init() GetDeletionPreviewOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3771,108 +3958,114 @@ func (s *GrantServiceAccountAccessOutputBodyAdditional) init() GrantServiceAccou
 	return m
 }
 
-// Ref: #/components/schemas/ListAuditEventsOutputBody
-type ListAuditEventsOutputBody struct {
+// Ref: #/components/schemas/GetMeOutputBody
+type GetMeOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI       `json:"$schema"`
-	Events []AuditEvent `json:"events"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListAuditEventsOutputBodyAdditional
+	Schema OptURI `json:"$schema"`
+	Auth   MeAuth `json:"auth"`
+	// Present only when a deletion is pending; carries the cooldown window.
+	Deletion            OptMeDeletion            `json:"deletion"`
+	Global              MeGlobal                 `json:"global"`
+	Jurisdiction        OptString                `json:"jurisdiction"`
+	Mode                OptGetMeOutputBodyMode   `json:"mode"`
+	Regional            OptMeRegional            `json:"regional"`
+	RegionalUnavailable OptMeRegionalUnavailable `json:"regionalUnavailable"`
+	AdditionalProps     GetMeOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListAuditEventsOutputBody) GetSchema() OptURI {
+func (s *GetMeOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetEvents returns the value of Events.
-func (s *ListAuditEventsOutputBody) GetEvents() []AuditEvent {
-	return s.Events
+// GetAuth returns the value of Auth.
+func (s *GetMeOutputBody) GetAuth() MeAuth {
+	return s.Auth
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListAuditEventsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetDeletion returns the value of Deletion.
+func (s *GetMeOutputBody) GetDeletion() OptMeDeletion {
+	return s.Deletion
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListAuditEventsOutputBody) GetAdditionalProps() ListAuditEventsOutputBodyAdditional {
-	return s.AdditionalProps
+// GetGlobal returns the value of Global.
+func (s *GetMeOutputBody) GetGlobal() MeGlobal {
+	return s.Global
 }
 
-// SetSchema sets the value of Schema.
-func (s *ListAuditEventsOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *GetMeOutputBody) GetJurisdiction() OptString {
+	return s.Jurisdiction
 }
 
-// SetEvents sets the value of Events.
-func (s *ListAuditEventsOutputBody) SetEvents(val []AuditEvent) {
-	s.Events = val
+// GetMode returns the value of Mode.
+func (s *GetMeOutputBody) GetMode() OptGetMeOutputBodyMode {
+	return s.Mode
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListAuditEventsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// GetRegional returns the value of Regional.
+func (s *GetMeOutputBody) GetRegional() OptMeRegional {
+	return s.Regional
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListAuditEventsOutputBody) SetAdditionalProps(val ListAuditEventsOutputBodyAdditional) {
-	s.AdditionalProps = val
+// GetRegionalUnavailable returns the value of RegionalUnavailable.
+func (s *GetMeOutputBody) GetRegionalUnavailable() OptMeRegionalUnavailable {
+	return s.RegionalUnavailable
 }
 
-type ListAuditEventsOutputBodyAdditional map[string]jx.Raw
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *GetMeOutputBody) GetAdditionalProps() GetMeOutputBodyAdditional {
+	return s.AdditionalProps
+}
 
-func (s *ListAuditEventsOutputBodyAdditional) init() ListAuditEventsOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
+// SetSchema sets the value of Schema.
+func (s *GetMeOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// Ref: #/components/schemas/ListAvailableMirrorsOutputBody
-type ListAvailableMirrorsOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI            `json:"$schema"`
-	Available       []AvailableMirror `json:"available"`
-	AdditionalProps ListAvailableMirrorsOutputBodyAdditional
+// SetAuth sets the value of Auth.
+func (s *GetMeOutputBody) SetAuth(val MeAuth) {
+	s.Auth = val
 }
 
-// GetSchema returns the value of Schema.
-func (s *ListAvailableMirrorsOutputBody) GetSchema() OptURI {
-	return s.Schema
+// SetDeletion sets the value of Deletion.
+func (s *GetMeOutputBody) SetDeletion(val OptMeDeletion) {
+	s.Deletion = val
 }
 
-// GetAvailable returns the value of Available.
-func (s *ListAvailableMirrorsOutputBody) GetAvailable() []AvailableMirror {
-	return s.Available
+// SetGlobal sets the value of Global.
+func (s *GetMeOutputBody) SetGlobal(val MeGlobal) {
+	s.Global = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListAvailableMirrorsOutputBody) GetAdditionalProps() ListAvailableMirrorsOutputBodyAdditional {
-	return s.AdditionalProps
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *GetMeOutputBody) SetJurisdiction(val OptString) {
+	s.Jurisdiction = val
 }
 
-// SetSchema sets the value of Schema.
-func (s *ListAvailableMirrorsOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetMode sets the value of Mode.
+func (s *GetMeOutputBody) SetMode(val OptGetMeOutputBodyMode) {
+	s.Mode = val
 }
 
-// SetAvailable sets the value of Available.
-func (s *ListAvailableMirrorsOutputBody) SetAvailable(val []AvailableMirror) {
-	s.Available = val
+// SetRegional sets the value of Regional.
+func (s *GetMeOutputBody) SetRegional(val OptMeRegional) {
+	s.Regional = val
+}
+
+// SetRegionalUnavailable sets the value of RegionalUnavailable.
+func (s *GetMeOutputBody) SetRegionalUnavailable(val OptMeRegionalUnavailable) {
+	s.RegionalUnavailable = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListAvailableMirrorsOutputBody) SetAdditionalProps(val ListAvailableMirrorsOutputBodyAdditional) {
+func (s *GetMeOutputBody) SetAdditionalProps(val GetMeOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListAvailableMirrorsOutputBodyAdditional map[string]jx.Raw
+type GetMeOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListAvailableMirrorsOutputBodyAdditional) init() ListAvailableMirrorsOutputBodyAdditional {
+func (s *GetMeOutputBodyAdditional) init() GetMeOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3881,59 +4074,101 @@ func (s *ListAvailableMirrorsOutputBodyAdditional) init() ListAvailableMirrorsOu
 	return m
 }
 
-// Ref: #/components/schemas/ListBindingsOutputBody
-type ListBindingsOutputBody struct {
+type GetMeOutputBodyMode string
+
+const (
+	GetMeOutputBodyModeGlobal   GetMeOutputBodyMode = "global"
+	GetMeOutputBodyModeRegional GetMeOutputBodyMode = "regional"
+)
+
+// AllValues returns all GetMeOutputBodyMode values.
+func (GetMeOutputBodyMode) AllValues() []GetMeOutputBodyMode {
+	return []GetMeOutputBodyMode{
+		GetMeOutputBodyModeGlobal,
+		GetMeOutputBodyModeRegional,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s GetMeOutputBodyMode) MarshalText() ([]byte, error) {
+	switch s {
+	case GetMeOutputBodyModeGlobal:
+		return []byte(s), nil
+	case GetMeOutputBodyModeRegional:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GetMeOutputBodyMode) UnmarshalText(data []byte) error {
+	switch GetMeOutputBodyMode(data) {
+	case GetMeOutputBodyModeGlobal:
+		*s = GetMeOutputBodyModeGlobal
+		return nil
+	case GetMeOutputBodyModeRegional:
+		*s = GetMeOutputBodyModeRegional
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/GetOnboardingStatusOutputBody
+type GetOnboardingStatusOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema   OptURI    `json:"$schema"`
-	Bindings []Binding `json:"bindings"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListBindingsOutputBodyAdditional
+	Schema OptURI `json:"$schema"`
+	// True once the account has completed a CLI login (either grant type).
+	CliLoggedIn bool `json:"cliLoggedIn"`
+	// True until the account completes web onboarding at least once.
+	NeedsOnboarding bool `json:"needsOnboarding"`
+	AdditionalProps GetOnboardingStatusOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListBindingsOutputBody) GetSchema() OptURI {
+func (s *GetOnboardingStatusOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetBindings returns the value of Bindings.
-func (s *ListBindingsOutputBody) GetBindings() []Binding {
-	return s.Bindings
+// GetCliLoggedIn returns the value of CliLoggedIn.
+func (s *GetOnboardingStatusOutputBody) GetCliLoggedIn() bool {
+	return s.CliLoggedIn
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListBindingsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetNeedsOnboarding returns the value of NeedsOnboarding.
+func (s *GetOnboardingStatusOutputBody) GetNeedsOnboarding() bool {
+	return s.NeedsOnboarding
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListBindingsOutputBody) GetAdditionalProps() ListBindingsOutputBodyAdditional {
+func (s *GetOnboardingStatusOutputBody) GetAdditionalProps() GetOnboardingStatusOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListBindingsOutputBody) SetSchema(val OptURI) {
+func (s *GetOnboardingStatusOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetBindings sets the value of Bindings.
-func (s *ListBindingsOutputBody) SetBindings(val []Binding) {
-	s.Bindings = val
+// SetCliLoggedIn sets the value of CliLoggedIn.
+func (s *GetOnboardingStatusOutputBody) SetCliLoggedIn(val bool) {
+	s.CliLoggedIn = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListBindingsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetNeedsOnboarding sets the value of NeedsOnboarding.
+func (s *GetOnboardingStatusOutputBody) SetNeedsOnboarding(val bool) {
+	s.NeedsOnboarding = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListBindingsOutputBody) SetAdditionalProps(val ListBindingsOutputBodyAdditional) {
+func (s *GetOnboardingStatusOutputBody) SetAdditionalProps(val GetOnboardingStatusOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListBindingsOutputBodyAdditional map[string]jx.Raw
+type GetOnboardingStatusOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListBindingsOutputBodyAdditional) init() ListBindingsOutputBodyAdditional {
+func (s *GetOnboardingStatusOutputBodyAdditional) init() GetOnboardingStatusOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -3942,96 +4177,91 @@ func (s *ListBindingsOutputBodyAdditional) init() ListBindingsOutputBodyAddition
 	return m
 }
 
-// Ref: #/components/schemas/ListClustersOutputBody
-type ListClustersOutputBody struct {
+// Ref: #/components/schemas/GetPermissionsOutputBody
+type GetPermissionsOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI    `json:"$schema"`
-	Clusters        []Cluster `json:"clusters"`
-	AdditionalProps ListClustersOutputBodyAdditional
+	Schema          OptURI                                    `json:"$schema"`
+	Explain         OptGetPermissionsOutputBodyExplain        `json:"explain"`
+	Permissions     []GetPermissionsOutputBodyPermissionsItem `json:"permissions"`
+	ResourceId      string                                    `json:"resourceId"`
+	ResourceType    string                                    `json:"resourceType"`
+	AdditionalProps GetPermissionsOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListClustersOutputBody) GetSchema() OptURI {
+func (s *GetPermissionsOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetClusters returns the value of Clusters.
-func (s *ListClustersOutputBody) GetClusters() []Cluster {
-	return s.Clusters
+// GetExplain returns the value of Explain.
+func (s *GetPermissionsOutputBody) GetExplain() OptGetPermissionsOutputBodyExplain {
+	return s.Explain
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListClustersOutputBody) GetAdditionalProps() ListClustersOutputBodyAdditional {
-	return s.AdditionalProps
+// GetPermissions returns the value of Permissions.
+func (s *GetPermissionsOutputBody) GetPermissions() []GetPermissionsOutputBodyPermissionsItem {
+	return s.Permissions
 }
 
-// SetSchema sets the value of Schema.
-func (s *ListClustersOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// GetResourceId returns the value of ResourceId.
+func (s *GetPermissionsOutputBody) GetResourceId() string {
+	return s.ResourceId
 }
 
-// SetClusters sets the value of Clusters.
-func (s *ListClustersOutputBody) SetClusters(val []Cluster) {
-	s.Clusters = val
+// GetResourceType returns the value of ResourceType.
+func (s *GetPermissionsOutputBody) GetResourceType() string {
+	return s.ResourceType
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListClustersOutputBody) SetAdditionalProps(val ListClustersOutputBodyAdditional) {
-	s.AdditionalProps = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *GetPermissionsOutputBody) GetAdditionalProps() GetPermissionsOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-type ListClustersOutputBodyAdditional map[string]jx.Raw
-
-func (s *ListClustersOutputBodyAdditional) init() ListClustersOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
+// SetSchema sets the value of Schema.
+func (s *GetPermissionsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// Ref: #/components/schemas/ListMirrorCollaboratorsOutputBody
-type ListMirrorCollaboratorsOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema          OptURI               `json:"$schema"`
-	Collaborators   []MirrorCollaborator `json:"collaborators"`
-	AdditionalProps ListMirrorCollaboratorsOutputBodyAdditional
+// SetExplain sets the value of Explain.
+func (s *GetPermissionsOutputBody) SetExplain(val OptGetPermissionsOutputBodyExplain) {
+	s.Explain = val
 }
 
-// GetSchema returns the value of Schema.
-func (s *ListMirrorCollaboratorsOutputBody) GetSchema() OptURI {
-	return s.Schema
+// SetPermissions sets the value of Permissions.
+func (s *GetPermissionsOutputBody) SetPermissions(val []GetPermissionsOutputBodyPermissionsItem) {
+	s.Permissions = val
 }
 
-// GetCollaborators returns the value of Collaborators.
-func (s *ListMirrorCollaboratorsOutputBody) GetCollaborators() []MirrorCollaborator {
-	return s.Collaborators
+// SetResourceId sets the value of ResourceId.
+func (s *GetPermissionsOutputBody) SetResourceId(val string) {
+	s.ResourceId = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListMirrorCollaboratorsOutputBody) GetAdditionalProps() ListMirrorCollaboratorsOutputBodyAdditional {
-	return s.AdditionalProps
+// SetResourceType sets the value of ResourceType.
+func (s *GetPermissionsOutputBody) SetResourceType(val string) {
+	s.ResourceType = val
 }
 
-// SetSchema sets the value of Schema.
-func (s *ListMirrorCollaboratorsOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *GetPermissionsOutputBody) SetAdditionalProps(val GetPermissionsOutputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// SetCollaborators sets the value of Collaborators.
-func (s *ListMirrorCollaboratorsOutputBody) SetCollaborators(val []MirrorCollaborator) {
-	s.Collaborators = val
-}
+type GetPermissionsOutputBodyAdditional map[string]jx.Raw
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListMirrorCollaboratorsOutputBody) SetAdditionalProps(val ListMirrorCollaboratorsOutputBodyAdditional) {
-	s.AdditionalProps = val
+func (s *GetPermissionsOutputBodyAdditional) init() GetPermissionsOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-type ListMirrorCollaboratorsOutputBodyAdditional map[string]jx.Raw
+type GetPermissionsOutputBodyExplain map[string]jx.Raw
 
-func (s *ListMirrorCollaboratorsOutputBodyAdditional) init() ListMirrorCollaboratorsOutputBodyAdditional {
+func (s *GetPermissionsOutputBodyExplain) init() GetPermissionsOutputBodyExplain {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4040,23 +4270,55 @@ func (s *ListMirrorCollaboratorsOutputBodyAdditional) init() ListMirrorCollabora
 	return m
 }
 
-type ListMirrorCollaboratorsProvider string
+type GetPermissionsOutputBodyPermissionsItem string
 
 const (
-	ListMirrorCollaboratorsProviderGithub ListMirrorCollaboratorsProvider = "github"
+	GetPermissionsOutputBodyPermissionsItemManage     GetPermissionsOutputBodyPermissionsItem = "manage"
+	GetPermissionsOutputBodyPermissionsItemView       GetPermissionsOutputBodyPermissionsItem = "view"
+	GetPermissionsOutputBodyPermissionsItemRead       GetPermissionsOutputBodyPermissionsItem = "read"
+	GetPermissionsOutputBodyPermissionsItemWrite      GetPermissionsOutputBodyPermissionsItem = "write"
+	GetPermissionsOutputBodyPermissionsItemPush       GetPermissionsOutputBodyPermissionsItem = "push"
+	GetPermissionsOutputBodyPermissionsItemPull       GetPermissionsOutputBodyPermissionsItem = "pull"
+	GetPermissionsOutputBodyPermissionsItemCreateRepo GetPermissionsOutputBodyPermissionsItem = "create_repo"
+	GetPermissionsOutputBodyPermissionsItemAdmin      GetPermissionsOutputBodyPermissionsItem = "admin"
+	GetPermissionsOutputBodyPermissionsItemAdminRead  GetPermissionsOutputBodyPermissionsItem = "admin_read"
 )
 
-// AllValues returns all ListMirrorCollaboratorsProvider values.
-func (ListMirrorCollaboratorsProvider) AllValues() []ListMirrorCollaboratorsProvider {
-	return []ListMirrorCollaboratorsProvider{
-		ListMirrorCollaboratorsProviderGithub,
+// AllValues returns all GetPermissionsOutputBodyPermissionsItem values.
+func (GetPermissionsOutputBodyPermissionsItem) AllValues() []GetPermissionsOutputBodyPermissionsItem {
+	return []GetPermissionsOutputBodyPermissionsItem{
+		GetPermissionsOutputBodyPermissionsItemManage,
+		GetPermissionsOutputBodyPermissionsItemView,
+		GetPermissionsOutputBodyPermissionsItemRead,
+		GetPermissionsOutputBodyPermissionsItemWrite,
+		GetPermissionsOutputBodyPermissionsItemPush,
+		GetPermissionsOutputBodyPermissionsItemPull,
+		GetPermissionsOutputBodyPermissionsItemCreateRepo,
+		GetPermissionsOutputBodyPermissionsItemAdmin,
+		GetPermissionsOutputBodyPermissionsItemAdminRead,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s ListMirrorCollaboratorsProvider) MarshalText() ([]byte, error) {
+func (s GetPermissionsOutputBodyPermissionsItem) MarshalText() ([]byte, error) {
 	switch s {
-	case ListMirrorCollaboratorsProviderGithub:
+	case GetPermissionsOutputBodyPermissionsItemManage:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemView:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemRead:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemWrite:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemPush:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemPull:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemCreateRepo:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemAdmin:
+		return []byte(s), nil
+	case GetPermissionsOutputBodyPermissionsItemAdminRead:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -4064,69 +4326,81 @@ func (s ListMirrorCollaboratorsProvider) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *ListMirrorCollaboratorsProvider) UnmarshalText(data []byte) error {
-	switch ListMirrorCollaboratorsProvider(data) {
-	case ListMirrorCollaboratorsProviderGithub:
-		*s = ListMirrorCollaboratorsProviderGithub
+func (s *GetPermissionsOutputBodyPermissionsItem) UnmarshalText(data []byte) error {
+	switch GetPermissionsOutputBodyPermissionsItem(data) {
+	case GetPermissionsOutputBodyPermissionsItemManage:
+		*s = GetPermissionsOutputBodyPermissionsItemManage
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemView:
+		*s = GetPermissionsOutputBodyPermissionsItemView
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemRead:
+		*s = GetPermissionsOutputBodyPermissionsItemRead
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemWrite:
+		*s = GetPermissionsOutputBodyPermissionsItemWrite
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemPush:
+		*s = GetPermissionsOutputBodyPermissionsItemPush
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemPull:
+		*s = GetPermissionsOutputBodyPermissionsItemPull
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemCreateRepo:
+		*s = GetPermissionsOutputBodyPermissionsItemCreateRepo
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemAdmin:
+		*s = GetPermissionsOutputBodyPermissionsItemAdmin
+		return nil
+	case GetPermissionsOutputBodyPermissionsItemAdminRead:
+		*s = GetPermissionsOutputBodyPermissionsItemAdminRead
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/ListMirrorsOutputBody
-type ListMirrorsOutputBody struct {
+// Ref: #/components/schemas/GetRepoVisibilityOutputBody
+type GetRepoVisibilityOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema  OptURI   `json:"$schema"`
-	Mirrors []Mirror `json:"mirrors"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListMirrorsOutputBodyAdditional
+	Schema          OptURI                                `json:"$schema"`
+	Visibility      GetRepoVisibilityOutputBodyVisibility `json:"visibility"`
+	AdditionalProps GetRepoVisibilityOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListMirrorsOutputBody) GetSchema() OptURI {
+func (s *GetRepoVisibilityOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetMirrors returns the value of Mirrors.
-func (s *ListMirrorsOutputBody) GetMirrors() []Mirror {
-	return s.Mirrors
-}
-
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListMirrorsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetVisibility returns the value of Visibility.
+func (s *GetRepoVisibilityOutputBody) GetVisibility() GetRepoVisibilityOutputBodyVisibility {
+	return s.Visibility
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListMirrorsOutputBody) GetAdditionalProps() ListMirrorsOutputBodyAdditional {
+func (s *GetRepoVisibilityOutputBody) GetAdditionalProps() GetRepoVisibilityOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListMirrorsOutputBody) SetSchema(val OptURI) {
+func (s *GetRepoVisibilityOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetMirrors sets the value of Mirrors.
-func (s *ListMirrorsOutputBody) SetMirrors(val []Mirror) {
-	s.Mirrors = val
-}
-
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListMirrorsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetVisibility sets the value of Visibility.
+func (s *GetRepoVisibilityOutputBody) SetVisibility(val GetRepoVisibilityOutputBodyVisibility) {
+	s.Visibility = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListMirrorsOutputBody) SetAdditionalProps(val ListMirrorsOutputBodyAdditional) {
+func (s *GetRepoVisibilityOutputBody) SetAdditionalProps(val GetRepoVisibilityOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListMirrorsOutputBodyAdditional map[string]jx.Raw
+type GetRepoVisibilityOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListMirrorsOutputBodyAdditional) init() ListMirrorsOutputBodyAdditional {
+func (s *GetRepoVisibilityOutputBodyAdditional) init() GetRepoVisibilityOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4135,59 +4409,88 @@ func (s *ListMirrorsOutputBodyAdditional) init() ListMirrorsOutputBodyAdditional
 	return m
 }
 
-// Ref: #/components/schemas/ListOIDCProvidersOutputBody
-type ListOIDCProvidersOutputBody struct {
+type GetRepoVisibilityOutputBodyVisibility string
+
+const (
+	GetRepoVisibilityOutputBodyVisibilityPublic  GetRepoVisibilityOutputBodyVisibility = "public"
+	GetRepoVisibilityOutputBodyVisibilityPrivate GetRepoVisibilityOutputBodyVisibility = "private"
+)
+
+// AllValues returns all GetRepoVisibilityOutputBodyVisibility values.
+func (GetRepoVisibilityOutputBodyVisibility) AllValues() []GetRepoVisibilityOutputBodyVisibility {
+	return []GetRepoVisibilityOutputBodyVisibility{
+		GetRepoVisibilityOutputBodyVisibilityPublic,
+		GetRepoVisibilityOutputBodyVisibilityPrivate,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s GetRepoVisibilityOutputBodyVisibility) MarshalText() ([]byte, error) {
+	switch s {
+	case GetRepoVisibilityOutputBodyVisibilityPublic:
+		return []byte(s), nil
+	case GetRepoVisibilityOutputBodyVisibilityPrivate:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GetRepoVisibilityOutputBodyVisibility) UnmarshalText(data []byte) error {
+	switch GetRepoVisibilityOutputBodyVisibility(data) {
+	case GetRepoVisibilityOutputBodyVisibilityPublic:
+		*s = GetRepoVisibilityOutputBodyVisibilityPublic
+		return nil
+	case GetRepoVisibilityOutputBodyVisibilityPrivate:
+		*s = GetRepoVisibilityOutputBodyVisibilityPrivate
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/GetTopologyOutputBody
+type GetTopologyOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString      `json:"nextPageToken"`
-	Providers       []OIDCProvider `json:"providers"`
-	AdditionalProps ListOIDCProvidersOutputBodyAdditional
+	Schema          OptURI                 `json:"$schema"`
+	Jurisdictions   []TopologyJurisdiction `json:"jurisdictions"`
+	AdditionalProps GetTopologyOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListOIDCProvidersOutputBody) GetSchema() OptURI {
+func (s *GetTopologyOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListOIDCProvidersOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
-}
-
-// GetProviders returns the value of Providers.
-func (s *ListOIDCProvidersOutputBody) GetProviders() []OIDCProvider {
-	return s.Providers
+// GetJurisdictions returns the value of Jurisdictions.
+func (s *GetTopologyOutputBody) GetJurisdictions() []TopologyJurisdiction {
+	return s.Jurisdictions
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListOIDCProvidersOutputBody) GetAdditionalProps() ListOIDCProvidersOutputBodyAdditional {
+func (s *GetTopologyOutputBody) GetAdditionalProps() GetTopologyOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListOIDCProvidersOutputBody) SetSchema(val OptURI) {
+func (s *GetTopologyOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListOIDCProvidersOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
-}
-
-// SetProviders sets the value of Providers.
-func (s *ListOIDCProvidersOutputBody) SetProviders(val []OIDCProvider) {
-	s.Providers = val
+// SetJurisdictions sets the value of Jurisdictions.
+func (s *GetTopologyOutputBody) SetJurisdictions(val []TopologyJurisdiction) {
+	s.Jurisdictions = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListOIDCProvidersOutputBody) SetAdditionalProps(val ListOIDCProvidersOutputBodyAdditional) {
+func (s *GetTopologyOutputBody) SetAdditionalProps(val GetTopologyOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListOIDCProvidersOutputBodyAdditional map[string]jx.Raw
+type GetTopologyOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListOIDCProvidersOutputBodyAdditional) init() ListOIDCProvidersOutputBodyAdditional {
+func (s *GetTopologyOutputBodyAdditional) init() GetTopologyOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4196,59 +4499,60 @@ func (s *ListOIDCProvidersOutputBodyAdditional) init() ListOIDCProvidersOutputBo
 	return m
 }
 
-// Ref: #/components/schemas/ListOrgMembersOutputBody
-type ListOrgMembersOutputBody struct {
+// Ref: #/components/schemas/GetVersionOutputBody
+type GetVersionOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema  OptURI       `json:"$schema"`
-	Members []Membership `json:"members"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListOrgMembersOutputBodyAdditional
+	Schema OptURI `json:"$schema"`
+	// Server mode.
+	Mode OptGetVersionOutputBodyMode `json:"mode"`
+	// Git commit SHA of the running entire-core binary, or "dev" for an untagged local build.
+	Version         string `json:"version"`
+	AdditionalProps GetVersionOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListOrgMembersOutputBody) GetSchema() OptURI {
+func (s *GetVersionOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetMembers returns the value of Members.
-func (s *ListOrgMembersOutputBody) GetMembers() []Membership {
-	return s.Members
+// GetMode returns the value of Mode.
+func (s *GetVersionOutputBody) GetMode() OptGetVersionOutputBodyMode {
+	return s.Mode
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListOrgMembersOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetVersion returns the value of Version.
+func (s *GetVersionOutputBody) GetVersion() string {
+	return s.Version
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListOrgMembersOutputBody) GetAdditionalProps() ListOrgMembersOutputBodyAdditional {
+func (s *GetVersionOutputBody) GetAdditionalProps() GetVersionOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListOrgMembersOutputBody) SetSchema(val OptURI) {
+func (s *GetVersionOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetMembers sets the value of Members.
-func (s *ListOrgMembersOutputBody) SetMembers(val []Membership) {
-	s.Members = val
+// SetMode sets the value of Mode.
+func (s *GetVersionOutputBody) SetMode(val OptGetVersionOutputBodyMode) {
+	s.Mode = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListOrgMembersOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetVersion sets the value of Version.
+func (s *GetVersionOutputBody) SetVersion(val string) {
+	s.Version = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListOrgMembersOutputBody) SetAdditionalProps(val ListOrgMembersOutputBodyAdditional) {
+func (s *GetVersionOutputBody) SetAdditionalProps(val GetVersionOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListOrgMembersOutputBodyAdditional map[string]jx.Raw
+type GetVersionOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListOrgMembersOutputBodyAdditional) init() ListOrgMembersOutputBodyAdditional {
+func (s *GetVersionOutputBodyAdditional) init() GetVersionOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4257,142 +4561,122 @@ func (s *ListOrgMembersOutputBodyAdditional) init() ListOrgMembersOutputBodyAddi
 	return m
 }
 
-// Ref: #/components/schemas/ListOrgProjectsOutputBody
-type ListOrgProjectsOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString  `json:"nextPageToken"`
-	Project         OptProject `json:"project"`
-	Projects        []Project  `json:"projects"`
-	AdditionalProps ListOrgProjectsOutputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *ListOrgProjectsOutputBody) GetSchema() OptURI {
-	return s.Schema
-}
+// Server mode.
+type GetVersionOutputBodyMode string
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListOrgProjectsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
-}
+const (
+	GetVersionOutputBodyModeGlobal   GetVersionOutputBodyMode = "global"
+	GetVersionOutputBodyModeRegional GetVersionOutputBodyMode = "regional"
+)
 
-// GetProject returns the value of Project.
-func (s *ListOrgProjectsOutputBody) GetProject() OptProject {
-	return s.Project
+// AllValues returns all GetVersionOutputBodyMode values.
+func (GetVersionOutputBodyMode) AllValues() []GetVersionOutputBodyMode {
+	return []GetVersionOutputBodyMode{
+		GetVersionOutputBodyModeGlobal,
+		GetVersionOutputBodyModeRegional,
+	}
 }
 
-// GetProjects returns the value of Projects.
-func (s *ListOrgProjectsOutputBody) GetProjects() []Project {
-	return s.Projects
+// MarshalText implements encoding.TextMarshaler.
+func (s GetVersionOutputBodyMode) MarshalText() ([]byte, error) {
+	switch s {
+	case GetVersionOutputBodyModeGlobal:
+		return []byte(s), nil
+	case GetVersionOutputBodyModeRegional:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListOrgProjectsOutputBody) GetAdditionalProps() ListOrgProjectsOutputBodyAdditional {
-	return s.AdditionalProps
-}
-
-// SetSchema sets the value of Schema.
-func (s *ListOrgProjectsOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
-
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListOrgProjectsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
-}
-
-// SetProject sets the value of Project.
-func (s *ListOrgProjectsOutputBody) SetProject(val OptProject) {
-	s.Project = val
-}
-
-// SetProjects sets the value of Projects.
-func (s *ListOrgProjectsOutputBody) SetProjects(val []Project) {
-	s.Projects = val
-}
-
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListOrgProjectsOutputBody) SetAdditionalProps(val ListOrgProjectsOutputBodyAdditional) {
-	s.AdditionalProps = val
-}
-
-type ListOrgProjectsOutputBodyAdditional map[string]jx.Raw
-
-func (s *ListOrgProjectsOutputBodyAdditional) init() ListOrgProjectsOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GetVersionOutputBodyMode) UnmarshalText(data []byte) error {
+	switch GetVersionOutputBodyMode(data) {
+	case GetVersionOutputBodyModeGlobal:
+		*s = GetVersionOutputBodyModeGlobal
+		return nil
+	case GetVersionOutputBodyModeRegional:
+		*s = GetVersionOutputBodyModeRegional
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
 	}
-	return m
 }
 
-// Ref: #/components/schemas/ListOrgsOutputBody
-type ListOrgsOutputBody struct {
+// Ref: #/components/schemas/GrantProjectAccessInputBody
+type GrantProjectAccessInputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	Org             OptOrg    `json:"org"`
-	Orgs            []Org     `json:"orgs"`
-	AdditionalProps ListOrgsOutputBodyAdditional
+	Schema          OptURI                                    `json:"$schema"`
+	GranteeType     OptGrantProjectAccessInputBodyGranteeType `json:"granteeType"`
+	Provider        string                                    `json:"provider"`
+	ProviderUserId  string                                    `json:"providerUserId"`
+	Role            GrantProjectAccessInputBodyRole           `json:"role"`
+	AdditionalProps GrantProjectAccessInputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListOrgsOutputBody) GetSchema() OptURI {
+func (s *GrantProjectAccessInputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListOrgsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetGranteeType returns the value of GranteeType.
+func (s *GrantProjectAccessInputBody) GetGranteeType() OptGrantProjectAccessInputBodyGranteeType {
+	return s.GranteeType
 }
 
-// GetOrg returns the value of Org.
-func (s *ListOrgsOutputBody) GetOrg() OptOrg {
-	return s.Org
+// GetProvider returns the value of Provider.
+func (s *GrantProjectAccessInputBody) GetProvider() string {
+	return s.Provider
 }
 
-// GetOrgs returns the value of Orgs.
-func (s *ListOrgsOutputBody) GetOrgs() []Org {
-	return s.Orgs
+// GetProviderUserId returns the value of ProviderUserId.
+func (s *GrantProjectAccessInputBody) GetProviderUserId() string {
+	return s.ProviderUserId
+}
+
+// GetRole returns the value of Role.
+func (s *GrantProjectAccessInputBody) GetRole() GrantProjectAccessInputBodyRole {
+	return s.Role
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListOrgsOutputBody) GetAdditionalProps() ListOrgsOutputBodyAdditional {
+func (s *GrantProjectAccessInputBody) GetAdditionalProps() GrantProjectAccessInputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListOrgsOutputBody) SetSchema(val OptURI) {
+func (s *GrantProjectAccessInputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListOrgsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetGranteeType sets the value of GranteeType.
+func (s *GrantProjectAccessInputBody) SetGranteeType(val OptGrantProjectAccessInputBodyGranteeType) {
+	s.GranteeType = val
 }
 
-// SetOrg sets the value of Org.
-func (s *ListOrgsOutputBody) SetOrg(val OptOrg) {
-	s.Org = val
+// SetProvider sets the value of Provider.
+func (s *GrantProjectAccessInputBody) SetProvider(val string) {
+	s.Provider = val
 }
 
-// SetOrgs sets the value of Orgs.
-func (s *ListOrgsOutputBody) SetOrgs(val []Org) {
-	s.Orgs = val
+// SetProviderUserId sets the value of ProviderUserId.
+func (s *GrantProjectAccessInputBody) SetProviderUserId(val string) {
+	s.ProviderUserId = val
+}
+
+// SetRole sets the value of Role.
+func (s *GrantProjectAccessInputBody) SetRole(val GrantProjectAccessInputBodyRole) {
+	s.Role = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListOrgsOutputBody) SetAdditionalProps(val ListOrgsOutputBodyAdditional) {
+func (s *GrantProjectAccessInputBody) SetAdditionalProps(val GrantProjectAccessInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListOrgsOutputBodyAdditional map[string]jx.Raw
+type GrantProjectAccessInputBodyAdditional map[string]jx.Raw
 
-func (s *ListOrgsOutputBodyAdditional) init() ListOrgsOutputBodyAdditional {
+func (s *GrantProjectAccessInputBodyAdditional) init() GrantProjectAccessInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4401,107 +4685,129 @@ func (s *ListOrgsOutputBodyAdditional) init() ListOrgsOutputBodyAdditional {
 	return m
 }
 
-// ListOrgsOutputBodyHeaders wraps ListOrgsOutputBody with response headers.
-type ListOrgsOutputBodyHeaders struct {
-	CacheControl OptString
-	ETag         OptString
-	Vary         OptString
-	Response     ListOrgsOutputBody
-}
+type GrantProjectAccessInputBodyGranteeType string
 
-// GetCacheControl returns the value of CacheControl.
-func (s *ListOrgsOutputBodyHeaders) GetCacheControl() OptString {
-	return s.CacheControl
-}
+const (
+	GrantProjectAccessInputBodyGranteeTypeAccount GrantProjectAccessInputBodyGranteeType = "account"
+)
 
-// GetETag returns the value of ETag.
-func (s *ListOrgsOutputBodyHeaders) GetETag() OptString {
-	return s.ETag
+// AllValues returns all GrantProjectAccessInputBodyGranteeType values.
+func (GrantProjectAccessInputBodyGranteeType) AllValues() []GrantProjectAccessInputBodyGranteeType {
+	return []GrantProjectAccessInputBodyGranteeType{
+		GrantProjectAccessInputBodyGranteeTypeAccount,
+	}
 }
 
-// GetVary returns the value of Vary.
-func (s *ListOrgsOutputBodyHeaders) GetVary() OptString {
-	return s.Vary
+// MarshalText implements encoding.TextMarshaler.
+func (s GrantProjectAccessInputBodyGranteeType) MarshalText() ([]byte, error) {
+	switch s {
+	case GrantProjectAccessInputBodyGranteeTypeAccount:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-// GetResponse returns the value of Response.
-func (s *ListOrgsOutputBodyHeaders) GetResponse() ListOrgsOutputBody {
-	return s.Response
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GrantProjectAccessInputBodyGranteeType) UnmarshalText(data []byte) error {
+	switch GrantProjectAccessInputBodyGranteeType(data) {
+	case GrantProjectAccessInputBodyGranteeTypeAccount:
+		*s = GrantProjectAccessInputBodyGranteeTypeAccount
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
 }
 
-// SetCacheControl sets the value of CacheControl.
-func (s *ListOrgsOutputBodyHeaders) SetCacheControl(val OptString) {
-	s.CacheControl = val
-}
+type GrantProjectAccessInputBodyRole string
 
-// SetETag sets the value of ETag.
-func (s *ListOrgsOutputBodyHeaders) SetETag(val OptString) {
-	s.ETag = val
+const (
+	GrantProjectAccessInputBodyRoleReader GrantProjectAccessInputBodyRole = "reader"
+	GrantProjectAccessInputBodyRoleWriter GrantProjectAccessInputBodyRole = "writer"
+	GrantProjectAccessInputBodyRoleAdmin  GrantProjectAccessInputBodyRole = "admin"
+)
+
+// AllValues returns all GrantProjectAccessInputBodyRole values.
+func (GrantProjectAccessInputBodyRole) AllValues() []GrantProjectAccessInputBodyRole {
+	return []GrantProjectAccessInputBodyRole{
+		GrantProjectAccessInputBodyRoleReader,
+		GrantProjectAccessInputBodyRoleWriter,
+		GrantProjectAccessInputBodyRoleAdmin,
+	}
 }
 
-// SetVary sets the value of Vary.
-func (s *ListOrgsOutputBodyHeaders) SetVary(val OptString) {
-	s.Vary = val
+// MarshalText implements encoding.TextMarshaler.
+func (s GrantProjectAccessInputBodyRole) MarshalText() ([]byte, error) {
+	switch s {
+	case GrantProjectAccessInputBodyRoleReader:
+		return []byte(s), nil
+	case GrantProjectAccessInputBodyRoleWriter:
+		return []byte(s), nil
+	case GrantProjectAccessInputBodyRoleAdmin:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-// SetResponse sets the value of Response.
-func (s *ListOrgsOutputBodyHeaders) SetResponse(val ListOrgsOutputBody) {
-	s.Response = val
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GrantProjectAccessInputBodyRole) UnmarshalText(data []byte) error {
+	switch GrantProjectAccessInputBodyRole(data) {
+	case GrantProjectAccessInputBodyRoleReader:
+		*s = GrantProjectAccessInputBodyRoleReader
+		return nil
+	case GrantProjectAccessInputBodyRoleWriter:
+		*s = GrantProjectAccessInputBodyRoleWriter
+		return nil
+	case GrantProjectAccessInputBodyRoleAdmin:
+		*s = GrantProjectAccessInputBodyRoleAdmin
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
 }
 
-// Ref: #/components/schemas/ListProjectMembersOutputBody
-type ListProjectMembersOutputBody struct {
+// Ref: #/components/schemas/GrantProjectAccessOutputBody
+type GrantProjectAccessOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema  OptURI         `json:"$schema"`
-	Members []ProjectGrant `json:"members"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListProjectMembersOutputBodyAdditional
+	Schema          OptURI `json:"$schema"`
+	Status          string `json:"status"`
+	AdditionalProps GrantProjectAccessOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListProjectMembersOutputBody) GetSchema() OptURI {
+func (s *GrantProjectAccessOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetMembers returns the value of Members.
-func (s *ListProjectMembersOutputBody) GetMembers() []ProjectGrant {
-	return s.Members
-}
-
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListProjectMembersOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetStatus returns the value of Status.
+func (s *GrantProjectAccessOutputBody) GetStatus() string {
+	return s.Status
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListProjectMembersOutputBody) GetAdditionalProps() ListProjectMembersOutputBodyAdditional {
+func (s *GrantProjectAccessOutputBody) GetAdditionalProps() GrantProjectAccessOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListProjectMembersOutputBody) SetSchema(val OptURI) {
+func (s *GrantProjectAccessOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetMembers sets the value of Members.
-func (s *ListProjectMembersOutputBody) SetMembers(val []ProjectGrant) {
-	s.Members = val
-}
-
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListProjectMembersOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetStatus sets the value of Status.
+func (s *GrantProjectAccessOutputBody) SetStatus(val string) {
+	s.Status = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListProjectMembersOutputBody) SetAdditionalProps(val ListProjectMembersOutputBodyAdditional) {
+func (s *GrantProjectAccessOutputBody) SetAdditionalProps(val GrantProjectAccessOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListProjectMembersOutputBodyAdditional map[string]jx.Raw
+type GrantProjectAccessOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListProjectMembersOutputBodyAdditional) init() ListProjectMembersOutputBodyAdditional {
+func (s *GrantProjectAccessOutputBodyAdditional) init() GrantProjectAccessOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4510,70 +4816,80 @@ func (s *ListProjectMembersOutputBodyAdditional) init() ListProjectMembersOutput
 	return m
 }
 
-// Ref: #/components/schemas/ListProjectReposOutputBody
-type ListProjectReposOutputBody struct {
+// Ref: #/components/schemas/GrantRepoAccessInputBody
+type GrantRepoAccessInputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	Repo            OptRepo   `json:"repo"`
-	Repos           []Repo    `json:"repos"`
-	AdditionalProps ListProjectReposOutputBodyAdditional
+	Schema          OptURI                                 `json:"$schema"`
+	GranteeType     OptGrantRepoAccessInputBodyGranteeType `json:"granteeType"`
+	Provider        string                                 `json:"provider"`
+	ProviderUserId  string                                 `json:"providerUserId"`
+	Role            GrantRepoAccessInputBodyRole           `json:"role"`
+	AdditionalProps GrantRepoAccessInputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListProjectReposOutputBody) GetSchema() OptURI {
+func (s *GrantRepoAccessInputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListProjectReposOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetGranteeType returns the value of GranteeType.
+func (s *GrantRepoAccessInputBody) GetGranteeType() OptGrantRepoAccessInputBodyGranteeType {
+	return s.GranteeType
 }
 
-// GetRepo returns the value of Repo.
-func (s *ListProjectReposOutputBody) GetRepo() OptRepo {
-	return s.Repo
+// GetProvider returns the value of Provider.
+func (s *GrantRepoAccessInputBody) GetProvider() string {
+	return s.Provider
 }
 
-// GetRepos returns the value of Repos.
-func (s *ListProjectReposOutputBody) GetRepos() []Repo {
-	return s.Repos
+// GetProviderUserId returns the value of ProviderUserId.
+func (s *GrantRepoAccessInputBody) GetProviderUserId() string {
+	return s.ProviderUserId
+}
+
+// GetRole returns the value of Role.
+func (s *GrantRepoAccessInputBody) GetRole() GrantRepoAccessInputBodyRole {
+	return s.Role
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListProjectReposOutputBody) GetAdditionalProps() ListProjectReposOutputBodyAdditional {
+func (s *GrantRepoAccessInputBody) GetAdditionalProps() GrantRepoAccessInputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListProjectReposOutputBody) SetSchema(val OptURI) {
+func (s *GrantRepoAccessInputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListProjectReposOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetGranteeType sets the value of GranteeType.
+func (s *GrantRepoAccessInputBody) SetGranteeType(val OptGrantRepoAccessInputBodyGranteeType) {
+	s.GranteeType = val
 }
 
-// SetRepo sets the value of Repo.
-func (s *ListProjectReposOutputBody) SetRepo(val OptRepo) {
-	s.Repo = val
+// SetProvider sets the value of Provider.
+func (s *GrantRepoAccessInputBody) SetProvider(val string) {
+	s.Provider = val
 }
 
-// SetRepos sets the value of Repos.
-func (s *ListProjectReposOutputBody) SetRepos(val []Repo) {
-	s.Repos = val
+// SetProviderUserId sets the value of ProviderUserId.
+func (s *GrantRepoAccessInputBody) SetProviderUserId(val string) {
+	s.ProviderUserId = val
+}
+
+// SetRole sets the value of Role.
+func (s *GrantRepoAccessInputBody) SetRole(val GrantRepoAccessInputBodyRole) {
+	s.Role = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListProjectReposOutputBody) SetAdditionalProps(val ListProjectReposOutputBodyAdditional) {
+func (s *GrantRepoAccessInputBody) SetAdditionalProps(val GrantRepoAccessInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListProjectReposOutputBodyAdditional map[string]jx.Raw
+type GrantRepoAccessInputBodyAdditional map[string]jx.Raw
 
-func (s *ListProjectReposOutputBodyAdditional) init() ListProjectReposOutputBodyAdditional {
+func (s *GrantRepoAccessInputBodyAdditional) init() GrantRepoAccessInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4582,119 +4898,129 @@ func (s *ListProjectReposOutputBodyAdditional) init() ListProjectReposOutputBody
 	return m
 }
 
-// Ref: #/components/schemas/ListProjectsOutputBody
-type ListProjectsOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString  `json:"nextPageToken"`
-	Project         OptProject `json:"project"`
-	Projects        []Project  `json:"projects"`
-	AdditionalProps ListProjectsOutputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *ListProjectsOutputBody) GetSchema() OptURI {
-	return s.Schema
-}
-
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListProjectsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
-}
+type GrantRepoAccessInputBodyGranteeType string
 
-// GetProject returns the value of Project.
-func (s *ListProjectsOutputBody) GetProject() OptProject {
-	return s.Project
-}
+const (
+	GrantRepoAccessInputBodyGranteeTypeAccount GrantRepoAccessInputBodyGranteeType = "account"
+)
 
-// GetProjects returns the value of Projects.
-func (s *ListProjectsOutputBody) GetProjects() []Project {
-	return s.Projects
+// AllValues returns all GrantRepoAccessInputBodyGranteeType values.
+func (GrantRepoAccessInputBodyGranteeType) AllValues() []GrantRepoAccessInputBodyGranteeType {
+	return []GrantRepoAccessInputBodyGranteeType{
+		GrantRepoAccessInputBodyGranteeTypeAccount,
+	}
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListProjectsOutputBody) GetAdditionalProps() ListProjectsOutputBodyAdditional {
-	return s.AdditionalProps
+// MarshalText implements encoding.TextMarshaler.
+func (s GrantRepoAccessInputBodyGranteeType) MarshalText() ([]byte, error) {
+	switch s {
+	case GrantRepoAccessInputBodyGranteeTypeAccount:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-// SetSchema sets the value of Schema.
-func (s *ListProjectsOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GrantRepoAccessInputBodyGranteeType) UnmarshalText(data []byte) error {
+	switch GrantRepoAccessInputBodyGranteeType(data) {
+	case GrantRepoAccessInputBodyGranteeTypeAccount:
+		*s = GrantRepoAccessInputBodyGranteeTypeAccount
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListProjectsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
-}
+type GrantRepoAccessInputBodyRole string
 
-// SetProject sets the value of Project.
-func (s *ListProjectsOutputBody) SetProject(val OptProject) {
-	s.Project = val
-}
+const (
+	GrantRepoAccessInputBodyRoleReader GrantRepoAccessInputBodyRole = "reader"
+	GrantRepoAccessInputBodyRoleWriter GrantRepoAccessInputBodyRole = "writer"
+	GrantRepoAccessInputBodyRoleAdmin  GrantRepoAccessInputBodyRole = "admin"
+)
 
-// SetProjects sets the value of Projects.
-func (s *ListProjectsOutputBody) SetProjects(val []Project) {
-	s.Projects = val
+// AllValues returns all GrantRepoAccessInputBodyRole values.
+func (GrantRepoAccessInputBodyRole) AllValues() []GrantRepoAccessInputBodyRole {
+	return []GrantRepoAccessInputBodyRole{
+		GrantRepoAccessInputBodyRoleReader,
+		GrantRepoAccessInputBodyRoleWriter,
+		GrantRepoAccessInputBodyRoleAdmin,
+	}
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListProjectsOutputBody) SetAdditionalProps(val ListProjectsOutputBodyAdditional) {
-	s.AdditionalProps = val
+// MarshalText implements encoding.TextMarshaler.
+func (s GrantRepoAccessInputBodyRole) MarshalText() ([]byte, error) {
+	switch s {
+	case GrantRepoAccessInputBodyRoleReader:
+		return []byte(s), nil
+	case GrantRepoAccessInputBodyRoleWriter:
+		return []byte(s), nil
+	case GrantRepoAccessInputBodyRoleAdmin:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-type ListProjectsOutputBodyAdditional map[string]jx.Raw
-
-func (s *ListProjectsOutputBodyAdditional) init() ListProjectsOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GrantRepoAccessInputBodyRole) UnmarshalText(data []byte) error {
+	switch GrantRepoAccessInputBodyRole(data) {
+	case GrantRepoAccessInputBodyRoleReader:
+		*s = GrantRepoAccessInputBodyRoleReader
+		return nil
+	case GrantRepoAccessInputBodyRoleWriter:
+		*s = GrantRepoAccessInputBodyRoleWriter
+		return nil
+	case GrantRepoAccessInputBodyRoleAdmin:
+		*s = GrantRepoAccessInputBodyRoleAdmin
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
 	}
-	return m
 }
 
-// Ref: #/components/schemas/ListRepoCIWebhooksOutputBody
-type ListRepoCIWebhooksOutputBody struct {
+// Ref: #/components/schemas/GrantRepoAccessOutputBody
+type GrantRepoAccessOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI          `json:"$schema"`
-	Subscriptions   []CIWebhookView `json:"subscriptions"`
-	AdditionalProps ListRepoCIWebhooksOutputBodyAdditional
+	Schema          OptURI `json:"$schema"`
+	Status          string `json:"status"`
+	AdditionalProps GrantRepoAccessOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListRepoCIWebhooksOutputBody) GetSchema() OptURI {
+func (s *GrantRepoAccessOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetSubscriptions returns the value of Subscriptions.
-func (s *ListRepoCIWebhooksOutputBody) GetSubscriptions() []CIWebhookView {
-	return s.Subscriptions
+// GetStatus returns the value of Status.
+func (s *GrantRepoAccessOutputBody) GetStatus() string {
+	return s.Status
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListRepoCIWebhooksOutputBody) GetAdditionalProps() ListRepoCIWebhooksOutputBodyAdditional {
+func (s *GrantRepoAccessOutputBody) GetAdditionalProps() GrantRepoAccessOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListRepoCIWebhooksOutputBody) SetSchema(val OptURI) {
+func (s *GrantRepoAccessOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetSubscriptions sets the value of Subscriptions.
-func (s *ListRepoCIWebhooksOutputBody) SetSubscriptions(val []CIWebhookView) {
-	s.Subscriptions = val
+// SetStatus sets the value of Status.
+func (s *GrantRepoAccessOutputBody) SetStatus(val string) {
+	s.Status = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListRepoCIWebhooksOutputBody) SetAdditionalProps(val ListRepoCIWebhooksOutputBodyAdditional) {
+func (s *GrantRepoAccessOutputBody) SetAdditionalProps(val GrantRepoAccessOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListRepoCIWebhooksOutputBodyAdditional map[string]jx.Raw
+type GrantRepoAccessOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListRepoCIWebhooksOutputBodyAdditional) init() ListRepoCIWebhooksOutputBodyAdditional {
+func (s *GrantRepoAccessOutputBodyAdditional) init() GrantRepoAccessOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4703,59 +5029,69 @@ func (s *ListRepoCIWebhooksOutputBodyAdditional) init() ListRepoCIWebhooksOutput
 	return m
 }
 
-// Ref: #/components/schemas/ListRepoGrantsOutputBody
-type ListRepoGrantsOutputBody struct {
+// Ref: #/components/schemas/GrantServiceAccountAccessInputBody
+type GrantServiceAccountAccessInputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI      `json:"$schema"`
-	Grants []RepoGrant `json:"grants"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListRepoGrantsOutputBodyAdditional
+	Schema          OptURI                                         `json:"$schema"`
+	ResourceId      string                                         `json:"resourceId"`
+	ResourceType    GrantServiceAccountAccessInputBodyResourceType `json:"resourceType"`
+	Role            GrantServiceAccountAccessInputBodyRole         `json:"role"`
+	AdditionalProps GrantServiceAccountAccessInputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListRepoGrantsOutputBody) GetSchema() OptURI {
+func (s *GrantServiceAccountAccessInputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetGrants returns the value of Grants.
-func (s *ListRepoGrantsOutputBody) GetGrants() []RepoGrant {
-	return s.Grants
+// GetResourceId returns the value of ResourceId.
+func (s *GrantServiceAccountAccessInputBody) GetResourceId() string {
+	return s.ResourceId
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListRepoGrantsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetResourceType returns the value of ResourceType.
+func (s *GrantServiceAccountAccessInputBody) GetResourceType() GrantServiceAccountAccessInputBodyResourceType {
+	return s.ResourceType
+}
+
+// GetRole returns the value of Role.
+func (s *GrantServiceAccountAccessInputBody) GetRole() GrantServiceAccountAccessInputBodyRole {
+	return s.Role
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListRepoGrantsOutputBody) GetAdditionalProps() ListRepoGrantsOutputBodyAdditional {
+func (s *GrantServiceAccountAccessInputBody) GetAdditionalProps() GrantServiceAccountAccessInputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListRepoGrantsOutputBody) SetSchema(val OptURI) {
+func (s *GrantServiceAccountAccessInputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetGrants sets the value of Grants.
-func (s *ListRepoGrantsOutputBody) SetGrants(val []RepoGrant) {
-	s.Grants = val
+// SetResourceId sets the value of ResourceId.
+func (s *GrantServiceAccountAccessInputBody) SetResourceId(val string) {
+	s.ResourceId = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListRepoGrantsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetResourceType sets the value of ResourceType.
+func (s *GrantServiceAccountAccessInputBody) SetResourceType(val GrantServiceAccountAccessInputBodyResourceType) {
+	s.ResourceType = val
+}
+
+// SetRole sets the value of Role.
+func (s *GrantServiceAccountAccessInputBody) SetRole(val GrantServiceAccountAccessInputBodyRole) {
+	s.Role = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListRepoGrantsOutputBody) SetAdditionalProps(val ListRepoGrantsOutputBodyAdditional) {
+func (s *GrantServiceAccountAccessInputBody) SetAdditionalProps(val GrantServiceAccountAccessInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListRepoGrantsOutputBodyAdditional map[string]jx.Raw
+type GrantServiceAccountAccessInputBodyAdditional map[string]jx.Raw
 
-func (s *ListRepoGrantsOutputBodyAdditional) init() ListRepoGrantsOutputBodyAdditional {
+func (s *GrantServiceAccountAccessInputBodyAdditional) init() GrantServiceAccountAccessInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4764,100 +5100,72 @@ func (s *ListRepoGrantsOutputBodyAdditional) init() ListRepoGrantsOutputBodyAddi
 	return m
 }
 
-// Ref: #/components/schemas/ListReposOutputBody
-type ListReposOutputBody struct {
-	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString        `json:"nextPageToken"`
-	Repos           []RepoIndexEntry `json:"repos"`
-	Truncated       bool             `json:"truncated"`
-	AdditionalProps ListReposOutputBodyAdditional
-}
-
-// GetSchema returns the value of Schema.
-func (s *ListReposOutputBody) GetSchema() OptURI {
-	return s.Schema
-}
-
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListReposOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
-}
-
-// GetRepos returns the value of Repos.
-func (s *ListReposOutputBody) GetRepos() []RepoIndexEntry {
-	return s.Repos
-}
-
-// GetTruncated returns the value of Truncated.
-func (s *ListReposOutputBody) GetTruncated() bool {
-	return s.Truncated
-}
-
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListReposOutputBody) GetAdditionalProps() ListReposOutputBodyAdditional {
-	return s.AdditionalProps
-}
-
-// SetSchema sets the value of Schema.
-func (s *ListReposOutputBody) SetSchema(val OptURI) {
-	s.Schema = val
-}
-
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListReposOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
-}
+type GrantServiceAccountAccessInputBodyResourceType string
 
-// SetRepos sets the value of Repos.
-func (s *ListReposOutputBody) SetRepos(val []RepoIndexEntry) {
-	s.Repos = val
-}
+const (
+	GrantServiceAccountAccessInputBodyResourceTypeRepo    GrantServiceAccountAccessInputBodyResourceType = "repo"
+	GrantServiceAccountAccessInputBodyResourceTypeProject GrantServiceAccountAccessInputBodyResourceType = "project"
+)
 
-// SetTruncated sets the value of Truncated.
-func (s *ListReposOutputBody) SetTruncated(val bool) {
-	s.Truncated = val
+// AllValues returns all GrantServiceAccountAccessInputBodyResourceType values.
+func (GrantServiceAccountAccessInputBodyResourceType) AllValues() []GrantServiceAccountAccessInputBodyResourceType {
+	return []GrantServiceAccountAccessInputBodyResourceType{
+		GrantServiceAccountAccessInputBodyResourceTypeRepo,
+		GrantServiceAccountAccessInputBodyResourceTypeProject,
+	}
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListReposOutputBody) SetAdditionalProps(val ListReposOutputBodyAdditional) {
-	s.AdditionalProps = val
+// MarshalText implements encoding.TextMarshaler.
+func (s GrantServiceAccountAccessInputBodyResourceType) MarshalText() ([]byte, error) {
+	switch s {
+	case GrantServiceAccountAccessInputBodyResourceTypeRepo:
+		return []byte(s), nil
+	case GrantServiceAccountAccessInputBodyResourceTypeProject:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
 }
 
-type ListReposOutputBodyAdditional map[string]jx.Raw
-
-func (s *ListReposOutputBodyAdditional) init() ListReposOutputBodyAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *GrantServiceAccountAccessInputBodyResourceType) UnmarshalText(data []byte) error {
+	switch GrantServiceAccountAccessInputBodyResourceType(data) {
+	case GrantServiceAccountAccessInputBodyResourceTypeRepo:
+		*s = GrantServiceAccountAccessInputBodyResourceTypeRepo
+		return nil
+	case GrantServiceAccountAccessInputBodyResourceTypeProject:
+		*s = GrantServiceAccountAccessInputBodyResourceTypeProject
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
 	}
-	return m
 }
 
-// Onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.
-type ListReposScope string
+type GrantServiceAccountAccessInputBodyRole string
 
 const (
-	ListReposScopeOnboarded ListReposScope = "onboarded"
-	ListReposScopeAll       ListReposScope = "all"
+	GrantServiceAccountAccessInputBodyRoleReader GrantServiceAccountAccessInputBodyRole = "reader"
+	GrantServiceAccountAccessInputBodyRoleWriter GrantServiceAccountAccessInputBodyRole = "writer"
+	GrantServiceAccountAccessInputBodyRoleAdmin  GrantServiceAccountAccessInputBodyRole = "admin"
 )
 
-// AllValues returns all ListReposScope values.
-func (ListReposScope) AllValues() []ListReposScope {
-	return []ListReposScope{
-		ListReposScopeOnboarded,
-		ListReposScopeAll,
+// AllValues returns all GrantServiceAccountAccessInputBodyRole values.
+func (GrantServiceAccountAccessInputBodyRole) AllValues() []GrantServiceAccountAccessInputBodyRole {
+	return []GrantServiceAccountAccessInputBodyRole{
+		GrantServiceAccountAccessInputBodyRoleReader,
+		GrantServiceAccountAccessInputBodyRoleWriter,
+		GrantServiceAccountAccessInputBodyRoleAdmin,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s ListReposScope) MarshalText() ([]byte, error) {
+func (s GrantServiceAccountAccessInputBodyRole) MarshalText() ([]byte, error) {
 	switch s {
-	case ListReposScopeOnboarded:
+	case GrantServiceAccountAccessInputBodyRoleReader:
 		return []byte(s), nil
-	case ListReposScopeAll:
+	case GrantServiceAccountAccessInputBodyRoleWriter:
+		return []byte(s), nil
+	case GrantServiceAccountAccessInputBodyRoleAdmin:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -4865,72 +5173,63 @@ func (s ListReposScope) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *ListReposScope) UnmarshalText(data []byte) error {
-	switch ListReposScope(data) {
-	case ListReposScopeOnboarded:
-		*s = ListReposScopeOnboarded
+func (s *GrantServiceAccountAccessInputBodyRole) UnmarshalText(data []byte) error {
+	switch GrantServiceAccountAccessInputBodyRole(data) {
+	case GrantServiceAccountAccessInputBodyRoleReader:
+		*s = GrantServiceAccountAccessInputBodyRoleReader
 		return nil
-	case ListReposScopeAll:
-		*s = ListReposScopeAll
+	case GrantServiceAccountAccessInputBodyRoleWriter:
+		*s = GrantServiceAccountAccessInputBodyRoleWriter
+		return nil
+	case GrantServiceAccountAccessInputBodyRoleAdmin:
+		*s = GrantServiceAccountAccessInputBodyRoleAdmin
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/ListServiceAccountGrantsOutputBody
-type ListServiceAccountGrantsOutputBody struct {
+// Ref: #/components/schemas/GrantServiceAccountAccessOutputBody
+type GrantServiceAccountAccessOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI                `json:"$schema"`
-	Grants []ServiceAccountGrant `json:"grants"`
-	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString `json:"nextPageToken"`
-	AdditionalProps ListServiceAccountGrantsOutputBodyAdditional
+	Schema          OptURI `json:"$schema"`
+	Status          string `json:"status"`
+	AdditionalProps GrantServiceAccountAccessOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListServiceAccountGrantsOutputBody) GetSchema() OptURI {
+func (s *GrantServiceAccountAccessOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetGrants returns the value of Grants.
-func (s *ListServiceAccountGrantsOutputBody) GetGrants() []ServiceAccountGrant {
-	return s.Grants
-}
-
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListServiceAccountGrantsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetStatus returns the value of Status.
+func (s *GrantServiceAccountAccessOutputBody) GetStatus() string {
+	return s.Status
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListServiceAccountGrantsOutputBody) GetAdditionalProps() ListServiceAccountGrantsOutputBodyAdditional {
+func (s *GrantServiceAccountAccessOutputBody) GetAdditionalProps() GrantServiceAccountAccessOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListServiceAccountGrantsOutputBody) SetSchema(val OptURI) {
+func (s *GrantServiceAccountAccessOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetGrants sets the value of Grants.
-func (s *ListServiceAccountGrantsOutputBody) SetGrants(val []ServiceAccountGrant) {
-	s.Grants = val
-}
-
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListServiceAccountGrantsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetStatus sets the value of Status.
+func (s *GrantServiceAccountAccessOutputBody) SetStatus(val string) {
+	s.Status = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListServiceAccountGrantsOutputBody) SetAdditionalProps(val ListServiceAccountGrantsOutputBodyAdditional) {
+func (s *GrantServiceAccountAccessOutputBody) SetAdditionalProps(val GrantServiceAccountAccessOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListServiceAccountGrantsOutputBodyAdditional map[string]jx.Raw
+type GrantServiceAccountAccessOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListServiceAccountGrantsOutputBodyAdditional) init() ListServiceAccountGrantsOutputBodyAdditional {
+func (s *GrantServiceAccountAccessOutputBodyAdditional) init() GrantServiceAccountAccessOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -4939,59 +5238,59 @@ func (s *ListServiceAccountGrantsOutputBodyAdditional) init() ListServiceAccount
 	return m
 }
 
-// Ref: #/components/schemas/ListServiceAccountsOutputBody
-type ListServiceAccountsOutputBody struct {
+// Ref: #/components/schemas/ListAuditEventsOutputBody
+type ListAuditEventsOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
+	Schema OptURI       `json:"$schema"`
+	Events []AuditEvent `json:"events"`
 	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString                  `json:"nextPageToken"`
-	ServiceAccounts []ServiceAccountWithGrants `json:"serviceAccounts"`
-	AdditionalProps ListServiceAccountsOutputBodyAdditional
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListAuditEventsOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *ListServiceAccountsOutputBody) GetSchema() OptURI {
+func (s *ListAuditEventsOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetNextPageToken returns the value of NextPageToken.
-func (s *ListServiceAccountsOutputBody) GetNextPageToken() OptString {
-	return s.NextPageToken
+// GetEvents returns the value of Events.
+func (s *ListAuditEventsOutputBody) GetEvents() []AuditEvent {
+	return s.Events
 }
 
-// GetServiceAccounts returns the value of ServiceAccounts.
-func (s *ListServiceAccountsOutputBody) GetServiceAccounts() []ServiceAccountWithGrants {
-	return s.ServiceAccounts
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListAuditEventsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *ListServiceAccountsOutputBody) GetAdditionalProps() ListServiceAccountsOutputBodyAdditional {
+func (s *ListAuditEventsOutputBody) GetAdditionalProps() ListAuditEventsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *ListServiceAccountsOutputBody) SetSchema(val OptURI) {
+func (s *ListAuditEventsOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *ListServiceAccountsOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
+// SetEvents sets the value of Events.
+func (s *ListAuditEventsOutputBody) SetEvents(val []AuditEvent) {
+	s.Events = val
 }
 
-// SetServiceAccounts sets the value of ServiceAccounts.
-func (s *ListServiceAccountsOutputBody) SetServiceAccounts(val []ServiceAccountWithGrants) {
-	s.ServiceAccounts = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListAuditEventsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ListServiceAccountsOutputBody) SetAdditionalProps(val ListServiceAccountsOutputBodyAdditional) {
+func (s *ListAuditEventsOutputBody) SetAdditionalProps(val ListAuditEventsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ListServiceAccountsOutputBodyAdditional map[string]jx.Raw
+type ListAuditEventsOutputBodyAdditional map[string]jx.Raw
 
-func (s *ListServiceAccountsOutputBodyAdditional) init() ListServiceAccountsOutputBodyAdditional {
+func (s *ListAuditEventsOutputBodyAdditional) init() ListAuditEventsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5000,91 +5299,47 @@ func (s *ListServiceAccountsOutputBodyAdditional) init() ListServiceAccountsOutp
 	return m
 }
 
-// Ref: #/components/schemas/LookupBySlugOutputBody
-type LookupBySlugOutputBody struct {
+// Ref: #/components/schemas/ListAvailableMirrorsOutputBody
+type ListAvailableMirrorsOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI `json:"$schema"`
-	Cell            string `json:"cell"`
-	Jurisdiction    string `json:"jurisdiction"`
-	Owner           string `json:"owner"`
-	Repo            string `json:"repo"`
-	RepoId          string `json:"repoId"`
-	AdditionalProps LookupBySlugOutputBodyAdditional
+	Schema          OptURI            `json:"$schema"`
+	Available       []AvailableMirror `json:"available"`
+	AdditionalProps ListAvailableMirrorsOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *LookupBySlugOutputBody) GetSchema() OptURI {
+func (s *ListAvailableMirrorsOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetCell returns the value of Cell.
-func (s *LookupBySlugOutputBody) GetCell() string {
-	return s.Cell
-}
-
-// GetJurisdiction returns the value of Jurisdiction.
-func (s *LookupBySlugOutputBody) GetJurisdiction() string {
-	return s.Jurisdiction
-}
-
-// GetOwner returns the value of Owner.
-func (s *LookupBySlugOutputBody) GetOwner() string {
-	return s.Owner
-}
-
-// GetRepo returns the value of Repo.
-func (s *LookupBySlugOutputBody) GetRepo() string {
-	return s.Repo
-}
-
-// GetRepoId returns the value of RepoId.
-func (s *LookupBySlugOutputBody) GetRepoId() string {
-	return s.RepoId
+// GetAvailable returns the value of Available.
+func (s *ListAvailableMirrorsOutputBody) GetAvailable() []AvailableMirror {
+	return s.Available
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *LookupBySlugOutputBody) GetAdditionalProps() LookupBySlugOutputBodyAdditional {
+func (s *ListAvailableMirrorsOutputBody) GetAdditionalProps() ListAvailableMirrorsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *LookupBySlugOutputBody) SetSchema(val OptURI) {
+func (s *ListAvailableMirrorsOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetCell sets the value of Cell.
-func (s *LookupBySlugOutputBody) SetCell(val string) {
-	s.Cell = val
-}
-
-// SetJurisdiction sets the value of Jurisdiction.
-func (s *LookupBySlugOutputBody) SetJurisdiction(val string) {
-	s.Jurisdiction = val
-}
-
-// SetOwner sets the value of Owner.
-func (s *LookupBySlugOutputBody) SetOwner(val string) {
-	s.Owner = val
-}
-
-// SetRepo sets the value of Repo.
-func (s *LookupBySlugOutputBody) SetRepo(val string) {
-	s.Repo = val
-}
-
-// SetRepoId sets the value of RepoId.
-func (s *LookupBySlugOutputBody) SetRepoId(val string) {
-	s.RepoId = val
+// SetAvailable sets the value of Available.
+func (s *ListAvailableMirrorsOutputBody) SetAvailable(val []AvailableMirror) {
+	s.Available = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *LookupBySlugOutputBody) SetAdditionalProps(val LookupBySlugOutputBodyAdditional) {
+func (s *ListAvailableMirrorsOutputBody) SetAdditionalProps(val ListAvailableMirrorsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type LookupBySlugOutputBodyAdditional map[string]jx.Raw
+type ListAvailableMirrorsOutputBodyAdditional map[string]jx.Raw
 
-func (s *LookupBySlugOutputBodyAdditional) init() LookupBySlugOutputBodyAdditional {
+func (s *ListAvailableMirrorsOutputBodyAdditional) init() ListAvailableMirrorsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5093,47 +5348,59 @@ func (s *LookupBySlugOutputBodyAdditional) init() LookupBySlugOutputBodyAddition
 	return m
 }
 
-// Ref: #/components/schemas/LookupRef
-type LookupRef struct {
-	ID string `json:"id"`
-	// Resource type slug; "org", "project", "repo" are enriched, unknown types pass through.
-	Type            string `json:"type"`
-	AdditionalProps LookupRefAdditional
+// Ref: #/components/schemas/ListBindingsOutputBody
+type ListBindingsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema   OptURI    `json:"$schema"`
+	Bindings []Binding `json:"bindings"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListBindingsOutputBodyAdditional
 }
 
-// GetID returns the value of ID.
-func (s *LookupRef) GetID() string {
-	return s.ID
+// GetSchema returns the value of Schema.
+func (s *ListBindingsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetType returns the value of Type.
-func (s *LookupRef) GetType() string {
-	return s.Type
+// GetBindings returns the value of Bindings.
+func (s *ListBindingsOutputBody) GetBindings() []Binding {
+	return s.Bindings
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListBindingsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *LookupRef) GetAdditionalProps() LookupRefAdditional {
+func (s *ListBindingsOutputBody) GetAdditionalProps() ListBindingsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetID sets the value of ID.
-func (s *LookupRef) SetID(val string) {
-	s.ID = val
+// SetSchema sets the value of Schema.
+func (s *ListBindingsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetType sets the value of Type.
-func (s *LookupRef) SetType(val string) {
-	s.Type = val
+// SetBindings sets the value of Bindings.
+func (s *ListBindingsOutputBody) SetBindings(val []Binding) {
+	s.Bindings = val
+}
+
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListBindingsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *LookupRef) SetAdditionalProps(val LookupRefAdditional) {
+func (s *ListBindingsOutputBody) SetAdditionalProps(val ListBindingsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type LookupRefAdditional map[string]jx.Raw
+type ListBindingsOutputBodyAdditional map[string]jx.Raw
 
-func (s *LookupRefAdditional) init() LookupRefAdditional {
+func (s *ListBindingsOutputBodyAdditional) init() ListBindingsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5142,101 +5409,96 @@ func (s *LookupRefAdditional) init() LookupRefAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/LookupRefResult
-type LookupRefResult struct {
-	ID              string                      `json:"id"`
-	Name            OptString                   `json:"name"`
-	OwnerId         OptString                   `json:"ownerId"`
-	OwnerType       OptLookupRefResultOwnerType `json:"ownerType"`
-	ProjectId       OptString                   `json:"projectId"`
-	Type            string                      `json:"type"`
-	URL             OptString                   `json:"url"`
-	AdditionalProps LookupRefResultAdditional
-}
-
-// GetID returns the value of ID.
-func (s *LookupRefResult) GetID() string {
-	return s.ID
+// Ref: #/components/schemas/ListClustersOutputBody
+type ListClustersOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI    `json:"$schema"`
+	Clusters        []Cluster `json:"clusters"`
+	AdditionalProps ListClustersOutputBodyAdditional
 }
 
-// GetName returns the value of Name.
-func (s *LookupRefResult) GetName() OptString {
-	return s.Name
+// GetSchema returns the value of Schema.
+func (s *ListClustersOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetOwnerId returns the value of OwnerId.
-func (s *LookupRefResult) GetOwnerId() OptString {
-	return s.OwnerId
+// GetClusters returns the value of Clusters.
+func (s *ListClustersOutputBody) GetClusters() []Cluster {
+	return s.Clusters
 }
 
-// GetOwnerType returns the value of OwnerType.
-func (s *LookupRefResult) GetOwnerType() OptLookupRefResultOwnerType {
-	return s.OwnerType
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListClustersOutputBody) GetAdditionalProps() ListClustersOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetProjectId returns the value of ProjectId.
-func (s *LookupRefResult) GetProjectId() OptString {
-	return s.ProjectId
+// SetSchema sets the value of Schema.
+func (s *ListClustersOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetType returns the value of Type.
-func (s *LookupRefResult) GetType() string {
-	return s.Type
+// SetClusters sets the value of Clusters.
+func (s *ListClustersOutputBody) SetClusters(val []Cluster) {
+	s.Clusters = val
 }
 
-// GetURL returns the value of URL.
-func (s *LookupRefResult) GetURL() OptString {
-	return s.URL
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListClustersOutputBody) SetAdditionalProps(val ListClustersOutputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *LookupRefResult) GetAdditionalProps() LookupRefResultAdditional {
-	return s.AdditionalProps
-}
+type ListClustersOutputBodyAdditional map[string]jx.Raw
 
-// SetID sets the value of ID.
-func (s *LookupRefResult) SetID(val string) {
-	s.ID = val
+func (s *ListClustersOutputBodyAdditional) init() ListClustersOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// SetName sets the value of Name.
-func (s *LookupRefResult) SetName(val OptString) {
-	s.Name = val
+// Ref: #/components/schemas/ListMirrorCollaboratorsOutputBody
+type ListMirrorCollaboratorsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI               `json:"$schema"`
+	Collaborators   []MirrorCollaborator `json:"collaborators"`
+	AdditionalProps ListMirrorCollaboratorsOutputBodyAdditional
 }
 
-// SetOwnerId sets the value of OwnerId.
-func (s *LookupRefResult) SetOwnerId(val OptString) {
-	s.OwnerId = val
+// GetSchema returns the value of Schema.
+func (s *ListMirrorCollaboratorsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetOwnerType sets the value of OwnerType.
-func (s *LookupRefResult) SetOwnerType(val OptLookupRefResultOwnerType) {
-	s.OwnerType = val
+// GetCollaborators returns the value of Collaborators.
+func (s *ListMirrorCollaboratorsOutputBody) GetCollaborators() []MirrorCollaborator {
+	return s.Collaborators
 }
 
-// SetProjectId sets the value of ProjectId.
-func (s *LookupRefResult) SetProjectId(val OptString) {
-	s.ProjectId = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListMirrorCollaboratorsOutputBody) GetAdditionalProps() ListMirrorCollaboratorsOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// SetType sets the value of Type.
-func (s *LookupRefResult) SetType(val string) {
-	s.Type = val
+// SetSchema sets the value of Schema.
+func (s *ListMirrorCollaboratorsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetURL sets the value of URL.
-func (s *LookupRefResult) SetURL(val OptString) {
-	s.URL = val
+// SetCollaborators sets the value of Collaborators.
+func (s *ListMirrorCollaboratorsOutputBody) SetCollaborators(val []MirrorCollaborator) {
+	s.Collaborators = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *LookupRefResult) SetAdditionalProps(val LookupRefResultAdditional) {
+func (s *ListMirrorCollaboratorsOutputBody) SetAdditionalProps(val ListMirrorCollaboratorsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type LookupRefResultAdditional map[string]jx.Raw
+type ListMirrorCollaboratorsOutputBodyAdditional map[string]jx.Raw
 
-func (s *LookupRefResultAdditional) init() LookupRefResultAdditional {
+func (s *ListMirrorCollaboratorsOutputBodyAdditional) init() ListMirrorCollaboratorsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5245,27 +5507,23 @@ func (s *LookupRefResultAdditional) init() LookupRefResultAdditional {
 	return m
 }
 
-type LookupRefResultOwnerType string
+type ListMirrorCollaboratorsProvider string
 
 const (
-	LookupRefResultOwnerTypeOrg     LookupRefResultOwnerType = "org"
-	LookupRefResultOwnerTypeAccount LookupRefResultOwnerType = "account"
+	ListMirrorCollaboratorsProviderGithub ListMirrorCollaboratorsProvider = "github"
 )
 
-// AllValues returns all LookupRefResultOwnerType values.
-func (LookupRefResultOwnerType) AllValues() []LookupRefResultOwnerType {
-	return []LookupRefResultOwnerType{
-		LookupRefResultOwnerTypeOrg,
-		LookupRefResultOwnerTypeAccount,
+// AllValues returns all ListMirrorCollaboratorsProvider values.
+func (ListMirrorCollaboratorsProvider) AllValues() []ListMirrorCollaboratorsProvider {
+	return []ListMirrorCollaboratorsProvider{
+		ListMirrorCollaboratorsProviderGithub,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s LookupRefResultOwnerType) MarshalText() ([]byte, error) {
+func (s ListMirrorCollaboratorsProvider) MarshalText() ([]byte, error) {
 	switch s {
-	case LookupRefResultOwnerTypeOrg:
-		return []byte(s), nil
-	case LookupRefResultOwnerTypeAccount:
+	case ListMirrorCollaboratorsProviderGithub:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
@@ -5273,105 +5531,69 @@ func (s LookupRefResultOwnerType) MarshalText() ([]byte, error) {
 }
 
 // UnmarshalText implements encoding.TextUnmarshaler.
-func (s *LookupRefResultOwnerType) UnmarshalText(data []byte) error {
-	switch LookupRefResultOwnerType(data) {
-	case LookupRefResultOwnerTypeOrg:
-		*s = LookupRefResultOwnerTypeOrg
-		return nil
-	case LookupRefResultOwnerTypeAccount:
-		*s = LookupRefResultOwnerTypeAccount
+func (s *ListMirrorCollaboratorsProvider) UnmarshalText(data []byte) error {
+	switch ListMirrorCollaboratorsProvider(data) {
+	case ListMirrorCollaboratorsProviderGithub:
+		*s = ListMirrorCollaboratorsProviderGithub
 		return nil
 	default:
 		return errors.Errorf("invalid value: %q", data)
 	}
 }
 
-// Ref: #/components/schemas/LookupResourcesOutputBody
-type LookupResourcesOutputBody struct {
+// Ref: #/components/schemas/ListMirrorsOutputBody
+type ListMirrorsOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema OptURI `json:"$schema"`
+	Schema  OptURI   `json:"$schema"`
+	Mirrors []Mirror `json:"mirrors"`
 	// Pass back to fetch the next page; empty when no more entries.
-	NextPageToken   OptString        `json:"nextPageToken"`
-	Permission      OptString        `json:"permission"`
-	ResourceIds     []string         `json:"resourceIds"`
-	ResourceType    string           `json:"resourceType"`
-	Resources       []ResourceAccess `json:"resources"`
-	AdditionalProps LookupResourcesOutputBodyAdditional
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListMirrorsOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *LookupResourcesOutputBody) GetSchema() OptURI {
+func (s *ListMirrorsOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
+// GetMirrors returns the value of Mirrors.
+func (s *ListMirrorsOutputBody) GetMirrors() []Mirror {
+	return s.Mirrors
+}
+
 // GetNextPageToken returns the value of NextPageToken.
-func (s *LookupResourcesOutputBody) GetNextPageToken() OptString {
+func (s *ListMirrorsOutputBody) GetNextPageToken() OptString {
 	return s.NextPageToken
 }
 
-// GetPermission returns the value of Permission.
-func (s *LookupResourcesOutputBody) GetPermission() OptString {
-	return s.Permission
-}
-
-// GetResourceIds returns the value of ResourceIds.
-func (s *LookupResourcesOutputBody) GetResourceIds() []string {
-	return s.ResourceIds
-}
-
-// GetResourceType returns the value of ResourceType.
-func (s *LookupResourcesOutputBody) GetResourceType() string {
-	return s.ResourceType
-}
-
-// GetResources returns the value of Resources.
-func (s *LookupResourcesOutputBody) GetResources() []ResourceAccess {
-	return s.Resources
-}
-
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *LookupResourcesOutputBody) GetAdditionalProps() LookupResourcesOutputBodyAdditional {
-	return s.AdditionalProps
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListMirrorsOutputBody) GetAdditionalProps() ListMirrorsOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *LookupResourcesOutputBody) SetSchema(val OptURI) {
+func (s *ListMirrorsOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetNextPageToken sets the value of NextPageToken.
-func (s *LookupResourcesOutputBody) SetNextPageToken(val OptString) {
-	s.NextPageToken = val
-}
-
-// SetPermission sets the value of Permission.
-func (s *LookupResourcesOutputBody) SetPermission(val OptString) {
-	s.Permission = val
-}
-
-// SetResourceIds sets the value of ResourceIds.
-func (s *LookupResourcesOutputBody) SetResourceIds(val []string) {
-	s.ResourceIds = val
-}
-
-// SetResourceType sets the value of ResourceType.
-func (s *LookupResourcesOutputBody) SetResourceType(val string) {
-	s.ResourceType = val
+// SetMirrors sets the value of Mirrors.
+func (s *ListMirrorsOutputBody) SetMirrors(val []Mirror) {
+	s.Mirrors = val
 }
 
-// SetResources sets the value of Resources.
-func (s *LookupResourcesOutputBody) SetResources(val []ResourceAccess) {
-	s.Resources = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListMirrorsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *LookupResourcesOutputBody) SetAdditionalProps(val LookupResourcesOutputBodyAdditional) {
+func (s *ListMirrorsOutputBody) SetAdditionalProps(val ListMirrorsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type LookupResourcesOutputBodyAdditional map[string]jx.Raw
+type ListMirrorsOutputBodyAdditional map[string]jx.Raw
 
-func (s *LookupResourcesOutputBodyAdditional) init() LookupResourcesOutputBodyAdditional {
+func (s *ListMirrorsOutputBodyAdditional) init() ListMirrorsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5380,46 +5602,47 @@ func (s *LookupResourcesOutputBodyAdditional) init() LookupResourcesOutputBodyAd
 	return m
 }
 
-// Ref: #/components/schemas/MeAuth
-type MeAuth struct {
-	Provider        string `json:"provider"`
-	ProviderUserId  string `json:"providerUserId"`
-	AdditionalProps MeAuthAdditional
+// Ref: #/components/schemas/ListNativeMirrorsOutputBody
+type ListNativeMirrorsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI                  `json:"$schema"`
+	NativeMirrors   []NativeMirrorPlacement `json:"nativeMirrors"`
+	AdditionalProps ListNativeMirrorsOutputBodyAdditional
 }
 
-// GetProvider returns the value of Provider.
-func (s *MeAuth) GetProvider() string {
-	return s.Provider
+// GetSchema returns the value of Schema.
+func (s *ListNativeMirrorsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetProviderUserId returns the value of ProviderUserId.
-func (s *MeAuth) GetProviderUserId() string {
-	return s.ProviderUserId
+// GetNativeMirrors returns the value of NativeMirrors.
+func (s *ListNativeMirrorsOutputBody) GetNativeMirrors() []NativeMirrorPlacement {
+	return s.NativeMirrors
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MeAuth) GetAdditionalProps() MeAuthAdditional {
+func (s *ListNativeMirrorsOutputBody) GetAdditionalProps() ListNativeMirrorsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetProvider sets the value of Provider.
-func (s *MeAuth) SetProvider(val string) {
-	s.Provider = val
+// SetSchema sets the value of Schema.
+func (s *ListNativeMirrorsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetProviderUserId sets the value of ProviderUserId.
-func (s *MeAuth) SetProviderUserId(val string) {
-	s.ProviderUserId = val
+// SetNativeMirrors sets the value of NativeMirrors.
+func (s *ListNativeMirrorsOutputBody) SetNativeMirrors(val []NativeMirrorPlacement) {
+	s.NativeMirrors = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MeAuth) SetAdditionalProps(val MeAuthAdditional) {
+func (s *ListNativeMirrorsOutputBody) SetAdditionalProps(val ListNativeMirrorsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MeAuthAdditional map[string]jx.Raw
+type ListNativeMirrorsOutputBodyAdditional map[string]jx.Raw
 
-func (s *MeAuthAdditional) init() MeAuthAdditional {
+func (s *ListNativeMirrorsOutputBodyAdditional) init() ListNativeMirrorsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5428,48 +5651,59 @@ func (s *MeAuthAdditional) init() MeAuthAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MeDeletion
-type MeDeletion struct {
-	// When the cooldown elapses and the account becomes eligible for irreversible hard-deletion.
-	CooldownEndsAt time.Time `json:"cooldownEndsAt"`
-	// When deletion was requested (deletion_requested_at).
-	RequestedAt     time.Time `json:"requestedAt"`
-	AdditionalProps MeDeletionAdditional
+// Ref: #/components/schemas/ListOIDCProvidersOutputBody
+type ListOIDCProvidersOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString      `json:"nextPageToken"`
+	Providers       []OIDCProvider `json:"providers"`
+	AdditionalProps ListOIDCProvidersOutputBodyAdditional
 }
 
-// GetCooldownEndsAt returns the value of CooldownEndsAt.
-func (s *MeDeletion) GetCooldownEndsAt() time.Time {
-	return s.CooldownEndsAt
+// GetSchema returns the value of Schema.
+func (s *ListOIDCProvidersOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetRequestedAt returns the value of RequestedAt.
-func (s *MeDeletion) GetRequestedAt() time.Time {
-	return s.RequestedAt
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListOIDCProvidersOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetProviders returns the value of Providers.
+func (s *ListOIDCProvidersOutputBody) GetProviders() []OIDCProvider {
+	return s.Providers
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MeDeletion) GetAdditionalProps() MeDeletionAdditional {
+func (s *ListOIDCProvidersOutputBody) GetAdditionalProps() ListOIDCProvidersOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetCooldownEndsAt sets the value of CooldownEndsAt.
-func (s *MeDeletion) SetCooldownEndsAt(val time.Time) {
-	s.CooldownEndsAt = val
+// SetSchema sets the value of Schema.
+func (s *ListOIDCProvidersOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetRequestedAt sets the value of RequestedAt.
-func (s *MeDeletion) SetRequestedAt(val time.Time) {
-	s.RequestedAt = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListOIDCProvidersOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
+}
+
+// SetProviders sets the value of Providers.
+func (s *ListOIDCProvidersOutputBody) SetProviders(val []OIDCProvider) {
+	s.Providers = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MeDeletion) SetAdditionalProps(val MeDeletionAdditional) {
+func (s *ListOIDCProvidersOutputBody) SetAdditionalProps(val ListOIDCProvidersOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MeDeletionAdditional map[string]jx.Raw
+type ListOIDCProvidersOutputBodyAdditional map[string]jx.Raw
 
-func (s *MeDeletionAdditional) init() MeDeletionAdditional {
+func (s *ListOIDCProvidersOutputBodyAdditional) init() ListOIDCProvidersOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5478,91 +5712,96 @@ func (s *MeDeletionAdditional) init() MeDeletionAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MeGlobal
-type MeGlobal struct {
-	AccountId string    `json:"accountId"`
-	AvatarUrl OptString `json:"avatarUrl"`
-	// When the account was created (accounts.created_at).
-	CreatedAt        time.Time          `json:"createdAt"`
-	Handle           OptString          `json:"handle"`
-	Handles          []MeIdentityHandle `json:"handles"`
-	HomeJurisdiction OptString          `json:"homeJurisdiction"`
-	AdditionalProps  MeGlobalAdditional
+// Ref: #/components/schemas/ListOrgCIBuildkiteClustersOutputBody
+type ListOrgCIBuildkiteClustersOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI                      `json:"$schema"`
+	Clusters        []OrgCIBuildkiteClusterView `json:"clusters"`
+	AdditionalProps ListOrgCIBuildkiteClustersOutputBodyAdditional
 }
 
-// GetAccountId returns the value of AccountId.
-func (s *MeGlobal) GetAccountId() string {
-	return s.AccountId
+// GetSchema returns the value of Schema.
+func (s *ListOrgCIBuildkiteClustersOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetAvatarUrl returns the value of AvatarUrl.
-func (s *MeGlobal) GetAvatarUrl() OptString {
-	return s.AvatarUrl
+// GetClusters returns the value of Clusters.
+func (s *ListOrgCIBuildkiteClustersOutputBody) GetClusters() []OrgCIBuildkiteClusterView {
+	return s.Clusters
 }
 
-// GetCreatedAt returns the value of CreatedAt.
-func (s *MeGlobal) GetCreatedAt() time.Time {
-	return s.CreatedAt
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListOrgCIBuildkiteClustersOutputBody) GetAdditionalProps() ListOrgCIBuildkiteClustersOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetHandle returns the value of Handle.
-func (s *MeGlobal) GetHandle() OptString {
-	return s.Handle
+// SetSchema sets the value of Schema.
+func (s *ListOrgCIBuildkiteClustersOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetHandles returns the value of Handles.
-func (s *MeGlobal) GetHandles() []MeIdentityHandle {
-	return s.Handles
+// SetClusters sets the value of Clusters.
+func (s *ListOrgCIBuildkiteClustersOutputBody) SetClusters(val []OrgCIBuildkiteClusterView) {
+	s.Clusters = val
 }
 
-// GetHomeJurisdiction returns the value of HomeJurisdiction.
-func (s *MeGlobal) GetHomeJurisdiction() OptString {
-	return s.HomeJurisdiction
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListOrgCIBuildkiteClustersOutputBody) SetAdditionalProps(val ListOrgCIBuildkiteClustersOutputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *MeGlobal) GetAdditionalProps() MeGlobalAdditional {
-	return s.AdditionalProps
+type ListOrgCIBuildkiteClustersOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListOrgCIBuildkiteClustersOutputBodyAdditional) init() ListOrgCIBuildkiteClustersOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// SetAccountId sets the value of AccountId.
-func (s *MeGlobal) SetAccountId(val string) {
-	s.AccountId = val
+// Ref: #/components/schemas/ListOrgCIBuildkiteCredentialsOutputBody
+type ListOrgCIBuildkiteCredentialsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI                         `json:"$schema"`
+	Credentials     []OrgCIBuildkiteCredentialView `json:"credentials"`
+	AdditionalProps ListOrgCIBuildkiteCredentialsOutputBodyAdditional
 }
 
-// SetAvatarUrl sets the value of AvatarUrl.
-func (s *MeGlobal) SetAvatarUrl(val OptString) {
-	s.AvatarUrl = val
+// GetSchema returns the value of Schema.
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetCreatedAt sets the value of CreatedAt.
-func (s *MeGlobal) SetCreatedAt(val time.Time) {
-	s.CreatedAt = val
+// GetCredentials returns the value of Credentials.
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) GetCredentials() []OrgCIBuildkiteCredentialView {
+	return s.Credentials
 }
 
-// SetHandle sets the value of Handle.
-func (s *MeGlobal) SetHandle(val OptString) {
-	s.Handle = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) GetAdditionalProps() ListOrgCIBuildkiteCredentialsOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// SetHandles sets the value of Handles.
-func (s *MeGlobal) SetHandles(val []MeIdentityHandle) {
-	s.Handles = val
+// SetSchema sets the value of Schema.
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetHomeJurisdiction sets the value of HomeJurisdiction.
-func (s *MeGlobal) SetHomeJurisdiction(val OptString) {
-	s.HomeJurisdiction = val
+// SetCredentials sets the value of Credentials.
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) SetCredentials(val []OrgCIBuildkiteCredentialView) {
+	s.Credentials = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MeGlobal) SetAdditionalProps(val MeGlobalAdditional) {
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) SetAdditionalProps(val ListOrgCIBuildkiteCredentialsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MeGlobalAdditional map[string]jx.Raw
+type ListOrgCIBuildkiteCredentialsOutputBodyAdditional map[string]jx.Raw
 
-func (s *MeGlobalAdditional) init() MeGlobalAdditional {
+func (s *ListOrgCIBuildkiteCredentialsOutputBodyAdditional) init() ListOrgCIBuildkiteCredentialsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5571,70 +5810,59 @@ func (s *MeGlobalAdditional) init() MeGlobalAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MeIdentityHandle
-type MeIdentityHandle struct {
-	// The provider's publicly-visible profile email (from the provider at login; may be empty). NOT the
-	// account's contact email.
-	Email           OptString `json:"email"`
-	Handle          string    `json:"handle"`
-	Provider        string    `json:"provider"`
-	ProviderUserId  string    `json:"providerUserId"`
-	AdditionalProps MeIdentityHandleAdditional
-}
-
-// GetEmail returns the value of Email.
-func (s *MeIdentityHandle) GetEmail() OptString {
-	return s.Email
+// Ref: #/components/schemas/ListOrgMembersOutputBody
+type ListOrgMembersOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema  OptURI       `json:"$schema"`
+	Members []Membership `json:"members"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListOrgMembersOutputBodyAdditional
 }
 
-// GetHandle returns the value of Handle.
-func (s *MeIdentityHandle) GetHandle() string {
-	return s.Handle
+// GetSchema returns the value of Schema.
+func (s *ListOrgMembersOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetProvider returns the value of Provider.
-func (s *MeIdentityHandle) GetProvider() string {
-	return s.Provider
+// GetMembers returns the value of Members.
+func (s *ListOrgMembersOutputBody) GetMembers() []Membership {
+	return s.Members
 }
 
-// GetProviderUserId returns the value of ProviderUserId.
-func (s *MeIdentityHandle) GetProviderUserId() string {
-	return s.ProviderUserId
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListOrgMembersOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MeIdentityHandle) GetAdditionalProps() MeIdentityHandleAdditional {
+func (s *ListOrgMembersOutputBody) GetAdditionalProps() ListOrgMembersOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetEmail sets the value of Email.
-func (s *MeIdentityHandle) SetEmail(val OptString) {
-	s.Email = val
-}
-
-// SetHandle sets the value of Handle.
-func (s *MeIdentityHandle) SetHandle(val string) {
-	s.Handle = val
+// SetSchema sets the value of Schema.
+func (s *ListOrgMembersOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetProvider sets the value of Provider.
-func (s *MeIdentityHandle) SetProvider(val string) {
-	s.Provider = val
+// SetMembers sets the value of Members.
+func (s *ListOrgMembersOutputBody) SetMembers(val []Membership) {
+	s.Members = val
 }
 
-// SetProviderUserId sets the value of ProviderUserId.
-func (s *MeIdentityHandle) SetProviderUserId(val string) {
-	s.ProviderUserId = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListOrgMembersOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MeIdentityHandle) SetAdditionalProps(val MeIdentityHandleAdditional) {
+func (s *ListOrgMembersOutputBody) SetAdditionalProps(val ListOrgMembersOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MeIdentityHandleAdditional map[string]jx.Raw
+type ListOrgMembersOutputBodyAdditional map[string]jx.Raw
 
-func (s *MeIdentityHandleAdditional) init() MeIdentityHandleAdditional {
+func (s *ListOrgMembersOutputBodyAdditional) init() ListOrgMembersOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5643,79 +5871,70 @@ func (s *MeIdentityHandleAdditional) init() MeIdentityHandleAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MeRegional
-type MeRegional struct {
-	Bio             OptString `json:"bio"`
-	Company         OptString `json:"company"`
-	DisplayName     OptString `json:"displayName"`
-	Email           OptString `json:"email"`
-	Location        OptString `json:"location"`
-	AdditionalProps MeRegionalAdditional
-}
-
-// GetBio returns the value of Bio.
-func (s *MeRegional) GetBio() OptString {
-	return s.Bio
+// Ref: #/components/schemas/ListOrgProjectsOutputBody
+type ListOrgProjectsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString  `json:"nextPageToken"`
+	Project         OptProject `json:"project"`
+	Projects        []Project  `json:"projects"`
+	AdditionalProps ListOrgProjectsOutputBodyAdditional
 }
 
-// GetCompany returns the value of Company.
-func (s *MeRegional) GetCompany() OptString {
-	return s.Company
+// GetSchema returns the value of Schema.
+func (s *ListOrgProjectsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetDisplayName returns the value of DisplayName.
-func (s *MeRegional) GetDisplayName() OptString {
-	return s.DisplayName
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListOrgProjectsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
-// GetEmail returns the value of Email.
-func (s *MeRegional) GetEmail() OptString {
-	return s.Email
+// GetProject returns the value of Project.
+func (s *ListOrgProjectsOutputBody) GetProject() OptProject {
+	return s.Project
 }
 
-// GetLocation returns the value of Location.
-func (s *MeRegional) GetLocation() OptString {
-	return s.Location
+// GetProjects returns the value of Projects.
+func (s *ListOrgProjectsOutputBody) GetProjects() []Project {
+	return s.Projects
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MeRegional) GetAdditionalProps() MeRegionalAdditional {
+func (s *ListOrgProjectsOutputBody) GetAdditionalProps() ListOrgProjectsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetBio sets the value of Bio.
-func (s *MeRegional) SetBio(val OptString) {
-	s.Bio = val
-}
-
-// SetCompany sets the value of Company.
-func (s *MeRegional) SetCompany(val OptString) {
-	s.Company = val
+// SetSchema sets the value of Schema.
+func (s *ListOrgProjectsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetDisplayName sets the value of DisplayName.
-func (s *MeRegional) SetDisplayName(val OptString) {
-	s.DisplayName = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListOrgProjectsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
-// SetEmail sets the value of Email.
-func (s *MeRegional) SetEmail(val OptString) {
-	s.Email = val
+// SetProject sets the value of Project.
+func (s *ListOrgProjectsOutputBody) SetProject(val OptProject) {
+	s.Project = val
 }
 
-// SetLocation sets the value of Location.
-func (s *MeRegional) SetLocation(val OptString) {
-	s.Location = val
+// SetProjects sets the value of Projects.
+func (s *ListOrgProjectsOutputBody) SetProjects(val []Project) {
+	s.Projects = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MeRegional) SetAdditionalProps(val MeRegionalAdditional) {
+func (s *ListOrgProjectsOutputBody) SetAdditionalProps(val ListOrgProjectsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MeRegionalAdditional map[string]jx.Raw
+type ListOrgProjectsOutputBodyAdditional map[string]jx.Raw
 
-func (s *MeRegionalAdditional) init() MeRegionalAdditional {
+func (s *ListOrgProjectsOutputBodyAdditional) init() ListOrgProjectsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5724,72 +5943,70 @@ func (s *MeRegionalAdditional) init() MeRegionalAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MeRegionalUnavailable
-type MeRegionalUnavailable struct {
-	// Always 'foreign_jurisdiction'. Discriminator for client-side state machines.
-	Error MeRegionalUnavailableError `json:"error"`
-	// Deep link into the home console for this account.
-	HomeCoreUrl string `json:"homeCoreUrl"`
-	// The account's home jurisdiction (e.g. 'us', 'eu').
-	Jurisdiction string `json:"jurisdiction"`
-	// Human-readable copy ready to surface in a UI.
-	Message         string `json:"message"`
-	AdditionalProps MeRegionalUnavailableAdditional
+// Ref: #/components/schemas/ListOrgsOutputBody
+type ListOrgsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	Org             OptOrg    `json:"org"`
+	Orgs            []Org     `json:"orgs"`
+	AdditionalProps ListOrgsOutputBodyAdditional
 }
 
-// GetError returns the value of Error.
-func (s *MeRegionalUnavailable) GetError() MeRegionalUnavailableError {
-	return s.Error
+// GetSchema returns the value of Schema.
+func (s *ListOrgsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetHomeCoreUrl returns the value of HomeCoreUrl.
-func (s *MeRegionalUnavailable) GetHomeCoreUrl() string {
-	return s.HomeCoreUrl
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListOrgsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
-// GetJurisdiction returns the value of Jurisdiction.
-func (s *MeRegionalUnavailable) GetJurisdiction() string {
-	return s.Jurisdiction
+// GetOrg returns the value of Org.
+func (s *ListOrgsOutputBody) GetOrg() OptOrg {
+	return s.Org
 }
 
-// GetMessage returns the value of Message.
-func (s *MeRegionalUnavailable) GetMessage() string {
-	return s.Message
+// GetOrgs returns the value of Orgs.
+func (s *ListOrgsOutputBody) GetOrgs() []Org {
+	return s.Orgs
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MeRegionalUnavailable) GetAdditionalProps() MeRegionalUnavailableAdditional {
+func (s *ListOrgsOutputBody) GetAdditionalProps() ListOrgsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetError sets the value of Error.
-func (s *MeRegionalUnavailable) SetError(val MeRegionalUnavailableError) {
-	s.Error = val
+// SetSchema sets the value of Schema.
+func (s *ListOrgsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetHomeCoreUrl sets the value of HomeCoreUrl.
-func (s *MeRegionalUnavailable) SetHomeCoreUrl(val string) {
-	s.HomeCoreUrl = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListOrgsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
-// SetJurisdiction sets the value of Jurisdiction.
-func (s *MeRegionalUnavailable) SetJurisdiction(val string) {
-	s.Jurisdiction = val
+// SetOrg sets the value of Org.
+func (s *ListOrgsOutputBody) SetOrg(val OptOrg) {
+	s.Org = val
 }
 
-// SetMessage sets the value of Message.
-func (s *MeRegionalUnavailable) SetMessage(val string) {
-	s.Message = val
+// SetOrgs sets the value of Orgs.
+func (s *ListOrgsOutputBody) SetOrgs(val []Org) {
+	s.Orgs = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MeRegionalUnavailable) SetAdditionalProps(val MeRegionalUnavailableAdditional) {
+func (s *ListOrgsOutputBody) SetAdditionalProps(val ListOrgsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MeRegionalUnavailableAdditional map[string]jx.Raw
+type ListOrgsOutputBodyAdditional map[string]jx.Raw
 
-func (s *MeRegionalUnavailableAdditional) init() MeRegionalUnavailableAdditional {
+func (s *ListOrgsOutputBodyAdditional) init() ListOrgsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5798,148 +6015,107 @@ func (s *MeRegionalUnavailableAdditional) init() MeRegionalUnavailableAdditional
 	return m
 }
 
-// Always 'foreign_jurisdiction'. Discriminator for client-side state machines.
-type MeRegionalUnavailableError string
-
-const (
-	MeRegionalUnavailableErrorForeignJurisdiction MeRegionalUnavailableError = "foreign_jurisdiction"
-)
-
-// AllValues returns all MeRegionalUnavailableError values.
-func (MeRegionalUnavailableError) AllValues() []MeRegionalUnavailableError {
-	return []MeRegionalUnavailableError{
-		MeRegionalUnavailableErrorForeignJurisdiction,
-	}
+// ListOrgsOutputBodyHeaders wraps ListOrgsOutputBody with response headers.
+type ListOrgsOutputBodyHeaders struct {
+	CacheControl OptString
+	ETag         OptString
+	Vary         OptString
+	Response     ListOrgsOutputBody
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s MeRegionalUnavailableError) MarshalText() ([]byte, error) {
-	switch s {
-	case MeRegionalUnavailableErrorForeignJurisdiction:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// GetCacheControl returns the value of CacheControl.
+func (s *ListOrgsOutputBodyHeaders) GetCacheControl() OptString {
+	return s.CacheControl
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *MeRegionalUnavailableError) UnmarshalText(data []byte) error {
-	switch MeRegionalUnavailableError(data) {
-	case MeRegionalUnavailableErrorForeignJurisdiction:
-		*s = MeRegionalUnavailableErrorForeignJurisdiction
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
+// GetETag returns the value of ETag.
+func (s *ListOrgsOutputBodyHeaders) GetETag() OptString {
+	return s.ETag
 }
 
-// Ref: #/components/schemas/Membership
-type Membership struct {
-	// A URL to the JSON Schema for this object.
-	Schema                OptURI    `json:"$schema"`
-	AccountId             string    `json:"accountId"`
-	CreatedAt             time.Time `json:"createdAt"`
-	ID                    string    `json:"id"`
-	OrgId                 string    `json:"orgId"`
-	Role                  string    `json:"role"`
-	Status                string    `json:"status"`
-	WorkosOrgMembershipId OptString `json:"workosOrgMembershipId"`
-	AdditionalProps       MembershipAdditional
+// GetVary returns the value of Vary.
+func (s *ListOrgsOutputBodyHeaders) GetVary() OptString {
+	return s.Vary
 }
 
-// GetSchema returns the value of Schema.
-func (s *Membership) GetSchema() OptURI {
-	return s.Schema
+// GetResponse returns the value of Response.
+func (s *ListOrgsOutputBodyHeaders) GetResponse() ListOrgsOutputBody {
+	return s.Response
 }
 
-// GetAccountId returns the value of AccountId.
-func (s *Membership) GetAccountId() string {
-	return s.AccountId
+// SetCacheControl sets the value of CacheControl.
+func (s *ListOrgsOutputBodyHeaders) SetCacheControl(val OptString) {
+	s.CacheControl = val
 }
 
-// GetCreatedAt returns the value of CreatedAt.
-func (s *Membership) GetCreatedAt() time.Time {
-	return s.CreatedAt
+// SetETag sets the value of ETag.
+func (s *ListOrgsOutputBodyHeaders) SetETag(val OptString) {
+	s.ETag = val
 }
 
-// GetID returns the value of ID.
-func (s *Membership) GetID() string {
-	return s.ID
+// SetVary sets the value of Vary.
+func (s *ListOrgsOutputBodyHeaders) SetVary(val OptString) {
+	s.Vary = val
 }
 
-// GetOrgId returns the value of OrgId.
-func (s *Membership) GetOrgId() string {
-	return s.OrgId
+// SetResponse sets the value of Response.
+func (s *ListOrgsOutputBodyHeaders) SetResponse(val ListOrgsOutputBody) {
+	s.Response = val
 }
 
-// GetRole returns the value of Role.
-func (s *Membership) GetRole() string {
-	return s.Role
+// Ref: #/components/schemas/ListProjectMembersOutputBody
+type ListProjectMembersOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema  OptURI         `json:"$schema"`
+	Members []ProjectGrant `json:"members"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListProjectMembersOutputBodyAdditional
 }
 
-// GetStatus returns the value of Status.
-func (s *Membership) GetStatus() string {
-	return s.Status
+// GetSchema returns the value of Schema.
+func (s *ListProjectMembersOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetWorkosOrgMembershipId returns the value of WorkosOrgMembershipId.
-func (s *Membership) GetWorkosOrgMembershipId() OptString {
-	return s.WorkosOrgMembershipId
+// GetMembers returns the value of Members.
+func (s *ListProjectMembersOutputBody) GetMembers() []ProjectGrant {
+	return s.Members
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListProjectMembersOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *Membership) GetAdditionalProps() MembershipAdditional {
+func (s *ListProjectMembersOutputBody) GetAdditionalProps() ListProjectMembersOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *Membership) SetSchema(val OptURI) {
+func (s *ListProjectMembersOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetAccountId sets the value of AccountId.
-func (s *Membership) SetAccountId(val string) {
-	s.AccountId = val
-}
-
-// SetCreatedAt sets the value of CreatedAt.
-func (s *Membership) SetCreatedAt(val time.Time) {
-	s.CreatedAt = val
-}
-
-// SetID sets the value of ID.
-func (s *Membership) SetID(val string) {
-	s.ID = val
-}
-
-// SetOrgId sets the value of OrgId.
-func (s *Membership) SetOrgId(val string) {
-	s.OrgId = val
-}
-
-// SetRole sets the value of Role.
-func (s *Membership) SetRole(val string) {
-	s.Role = val
-}
-
-// SetStatus sets the value of Status.
-func (s *Membership) SetStatus(val string) {
-	s.Status = val
+// SetMembers sets the value of Members.
+func (s *ListProjectMembersOutputBody) SetMembers(val []ProjectGrant) {
+	s.Members = val
 }
 
-// SetWorkosOrgMembershipId sets the value of WorkosOrgMembershipId.
-func (s *Membership) SetWorkosOrgMembershipId(val OptString) {
-	s.WorkosOrgMembershipId = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListProjectMembersOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *Membership) SetAdditionalProps(val MembershipAdditional) {
+func (s *ListProjectMembersOutputBody) SetAdditionalProps(val ListProjectMembersOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MembershipAdditional map[string]jx.Raw
+type ListProjectMembersOutputBodyAdditional map[string]jx.Raw
 
-func (s *MembershipAdditional) init() MembershipAdditional {
+func (s *ListProjectMembersOutputBodyAdditional) init() ListProjectMembersOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -5948,183 +6124,191 @@ func (s *MembershipAdditional) init() MembershipAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/Mirror
-type Mirror struct {
+// Ref: #/components/schemas/ListProjectReposOutputBody
+type ListProjectReposOutputBody struct {
 	// A URL to the JSON Schema for this object.
 	Schema OptURI `json:"$schema"`
-	// Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.
-	Cell OptString `json:"cell"`
-	// Public host of the cluster serving this mirror.
-	ClusterHost    string    `json:"clusterHost"`
-	CreatedAt      time.Time `json:"createdAt"`
-	InstallationId OptInt64  `json:"installationId"`
-	IsArchived     OptBool   `json:"isArchived"`
-	IsPrivate      OptBool   `json:"isPrivate"`
-	Jurisdiction   OptString `json:"jurisdiction"`
-	MirrorId       string    `json:"mirrorId"`
-	Owner          string    `json:"owner"`
-	Provider       string    `json:"provider"`
-	Repo           string    `json:"repo"`
-	// Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or
-	// suspended.
-	Status          OptMirrorStatus `json:"status"`
-	SuspendedAt     OptDateTime     `json:"suspendedAt"`
-	AdditionalProps MirrorAdditional
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	Repo            OptRepo   `json:"repo"`
+	Repos           []Repo    `json:"repos"`
+	AdditionalProps ListProjectReposOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *Mirror) GetSchema() OptURI {
+func (s *ListProjectReposOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetCell returns the value of Cell.
-func (s *Mirror) GetCell() OptString {
-	return s.Cell
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListProjectReposOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
-// GetClusterHost returns the value of ClusterHost.
-func (s *Mirror) GetClusterHost() string {
-	return s.ClusterHost
+// GetRepo returns the value of Repo.
+func (s *ListProjectReposOutputBody) GetRepo() OptRepo {
+	return s.Repo
 }
 
-// GetCreatedAt returns the value of CreatedAt.
-func (s *Mirror) GetCreatedAt() time.Time {
-	return s.CreatedAt
+// GetRepos returns the value of Repos.
+func (s *ListProjectReposOutputBody) GetRepos() []Repo {
+	return s.Repos
 }
 
-// GetInstallationId returns the value of InstallationId.
-func (s *Mirror) GetInstallationId() OptInt64 {
-	return s.InstallationId
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListProjectReposOutputBody) GetAdditionalProps() ListProjectReposOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// GetIsArchived returns the value of IsArchived.
-func (s *Mirror) GetIsArchived() OptBool {
-	return s.IsArchived
+// SetSchema sets the value of Schema.
+func (s *ListProjectReposOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// GetIsPrivate returns the value of IsPrivate.
-func (s *Mirror) GetIsPrivate() OptBool {
-	return s.IsPrivate
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListProjectReposOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
-// GetJurisdiction returns the value of Jurisdiction.
-func (s *Mirror) GetJurisdiction() OptString {
-	return s.Jurisdiction
+// SetRepo sets the value of Repo.
+func (s *ListProjectReposOutputBody) SetRepo(val OptRepo) {
+	s.Repo = val
 }
 
-// GetMirrorId returns the value of MirrorId.
-func (s *Mirror) GetMirrorId() string {
-	return s.MirrorId
+// SetRepos sets the value of Repos.
+func (s *ListProjectReposOutputBody) SetRepos(val []Repo) {
+	s.Repos = val
 }
 
-// GetOwner returns the value of Owner.
-func (s *Mirror) GetOwner() string {
-	return s.Owner
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListProjectReposOutputBody) SetAdditionalProps(val ListProjectReposOutputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// GetProvider returns the value of Provider.
-func (s *Mirror) GetProvider() string {
-	return s.Provider
+type ListProjectReposOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListProjectReposOutputBodyAdditional) init() ListProjectReposOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// GetRepo returns the value of Repo.
-func (s *Mirror) GetRepo() string {
-	return s.Repo
+// Ref: #/components/schemas/ListProjectsOutputBody
+type ListProjectsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString  `json:"nextPageToken"`
+	Project         OptProject `json:"project"`
+	Projects        []Project  `json:"projects"`
+	AdditionalProps ListProjectsOutputBodyAdditional
 }
 
-// GetStatus returns the value of Status.
-func (s *Mirror) GetStatus() OptMirrorStatus {
-	return s.Status
+// GetSchema returns the value of Schema.
+func (s *ListProjectsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetSuspendedAt returns the value of SuspendedAt.
-func (s *Mirror) GetSuspendedAt() OptDateTime {
-	return s.SuspendedAt
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListProjectsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetProject returns the value of Project.
+func (s *ListProjectsOutputBody) GetProject() OptProject {
+	return s.Project
+}
+
+// GetProjects returns the value of Projects.
+func (s *ListProjectsOutputBody) GetProjects() []Project {
+	return s.Projects
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *Mirror) GetAdditionalProps() MirrorAdditional {
+func (s *ListProjectsOutputBody) GetAdditionalProps() ListProjectsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *Mirror) SetSchema(val OptURI) {
+func (s *ListProjectsOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetCell sets the value of Cell.
-func (s *Mirror) SetCell(val OptString) {
-	s.Cell = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListProjectsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
-// SetClusterHost sets the value of ClusterHost.
-func (s *Mirror) SetClusterHost(val string) {
-	s.ClusterHost = val
+// SetProject sets the value of Project.
+func (s *ListProjectsOutputBody) SetProject(val OptProject) {
+	s.Project = val
 }
 
-// SetCreatedAt sets the value of CreatedAt.
-func (s *Mirror) SetCreatedAt(val time.Time) {
-	s.CreatedAt = val
+// SetProjects sets the value of Projects.
+func (s *ListProjectsOutputBody) SetProjects(val []Project) {
+	s.Projects = val
 }
 
-// SetInstallationId sets the value of InstallationId.
-func (s *Mirror) SetInstallationId(val OptInt64) {
-	s.InstallationId = val
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListProjectsOutputBody) SetAdditionalProps(val ListProjectsOutputBodyAdditional) {
+	s.AdditionalProps = val
 }
 
-// SetIsArchived sets the value of IsArchived.
-func (s *Mirror) SetIsArchived(val OptBool) {
-	s.IsArchived = val
+type ListProjectsOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListProjectsOutputBodyAdditional) init() ListProjectsOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// SetIsPrivate sets the value of IsPrivate.
-func (s *Mirror) SetIsPrivate(val OptBool) {
-	s.IsPrivate = val
+// Ref: #/components/schemas/ListRepoCIBuildsOutputBody
+type ListRepoCIBuildsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI        `json:"$schema"`
+	Builds          []CIBuildView `json:"builds"`
+	AdditionalProps ListRepoCIBuildsOutputBodyAdditional
 }
 
-// SetJurisdiction sets the value of Jurisdiction.
-func (s *Mirror) SetJurisdiction(val OptString) {
-	s.Jurisdiction = val
+// GetSchema returns the value of Schema.
+func (s *ListRepoCIBuildsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetMirrorId sets the value of MirrorId.
-func (s *Mirror) SetMirrorId(val string) {
-	s.MirrorId = val
+// GetBuilds returns the value of Builds.
+func (s *ListRepoCIBuildsOutputBody) GetBuilds() []CIBuildView {
+	return s.Builds
 }
 
-// SetOwner sets the value of Owner.
-func (s *Mirror) SetOwner(val string) {
-	s.Owner = val
-}
-
-// SetProvider sets the value of Provider.
-func (s *Mirror) SetProvider(val string) {
-	s.Provider = val
-}
-
-// SetRepo sets the value of Repo.
-func (s *Mirror) SetRepo(val string) {
-	s.Repo = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListRepoCIBuildsOutputBody) GetAdditionalProps() ListRepoCIBuildsOutputBodyAdditional {
+	return s.AdditionalProps
 }
 
-// SetStatus sets the value of Status.
-func (s *Mirror) SetStatus(val OptMirrorStatus) {
-	s.Status = val
+// SetSchema sets the value of Schema.
+func (s *ListRepoCIBuildsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetSuspendedAt sets the value of SuspendedAt.
-func (s *Mirror) SetSuspendedAt(val OptDateTime) {
-	s.SuspendedAt = val
+// SetBuilds sets the value of Builds.
+func (s *ListRepoCIBuildsOutputBody) SetBuilds(val []CIBuildView) {
+	s.Builds = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *Mirror) SetAdditionalProps(val MirrorAdditional) {
+func (s *ListRepoCIBuildsOutputBody) SetAdditionalProps(val ListRepoCIBuildsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MirrorAdditional map[string]jx.Raw
+type ListRepoCIBuildsOutputBodyAdditional map[string]jx.Raw
 
-func (s *MirrorAdditional) init() MirrorAdditional {
+func (s *ListRepoCIBuildsOutputBodyAdditional) init() ListRepoCIBuildsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -6133,59 +6317,47 @@ func (s *MirrorAdditional) init() MirrorAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MirrorCollaborator
-type MirrorCollaborator struct {
-	AccountId string `json:"accountId"`
-	// Primary handle (provider:label), empty if none resolves.
-	Handle OptString `json:"handle"`
-	// Reader (pull) or writer (pull+push).
-	Role            string `json:"role"`
-	AdditionalProps MirrorCollaboratorAdditional
-}
-
-// GetAccountId returns the value of AccountId.
-func (s *MirrorCollaborator) GetAccountId() string {
-	return s.AccountId
+// Ref: #/components/schemas/ListRepoCIProvidersOutputBody
+type ListRepoCIProvidersOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI                 `json:"$schema"`
+	Providers       []CIProviderDescriptor `json:"providers"`
+	AdditionalProps ListRepoCIProvidersOutputBodyAdditional
 }
 
-// GetHandle returns the value of Handle.
-func (s *MirrorCollaborator) GetHandle() OptString {
-	return s.Handle
+// GetSchema returns the value of Schema.
+func (s *ListRepoCIProvidersOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetRole returns the value of Role.
-func (s *MirrorCollaborator) GetRole() string {
-	return s.Role
+// GetProviders returns the value of Providers.
+func (s *ListRepoCIProvidersOutputBody) GetProviders() []CIProviderDescriptor {
+	return s.Providers
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MirrorCollaborator) GetAdditionalProps() MirrorCollaboratorAdditional {
+func (s *ListRepoCIProvidersOutputBody) GetAdditionalProps() ListRepoCIProvidersOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetAccountId sets the value of AccountId.
-func (s *MirrorCollaborator) SetAccountId(val string) {
-	s.AccountId = val
-}
-
-// SetHandle sets the value of Handle.
-func (s *MirrorCollaborator) SetHandle(val OptString) {
-	s.Handle = val
+// SetSchema sets the value of Schema.
+func (s *ListRepoCIProvidersOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetRole sets the value of Role.
-func (s *MirrorCollaborator) SetRole(val string) {
-	s.Role = val
+// SetProviders sets the value of Providers.
+func (s *ListRepoCIProvidersOutputBody) SetProviders(val []CIProviderDescriptor) {
+	s.Providers = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MirrorCollaborator) SetAdditionalProps(val MirrorCollaboratorAdditional) {
+func (s *ListRepoCIProvidersOutputBody) SetAdditionalProps(val ListRepoCIProvidersOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MirrorCollaboratorAdditional map[string]jx.Raw
+type ListRepoCIProvidersOutputBodyAdditional map[string]jx.Raw
 
-func (s *MirrorCollaboratorAdditional) init() MirrorCollaboratorAdditional {
+func (s *ListRepoCIProvidersOutputBodyAdditional) init() ListRepoCIProvidersOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -6194,80 +6366,47 @@ func (s *MirrorCollaboratorAdditional) init() MirrorCollaboratorAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MirrorRequest
-type MirrorRequest struct {
+// Ref: #/components/schemas/ListRepoCIWebhookAuditOutputBody
+type ListRepoCIWebhookAuditOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI                  `json:"$schema"`
-	Failure         OptMirrorRequestFailure `json:"failure"`
-	RequestId       uuid.UUID               `json:"requestId"`
-	Result          OptMirrorRequestResult  `json:"result"`
-	Status          MirrorRequestStatus     `json:"status"`
-	AdditionalProps MirrorRequestAdditional
+	Schema          OptURI                    `json:"$schema"`
+	Events          []CIWebhookAuditEventView `json:"events"`
+	AdditionalProps ListRepoCIWebhookAuditOutputBodyAdditional
 }
 
 // GetSchema returns the value of Schema.
-func (s *MirrorRequest) GetSchema() OptURI {
+func (s *ListRepoCIWebhookAuditOutputBody) GetSchema() OptURI {
 	return s.Schema
 }
 
-// GetFailure returns the value of Failure.
-func (s *MirrorRequest) GetFailure() OptMirrorRequestFailure {
-	return s.Failure
-}
-
-// GetRequestId returns the value of RequestId.
-func (s *MirrorRequest) GetRequestId() uuid.UUID {
-	return s.RequestId
-}
-
-// GetResult returns the value of Result.
-func (s *MirrorRequest) GetResult() OptMirrorRequestResult {
-	return s.Result
-}
-
-// GetStatus returns the value of Status.
-func (s *MirrorRequest) GetStatus() MirrorRequestStatus {
-	return s.Status
+// GetEvents returns the value of Events.
+func (s *ListRepoCIWebhookAuditOutputBody) GetEvents() []CIWebhookAuditEventView {
+	return s.Events
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MirrorRequest) GetAdditionalProps() MirrorRequestAdditional {
+func (s *ListRepoCIWebhookAuditOutputBody) GetAdditionalProps() ListRepoCIWebhookAuditOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
 // SetSchema sets the value of Schema.
-func (s *MirrorRequest) SetSchema(val OptURI) {
+func (s *ListRepoCIWebhookAuditOutputBody) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
-// SetFailure sets the value of Failure.
-func (s *MirrorRequest) SetFailure(val OptMirrorRequestFailure) {
-	s.Failure = val
-}
-
-// SetRequestId sets the value of RequestId.
-func (s *MirrorRequest) SetRequestId(val uuid.UUID) {
-	s.RequestId = val
-}
-
-// SetResult sets the value of Result.
-func (s *MirrorRequest) SetResult(val OptMirrorRequestResult) {
-	s.Result = val
-}
-
-// SetStatus sets the value of Status.
-func (s *MirrorRequest) SetStatus(val MirrorRequestStatus) {
-	s.Status = val
+// SetEvents sets the value of Events.
+func (s *ListRepoCIWebhookAuditOutputBody) SetEvents(val []CIWebhookAuditEventView) {
+	s.Events = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MirrorRequest) SetAdditionalProps(val MirrorRequestAdditional) {
+func (s *ListRepoCIWebhookAuditOutputBody) SetAdditionalProps(val ListRepoCIWebhookAuditOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MirrorRequestAdditional map[string]jx.Raw
+type ListRepoCIWebhookAuditOutputBodyAdditional map[string]jx.Raw
 
-func (s *MirrorRequestAdditional) init() MirrorRequestAdditional {
+func (s *ListRepoCIWebhookAuditOutputBodyAdditional) init() ListRepoCIWebhookAuditOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -6276,59 +6415,47 @@ func (s *MirrorRequestAdditional) init() MirrorRequestAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/MirrorRequestFailure
-type MirrorRequestFailure struct {
-	// Stable machine-readable failure code.
-	Code    string `json:"code"`
-	Message string `json:"message"`
-	// Whether submitting a new request may succeed without changing its inputs.
-	Retryable       bool `json:"retryable"`
-	AdditionalProps MirrorRequestFailureAdditional
-}
-
-// GetCode returns the value of Code.
-func (s *MirrorRequestFailure) GetCode() string {
-	return s.Code
+// Ref: #/components/schemas/ListRepoCIWebhooksOutputBody
+type ListRepoCIWebhooksOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI          `json:"$schema"`
+	Subscriptions   []CIWebhookView `json:"subscriptions"`
+	AdditionalProps ListRepoCIWebhooksOutputBodyAdditional
 }
 
-// GetMessage returns the value of Message.
-func (s *MirrorRequestFailure) GetMessage() string {
-	return s.Message
+// GetSchema returns the value of Schema.
+func (s *ListRepoCIWebhooksOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetRetryable returns the value of Retryable.
-func (s *MirrorRequestFailure) GetRetryable() bool {
-	return s.Retryable
+// GetSubscriptions returns the value of Subscriptions.
+func (s *ListRepoCIWebhooksOutputBody) GetSubscriptions() []CIWebhookView {
+	return s.Subscriptions
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MirrorRequestFailure) GetAdditionalProps() MirrorRequestFailureAdditional {
+func (s *ListRepoCIWebhooksOutputBody) GetAdditionalProps() ListRepoCIWebhooksOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetCode sets the value of Code.
-func (s *MirrorRequestFailure) SetCode(val string) {
-	s.Code = val
-}
-
-// SetMessage sets the value of Message.
-func (s *MirrorRequestFailure) SetMessage(val string) {
-	s.Message = val
+// SetSchema sets the value of Schema.
+func (s *ListRepoCIWebhooksOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetRetryable sets the value of Retryable.
-func (s *MirrorRequestFailure) SetRetryable(val bool) {
-	s.Retryable = val
+// SetSubscriptions sets the value of Subscriptions.
+func (s *ListRepoCIWebhooksOutputBody) SetSubscriptions(val []CIWebhookView) {
+	s.Subscriptions = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MirrorRequestFailure) SetAdditionalProps(val MirrorRequestFailureAdditional) {
+func (s *ListRepoCIWebhooksOutputBody) SetAdditionalProps(val ListRepoCIWebhooksOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MirrorRequestFailureAdditional map[string]jx.Raw
+type ListRepoCIWebhooksOutputBodyAdditional map[string]jx.Raw
 
-func (s *MirrorRequestFailureAdditional) init() MirrorRequestFailureAdditional {
+func (s *ListRepoCIWebhooksOutputBodyAdditional) init() ListRepoCIWebhooksOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -6337,83 +6464,59 @@ func (s *MirrorRequestFailureAdditional) init() MirrorRequestFailureAdditional {
 	return m
 }
 
-// MirrorRequestHeaders wraps MirrorRequest with response headers.
-type MirrorRequestHeaders struct {
-	Location OptString
-	Response MirrorRequest
-}
-
-// GetLocation returns the value of Location.
-func (s *MirrorRequestHeaders) GetLocation() OptString {
-	return s.Location
-}
-
-// GetResponse returns the value of Response.
-func (s *MirrorRequestHeaders) GetResponse() MirrorRequest {
-	return s.Response
-}
-
-// SetLocation sets the value of Location.
-func (s *MirrorRequestHeaders) SetLocation(val OptString) {
-	s.Location = val
-}
-
-// SetResponse sets the value of Response.
-func (s *MirrorRequestHeaders) SetResponse(val MirrorRequest) {
-	s.Response = val
-}
-
-// Ref: #/components/schemas/MirrorRequestResult
-type MirrorRequestResult struct {
-	MirrorId        string `json:"mirrorId"`
-	MirrorUrl       string `json:"mirrorUrl"`
-	PublicUrl       string `json:"publicUrl"`
-	AdditionalProps MirrorRequestResultAdditional
+// Ref: #/components/schemas/ListRepoCollaboratorsOutputBody
+type ListRepoCollaboratorsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema        OptURI             `json:"$schema"`
+	Collaborators []RepoCollaborator `json:"collaborators"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListRepoCollaboratorsOutputBodyAdditional
 }
 
-// GetMirrorId returns the value of MirrorId.
-func (s *MirrorRequestResult) GetMirrorId() string {
-	return s.MirrorId
+// GetSchema returns the value of Schema.
+func (s *ListRepoCollaboratorsOutputBody) GetSchema() OptURI {
+	return s.Schema
 }
 
-// GetMirrorUrl returns the value of MirrorUrl.
-func (s *MirrorRequestResult) GetMirrorUrl() string {
-	return s.MirrorUrl
+// GetCollaborators returns the value of Collaborators.
+func (s *ListRepoCollaboratorsOutputBody) GetCollaborators() []RepoCollaborator {
+	return s.Collaborators
 }
 
-// GetPublicUrl returns the value of PublicUrl.
-func (s *MirrorRequestResult) GetPublicUrl() string {
-	return s.PublicUrl
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListRepoCollaboratorsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
 }
 
 // GetAdditionalProps returns the value of AdditionalProps.
-func (s *MirrorRequestResult) GetAdditionalProps() MirrorRequestResultAdditional {
+func (s *ListRepoCollaboratorsOutputBody) GetAdditionalProps() ListRepoCollaboratorsOutputBodyAdditional {
 	return s.AdditionalProps
 }
 
-// SetMirrorId sets the value of MirrorId.
-func (s *MirrorRequestResult) SetMirrorId(val string) {
-	s.MirrorId = val
+// SetSchema sets the value of Schema.
+func (s *ListRepoCollaboratorsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetMirrorUrl sets the value of MirrorUrl.
-func (s *MirrorRequestResult) SetMirrorUrl(val string) {
-	s.MirrorUrl = val
+// SetCollaborators sets the value of Collaborators.
+func (s *ListRepoCollaboratorsOutputBody) SetCollaborators(val []RepoCollaborator) {
+	s.Collaborators = val
 }
 
-// SetPublicUrl sets the value of PublicUrl.
-func (s *MirrorRequestResult) SetPublicUrl(val string) {
-	s.PublicUrl = val
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListRepoCollaboratorsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *MirrorRequestResult) SetAdditionalProps(val MirrorRequestResultAdditional) {
+func (s *ListRepoCollaboratorsOutputBody) SetAdditionalProps(val ListRepoCollaboratorsOutputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type MirrorRequestResultAdditional map[string]jx.Raw
+type ListRepoCollaboratorsOutputBodyAdditional map[string]jx.Raw
 
-func (s *MirrorRequestResultAdditional) init() MirrorRequestResultAdditional {
+func (s *ListRepoCollaboratorsOutputBodyAdditional) init() ListRepoCollaboratorsOutputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -6422,220 +6525,3246 @@ func (s *MirrorRequestResultAdditional) init() MirrorRequestResultAdditional {
 	return m
 }
 
-type MirrorRequestStatus string
-
-const (
-	MirrorRequestStatusPending    MirrorRequestStatus = "pending"
-	MirrorRequestStatusProcessing MirrorRequestStatus = "processing"
-	MirrorRequestStatusSucceeded  MirrorRequestStatus = "succeeded"
-	MirrorRequestStatusFailed     MirrorRequestStatus = "failed"
+// Ref: #/components/schemas/ListRepoGrantsOutputBody
+type ListRepoGrantsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI      `json:"$schema"`
+	Grants []RepoGrant `json:"grants"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListRepoGrantsOutputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ListRepoGrantsOutputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetGrants returns the value of Grants.
+func (s *ListRepoGrantsOutputBody) GetGrants() []RepoGrant {
+	return s.Grants
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListRepoGrantsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListRepoGrantsOutputBody) GetAdditionalProps() ListRepoGrantsOutputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ListRepoGrantsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetGrants sets the value of Grants.
+func (s *ListRepoGrantsOutputBody) SetGrants(val []RepoGrant) {
+	s.Grants = val
+}
+
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListRepoGrantsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListRepoGrantsOutputBody) SetAdditionalProps(val ListRepoGrantsOutputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ListRepoGrantsOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListRepoGrantsOutputBodyAdditional) init() ListRepoGrantsOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Filter on repo_facts.archived.
+type ListReposArchived string
+
+const (
+	ListReposArchivedTrue  ListReposArchived = "true"
+	ListReposArchivedFalse ListReposArchived = "false"
 )
 
-// AllValues returns all MirrorRequestStatus values.
-func (MirrorRequestStatus) AllValues() []MirrorRequestStatus {
-	return []MirrorRequestStatus{
-		MirrorRequestStatusPending,
-		MirrorRequestStatusProcessing,
-		MirrorRequestStatusSucceeded,
-		MirrorRequestStatusFailed,
+// AllValues returns all ListReposArchived values.
+func (ListReposArchived) AllValues() []ListReposArchived {
+	return []ListReposArchived{
+		ListReposArchivedTrue,
+		ListReposArchivedFalse,
 	}
 }
 
 // MarshalText implements encoding.TextMarshaler.
-func (s MirrorRequestStatus) MarshalText() ([]byte, error) {
+func (s ListReposArchived) MarshalText() ([]byte, error) {
 	switch s {
-	case MirrorRequestStatusPending:
+	case ListReposArchivedTrue:
 		return []byte(s), nil
-	case MirrorRequestStatusProcessing:
+	case ListReposArchivedFalse:
 		return []byte(s), nil
-	case MirrorRequestStatusSucceeded:
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposArchived) UnmarshalText(data []byte) error {
+	switch ListReposArchived(data) {
+	case ListReposArchivedTrue:
+		*s = ListReposArchivedTrue
+		return nil
+	case ListReposArchivedFalse:
+		*s = ListReposArchivedFalse
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// True: repo_facts.checkpoint_count > 0; false: no checkpoints (0 or unobserved).
+type ListReposHasCheckpoints string
+
+const (
+	ListReposHasCheckpointsTrue  ListReposHasCheckpoints = "true"
+	ListReposHasCheckpointsFalse ListReposHasCheckpoints = "false"
+)
+
+// AllValues returns all ListReposHasCheckpoints values.
+func (ListReposHasCheckpoints) AllValues() []ListReposHasCheckpoints {
+	return []ListReposHasCheckpoints{
+		ListReposHasCheckpointsTrue,
+		ListReposHasCheckpointsFalse,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ListReposHasCheckpoints) MarshalText() ([]byte, error) {
+	switch s {
+	case ListReposHasCheckpointsTrue:
 		return []byte(s), nil
-	case MirrorRequestStatusFailed:
+	case ListReposHasCheckpointsFalse:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposHasCheckpoints) UnmarshalText(data []byte) error {
+	switch ListReposHasCheckpoints(data) {
+	case ListReposHasCheckpointsTrue:
+		*s = ListReposHasCheckpointsTrue
+		return nil
+	case ListReposHasCheckpointsFalse:
+		*s = ListReposHasCheckpointsFalse
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Direction for a single bare sort key; defaults to asc. Ignored when sort carries per-key
+// :asc/:desc suffixes. Encoded into the cursor (authoritative on continuation).
+type ListReposOrder string
+
+const (
+	ListReposOrderAsc  ListReposOrder = "asc"
+	ListReposOrderDesc ListReposOrder = "desc"
+)
+
+// AllValues returns all ListReposOrder values.
+func (ListReposOrder) AllValues() []ListReposOrder {
+	return []ListReposOrder{
+		ListReposOrderAsc,
+		ListReposOrderDesc,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ListReposOrder) MarshalText() ([]byte, error) {
+	switch s {
+	case ListReposOrderAsc:
+		return []byte(s), nil
+	case ListReposOrderDesc:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposOrder) UnmarshalText(data []byte) error {
+	switch ListReposOrder(data) {
+	case ListReposOrderAsc:
+		*s = ListReposOrderAsc
+		return nil
+	case ListReposOrderDesc:
+		*s = ListReposOrderDesc
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/ListReposOutputBody
+type ListReposOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema               OptURI `json:"$schema"`
+	CandidatesIncomplete bool   `json:"candidatesIncomplete"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString        `json:"nextPageToken"`
+	Repos           []RepoIndexEntry `json:"repos"`
+	Truncated       bool             `json:"truncated"`
+	AdditionalProps ListReposOutputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ListReposOutputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetCandidatesIncomplete returns the value of CandidatesIncomplete.
+func (s *ListReposOutputBody) GetCandidatesIncomplete() bool {
+	return s.CandidatesIncomplete
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListReposOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetRepos returns the value of Repos.
+func (s *ListReposOutputBody) GetRepos() []RepoIndexEntry {
+	return s.Repos
+}
+
+// GetTruncated returns the value of Truncated.
+func (s *ListReposOutputBody) GetTruncated() bool {
+	return s.Truncated
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListReposOutputBody) GetAdditionalProps() ListReposOutputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ListReposOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetCandidatesIncomplete sets the value of CandidatesIncomplete.
+func (s *ListReposOutputBody) SetCandidatesIncomplete(val bool) {
+	s.CandidatesIncomplete = val
+}
+
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListReposOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
+}
+
+// SetRepos sets the value of Repos.
+func (s *ListReposOutputBody) SetRepos(val []RepoIndexEntry) {
+	s.Repos = val
+}
+
+// SetTruncated sets the value of Truncated.
+func (s *ListReposOutputBody) SetTruncated(val bool) {
+	s.Truncated = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListReposOutputBody) SetAdditionalProps(val ListReposOutputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ListReposOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListReposOutputBodyAdditional) init() ListReposOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Minimum caller access tier: read (all), write (write+admin), or admin. Also accepts permission[eq];
+//
+//	permission[ne] is rejected.
+type ListReposPermission string
+
+const (
+	ListReposPermissionRead  ListReposPermission = "read"
+	ListReposPermissionWrite ListReposPermission = "write"
+	ListReposPermissionAdmin ListReposPermission = "admin"
+)
+
+// AllValues returns all ListReposPermission values.
+func (ListReposPermission) AllValues() []ListReposPermission {
+	return []ListReposPermission{
+		ListReposPermissionRead,
+		ListReposPermissionWrite,
+		ListReposPermissionAdmin,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ListReposPermission) MarshalText() ([]byte, error) {
+	switch s {
+	case ListReposPermissionRead:
+		return []byte(s), nil
+	case ListReposPermissionWrite:
+		return []byte(s), nil
+	case ListReposPermissionAdmin:
 		return []byte(s), nil
 	default:
 		return nil, errors.Errorf("invalid value: %q", s)
 	}
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *MirrorRequestStatus) UnmarshalText(data []byte) error {
-	switch MirrorRequestStatus(data) {
-	case MirrorRequestStatusPending:
-		*s = MirrorRequestStatusPending
-		return nil
-	case MirrorRequestStatusProcessing:
-		*s = MirrorRequestStatusProcessing
-		return nil
-	case MirrorRequestStatusSucceeded:
-		*s = MirrorRequestStatusSucceeded
-		return nil
-	case MirrorRequestStatusFailed:
-		*s = MirrorRequestStatusFailed
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposPermission) UnmarshalText(data []byte) error {
+	switch ListReposPermission(data) {
+	case ListReposPermissionRead:
+		*s = ListReposPermissionRead
+		return nil
+	case ListReposPermissionWrite:
+		*s = ListReposPermissionWrite
+		return nil
+	case ListReposPermissionAdmin:
+		*s = ListReposPermissionAdmin
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.
+type ListReposScope string
+
+const (
+	ListReposScopeOnboarded ListReposScope = "onboarded"
+	ListReposScopeAll       ListReposScope = "all"
+)
+
+// AllValues returns all ListReposScope values.
+func (ListReposScope) AllValues() []ListReposScope {
+	return []ListReposScope{
+		ListReposScopeOnboarded,
+		ListReposScopeAll,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ListReposScope) MarshalText() ([]byte, error) {
+	switch s {
+	case ListReposScopeOnboarded:
+		return []byte(s), nil
+	case ListReposScopeAll:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposScope) UnmarshalText(data []byte) error {
+	switch ListReposScope(data) {
+	case ListReposScopeOnboarded:
+		*s = ListReposScopeOnboarded
+		return nil
+	case ListReposScopeAll:
+		*s = ListReposScopeAll
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Filter on placement/candidacy lifecycle. inactive requires scope=all. Also accepts
+// status[eq]/status[ne].
+type ListReposStatus string
+
+const (
+	ListReposStatusMirrored   ListReposStatus = "mirrored"
+	ListReposStatusProcessing ListReposStatus = "processing"
+	ListReposStatusInactive   ListReposStatus = "inactive"
+)
+
+// AllValues returns all ListReposStatus values.
+func (ListReposStatus) AllValues() []ListReposStatus {
+	return []ListReposStatus{
+		ListReposStatusMirrored,
+		ListReposStatusProcessing,
+		ListReposStatusInactive,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ListReposStatus) MarshalText() ([]byte, error) {
+	switch s {
+	case ListReposStatusMirrored:
+		return []byte(s), nil
+	case ListReposStatusProcessing:
+		return []byte(s), nil
+	case ListReposStatusInactive:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposStatus) UnmarshalText(data []byte) error {
+	switch ListReposStatus(data) {
+	case ListReposStatusMirrored:
+		*s = ListReposStatusMirrored
+		return nil
+	case ListReposStatusProcessing:
+		*s = ListReposStatusProcessing
+		return nil
+	case ListReposStatusInactive:
+		*s = ListReposStatusInactive
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Filter on the observed repo_facts.private fact (public: private=false; private: private=true).
+// Also accepts visibility[eq]/visibility[ne].
+type ListReposVisibility string
+
+const (
+	ListReposVisibilityPublic  ListReposVisibility = "public"
+	ListReposVisibilityPrivate ListReposVisibility = "private"
+)
+
+// AllValues returns all ListReposVisibility values.
+func (ListReposVisibility) AllValues() []ListReposVisibility {
+	return []ListReposVisibility{
+		ListReposVisibilityPublic,
+		ListReposVisibilityPrivate,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ListReposVisibility) MarshalText() ([]byte, error) {
+	switch s {
+	case ListReposVisibilityPublic:
+		return []byte(s), nil
+	case ListReposVisibilityPrivate:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ListReposVisibility) UnmarshalText(data []byte) error {
+	switch ListReposVisibility(data) {
+	case ListReposVisibilityPublic:
+		*s = ListReposVisibilityPublic
+		return nil
+	case ListReposVisibilityPrivate:
+		*s = ListReposVisibilityPrivate
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/ListServiceAccountGrantsOutputBody
+type ListServiceAccountGrantsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI                `json:"$schema"`
+	Grants []ServiceAccountGrant `json:"grants"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps ListServiceAccountGrantsOutputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ListServiceAccountGrantsOutputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetGrants returns the value of Grants.
+func (s *ListServiceAccountGrantsOutputBody) GetGrants() []ServiceAccountGrant {
+	return s.Grants
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListServiceAccountGrantsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListServiceAccountGrantsOutputBody) GetAdditionalProps() ListServiceAccountGrantsOutputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ListServiceAccountGrantsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetGrants sets the value of Grants.
+func (s *ListServiceAccountGrantsOutputBody) SetGrants(val []ServiceAccountGrant) {
+	s.Grants = val
+}
+
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListServiceAccountGrantsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListServiceAccountGrantsOutputBody) SetAdditionalProps(val ListServiceAccountGrantsOutputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ListServiceAccountGrantsOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListServiceAccountGrantsOutputBodyAdditional) init() ListServiceAccountGrantsOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/ListServiceAccountsOutputBody
+type ListServiceAccountsOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString                  `json:"nextPageToken"`
+	ServiceAccounts []ServiceAccountWithGrants `json:"serviceAccounts"`
+	AdditionalProps ListServiceAccountsOutputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ListServiceAccountsOutputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *ListServiceAccountsOutputBody) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetServiceAccounts returns the value of ServiceAccounts.
+func (s *ListServiceAccountsOutputBody) GetServiceAccounts() []ServiceAccountWithGrants {
+	return s.ServiceAccounts
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ListServiceAccountsOutputBody) GetAdditionalProps() ListServiceAccountsOutputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ListServiceAccountsOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetNextPageToken sets the value of NextPageToken.
+func (s *ListServiceAccountsOutputBody) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
+}
+
+// SetServiceAccounts sets the value of ServiceAccounts.
+func (s *ListServiceAccountsOutputBody) SetServiceAccounts(val []ServiceAccountWithGrants) {
+	s.ServiceAccounts = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ListServiceAccountsOutputBody) SetAdditionalProps(val ListServiceAccountsOutputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ListServiceAccountsOutputBodyAdditional map[string]jx.Raw
+
+func (s *ListServiceAccountsOutputBodyAdditional) init() ListServiceAccountsOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/LookupBySlugOutputBody
+type LookupBySlugOutputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI `json:"$schema"`
+	Cell            string `json:"cell"`
+	Jurisdiction    string `json:"jurisdiction"`
+	Owner           string `json:"owner"`
+	Repo            string `json:"repo"`
+	RepoId          string `json:"repoId"`
+	AdditionalProps LookupBySlugOutputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *LookupBySlugOutputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetCell returns the value of Cell.
+func (s *LookupBySlugOutputBody) GetCell() string {
+	return s.Cell
+}
+
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *LookupBySlugOutputBody) GetJurisdiction() string {
+	return s.Jurisdiction
+}
+
+// GetOwner returns the value of Owner.
+func (s *LookupBySlugOutputBody) GetOwner() string {
+	return s.Owner
+}
+
+// GetRepo returns the value of Repo.
+func (s *LookupBySlugOutputBody) GetRepo() string {
+	return s.Repo
+}
+
+// GetRepoId returns the value of RepoId.
+func (s *LookupBySlugOutputBody) GetRepoId() string {
+	return s.RepoId
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *LookupBySlugOutputBody) GetAdditionalProps() LookupBySlugOutputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *LookupBySlugOutputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetCell sets the value of Cell.
+func (s *LookupBySlugOutputBody) SetCell(val string) {
+	s.Cell = val
+}
+
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *LookupBySlugOutputBody) SetJurisdiction(val string) {
+	s.Jurisdiction = val
+}
+
+// SetOwner sets the value of Owner.
+func (s *LookupBySlugOutputBody) SetOwner(val string) {
+	s.Owner = val
+}
+
+// SetRepo sets the value of Repo.
+func (s *LookupBySlugOutputBody) SetRepo(val string) {
+	s.Repo = val
+}
+
+// SetRepoId sets the value of RepoId.
+func (s *LookupBySlugOutputBody) SetRepoId(val string) {
+	s.RepoId = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *LookupBySlugOutputBody) SetAdditionalProps(val LookupBySlugOutputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type LookupBySlugOutputBodyAdditional map[string]jx.Raw
+
+func (s *LookupBySlugOutputBodyAdditional) init() LookupBySlugOutputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MeAuth
+type MeAuth struct {
+	Provider        string `json:"provider"`
+	ProviderUserId  string `json:"providerUserId"`
+	AdditionalProps MeAuthAdditional
+}
+
+// GetProvider returns the value of Provider.
+func (s *MeAuth) GetProvider() string {
+	return s.Provider
+}
+
+// GetProviderUserId returns the value of ProviderUserId.
+func (s *MeAuth) GetProviderUserId() string {
+	return s.ProviderUserId
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MeAuth) GetAdditionalProps() MeAuthAdditional {
+	return s.AdditionalProps
+}
+
+// SetProvider sets the value of Provider.
+func (s *MeAuth) SetProvider(val string) {
+	s.Provider = val
+}
+
+// SetProviderUserId sets the value of ProviderUserId.
+func (s *MeAuth) SetProviderUserId(val string) {
+	s.ProviderUserId = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MeAuth) SetAdditionalProps(val MeAuthAdditional) {
+	s.AdditionalProps = val
+}
+
+type MeAuthAdditional map[string]jx.Raw
+
+func (s *MeAuthAdditional) init() MeAuthAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MeDeletion
+type MeDeletion struct {
+	// When the cooldown elapses and the account becomes eligible for irreversible hard-deletion.
+	CooldownEndsAt time.Time `json:"cooldownEndsAt"`
+	// When deletion was requested (deletion_requested_at).
+	RequestedAt     time.Time `json:"requestedAt"`
+	AdditionalProps MeDeletionAdditional
+}
+
+// GetCooldownEndsAt returns the value of CooldownEndsAt.
+func (s *MeDeletion) GetCooldownEndsAt() time.Time {
+	return s.CooldownEndsAt
+}
+
+// GetRequestedAt returns the value of RequestedAt.
+func (s *MeDeletion) GetRequestedAt() time.Time {
+	return s.RequestedAt
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MeDeletion) GetAdditionalProps() MeDeletionAdditional {
+	return s.AdditionalProps
+}
+
+// SetCooldownEndsAt sets the value of CooldownEndsAt.
+func (s *MeDeletion) SetCooldownEndsAt(val time.Time) {
+	s.CooldownEndsAt = val
+}
+
+// SetRequestedAt sets the value of RequestedAt.
+func (s *MeDeletion) SetRequestedAt(val time.Time) {
+	s.RequestedAt = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MeDeletion) SetAdditionalProps(val MeDeletionAdditional) {
+	s.AdditionalProps = val
+}
+
+type MeDeletionAdditional map[string]jx.Raw
+
+func (s *MeDeletionAdditional) init() MeDeletionAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MeGlobal
+type MeGlobal struct {
+	AccountId string    `json:"accountId"`
+	AvatarUrl OptString `json:"avatarUrl"`
+	// When the account was created (accounts.created_at).
+	CreatedAt        time.Time          `json:"createdAt"`
+	Handle           OptString          `json:"handle"`
+	Handles          []MeIdentityHandle `json:"handles"`
+	HomeJurisdiction OptString          `json:"homeJurisdiction"`
+	AdditionalProps  MeGlobalAdditional
+}
+
+// GetAccountId returns the value of AccountId.
+func (s *MeGlobal) GetAccountId() string {
+	return s.AccountId
+}
+
+// GetAvatarUrl returns the value of AvatarUrl.
+func (s *MeGlobal) GetAvatarUrl() OptString {
+	return s.AvatarUrl
+}
+
+// GetCreatedAt returns the value of CreatedAt.
+func (s *MeGlobal) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
+// GetHandle returns the value of Handle.
+func (s *MeGlobal) GetHandle() OptString {
+	return s.Handle
+}
+
+// GetHandles returns the value of Handles.
+func (s *MeGlobal) GetHandles() []MeIdentityHandle {
+	return s.Handles
+}
+
+// GetHomeJurisdiction returns the value of HomeJurisdiction.
+func (s *MeGlobal) GetHomeJurisdiction() OptString {
+	return s.HomeJurisdiction
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MeGlobal) GetAdditionalProps() MeGlobalAdditional {
+	return s.AdditionalProps
+}
+
+// SetAccountId sets the value of AccountId.
+func (s *MeGlobal) SetAccountId(val string) {
+	s.AccountId = val
+}
+
+// SetAvatarUrl sets the value of AvatarUrl.
+func (s *MeGlobal) SetAvatarUrl(val OptString) {
+	s.AvatarUrl = val
+}
+
+// SetCreatedAt sets the value of CreatedAt.
+func (s *MeGlobal) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
+// SetHandle sets the value of Handle.
+func (s *MeGlobal) SetHandle(val OptString) {
+	s.Handle = val
+}
+
+// SetHandles sets the value of Handles.
+func (s *MeGlobal) SetHandles(val []MeIdentityHandle) {
+	s.Handles = val
+}
+
+// SetHomeJurisdiction sets the value of HomeJurisdiction.
+func (s *MeGlobal) SetHomeJurisdiction(val OptString) {
+	s.HomeJurisdiction = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MeGlobal) SetAdditionalProps(val MeGlobalAdditional) {
+	s.AdditionalProps = val
+}
+
+type MeGlobalAdditional map[string]jx.Raw
+
+func (s *MeGlobalAdditional) init() MeGlobalAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MeIdentityHandle
+type MeIdentityHandle struct {
+	// The provider's publicly-visible profile email (from the provider at login; may be empty). NOT the
+	// account's contact email.
+	Email           OptString `json:"email"`
+	Handle          string    `json:"handle"`
+	Provider        string    `json:"provider"`
+	ProviderUserId  string    `json:"providerUserId"`
+	AdditionalProps MeIdentityHandleAdditional
+}
+
+// GetEmail returns the value of Email.
+func (s *MeIdentityHandle) GetEmail() OptString {
+	return s.Email
+}
+
+// GetHandle returns the value of Handle.
+func (s *MeIdentityHandle) GetHandle() string {
+	return s.Handle
+}
+
+// GetProvider returns the value of Provider.
+func (s *MeIdentityHandle) GetProvider() string {
+	return s.Provider
+}
+
+// GetProviderUserId returns the value of ProviderUserId.
+func (s *MeIdentityHandle) GetProviderUserId() string {
+	return s.ProviderUserId
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MeIdentityHandle) GetAdditionalProps() MeIdentityHandleAdditional {
+	return s.AdditionalProps
+}
+
+// SetEmail sets the value of Email.
+func (s *MeIdentityHandle) SetEmail(val OptString) {
+	s.Email = val
+}
+
+// SetHandle sets the value of Handle.
+func (s *MeIdentityHandle) SetHandle(val string) {
+	s.Handle = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *MeIdentityHandle) SetProvider(val string) {
+	s.Provider = val
+}
+
+// SetProviderUserId sets the value of ProviderUserId.
+func (s *MeIdentityHandle) SetProviderUserId(val string) {
+	s.ProviderUserId = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MeIdentityHandle) SetAdditionalProps(val MeIdentityHandleAdditional) {
+	s.AdditionalProps = val
+}
+
+type MeIdentityHandleAdditional map[string]jx.Raw
+
+func (s *MeIdentityHandleAdditional) init() MeIdentityHandleAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MeRegional
+type MeRegional struct {
+	Bio             OptString `json:"bio"`
+	Company         OptString `json:"company"`
+	DisplayName     OptString `json:"displayName"`
+	Email           OptString `json:"email"`
+	Location        OptString `json:"location"`
+	AdditionalProps MeRegionalAdditional
+}
+
+// GetBio returns the value of Bio.
+func (s *MeRegional) GetBio() OptString {
+	return s.Bio
+}
+
+// GetCompany returns the value of Company.
+func (s *MeRegional) GetCompany() OptString {
+	return s.Company
+}
+
+// GetDisplayName returns the value of DisplayName.
+func (s *MeRegional) GetDisplayName() OptString {
+	return s.DisplayName
+}
+
+// GetEmail returns the value of Email.
+func (s *MeRegional) GetEmail() OptString {
+	return s.Email
+}
+
+// GetLocation returns the value of Location.
+func (s *MeRegional) GetLocation() OptString {
+	return s.Location
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MeRegional) GetAdditionalProps() MeRegionalAdditional {
+	return s.AdditionalProps
+}
+
+// SetBio sets the value of Bio.
+func (s *MeRegional) SetBio(val OptString) {
+	s.Bio = val
+}
+
+// SetCompany sets the value of Company.
+func (s *MeRegional) SetCompany(val OptString) {
+	s.Company = val
+}
+
+// SetDisplayName sets the value of DisplayName.
+func (s *MeRegional) SetDisplayName(val OptString) {
+	s.DisplayName = val
+}
+
+// SetEmail sets the value of Email.
+func (s *MeRegional) SetEmail(val OptString) {
+	s.Email = val
+}
+
+// SetLocation sets the value of Location.
+func (s *MeRegional) SetLocation(val OptString) {
+	s.Location = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MeRegional) SetAdditionalProps(val MeRegionalAdditional) {
+	s.AdditionalProps = val
+}
+
+type MeRegionalAdditional map[string]jx.Raw
+
+func (s *MeRegionalAdditional) init() MeRegionalAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MeRegionalUnavailable
+type MeRegionalUnavailable struct {
+	// Always 'foreign_jurisdiction'. Discriminator for client-side state machines.
+	Error MeRegionalUnavailableError `json:"error"`
+	// Origin of the account's home core — its OIDC issuer, e.g. 'https://us.auth.entire.io'. Not a
+	// browser link and not the console.
+	HomeCoreUrl string `json:"homeCoreUrl"`
+	// The account's home jurisdiction (e.g. 'us', 'eu').
+	Jurisdiction string `json:"jurisdiction"`
+	// Human-readable copy ready to surface in a UI.
+	Message         string `json:"message"`
+	AdditionalProps MeRegionalUnavailableAdditional
+}
+
+// GetError returns the value of Error.
+func (s *MeRegionalUnavailable) GetError() MeRegionalUnavailableError {
+	return s.Error
+}
+
+// GetHomeCoreUrl returns the value of HomeCoreUrl.
+func (s *MeRegionalUnavailable) GetHomeCoreUrl() string {
+	return s.HomeCoreUrl
+}
+
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *MeRegionalUnavailable) GetJurisdiction() string {
+	return s.Jurisdiction
+}
+
+// GetMessage returns the value of Message.
+func (s *MeRegionalUnavailable) GetMessage() string {
+	return s.Message
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MeRegionalUnavailable) GetAdditionalProps() MeRegionalUnavailableAdditional {
+	return s.AdditionalProps
+}
+
+// SetError sets the value of Error.
+func (s *MeRegionalUnavailable) SetError(val MeRegionalUnavailableError) {
+	s.Error = val
+}
+
+// SetHomeCoreUrl sets the value of HomeCoreUrl.
+func (s *MeRegionalUnavailable) SetHomeCoreUrl(val string) {
+	s.HomeCoreUrl = val
+}
+
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *MeRegionalUnavailable) SetJurisdiction(val string) {
+	s.Jurisdiction = val
+}
+
+// SetMessage sets the value of Message.
+func (s *MeRegionalUnavailable) SetMessage(val string) {
+	s.Message = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MeRegionalUnavailable) SetAdditionalProps(val MeRegionalUnavailableAdditional) {
+	s.AdditionalProps = val
+}
+
+type MeRegionalUnavailableAdditional map[string]jx.Raw
+
+func (s *MeRegionalUnavailableAdditional) init() MeRegionalUnavailableAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Always 'foreign_jurisdiction'. Discriminator for client-side state machines.
+type MeRegionalUnavailableError string
+
+const (
+	MeRegionalUnavailableErrorForeignJurisdiction MeRegionalUnavailableError = "foreign_jurisdiction"
+)
+
+// AllValues returns all MeRegionalUnavailableError values.
+func (MeRegionalUnavailableError) AllValues() []MeRegionalUnavailableError {
+	return []MeRegionalUnavailableError{
+		MeRegionalUnavailableErrorForeignJurisdiction,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s MeRegionalUnavailableError) MarshalText() ([]byte, error) {
+	switch s {
+	case MeRegionalUnavailableErrorForeignJurisdiction:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *MeRegionalUnavailableError) UnmarshalText(data []byte) error {
+	switch MeRegionalUnavailableError(data) {
+	case MeRegionalUnavailableErrorForeignJurisdiction:
+		*s = MeRegionalUnavailableErrorForeignJurisdiction
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/Membership
+type Membership struct {
+	// A URL to the JSON Schema for this object.
+	Schema                OptURI    `json:"$schema"`
+	AccountId             string    `json:"accountId"`
+	CreatedAt             time.Time `json:"createdAt"`
+	Handle                OptString `json:"handle"`
+	ID                    string    `json:"id"`
+	OrgId                 string    `json:"orgId"`
+	Provider              OptString `json:"provider"`
+	Role                  string    `json:"role"`
+	Status                string    `json:"status"`
+	WorkosOrgMembershipId OptString `json:"workosOrgMembershipId"`
+	AdditionalProps       MembershipAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *Membership) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetAccountId returns the value of AccountId.
+func (s *Membership) GetAccountId() string {
+	return s.AccountId
+}
+
+// GetCreatedAt returns the value of CreatedAt.
+func (s *Membership) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
+// GetHandle returns the value of Handle.
+func (s *Membership) GetHandle() OptString {
+	return s.Handle
+}
+
+// GetID returns the value of ID.
+func (s *Membership) GetID() string {
+	return s.ID
+}
+
+// GetOrgId returns the value of OrgId.
+func (s *Membership) GetOrgId() string {
+	return s.OrgId
+}
+
+// GetProvider returns the value of Provider.
+func (s *Membership) GetProvider() OptString {
+	return s.Provider
+}
+
+// GetRole returns the value of Role.
+func (s *Membership) GetRole() string {
+	return s.Role
+}
+
+// GetStatus returns the value of Status.
+func (s *Membership) GetStatus() string {
+	return s.Status
+}
+
+// GetWorkosOrgMembershipId returns the value of WorkosOrgMembershipId.
+func (s *Membership) GetWorkosOrgMembershipId() OptString {
+	return s.WorkosOrgMembershipId
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *Membership) GetAdditionalProps() MembershipAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *Membership) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetAccountId sets the value of AccountId.
+func (s *Membership) SetAccountId(val string) {
+	s.AccountId = val
+}
+
+// SetCreatedAt sets the value of CreatedAt.
+func (s *Membership) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
+// SetHandle sets the value of Handle.
+func (s *Membership) SetHandle(val OptString) {
+	s.Handle = val
+}
+
+// SetID sets the value of ID.
+func (s *Membership) SetID(val string) {
+	s.ID = val
+}
+
+// SetOrgId sets the value of OrgId.
+func (s *Membership) SetOrgId(val string) {
+	s.OrgId = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *Membership) SetProvider(val OptString) {
+	s.Provider = val
+}
+
+// SetRole sets the value of Role.
+func (s *Membership) SetRole(val string) {
+	s.Role = val
+}
+
+// SetStatus sets the value of Status.
+func (s *Membership) SetStatus(val string) {
+	s.Status = val
+}
+
+// SetWorkosOrgMembershipId sets the value of WorkosOrgMembershipId.
+func (s *Membership) SetWorkosOrgMembershipId(val OptString) {
+	s.WorkosOrgMembershipId = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *Membership) SetAdditionalProps(val MembershipAdditional) {
+	s.AdditionalProps = val
+}
+
+type MembershipAdditional map[string]jx.Raw
+
+func (s *MembershipAdditional) init() MembershipAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MintOrgCIGitHubActionsCredentialInputBody
+type MintOrgCIGitHubActionsCredentialInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// GitHub login (user or organization) whose webhooks this credential verifies.
+	Account string `json:"account"`
+	// GitHub API token for outbound workflow dispatch. Optional: omit for an inbound-only credential. On
+	// an existing github-actions row this stores/rotates the token instead of conflicting.
+	APIToken        OptString `json:"api_token"`
+	AdditionalProps MintOrgCIGitHubActionsCredentialInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetAccount returns the value of Account.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) GetAccount() string {
+	return s.Account
+}
+
+// GetAPIToken returns the value of APIToken.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) GetAPIToken() OptString {
+	return s.APIToken
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) GetAdditionalProps() MintOrgCIGitHubActionsCredentialInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetAccount sets the value of Account.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) SetAccount(val string) {
+	s.Account = val
+}
+
+// SetAPIToken sets the value of APIToken.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) SetAPIToken(val OptString) {
+	s.APIToken = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MintOrgCIGitHubActionsCredentialInputBody) SetAdditionalProps(val MintOrgCIGitHubActionsCredentialInputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type MintOrgCIGitHubActionsCredentialInputBodyAdditional map[string]jx.Raw
+
+func (s *MintOrgCIGitHubActionsCredentialInputBodyAdditional) init() MintOrgCIGitHubActionsCredentialInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/Mirror
+type Mirror struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.
+	Cell OptString `json:"cell"`
+	// Public host of the cluster serving this mirror.
+	ClusterHost    string    `json:"clusterHost"`
+	CreatedAt      time.Time `json:"createdAt"`
+	InstallationId OptInt64  `json:"installationId"`
+	IsArchived     OptBool   `json:"isArchived"`
+	IsPrivate      OptBool   `json:"isPrivate"`
+	Jurisdiction   OptString `json:"jurisdiction"`
+	MirrorId       string    `json:"mirrorId"`
+	Owner          string    `json:"owner"`
+	Provider       string    `json:"provider"`
+	Repo           string    `json:"repo"`
+	// Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or
+	// suspended.
+	Status          OptMirrorStatus `json:"status"`
+	SuspendedAt     OptDateTime     `json:"suspendedAt"`
+	AdditionalProps MirrorAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *Mirror) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetCell returns the value of Cell.
+func (s *Mirror) GetCell() OptString {
+	return s.Cell
+}
+
+// GetClusterHost returns the value of ClusterHost.
+func (s *Mirror) GetClusterHost() string {
+	return s.ClusterHost
+}
+
+// GetCreatedAt returns the value of CreatedAt.
+func (s *Mirror) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
+// GetInstallationId returns the value of InstallationId.
+func (s *Mirror) GetInstallationId() OptInt64 {
+	return s.InstallationId
+}
+
+// GetIsArchived returns the value of IsArchived.
+func (s *Mirror) GetIsArchived() OptBool {
+	return s.IsArchived
+}
+
+// GetIsPrivate returns the value of IsPrivate.
+func (s *Mirror) GetIsPrivate() OptBool {
+	return s.IsPrivate
+}
+
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *Mirror) GetJurisdiction() OptString {
+	return s.Jurisdiction
+}
+
+// GetMirrorId returns the value of MirrorId.
+func (s *Mirror) GetMirrorId() string {
+	return s.MirrorId
+}
+
+// GetOwner returns the value of Owner.
+func (s *Mirror) GetOwner() string {
+	return s.Owner
+}
+
+// GetProvider returns the value of Provider.
+func (s *Mirror) GetProvider() string {
+	return s.Provider
+}
+
+// GetRepo returns the value of Repo.
+func (s *Mirror) GetRepo() string {
+	return s.Repo
+}
+
+// GetStatus returns the value of Status.
+func (s *Mirror) GetStatus() OptMirrorStatus {
+	return s.Status
+}
+
+// GetSuspendedAt returns the value of SuspendedAt.
+func (s *Mirror) GetSuspendedAt() OptDateTime {
+	return s.SuspendedAt
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *Mirror) GetAdditionalProps() MirrorAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *Mirror) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetCell sets the value of Cell.
+func (s *Mirror) SetCell(val OptString) {
+	s.Cell = val
+}
+
+// SetClusterHost sets the value of ClusterHost.
+func (s *Mirror) SetClusterHost(val string) {
+	s.ClusterHost = val
+}
+
+// SetCreatedAt sets the value of CreatedAt.
+func (s *Mirror) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
+// SetInstallationId sets the value of InstallationId.
+func (s *Mirror) SetInstallationId(val OptInt64) {
+	s.InstallationId = val
+}
+
+// SetIsArchived sets the value of IsArchived.
+func (s *Mirror) SetIsArchived(val OptBool) {
+	s.IsArchived = val
+}
+
+// SetIsPrivate sets the value of IsPrivate.
+func (s *Mirror) SetIsPrivate(val OptBool) {
+	s.IsPrivate = val
+}
+
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *Mirror) SetJurisdiction(val OptString) {
+	s.Jurisdiction = val
+}
+
+// SetMirrorId sets the value of MirrorId.
+func (s *Mirror) SetMirrorId(val string) {
+	s.MirrorId = val
+}
+
+// SetOwner sets the value of Owner.
+func (s *Mirror) SetOwner(val string) {
+	s.Owner = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *Mirror) SetProvider(val string) {
+	s.Provider = val
+}
+
+// SetRepo sets the value of Repo.
+func (s *Mirror) SetRepo(val string) {
+	s.Repo = val
+}
+
+// SetStatus sets the value of Status.
+func (s *Mirror) SetStatus(val OptMirrorStatus) {
+	s.Status = val
+}
+
+// SetSuspendedAt sets the value of SuspendedAt.
+func (s *Mirror) SetSuspendedAt(val OptDateTime) {
+	s.SuspendedAt = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *Mirror) SetAdditionalProps(val MirrorAdditional) {
+	s.AdditionalProps = val
+}
+
+type MirrorAdditional map[string]jx.Raw
+
+func (s *MirrorAdditional) init() MirrorAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MirrorCollaborator
+type MirrorCollaborator struct {
+	AccountId string `json:"accountId"`
+	// Primary handle (provider:label), empty if none resolves.
+	Handle OptString `json:"handle"`
+	// Reader (pull) or writer (pull+push).
+	Role            string `json:"role"`
+	AdditionalProps MirrorCollaboratorAdditional
+}
+
+// GetAccountId returns the value of AccountId.
+func (s *MirrorCollaborator) GetAccountId() string {
+	return s.AccountId
+}
+
+// GetHandle returns the value of Handle.
+func (s *MirrorCollaborator) GetHandle() OptString {
+	return s.Handle
+}
+
+// GetRole returns the value of Role.
+func (s *MirrorCollaborator) GetRole() string {
+	return s.Role
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MirrorCollaborator) GetAdditionalProps() MirrorCollaboratorAdditional {
+	return s.AdditionalProps
+}
+
+// SetAccountId sets the value of AccountId.
+func (s *MirrorCollaborator) SetAccountId(val string) {
+	s.AccountId = val
+}
+
+// SetHandle sets the value of Handle.
+func (s *MirrorCollaborator) SetHandle(val OptString) {
+	s.Handle = val
+}
+
+// SetRole sets the value of Role.
+func (s *MirrorCollaborator) SetRole(val string) {
+	s.Role = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MirrorCollaborator) SetAdditionalProps(val MirrorCollaboratorAdditional) {
+	s.AdditionalProps = val
+}
+
+type MirrorCollaboratorAdditional map[string]jx.Raw
+
+func (s *MirrorCollaboratorAdditional) init() MirrorCollaboratorAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MirrorRequest
+type MirrorRequest struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI                  `json:"$schema"`
+	Failure         OptMirrorRequestFailure `json:"failure"`
+	RequestId       uuid.UUID               `json:"requestId"`
+	Result          OptMirrorRequestResult  `json:"result"`
+	Status          MirrorRequestStatus     `json:"status"`
+	AdditionalProps MirrorRequestAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *MirrorRequest) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetFailure returns the value of Failure.
+func (s *MirrorRequest) GetFailure() OptMirrorRequestFailure {
+	return s.Failure
+}
+
+// GetRequestId returns the value of RequestId.
+func (s *MirrorRequest) GetRequestId() uuid.UUID {
+	return s.RequestId
+}
+
+// GetResult returns the value of Result.
+func (s *MirrorRequest) GetResult() OptMirrorRequestResult {
+	return s.Result
+}
+
+// GetStatus returns the value of Status.
+func (s *MirrorRequest) GetStatus() MirrorRequestStatus {
+	return s.Status
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MirrorRequest) GetAdditionalProps() MirrorRequestAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *MirrorRequest) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetFailure sets the value of Failure.
+func (s *MirrorRequest) SetFailure(val OptMirrorRequestFailure) {
+	s.Failure = val
+}
+
+// SetRequestId sets the value of RequestId.
+func (s *MirrorRequest) SetRequestId(val uuid.UUID) {
+	s.RequestId = val
+}
+
+// SetResult sets the value of Result.
+func (s *MirrorRequest) SetResult(val OptMirrorRequestResult) {
+	s.Result = val
+}
+
+// SetStatus sets the value of Status.
+func (s *MirrorRequest) SetStatus(val MirrorRequestStatus) {
+	s.Status = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MirrorRequest) SetAdditionalProps(val MirrorRequestAdditional) {
+	s.AdditionalProps = val
+}
+
+type MirrorRequestAdditional map[string]jx.Raw
+
+func (s *MirrorRequestAdditional) init() MirrorRequestAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/MirrorRequestFailure
+type MirrorRequestFailure struct {
+	// Stable machine-readable failure code.
+	Code    string `json:"code"`
+	Message string `json:"message"`
+	// Whether submitting a new request may succeed without changing its inputs.
+	Retryable       bool `json:"retryable"`
+	AdditionalProps MirrorRequestFailureAdditional
+}
+
+// GetCode returns the value of Code.
+func (s *MirrorRequestFailure) GetCode() string {
+	return s.Code
+}
+
+// GetMessage returns the value of Message.
+func (s *MirrorRequestFailure) GetMessage() string {
+	return s.Message
+}
+
+// GetRetryable returns the value of Retryable.
+func (s *MirrorRequestFailure) GetRetryable() bool {
+	return s.Retryable
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MirrorRequestFailure) GetAdditionalProps() MirrorRequestFailureAdditional {
+	return s.AdditionalProps
+}
+
+// SetCode sets the value of Code.
+func (s *MirrorRequestFailure) SetCode(val string) {
+	s.Code = val
+}
+
+// SetMessage sets the value of Message.
+func (s *MirrorRequestFailure) SetMessage(val string) {
+	s.Message = val
+}
+
+// SetRetryable sets the value of Retryable.
+func (s *MirrorRequestFailure) SetRetryable(val bool) {
+	s.Retryable = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MirrorRequestFailure) SetAdditionalProps(val MirrorRequestFailureAdditional) {
+	s.AdditionalProps = val
+}
+
+type MirrorRequestFailureAdditional map[string]jx.Raw
+
+func (s *MirrorRequestFailureAdditional) init() MirrorRequestFailureAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// MirrorRequestHeaders wraps MirrorRequest with response headers.
+type MirrorRequestHeaders struct {
+	Location OptString
+	Response MirrorRequest
+}
+
+// GetLocation returns the value of Location.
+func (s *MirrorRequestHeaders) GetLocation() OptString {
+	return s.Location
+}
+
+// GetResponse returns the value of Response.
+func (s *MirrorRequestHeaders) GetResponse() MirrorRequest {
+	return s.Response
+}
+
+// SetLocation sets the value of Location.
+func (s *MirrorRequestHeaders) SetLocation(val OptString) {
+	s.Location = val
+}
+
+// SetResponse sets the value of Response.
+func (s *MirrorRequestHeaders) SetResponse(val MirrorRequest) {
+	s.Response = val
+}
+
+// Ref: #/components/schemas/MirrorRequestResult
+type MirrorRequestResult struct {
+	MirrorId        string `json:"mirrorId"`
+	MirrorUrl       string `json:"mirrorUrl"`
+	PublicUrl       string `json:"publicUrl"`
+	AdditionalProps MirrorRequestResultAdditional
+}
+
+// GetMirrorId returns the value of MirrorId.
+func (s *MirrorRequestResult) GetMirrorId() string {
+	return s.MirrorId
+}
+
+// GetMirrorUrl returns the value of MirrorUrl.
+func (s *MirrorRequestResult) GetMirrorUrl() string {
+	return s.MirrorUrl
+}
+
+// GetPublicUrl returns the value of PublicUrl.
+func (s *MirrorRequestResult) GetPublicUrl() string {
+	return s.PublicUrl
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *MirrorRequestResult) GetAdditionalProps() MirrorRequestResultAdditional {
+	return s.AdditionalProps
+}
+
+// SetMirrorId sets the value of MirrorId.
+func (s *MirrorRequestResult) SetMirrorId(val string) {
+	s.MirrorId = val
+}
+
+// SetMirrorUrl sets the value of MirrorUrl.
+func (s *MirrorRequestResult) SetMirrorUrl(val string) {
+	s.MirrorUrl = val
+}
+
+// SetPublicUrl sets the value of PublicUrl.
+func (s *MirrorRequestResult) SetPublicUrl(val string) {
+	s.PublicUrl = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *MirrorRequestResult) SetAdditionalProps(val MirrorRequestResultAdditional) {
+	s.AdditionalProps = val
+}
+
+type MirrorRequestResultAdditional map[string]jx.Raw
+
+func (s *MirrorRequestResultAdditional) init() MirrorRequestResultAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+type MirrorRequestStatus string
+
+const (
+	MirrorRequestStatusPending    MirrorRequestStatus = "pending"
+	MirrorRequestStatusProcessing MirrorRequestStatus = "processing"
+	MirrorRequestStatusSucceeded  MirrorRequestStatus = "succeeded"
+	MirrorRequestStatusFailed     MirrorRequestStatus = "failed"
+)
+
+// AllValues returns all MirrorRequestStatus values.
+func (MirrorRequestStatus) AllValues() []MirrorRequestStatus {
+	return []MirrorRequestStatus{
+		MirrorRequestStatusPending,
+		MirrorRequestStatusProcessing,
+		MirrorRequestStatusSucceeded,
+		MirrorRequestStatusFailed,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s MirrorRequestStatus) MarshalText() ([]byte, error) {
+	switch s {
+	case MirrorRequestStatusPending:
+		return []byte(s), nil
+	case MirrorRequestStatusProcessing:
+		return []byte(s), nil
+	case MirrorRequestStatusSucceeded:
+		return []byte(s), nil
+	case MirrorRequestStatusFailed:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *MirrorRequestStatus) UnmarshalText(data []byte) error {
+	switch MirrorRequestStatus(data) {
+	case MirrorRequestStatusPending:
+		*s = MirrorRequestStatusPending
+		return nil
+	case MirrorRequestStatusProcessing:
+		*s = MirrorRequestStatusProcessing
+		return nil
+	case MirrorRequestStatusSucceeded:
+		*s = MirrorRequestStatusSucceeded
+		return nil
+	case MirrorRequestStatusFailed:
+		*s = MirrorRequestStatusFailed
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or
+// suspended.
+type MirrorStatus string
+
+const (
+	MirrorStatusProcessing MirrorStatus = "processing"
+	MirrorStatusReady      MirrorStatus = "ready"
+	MirrorStatusFailed     MirrorStatus = "failed"
+	MirrorStatusSuspended  MirrorStatus = "suspended"
+)
+
+// AllValues returns all MirrorStatus values.
+func (MirrorStatus) AllValues() []MirrorStatus {
+	return []MirrorStatus{
+		MirrorStatusProcessing,
+		MirrorStatusReady,
+		MirrorStatusFailed,
+		MirrorStatusSuspended,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s MirrorStatus) MarshalText() ([]byte, error) {
+	switch s {
+	case MirrorStatusProcessing:
+		return []byte(s), nil
+	case MirrorStatusReady:
+		return []byte(s), nil
+	case MirrorStatusFailed:
+		return []byte(s), nil
+	case MirrorStatusSuspended:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *MirrorStatus) UnmarshalText(data []byte) error {
+	switch MirrorStatus(data) {
+	case MirrorStatusProcessing:
+		*s = MirrorStatusProcessing
+		return nil
+	case MirrorStatusReady:
+		*s = MirrorStatusReady
+		return nil
+	case MirrorStatusFailed:
+		*s = MirrorStatusFailed
+		return nil
+	case MirrorStatusSuspended:
+		*s = MirrorStatusSuspended
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/NativeMirrorPlacement
+type NativeMirrorPlacement struct {
+	// A URL to the JSON Schema for this object.
+	Schema           OptURI                            `json:"$schema"`
+	Attempts         int64                             `json:"attempts"`
+	ClusterSlug      string                            `json:"clusterSlug"`
+	CreatedAt        time.Time                         `json:"createdAt"`
+	CreationFailedAt OptDateTime                       `json:"creationFailedAt"`
+	DesiredState     NativeMirrorPlacementDesiredState `json:"desiredState"`
+	LastError        OptString                         `json:"lastError"`
+	NextRetryAt      OptDateTime                       `json:"nextRetryAt"`
+	PlacementId      string                            `json:"placementId"`
+	Stage            NativeMirrorPlacementStage        `json:"stage"`
+	Status           NativeMirrorPlacementStatus       `json:"status"`
+	AdditionalProps  NativeMirrorPlacementAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *NativeMirrorPlacement) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetAttempts returns the value of Attempts.
+func (s *NativeMirrorPlacement) GetAttempts() int64 {
+	return s.Attempts
+}
+
+// GetClusterSlug returns the value of ClusterSlug.
+func (s *NativeMirrorPlacement) GetClusterSlug() string {
+	return s.ClusterSlug
+}
+
+// GetCreatedAt returns the value of CreatedAt.
+func (s *NativeMirrorPlacement) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
+// GetCreationFailedAt returns the value of CreationFailedAt.
+func (s *NativeMirrorPlacement) GetCreationFailedAt() OptDateTime {
+	return s.CreationFailedAt
+}
+
+// GetDesiredState returns the value of DesiredState.
+func (s *NativeMirrorPlacement) GetDesiredState() NativeMirrorPlacementDesiredState {
+	return s.DesiredState
+}
+
+// GetLastError returns the value of LastError.
+func (s *NativeMirrorPlacement) GetLastError() OptString {
+	return s.LastError
+}
+
+// GetNextRetryAt returns the value of NextRetryAt.
+func (s *NativeMirrorPlacement) GetNextRetryAt() OptDateTime {
+	return s.NextRetryAt
+}
+
+// GetPlacementId returns the value of PlacementId.
+func (s *NativeMirrorPlacement) GetPlacementId() string {
+	return s.PlacementId
+}
+
+// GetStage returns the value of Stage.
+func (s *NativeMirrorPlacement) GetStage() NativeMirrorPlacementStage {
+	return s.Stage
+}
+
+// GetStatus returns the value of Status.
+func (s *NativeMirrorPlacement) GetStatus() NativeMirrorPlacementStatus {
+	return s.Status
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *NativeMirrorPlacement) GetAdditionalProps() NativeMirrorPlacementAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *NativeMirrorPlacement) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetAttempts sets the value of Attempts.
+func (s *NativeMirrorPlacement) SetAttempts(val int64) {
+	s.Attempts = val
+}
+
+// SetClusterSlug sets the value of ClusterSlug.
+func (s *NativeMirrorPlacement) SetClusterSlug(val string) {
+	s.ClusterSlug = val
+}
+
+// SetCreatedAt sets the value of CreatedAt.
+func (s *NativeMirrorPlacement) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
+// SetCreationFailedAt sets the value of CreationFailedAt.
+func (s *NativeMirrorPlacement) SetCreationFailedAt(val OptDateTime) {
+	s.CreationFailedAt = val
+}
+
+// SetDesiredState sets the value of DesiredState.
+func (s *NativeMirrorPlacement) SetDesiredState(val NativeMirrorPlacementDesiredState) {
+	s.DesiredState = val
+}
+
+// SetLastError sets the value of LastError.
+func (s *NativeMirrorPlacement) SetLastError(val OptString) {
+	s.LastError = val
+}
+
+// SetNextRetryAt sets the value of NextRetryAt.
+func (s *NativeMirrorPlacement) SetNextRetryAt(val OptDateTime) {
+	s.NextRetryAt = val
+}
+
+// SetPlacementId sets the value of PlacementId.
+func (s *NativeMirrorPlacement) SetPlacementId(val string) {
+	s.PlacementId = val
+}
+
+// SetStage sets the value of Stage.
+func (s *NativeMirrorPlacement) SetStage(val NativeMirrorPlacementStage) {
+	s.Stage = val
+}
+
+// SetStatus sets the value of Status.
+func (s *NativeMirrorPlacement) SetStatus(val NativeMirrorPlacementStatus) {
+	s.Status = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *NativeMirrorPlacement) SetAdditionalProps(val NativeMirrorPlacementAdditional) {
+	s.AdditionalProps = val
+}
+
+type NativeMirrorPlacementAdditional map[string]jx.Raw
+
+func (s *NativeMirrorPlacementAdditional) init() NativeMirrorPlacementAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+type NativeMirrorPlacementDesiredState string
+
+const (
+	NativeMirrorPlacementDesiredStateActive  NativeMirrorPlacementDesiredState = "active"
+	NativeMirrorPlacementDesiredStateDeleted NativeMirrorPlacementDesiredState = "deleted"
+)
+
+// AllValues returns all NativeMirrorPlacementDesiredState values.
+func (NativeMirrorPlacementDesiredState) AllValues() []NativeMirrorPlacementDesiredState {
+	return []NativeMirrorPlacementDesiredState{
+		NativeMirrorPlacementDesiredStateActive,
+		NativeMirrorPlacementDesiredStateDeleted,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s NativeMirrorPlacementDesiredState) MarshalText() ([]byte, error) {
+	switch s {
+	case NativeMirrorPlacementDesiredStateActive:
+		return []byte(s), nil
+	case NativeMirrorPlacementDesiredStateDeleted:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *NativeMirrorPlacementDesiredState) UnmarshalText(data []byte) error {
+	switch NativeMirrorPlacementDesiredState(data) {
+	case NativeMirrorPlacementDesiredStateActive:
+		*s = NativeMirrorPlacementDesiredStateActive
+		return nil
+	case NativeMirrorPlacementDesiredStateDeleted:
+		*s = NativeMirrorPlacementDesiredStateDeleted
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+type NativeMirrorPlacementStage string
+
+const (
+	NativeMirrorPlacementStagePending     NativeMirrorPlacementStage = "pending"
+	NativeMirrorPlacementStageProvisioned NativeMirrorPlacementStage = "provisioned"
+	NativeMirrorPlacementStageRegistered  NativeMirrorPlacementStage = "registered"
+	NativeMirrorPlacementStageSeeded      NativeMirrorPlacementStage = "seeded"
+	NativeMirrorPlacementStageAnnounced   NativeMirrorPlacementStage = "announced"
+)
+
+// AllValues returns all NativeMirrorPlacementStage values.
+func (NativeMirrorPlacementStage) AllValues() []NativeMirrorPlacementStage {
+	return []NativeMirrorPlacementStage{
+		NativeMirrorPlacementStagePending,
+		NativeMirrorPlacementStageProvisioned,
+		NativeMirrorPlacementStageRegistered,
+		NativeMirrorPlacementStageSeeded,
+		NativeMirrorPlacementStageAnnounced,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s NativeMirrorPlacementStage) MarshalText() ([]byte, error) {
+	switch s {
+	case NativeMirrorPlacementStagePending:
+		return []byte(s), nil
+	case NativeMirrorPlacementStageProvisioned:
+		return []byte(s), nil
+	case NativeMirrorPlacementStageRegistered:
+		return []byte(s), nil
+	case NativeMirrorPlacementStageSeeded:
+		return []byte(s), nil
+	case NativeMirrorPlacementStageAnnounced:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *NativeMirrorPlacementStage) UnmarshalText(data []byte) error {
+	switch NativeMirrorPlacementStage(data) {
+	case NativeMirrorPlacementStagePending:
+		*s = NativeMirrorPlacementStagePending
+		return nil
+	case NativeMirrorPlacementStageProvisioned:
+		*s = NativeMirrorPlacementStageProvisioned
+		return nil
+	case NativeMirrorPlacementStageRegistered:
+		*s = NativeMirrorPlacementStageRegistered
+		return nil
+	case NativeMirrorPlacementStageSeeded:
+		*s = NativeMirrorPlacementStageSeeded
+		return nil
+	case NativeMirrorPlacementStageAnnounced:
+		*s = NativeMirrorPlacementStageAnnounced
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+type NativeMirrorPlacementStatus string
+
+const (
+	NativeMirrorPlacementStatusProcessing NativeMirrorPlacementStatus = "processing"
+	NativeMirrorPlacementStatusReady      NativeMirrorPlacementStatus = "ready"
+	NativeMirrorPlacementStatusFailed     NativeMirrorPlacementStatus = "failed"
+	NativeMirrorPlacementStatusSuspended  NativeMirrorPlacementStatus = "suspended"
+)
+
+// AllValues returns all NativeMirrorPlacementStatus values.
+func (NativeMirrorPlacementStatus) AllValues() []NativeMirrorPlacementStatus {
+	return []NativeMirrorPlacementStatus{
+		NativeMirrorPlacementStatusProcessing,
+		NativeMirrorPlacementStatusReady,
+		NativeMirrorPlacementStatusFailed,
+		NativeMirrorPlacementStatusSuspended,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s NativeMirrorPlacementStatus) MarshalText() ([]byte, error) {
+	switch s {
+	case NativeMirrorPlacementStatusProcessing:
+		return []byte(s), nil
+	case NativeMirrorPlacementStatusReady:
+		return []byte(s), nil
+	case NativeMirrorPlacementStatusFailed:
+		return []byte(s), nil
+	case NativeMirrorPlacementStatusSuspended:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *NativeMirrorPlacementStatus) UnmarshalText(data []byte) error {
+	switch NativeMirrorPlacementStatus(data) {
+	case NativeMirrorPlacementStatusProcessing:
+		*s = NativeMirrorPlacementStatusProcessing
+		return nil
+	case NativeMirrorPlacementStatusReady:
+		*s = NativeMirrorPlacementStatusReady
+		return nil
+	case NativeMirrorPlacementStatusFailed:
+		*s = NativeMirrorPlacementStatusFailed
+		return nil
+	case NativeMirrorPlacementStatusSuspended:
+		*s = NativeMirrorPlacementStatusSuspended
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/OIDCProvider
+type OIDCProvider struct {
+	Description     OptString `json:"description"`
+	DisplayName     OptString `json:"displayName"`
+	ID              string    `json:"id"`
+	Issuer          string    `json:"issuer"`
+	AdditionalProps OIDCProviderAdditional
+}
+
+// GetDescription returns the value of Description.
+func (s *OIDCProvider) GetDescription() OptString {
+	return s.Description
+}
+
+// GetDisplayName returns the value of DisplayName.
+func (s *OIDCProvider) GetDisplayName() OptString {
+	return s.DisplayName
+}
+
+// GetID returns the value of ID.
+func (s *OIDCProvider) GetID() string {
+	return s.ID
+}
+
+// GetIssuer returns the value of Issuer.
+func (s *OIDCProvider) GetIssuer() string {
+	return s.Issuer
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *OIDCProvider) GetAdditionalProps() OIDCProviderAdditional {
+	return s.AdditionalProps
+}
+
+// SetDescription sets the value of Description.
+func (s *OIDCProvider) SetDescription(val OptString) {
+	s.Description = val
+}
+
+// SetDisplayName sets the value of DisplayName.
+func (s *OIDCProvider) SetDisplayName(val OptString) {
+	s.DisplayName = val
+}
+
+// SetID sets the value of ID.
+func (s *OIDCProvider) SetID(val string) {
+	s.ID = val
+}
+
+// SetIssuer sets the value of Issuer.
+func (s *OIDCProvider) SetIssuer(val string) {
+	s.Issuer = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *OIDCProvider) SetAdditionalProps(val OIDCProviderAdditional) {
+	s.AdditionalProps = val
+}
+
+type OIDCProviderAdditional map[string]jx.Raw
+
+func (s *OIDCProviderAdditional) init() OIDCProviderAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// NewOptAddOrgMemberInputBodyRole returns new OptAddOrgMemberInputBodyRole with value set to v.
+func NewOptAddOrgMemberInputBodyRole(v AddOrgMemberInputBodyRole) OptAddOrgMemberInputBodyRole {
+	return OptAddOrgMemberInputBodyRole{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptAddOrgMemberInputBodyRole is optional AddOrgMemberInputBodyRole.
+type OptAddOrgMemberInputBodyRole struct {
+	Value AddOrgMemberInputBodyRole
+	Set   bool
+}
+
+// IsSet returns true if OptAddOrgMemberInputBodyRole was set.
+func (o OptAddOrgMemberInputBodyRole) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptAddOrgMemberInputBodyRole) Reset() {
+	var v AddOrgMemberInputBodyRole
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptAddOrgMemberInputBodyRole) SetTo(v AddOrgMemberInputBodyRole) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptAddOrgMemberInputBodyRole) Get() (v AddOrgMemberInputBodyRole, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptAddOrgMemberInputBodyRole) Or(d AddOrgMemberInputBodyRole) AddOrgMemberInputBodyRole {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptAuditEventMetadata returns new OptAuditEventMetadata with value set to v.
+func NewOptAuditEventMetadata(v AuditEventMetadata) OptAuditEventMetadata {
+	return OptAuditEventMetadata{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptAuditEventMetadata is optional AuditEventMetadata.
+type OptAuditEventMetadata struct {
+	Value AuditEventMetadata
+	Set   bool
+}
+
+// IsSet returns true if OptAuditEventMetadata was set.
+func (o OptAuditEventMetadata) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptAuditEventMetadata) Reset() {
+	var v AuditEventMetadata
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptAuditEventMetadata) SetTo(v AuditEventMetadata) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptAuditEventMetadata) Get() (v AuditEventMetadata, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptAuditEventMetadata) Or(d AuditEventMetadata) AuditEventMetadata {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptBool returns new OptBool with value set to v.
+func NewOptBool(v bool) OptBool {
+	return OptBool{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptBool is optional bool.
+type OptBool struct {
+	Value bool
+	Set   bool
+}
+
+// IsSet returns true if OptBool was set.
+func (o OptBool) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptBool) Reset() {
+	var v bool
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptBool) SetTo(v bool) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptBool) Get() (v bool, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptBool) Or(d bool) bool {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptCISetupBlock returns new OptCISetupBlock with value set to v.
+func NewOptCISetupBlock(v CISetupBlock) OptCISetupBlock {
+	return OptCISetupBlock{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptCISetupBlock is optional CISetupBlock.
+type OptCISetupBlock struct {
+	Value CISetupBlock
+	Set   bool
+}
+
+// IsSet returns true if OptCISetupBlock was set.
+func (o OptCISetupBlock) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptCISetupBlock) Reset() {
+	var v CISetupBlock
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptCISetupBlock) SetTo(v CISetupBlock) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptCISetupBlock) Get() (v CISetupBlock, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptCISetupBlock) Or(d CISetupBlock) CISetupBlock {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptCIWebhookAuditEventViewMetadata returns new OptCIWebhookAuditEventViewMetadata with value set to v.
+func NewOptCIWebhookAuditEventViewMetadata(v CIWebhookAuditEventViewMetadata) OptCIWebhookAuditEventViewMetadata {
+	return OptCIWebhookAuditEventViewMetadata{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptCIWebhookAuditEventViewMetadata is optional CIWebhookAuditEventViewMetadata.
+type OptCIWebhookAuditEventViewMetadata struct {
+	Value CIWebhookAuditEventViewMetadata
+	Set   bool
+}
+
+// IsSet returns true if OptCIWebhookAuditEventViewMetadata was set.
+func (o OptCIWebhookAuditEventViewMetadata) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptCIWebhookAuditEventViewMetadata) Reset() {
+	var v CIWebhookAuditEventViewMetadata
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptCIWebhookAuditEventViewMetadata) SetTo(v CIWebhookAuditEventViewMetadata) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptCIWebhookAuditEventViewMetadata) Get() (v CIWebhookAuditEventViewMetadata, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptCIWebhookAuditEventViewMetadata) Or(d CIWebhookAuditEventViewMetadata) CIWebhookAuditEventViewMetadata {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptCreateRepoCIWebhookInputBodyConfig returns new OptCreateRepoCIWebhookInputBodyConfig with value set to v.
+func NewOptCreateRepoCIWebhookInputBodyConfig(v CreateRepoCIWebhookInputBodyConfig) OptCreateRepoCIWebhookInputBodyConfig {
+	return OptCreateRepoCIWebhookInputBodyConfig{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptCreateRepoCIWebhookInputBodyConfig is optional CreateRepoCIWebhookInputBodyConfig.
+type OptCreateRepoCIWebhookInputBodyConfig struct {
+	Value CreateRepoCIWebhookInputBodyConfig
+	Set   bool
+}
+
+// IsSet returns true if OptCreateRepoCIWebhookInputBodyConfig was set.
+func (o OptCreateRepoCIWebhookInputBodyConfig) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptCreateRepoCIWebhookInputBodyConfig) Reset() {
+	var v CreateRepoCIWebhookInputBodyConfig
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptCreateRepoCIWebhookInputBodyConfig) SetTo(v CreateRepoCIWebhookInputBodyConfig) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptCreateRepoCIWebhookInputBodyConfig) Get() (v CreateRepoCIWebhookInputBodyConfig, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptCreateRepoCIWebhookInputBodyConfig) Or(d CreateRepoCIWebhookInputBodyConfig) CreateRepoCIWebhookInputBodyConfig {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptCreateRepoInputBodyObjectFormat returns new OptCreateRepoInputBodyObjectFormat with value set to v.
+func NewOptCreateRepoInputBodyObjectFormat(v CreateRepoInputBodyObjectFormat) OptCreateRepoInputBodyObjectFormat {
+	return OptCreateRepoInputBodyObjectFormat{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptCreateRepoInputBodyObjectFormat is optional CreateRepoInputBodyObjectFormat.
+type OptCreateRepoInputBodyObjectFormat struct {
+	Value CreateRepoInputBodyObjectFormat
+	Set   bool
+}
+
+// IsSet returns true if OptCreateRepoInputBodyObjectFormat was set.
+func (o OptCreateRepoInputBodyObjectFormat) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptCreateRepoInputBodyObjectFormat) Reset() {
+	var v CreateRepoInputBodyObjectFormat
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptCreateRepoInputBodyObjectFormat) SetTo(v CreateRepoInputBodyObjectFormat) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptCreateRepoInputBodyObjectFormat) Get() (v CreateRepoInputBodyObjectFormat, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptCreateRepoInputBodyObjectFormat) Or(d CreateRepoInputBodyObjectFormat) CreateRepoInputBodyObjectFormat {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptDateTime returns new OptDateTime with value set to v.
+func NewOptDateTime(v time.Time) OptDateTime {
+	return OptDateTime{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptDateTime is optional time.Time.
+type OptDateTime struct {
+	Value time.Time
+	Set   bool
+}
+
+// IsSet returns true if OptDateTime was set.
+func (o OptDateTime) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptDateTime) Reset() {
+	var v time.Time
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptDateTime) SetTo(v time.Time) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptDateTime) Get() (v time.Time, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptDateTime) Or(d time.Time) time.Time {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptFloat64 returns new OptFloat64 with value set to v.
+func NewOptFloat64(v float64) OptFloat64 {
+	return OptFloat64{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptFloat64 is optional float64.
+type OptFloat64 struct {
+	Value float64
+	Set   bool
+}
+
+// IsSet returns true if OptFloat64 was set.
+func (o OptFloat64) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptFloat64) Reset() {
+	var v float64
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptFloat64) SetTo(v float64) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptFloat64) Get() (v float64, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptFloat64) Or(d float64) float64 {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptForgeRepoIdentity returns new OptForgeRepoIdentity with value set to v.
+func NewOptForgeRepoIdentity(v ForgeRepoIdentity) OptForgeRepoIdentity {
+	return OptForgeRepoIdentity{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptForgeRepoIdentity is optional ForgeRepoIdentity.
+type OptForgeRepoIdentity struct {
+	Value ForgeRepoIdentity
+	Set   bool
+}
+
+// IsSet returns true if OptForgeRepoIdentity was set.
+func (o OptForgeRepoIdentity) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptForgeRepoIdentity) Reset() {
+	var v ForgeRepoIdentity
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptForgeRepoIdentity) SetTo(v ForgeRepoIdentity) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptForgeRepoIdentity) Get() (v ForgeRepoIdentity, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptForgeRepoIdentity) Or(d ForgeRepoIdentity) ForgeRepoIdentity {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptGetMeOutputBodyMode returns new OptGetMeOutputBodyMode with value set to v.
+func NewOptGetMeOutputBodyMode(v GetMeOutputBodyMode) OptGetMeOutputBodyMode {
+	return OptGetMeOutputBodyMode{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptGetMeOutputBodyMode is optional GetMeOutputBodyMode.
+type OptGetMeOutputBodyMode struct {
+	Value GetMeOutputBodyMode
+	Set   bool
+}
+
+// IsSet returns true if OptGetMeOutputBodyMode was set.
+func (o OptGetMeOutputBodyMode) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptGetMeOutputBodyMode) Reset() {
+	var v GetMeOutputBodyMode
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptGetMeOutputBodyMode) SetTo(v GetMeOutputBodyMode) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptGetMeOutputBodyMode) Get() (v GetMeOutputBodyMode, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptGetMeOutputBodyMode) Or(d GetMeOutputBodyMode) GetMeOutputBodyMode {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptGetPermissionsOutputBodyExplain returns new OptGetPermissionsOutputBodyExplain with value set to v.
+func NewOptGetPermissionsOutputBodyExplain(v GetPermissionsOutputBodyExplain) OptGetPermissionsOutputBodyExplain {
+	return OptGetPermissionsOutputBodyExplain{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptGetPermissionsOutputBodyExplain is optional GetPermissionsOutputBodyExplain.
+type OptGetPermissionsOutputBodyExplain struct {
+	Value GetPermissionsOutputBodyExplain
+	Set   bool
+}
+
+// IsSet returns true if OptGetPermissionsOutputBodyExplain was set.
+func (o OptGetPermissionsOutputBodyExplain) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptGetPermissionsOutputBodyExplain) Reset() {
+	var v GetPermissionsOutputBodyExplain
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptGetPermissionsOutputBodyExplain) SetTo(v GetPermissionsOutputBodyExplain) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptGetPermissionsOutputBodyExplain) Get() (v GetPermissionsOutputBodyExplain, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptGetPermissionsOutputBodyExplain) Or(d GetPermissionsOutputBodyExplain) GetPermissionsOutputBodyExplain {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptGetVersionOutputBodyMode returns new OptGetVersionOutputBodyMode with value set to v.
+func NewOptGetVersionOutputBodyMode(v GetVersionOutputBodyMode) OptGetVersionOutputBodyMode {
+	return OptGetVersionOutputBodyMode{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptGetVersionOutputBodyMode is optional GetVersionOutputBodyMode.
+type OptGetVersionOutputBodyMode struct {
+	Value GetVersionOutputBodyMode
+	Set   bool
+}
+
+// IsSet returns true if OptGetVersionOutputBodyMode was set.
+func (o OptGetVersionOutputBodyMode) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptGetVersionOutputBodyMode) Reset() {
+	var v GetVersionOutputBodyMode
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptGetVersionOutputBodyMode) SetTo(v GetVersionOutputBodyMode) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptGetVersionOutputBodyMode) Get() (v GetVersionOutputBodyMode, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptGetVersionOutputBodyMode) Or(d GetVersionOutputBodyMode) GetVersionOutputBodyMode {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptGrantProjectAccessInputBodyGranteeType returns new OptGrantProjectAccessInputBodyGranteeType with value set to v.
+func NewOptGrantProjectAccessInputBodyGranteeType(v GrantProjectAccessInputBodyGranteeType) OptGrantProjectAccessInputBodyGranteeType {
+	return OptGrantProjectAccessInputBodyGranteeType{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptGrantProjectAccessInputBodyGranteeType is optional GrantProjectAccessInputBodyGranteeType.
+type OptGrantProjectAccessInputBodyGranteeType struct {
+	Value GrantProjectAccessInputBodyGranteeType
+	Set   bool
+}
+
+// IsSet returns true if OptGrantProjectAccessInputBodyGranteeType was set.
+func (o OptGrantProjectAccessInputBodyGranteeType) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptGrantProjectAccessInputBodyGranteeType) Reset() {
+	var v GrantProjectAccessInputBodyGranteeType
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptGrantProjectAccessInputBodyGranteeType) SetTo(v GrantProjectAccessInputBodyGranteeType) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptGrantProjectAccessInputBodyGranteeType) Get() (v GrantProjectAccessInputBodyGranteeType, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptGrantProjectAccessInputBodyGranteeType) Or(d GrantProjectAccessInputBodyGranteeType) GrantProjectAccessInputBodyGranteeType {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptGrantRepoAccessInputBodyGranteeType returns new OptGrantRepoAccessInputBodyGranteeType with value set to v.
+func NewOptGrantRepoAccessInputBodyGranteeType(v GrantRepoAccessInputBodyGranteeType) OptGrantRepoAccessInputBodyGranteeType {
+	return OptGrantRepoAccessInputBodyGranteeType{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptGrantRepoAccessInputBodyGranteeType is optional GrantRepoAccessInputBodyGranteeType.
+type OptGrantRepoAccessInputBodyGranteeType struct {
+	Value GrantRepoAccessInputBodyGranteeType
+	Set   bool
+}
+
+// IsSet returns true if OptGrantRepoAccessInputBodyGranteeType was set.
+func (o OptGrantRepoAccessInputBodyGranteeType) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptGrantRepoAccessInputBodyGranteeType) Reset() {
+	var v GrantRepoAccessInputBodyGranteeType
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptGrantRepoAccessInputBodyGranteeType) SetTo(v GrantRepoAccessInputBodyGranteeType) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptGrantRepoAccessInputBodyGranteeType) Get() (v GrantRepoAccessInputBodyGranteeType, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptGrantRepoAccessInputBodyGranteeType) Or(d GrantRepoAccessInputBodyGranteeType) GrantRepoAccessInputBodyGranteeType {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptInt32 returns new OptInt32 with value set to v.
+func NewOptInt32(v int32) OptInt32 {
+	return OptInt32{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptInt32 is optional int32.
+type OptInt32 struct {
+	Value int32
+	Set   bool
+}
+
+// IsSet returns true if OptInt32 was set.
+func (o OptInt32) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptInt32) Reset() {
+	var v int32
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptInt32) SetTo(v int32) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptInt32) Get() (v int32, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptInt32) Or(d int32) int32 {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptInt64 returns new OptInt64 with value set to v.
+func NewOptInt64(v int64) OptInt64 {
+	return OptInt64{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptInt64 is optional int64.
+type OptInt64 struct {
+	Value int64
+	Set   bool
+}
+
+// IsSet returns true if OptInt64 was set.
+func (o OptInt64) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptInt64) Reset() {
+	var v int64
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptInt64) SetTo(v int64) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptInt64) Get() (v int64, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptInt64) Or(d int64) int64 {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
+// NewOptListReposArchived returns new OptListReposArchived with value set to v.
+func NewOptListReposArchived(v ListReposArchived) OptListReposArchived {
+	return OptListReposArchived{
+		Value: v,
+		Set:   true,
 	}
 }
 
-// Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or
-// suspended.
-type MirrorStatus string
+// OptListReposArchived is optional ListReposArchived.
+type OptListReposArchived struct {
+	Value ListReposArchived
+	Set   bool
+}
 
-const (
-	MirrorStatusProcessing MirrorStatus = "processing"
-	MirrorStatusReady      MirrorStatus = "ready"
-	MirrorStatusFailed     MirrorStatus = "failed"
-	MirrorStatusSuspended  MirrorStatus = "suspended"
-)
+// IsSet returns true if OptListReposArchived was set.
+func (o OptListReposArchived) IsSet() bool { return o.Set }
 
-// AllValues returns all MirrorStatus values.
-func (MirrorStatus) AllValues() []MirrorStatus {
-	return []MirrorStatus{
-		MirrorStatusProcessing,
-		MirrorStatusReady,
-		MirrorStatusFailed,
-		MirrorStatusSuspended,
-	}
+// Reset unsets value.
+func (o *OptListReposArchived) Reset() {
+	var v ListReposArchived
+	o.Value = v
+	o.Set = false
 }
 
-// MarshalText implements encoding.TextMarshaler.
-func (s MirrorStatus) MarshalText() ([]byte, error) {
-	switch s {
-	case MirrorStatusProcessing:
-		return []byte(s), nil
-	case MirrorStatusReady:
-		return []byte(s), nil
-	case MirrorStatusFailed:
-		return []byte(s), nil
-	case MirrorStatusSuspended:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
+// SetTo sets value to v.
+func (o *OptListReposArchived) SetTo(v ListReposArchived) {
+	o.Set = true
+	o.Value = v
 }
 
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *MirrorStatus) UnmarshalText(data []byte) error {
-	switch MirrorStatus(data) {
-	case MirrorStatusProcessing:
-		*s = MirrorStatusProcessing
-		return nil
-	case MirrorStatusReady:
-		*s = MirrorStatusReady
-		return nil
-	case MirrorStatusFailed:
-		*s = MirrorStatusFailed
-		return nil
-	case MirrorStatusSuspended:
-		*s = MirrorStatusSuspended
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
+// Get returns value and boolean that denotes whether value was set.
+func (o OptListReposArchived) Get() (v ListReposArchived, ok bool) {
+	if !o.Set {
+		return v, false
 	}
+	return o.Value, true
 }
 
-// Ref: #/components/schemas/OIDCProvider
-type OIDCProvider struct {
-	Description     OptString `json:"description"`
-	DisplayName     OptString `json:"displayName"`
-	ID              string    `json:"id"`
-	Issuer          string    `json:"issuer"`
-	AdditionalProps OIDCProviderAdditional
+// Or returns value if set, or given parameter if does not.
+func (o OptListReposArchived) Or(d ListReposArchived) ListReposArchived {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
 }
 
-// GetDescription returns the value of Description.
-func (s *OIDCProvider) GetDescription() OptString {
-	return s.Description
+// NewOptListReposHasCheckpoints returns new OptListReposHasCheckpoints with value set to v.
+func NewOptListReposHasCheckpoints(v ListReposHasCheckpoints) OptListReposHasCheckpoints {
+	return OptListReposHasCheckpoints{
+		Value: v,
+		Set:   true,
+	}
 }
 
-// GetDisplayName returns the value of DisplayName.
-func (s *OIDCProvider) GetDisplayName() OptString {
-	return s.DisplayName
+// OptListReposHasCheckpoints is optional ListReposHasCheckpoints.
+type OptListReposHasCheckpoints struct {
+	Value ListReposHasCheckpoints
+	Set   bool
 }
 
-// GetID returns the value of ID.
-func (s *OIDCProvider) GetID() string {
-	return s.ID
+// IsSet returns true if OptListReposHasCheckpoints was set.
+func (o OptListReposHasCheckpoints) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptListReposHasCheckpoints) Reset() {
+	var v ListReposHasCheckpoints
+	o.Value = v
+	o.Set = false
 }
 
-// GetIssuer returns the value of Issuer.
-func (s *OIDCProvider) GetIssuer() string {
-	return s.Issuer
+// SetTo sets value to v.
+func (o *OptListReposHasCheckpoints) SetTo(v ListReposHasCheckpoints) {
+	o.Set = true
+	o.Value = v
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *OIDCProvider) GetAdditionalProps() OIDCProviderAdditional {
-	return s.AdditionalProps
+// Get returns value and boolean that denotes whether value was set.
+func (o OptListReposHasCheckpoints) Get() (v ListReposHasCheckpoints, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
 }
 
-// SetDescription sets the value of Description.
-func (s *OIDCProvider) SetDescription(val OptString) {
-	s.Description = val
+// Or returns value if set, or given parameter if does not.
+func (o OptListReposHasCheckpoints) Or(d ListReposHasCheckpoints) ListReposHasCheckpoints {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
 }
 
-// SetDisplayName sets the value of DisplayName.
-func (s *OIDCProvider) SetDisplayName(val OptString) {
-	s.DisplayName = val
+// NewOptListReposOrder returns new OptListReposOrder with value set to v.
+func NewOptListReposOrder(v ListReposOrder) OptListReposOrder {
+	return OptListReposOrder{
+		Value: v,
+		Set:   true,
+	}
 }
 
-// SetID sets the value of ID.
-func (s *OIDCProvider) SetID(val string) {
-	s.ID = val
+// OptListReposOrder is optional ListReposOrder.
+type OptListReposOrder struct {
+	Value ListReposOrder
+	Set   bool
 }
 
-// SetIssuer sets the value of Issuer.
-func (s *OIDCProvider) SetIssuer(val string) {
-	s.Issuer = val
+// IsSet returns true if OptListReposOrder was set.
+func (o OptListReposOrder) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptListReposOrder) Reset() {
+	var v ListReposOrder
+	o.Value = v
+	o.Set = false
 }
 
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *OIDCProvider) SetAdditionalProps(val OIDCProviderAdditional) {
-	s.AdditionalProps = val
+// SetTo sets value to v.
+func (o *OptListReposOrder) SetTo(v ListReposOrder) {
+	o.Set = true
+	o.Value = v
 }
 
-type OIDCProviderAdditional map[string]jx.Raw
+// Get returns value and boolean that denotes whether value was set.
+func (o OptListReposOrder) Get() (v ListReposOrder, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
 
-func (s *OIDCProviderAdditional) init() OIDCProviderAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
+// Or returns value if set, or given parameter if does not.
+func (o OptListReposOrder) Or(d ListReposOrder) ListReposOrder {
+	if v, ok := o.Get(); ok {
+		return v
 	}
-	return m
+	return d
 }
 
-// NewOptAddOrgMemberInputBodyRole returns new OptAddOrgMemberInputBodyRole with value set to v.
-func NewOptAddOrgMemberInputBodyRole(v AddOrgMemberInputBodyRole) OptAddOrgMemberInputBodyRole {
-	return OptAddOrgMemberInputBodyRole{
+// NewOptListReposPermission returns new OptListReposPermission with value set to v.
+func NewOptListReposPermission(v ListReposPermission) OptListReposPermission {
+	return OptListReposPermission{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptAddOrgMemberInputBodyRole is optional AddOrgMemberInputBodyRole.
-type OptAddOrgMemberInputBodyRole struct {
-	Value AddOrgMemberInputBodyRole
+// OptListReposPermission is optional ListReposPermission.
+type OptListReposPermission struct {
+	Value ListReposPermission
 	Set   bool
 }
 
-// IsSet returns true if OptAddOrgMemberInputBodyRole was set.
-func (o OptAddOrgMemberInputBodyRole) IsSet() bool { return o.Set }
+// IsSet returns true if OptListReposPermission was set.
+func (o OptListReposPermission) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptAddOrgMemberInputBodyRole) Reset() {
-	var v AddOrgMemberInputBodyRole
+func (o *OptListReposPermission) Reset() {
+	var v ListReposPermission
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptAddOrgMemberInputBodyRole) SetTo(v AddOrgMemberInputBodyRole) {
+func (o *OptListReposPermission) SetTo(v ListReposPermission) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptAddOrgMemberInputBodyRole) Get() (v AddOrgMemberInputBodyRole, ok bool) {
+func (o OptListReposPermission) Get() (v ListReposPermission, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6643,45 +9772,45 @@ func (o OptAddOrgMemberInputBodyRole) Get() (v AddOrgMemberInputBodyRole, ok boo
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptAddOrgMemberInputBodyRole) Or(d AddOrgMemberInputBodyRole) AddOrgMemberInputBodyRole {
+func (o OptListReposPermission) Or(d ListReposPermission) ListReposPermission {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptAuditEventMetadata returns new OptAuditEventMetadata with value set to v.
-func NewOptAuditEventMetadata(v AuditEventMetadata) OptAuditEventMetadata {
-	return OptAuditEventMetadata{
+// NewOptListReposScope returns new OptListReposScope with value set to v.
+func NewOptListReposScope(v ListReposScope) OptListReposScope {
+	return OptListReposScope{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptAuditEventMetadata is optional AuditEventMetadata.
-type OptAuditEventMetadata struct {
-	Value AuditEventMetadata
+// OptListReposScope is optional ListReposScope.
+type OptListReposScope struct {
+	Value ListReposScope
 	Set   bool
 }
 
-// IsSet returns true if OptAuditEventMetadata was set.
-func (o OptAuditEventMetadata) IsSet() bool { return o.Set }
+// IsSet returns true if OptListReposScope was set.
+func (o OptListReposScope) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptAuditEventMetadata) Reset() {
-	var v AuditEventMetadata
+func (o *OptListReposScope) Reset() {
+	var v ListReposScope
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptAuditEventMetadata) SetTo(v AuditEventMetadata) {
+func (o *OptListReposScope) SetTo(v ListReposScope) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptAuditEventMetadata) Get() (v AuditEventMetadata, ok bool) {
+func (o OptListReposScope) Get() (v ListReposScope, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6689,45 +9818,45 @@ func (o OptAuditEventMetadata) Get() (v AuditEventMetadata, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptAuditEventMetadata) Or(d AuditEventMetadata) AuditEventMetadata {
+func (o OptListReposScope) Or(d ListReposScope) ListReposScope {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptBool returns new OptBool with value set to v.
-func NewOptBool(v bool) OptBool {
-	return OptBool{
+// NewOptListReposStatus returns new OptListReposStatus with value set to v.
+func NewOptListReposStatus(v ListReposStatus) OptListReposStatus {
+	return OptListReposStatus{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptBool is optional bool.
-type OptBool struct {
-	Value bool
+// OptListReposStatus is optional ListReposStatus.
+type OptListReposStatus struct {
+	Value ListReposStatus
 	Set   bool
 }
 
-// IsSet returns true if OptBool was set.
-func (o OptBool) IsSet() bool { return o.Set }
+// IsSet returns true if OptListReposStatus was set.
+func (o OptListReposStatus) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptBool) Reset() {
-	var v bool
+func (o *OptListReposStatus) Reset() {
+	var v ListReposStatus
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptBool) SetTo(v bool) {
+func (o *OptListReposStatus) SetTo(v ListReposStatus) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptBool) Get() (v bool, ok bool) {
+func (o OptListReposStatus) Get() (v ListReposStatus, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6735,45 +9864,45 @@ func (o OptBool) Get() (v bool, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptBool) Or(d bool) bool {
+func (o OptListReposStatus) Or(d ListReposStatus) ListReposStatus {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptCreateRepoInputBodyObjectFormat returns new OptCreateRepoInputBodyObjectFormat with value set to v.
-func NewOptCreateRepoInputBodyObjectFormat(v CreateRepoInputBodyObjectFormat) OptCreateRepoInputBodyObjectFormat {
-	return OptCreateRepoInputBodyObjectFormat{
+// NewOptListReposVisibility returns new OptListReposVisibility with value set to v.
+func NewOptListReposVisibility(v ListReposVisibility) OptListReposVisibility {
+	return OptListReposVisibility{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptCreateRepoInputBodyObjectFormat is optional CreateRepoInputBodyObjectFormat.
-type OptCreateRepoInputBodyObjectFormat struct {
-	Value CreateRepoInputBodyObjectFormat
+// OptListReposVisibility is optional ListReposVisibility.
+type OptListReposVisibility struct {
+	Value ListReposVisibility
 	Set   bool
 }
 
-// IsSet returns true if OptCreateRepoInputBodyObjectFormat was set.
-func (o OptCreateRepoInputBodyObjectFormat) IsSet() bool { return o.Set }
+// IsSet returns true if OptListReposVisibility was set.
+func (o OptListReposVisibility) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptCreateRepoInputBodyObjectFormat) Reset() {
-	var v CreateRepoInputBodyObjectFormat
+func (o *OptListReposVisibility) Reset() {
+	var v ListReposVisibility
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptCreateRepoInputBodyObjectFormat) SetTo(v CreateRepoInputBodyObjectFormat) {
+func (o *OptListReposVisibility) SetTo(v ListReposVisibility) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptCreateRepoInputBodyObjectFormat) Get() (v CreateRepoInputBodyObjectFormat, ok bool) {
+func (o OptListReposVisibility) Get() (v ListReposVisibility, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6781,45 +9910,45 @@ func (o OptCreateRepoInputBodyObjectFormat) Get() (v CreateRepoInputBodyObjectFo
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptCreateRepoInputBodyObjectFormat) Or(d CreateRepoInputBodyObjectFormat) CreateRepoInputBodyObjectFormat {
+func (o OptListReposVisibility) Or(d ListReposVisibility) ListReposVisibility {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptDateTime returns new OptDateTime with value set to v.
-func NewOptDateTime(v time.Time) OptDateTime {
-	return OptDateTime{
+// NewOptMeDeletion returns new OptMeDeletion with value set to v.
+func NewOptMeDeletion(v MeDeletion) OptMeDeletion {
+	return OptMeDeletion{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptDateTime is optional time.Time.
-type OptDateTime struct {
-	Value time.Time
+// OptMeDeletion is optional MeDeletion.
+type OptMeDeletion struct {
+	Value MeDeletion
 	Set   bool
 }
 
-// IsSet returns true if OptDateTime was set.
-func (o OptDateTime) IsSet() bool { return o.Set }
-
+// IsSet returns true if OptMeDeletion was set.
+func (o OptMeDeletion) IsSet() bool { return o.Set }
+
 // Reset unsets value.
-func (o *OptDateTime) Reset() {
-	var v time.Time
+func (o *OptMeDeletion) Reset() {
+	var v MeDeletion
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptDateTime) SetTo(v time.Time) {
+func (o *OptMeDeletion) SetTo(v MeDeletion) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptDateTime) Get() (v time.Time, ok bool) {
+func (o OptMeDeletion) Get() (v MeDeletion, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6827,45 +9956,45 @@ func (o OptDateTime) Get() (v time.Time, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptDateTime) Or(d time.Time) time.Time {
+func (o OptMeDeletion) Or(d MeDeletion) MeDeletion {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptGetMeOutputBodyMode returns new OptGetMeOutputBodyMode with value set to v.
-func NewOptGetMeOutputBodyMode(v GetMeOutputBodyMode) OptGetMeOutputBodyMode {
-	return OptGetMeOutputBodyMode{
+// NewOptMeRegional returns new OptMeRegional with value set to v.
+func NewOptMeRegional(v MeRegional) OptMeRegional {
+	return OptMeRegional{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptGetMeOutputBodyMode is optional GetMeOutputBodyMode.
-type OptGetMeOutputBodyMode struct {
-	Value GetMeOutputBodyMode
+// OptMeRegional is optional MeRegional.
+type OptMeRegional struct {
+	Value MeRegional
 	Set   bool
 }
 
-// IsSet returns true if OptGetMeOutputBodyMode was set.
-func (o OptGetMeOutputBodyMode) IsSet() bool { return o.Set }
+// IsSet returns true if OptMeRegional was set.
+func (o OptMeRegional) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptGetMeOutputBodyMode) Reset() {
-	var v GetMeOutputBodyMode
+func (o *OptMeRegional) Reset() {
+	var v MeRegional
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptGetMeOutputBodyMode) SetTo(v GetMeOutputBodyMode) {
+func (o *OptMeRegional) SetTo(v MeRegional) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptGetMeOutputBodyMode) Get() (v GetMeOutputBodyMode, ok bool) {
+func (o OptMeRegional) Get() (v MeRegional, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6873,45 +10002,45 @@ func (o OptGetMeOutputBodyMode) Get() (v GetMeOutputBodyMode, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptGetMeOutputBodyMode) Or(d GetMeOutputBodyMode) GetMeOutputBodyMode {
+func (o OptMeRegional) Or(d MeRegional) MeRegional {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptGetPermissionsOutputBodyExplain returns new OptGetPermissionsOutputBodyExplain with value set to v.
-func NewOptGetPermissionsOutputBodyExplain(v GetPermissionsOutputBodyExplain) OptGetPermissionsOutputBodyExplain {
-	return OptGetPermissionsOutputBodyExplain{
+// NewOptMeRegionalUnavailable returns new OptMeRegionalUnavailable with value set to v.
+func NewOptMeRegionalUnavailable(v MeRegionalUnavailable) OptMeRegionalUnavailable {
+	return OptMeRegionalUnavailable{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptGetPermissionsOutputBodyExplain is optional GetPermissionsOutputBodyExplain.
-type OptGetPermissionsOutputBodyExplain struct {
-	Value GetPermissionsOutputBodyExplain
+// OptMeRegionalUnavailable is optional MeRegionalUnavailable.
+type OptMeRegionalUnavailable struct {
+	Value MeRegionalUnavailable
 	Set   bool
 }
 
-// IsSet returns true if OptGetPermissionsOutputBodyExplain was set.
-func (o OptGetPermissionsOutputBodyExplain) IsSet() bool { return o.Set }
+// IsSet returns true if OptMeRegionalUnavailable was set.
+func (o OptMeRegionalUnavailable) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptGetPermissionsOutputBodyExplain) Reset() {
-	var v GetPermissionsOutputBodyExplain
+func (o *OptMeRegionalUnavailable) Reset() {
+	var v MeRegionalUnavailable
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptGetPermissionsOutputBodyExplain) SetTo(v GetPermissionsOutputBodyExplain) {
+func (o *OptMeRegionalUnavailable) SetTo(v MeRegionalUnavailable) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptGetPermissionsOutputBodyExplain) Get() (v GetPermissionsOutputBodyExplain, ok bool) {
+func (o OptMeRegionalUnavailable) Get() (v MeRegionalUnavailable, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6919,45 +10048,45 @@ func (o OptGetPermissionsOutputBodyExplain) Get() (v GetPermissionsOutputBodyExp
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptGetPermissionsOutputBodyExplain) Or(d GetPermissionsOutputBodyExplain) GetPermissionsOutputBodyExplain {
+func (o OptMeRegionalUnavailable) Or(d MeRegionalUnavailable) MeRegionalUnavailable {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptGetVersionOutputBodyMode returns new OptGetVersionOutputBodyMode with value set to v.
-func NewOptGetVersionOutputBodyMode(v GetVersionOutputBodyMode) OptGetVersionOutputBodyMode {
-	return OptGetVersionOutputBodyMode{
+// NewOptMirrorRequestFailure returns new OptMirrorRequestFailure with value set to v.
+func NewOptMirrorRequestFailure(v MirrorRequestFailure) OptMirrorRequestFailure {
+	return OptMirrorRequestFailure{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptGetVersionOutputBodyMode is optional GetVersionOutputBodyMode.
-type OptGetVersionOutputBodyMode struct {
-	Value GetVersionOutputBodyMode
+// OptMirrorRequestFailure is optional MirrorRequestFailure.
+type OptMirrorRequestFailure struct {
+	Value MirrorRequestFailure
 	Set   bool
 }
 
-// IsSet returns true if OptGetVersionOutputBodyMode was set.
-func (o OptGetVersionOutputBodyMode) IsSet() bool { return o.Set }
+// IsSet returns true if OptMirrorRequestFailure was set.
+func (o OptMirrorRequestFailure) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptGetVersionOutputBodyMode) Reset() {
-	var v GetVersionOutputBodyMode
+func (o *OptMirrorRequestFailure) Reset() {
+	var v MirrorRequestFailure
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptGetVersionOutputBodyMode) SetTo(v GetVersionOutputBodyMode) {
+func (o *OptMirrorRequestFailure) SetTo(v MirrorRequestFailure) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptGetVersionOutputBodyMode) Get() (v GetVersionOutputBodyMode, ok bool) {
+func (o OptMirrorRequestFailure) Get() (v MirrorRequestFailure, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -6965,45 +10094,45 @@ func (o OptGetVersionOutputBodyMode) Get() (v GetVersionOutputBodyMode, ok bool)
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptGetVersionOutputBodyMode) Or(d GetVersionOutputBodyMode) GetVersionOutputBodyMode {
+func (o OptMirrorRequestFailure) Or(d MirrorRequestFailure) MirrorRequestFailure {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptGrantProjectAccessInputBodyGranteeType returns new OptGrantProjectAccessInputBodyGranteeType with value set to v.
-func NewOptGrantProjectAccessInputBodyGranteeType(v GrantProjectAccessInputBodyGranteeType) OptGrantProjectAccessInputBodyGranteeType {
-	return OptGrantProjectAccessInputBodyGranteeType{
+// NewOptMirrorRequestResult returns new OptMirrorRequestResult with value set to v.
+func NewOptMirrorRequestResult(v MirrorRequestResult) OptMirrorRequestResult {
+	return OptMirrorRequestResult{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptGrantProjectAccessInputBodyGranteeType is optional GrantProjectAccessInputBodyGranteeType.
-type OptGrantProjectAccessInputBodyGranteeType struct {
-	Value GrantProjectAccessInputBodyGranteeType
+// OptMirrorRequestResult is optional MirrorRequestResult.
+type OptMirrorRequestResult struct {
+	Value MirrorRequestResult
 	Set   bool
 }
 
-// IsSet returns true if OptGrantProjectAccessInputBodyGranteeType was set.
-func (o OptGrantProjectAccessInputBodyGranteeType) IsSet() bool { return o.Set }
+// IsSet returns true if OptMirrorRequestResult was set.
+func (o OptMirrorRequestResult) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptGrantProjectAccessInputBodyGranteeType) Reset() {
-	var v GrantProjectAccessInputBodyGranteeType
+func (o *OptMirrorRequestResult) Reset() {
+	var v MirrorRequestResult
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptGrantProjectAccessInputBodyGranteeType) SetTo(v GrantProjectAccessInputBodyGranteeType) {
+func (o *OptMirrorRequestResult) SetTo(v MirrorRequestResult) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptGrantProjectAccessInputBodyGranteeType) Get() (v GrantProjectAccessInputBodyGranteeType, ok bool) {
+func (o OptMirrorRequestResult) Get() (v MirrorRequestResult, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7011,45 +10140,45 @@ func (o OptGrantProjectAccessInputBodyGranteeType) Get() (v GrantProjectAccessIn
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptGrantProjectAccessInputBodyGranteeType) Or(d GrantProjectAccessInputBodyGranteeType) GrantProjectAccessInputBodyGranteeType {
+func (o OptMirrorRequestResult) Or(d MirrorRequestResult) MirrorRequestResult {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptGrantRepoAccessInputBodyGranteeType returns new OptGrantRepoAccessInputBodyGranteeType with value set to v.
-func NewOptGrantRepoAccessInputBodyGranteeType(v GrantRepoAccessInputBodyGranteeType) OptGrantRepoAccessInputBodyGranteeType {
-	return OptGrantRepoAccessInputBodyGranteeType{
+// NewOptMirrorStatus returns new OptMirrorStatus with value set to v.
+func NewOptMirrorStatus(v MirrorStatus) OptMirrorStatus {
+	return OptMirrorStatus{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptGrantRepoAccessInputBodyGranteeType is optional GrantRepoAccessInputBodyGranteeType.
-type OptGrantRepoAccessInputBodyGranteeType struct {
-	Value GrantRepoAccessInputBodyGranteeType
+// OptMirrorStatus is optional MirrorStatus.
+type OptMirrorStatus struct {
+	Value MirrorStatus
 	Set   bool
 }
 
-// IsSet returns true if OptGrantRepoAccessInputBodyGranteeType was set.
-func (o OptGrantRepoAccessInputBodyGranteeType) IsSet() bool { return o.Set }
+// IsSet returns true if OptMirrorStatus was set.
+func (o OptMirrorStatus) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptGrantRepoAccessInputBodyGranteeType) Reset() {
-	var v GrantRepoAccessInputBodyGranteeType
+func (o *OptMirrorStatus) Reset() {
+	var v MirrorStatus
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptGrantRepoAccessInputBodyGranteeType) SetTo(v GrantRepoAccessInputBodyGranteeType) {
+func (o *OptMirrorStatus) SetTo(v MirrorStatus) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptGrantRepoAccessInputBodyGranteeType) Get() (v GrantRepoAccessInputBodyGranteeType, ok bool) {
+func (o OptMirrorStatus) Get() (v MirrorStatus, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7057,45 +10186,45 @@ func (o OptGrantRepoAccessInputBodyGranteeType) Get() (v GrantRepoAccessInputBod
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptGrantRepoAccessInputBodyGranteeType) Or(d GrantRepoAccessInputBodyGranteeType) GrantRepoAccessInputBodyGranteeType {
+func (o OptMirrorStatus) Or(d MirrorStatus) MirrorStatus {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptInt32 returns new OptInt32 with value set to v.
-func NewOptInt32(v int32) OptInt32 {
-	return OptInt32{
+// NewOptOrg returns new OptOrg with value set to v.
+func NewOptOrg(v Org) OptOrg {
+	return OptOrg{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptInt32 is optional int32.
-type OptInt32 struct {
-	Value int32
+// OptOrg is optional Org.
+type OptOrg struct {
+	Value Org
 	Set   bool
 }
 
-// IsSet returns true if OptInt32 was set.
-func (o OptInt32) IsSet() bool { return o.Set }
+// IsSet returns true if OptOrg was set.
+func (o OptOrg) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptInt32) Reset() {
-	var v int32
+func (o *OptOrg) Reset() {
+	var v Org
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptInt32) SetTo(v int32) {
+func (o *OptOrg) SetTo(v Org) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptInt32) Get() (v int32, ok bool) {
+func (o OptOrg) Get() (v Org, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7103,45 +10232,45 @@ func (o OptInt32) Get() (v int32, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptInt32) Or(d int32) int32 {
+func (o OptOrg) Or(d Org) Org {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptInt64 returns new OptInt64 with value set to v.
-func NewOptInt64(v int64) OptInt64 {
-	return OptInt64{
+// NewOptProject returns new OptProject with value set to v.
+func NewOptProject(v Project) OptProject {
+	return OptProject{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptInt64 is optional int64.
-type OptInt64 struct {
-	Value int64
+// OptProject is optional Project.
+type OptProject struct {
+	Value Project
 	Set   bool
 }
 
-// IsSet returns true if OptInt64 was set.
-func (o OptInt64) IsSet() bool { return o.Set }
+// IsSet returns true if OptProject was set.
+func (o OptProject) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptInt64) Reset() {
-	var v int64
+func (o *OptProject) Reset() {
+	var v Project
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptInt64) SetTo(v int64) {
+func (o *OptProject) SetTo(v Project) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptInt64) Get() (v int64, ok bool) {
+func (o OptProject) Get() (v Project, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7149,45 +10278,45 @@ func (o OptInt64) Get() (v int64, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptInt64) Or(d int64) int64 {
+func (o OptProject) Or(d Project) Project {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptListReposScope returns new OptListReposScope with value set to v.
-func NewOptListReposScope(v ListReposScope) OptListReposScope {
-	return OptListReposScope{
+// NewOptRepo returns new OptRepo with value set to v.
+func NewOptRepo(v Repo) OptRepo {
+	return OptRepo{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptListReposScope is optional ListReposScope.
-type OptListReposScope struct {
-	Value ListReposScope
+// OptRepo is optional Repo.
+type OptRepo struct {
+	Value Repo
 	Set   bool
 }
 
-// IsSet returns true if OptListReposScope was set.
-func (o OptListReposScope) IsSet() bool { return o.Set }
+// IsSet returns true if OptRepo was set.
+func (o OptRepo) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptListReposScope) Reset() {
-	var v ListReposScope
+func (o *OptRepo) Reset() {
+	var v Repo
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptListReposScope) SetTo(v ListReposScope) {
+func (o *OptRepo) SetTo(v Repo) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptListReposScope) Get() (v ListReposScope, ok bool) {
+func (o OptRepo) Get() (v Repo, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7195,45 +10324,45 @@ func (o OptListReposScope) Get() (v ListReposScope, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptListReposScope) Or(d ListReposScope) ListReposScope {
+func (o OptRepo) Or(d Repo) Repo {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptLookupRefResultOwnerType returns new OptLookupRefResultOwnerType with value set to v.
-func NewOptLookupRefResultOwnerType(v LookupRefResultOwnerType) OptLookupRefResultOwnerType {
-	return OptLookupRefResultOwnerType{
+// NewOptRepoCandidate returns new OptRepoCandidate with value set to v.
+func NewOptRepoCandidate(v RepoCandidate) OptRepoCandidate {
+	return OptRepoCandidate{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptLookupRefResultOwnerType is optional LookupRefResultOwnerType.
-type OptLookupRefResultOwnerType struct {
-	Value LookupRefResultOwnerType
+// OptRepoCandidate is optional RepoCandidate.
+type OptRepoCandidate struct {
+	Value RepoCandidate
 	Set   bool
 }
 
-// IsSet returns true if OptLookupRefResultOwnerType was set.
-func (o OptLookupRefResultOwnerType) IsSet() bool { return o.Set }
+// IsSet returns true if OptRepoCandidate was set.
+func (o OptRepoCandidate) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptLookupRefResultOwnerType) Reset() {
-	var v LookupRefResultOwnerType
+func (o *OptRepoCandidate) Reset() {
+	var v RepoCandidate
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptLookupRefResultOwnerType) SetTo(v LookupRefResultOwnerType) {
+func (o *OptRepoCandidate) SetTo(v RepoCandidate) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptLookupRefResultOwnerType) Get() (v LookupRefResultOwnerType, ok bool) {
+func (o OptRepoCandidate) Get() (v RepoCandidate, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7241,45 +10370,45 @@ func (o OptLookupRefResultOwnerType) Get() (v LookupRefResultOwnerType, ok bool)
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptLookupRefResultOwnerType) Or(d LookupRefResultOwnerType) LookupRefResultOwnerType {
+func (o OptRepoCandidate) Or(d RepoCandidate) RepoCandidate {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptMeDeletion returns new OptMeDeletion with value set to v.
-func NewOptMeDeletion(v MeDeletion) OptMeDeletion {
-	return OptMeDeletion{
+// NewOptRepoCapabilities returns new OptRepoCapabilities with value set to v.
+func NewOptRepoCapabilities(v RepoCapabilities) OptRepoCapabilities {
+	return OptRepoCapabilities{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptMeDeletion is optional MeDeletion.
-type OptMeDeletion struct {
-	Value MeDeletion
+// OptRepoCapabilities is optional RepoCapabilities.
+type OptRepoCapabilities struct {
+	Value RepoCapabilities
 	Set   bool
 }
 
-// IsSet returns true if OptMeDeletion was set.
-func (o OptMeDeletion) IsSet() bool { return o.Set }
+// IsSet returns true if OptRepoCapabilities was set.
+func (o OptRepoCapabilities) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptMeDeletion) Reset() {
-	var v MeDeletion
+func (o *OptRepoCapabilities) Reset() {
+	var v RepoCapabilities
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptMeDeletion) SetTo(v MeDeletion) {
+func (o *OptRepoCapabilities) SetTo(v RepoCapabilities) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptMeDeletion) Get() (v MeDeletion, ok bool) {
+func (o OptRepoCapabilities) Get() (v RepoCapabilities, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7287,45 +10416,45 @@ func (o OptMeDeletion) Get() (v MeDeletion, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptMeDeletion) Or(d MeDeletion) MeDeletion {
+func (o OptRepoCapabilities) Or(d RepoCapabilities) RepoCapabilities {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptMeRegional returns new OptMeRegional with value set to v.
-func NewOptMeRegional(v MeRegional) OptMeRegional {
-	return OptMeRegional{
+// NewOptRepoIndexEntryPermission returns new OptRepoIndexEntryPermission with value set to v.
+func NewOptRepoIndexEntryPermission(v RepoIndexEntryPermission) OptRepoIndexEntryPermission {
+	return OptRepoIndexEntryPermission{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptMeRegional is optional MeRegional.
-type OptMeRegional struct {
-	Value MeRegional
+// OptRepoIndexEntryPermission is optional RepoIndexEntryPermission.
+type OptRepoIndexEntryPermission struct {
+	Value RepoIndexEntryPermission
 	Set   bool
 }
 
-// IsSet returns true if OptMeRegional was set.
-func (o OptMeRegional) IsSet() bool { return o.Set }
-
+// IsSet returns true if OptRepoIndexEntryPermission was set.
+func (o OptRepoIndexEntryPermission) IsSet() bool { return o.Set }
+
 // Reset unsets value.
-func (o *OptMeRegional) Reset() {
-	var v MeRegional
+func (o *OptRepoIndexEntryPermission) Reset() {
+	var v RepoIndexEntryPermission
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptMeRegional) SetTo(v MeRegional) {
+func (o *OptRepoIndexEntryPermission) SetTo(v RepoIndexEntryPermission) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptMeRegional) Get() (v MeRegional, ok bool) {
+func (o OptRepoIndexEntryPermission) Get() (v RepoIndexEntryPermission, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7333,45 +10462,45 @@ func (o OptMeRegional) Get() (v MeRegional, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptMeRegional) Or(d MeRegional) MeRegional {
+func (o OptRepoIndexEntryPermission) Or(d RepoIndexEntryPermission) RepoIndexEntryPermission {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptMeRegionalUnavailable returns new OptMeRegionalUnavailable with value set to v.
-func NewOptMeRegionalUnavailable(v MeRegionalUnavailable) OptMeRegionalUnavailable {
-	return OptMeRegionalUnavailable{
+// NewOptRepoPrimaries returns new OptRepoPrimaries with value set to v.
+func NewOptRepoPrimaries(v RepoPrimaries) OptRepoPrimaries {
+	return OptRepoPrimaries{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptMeRegionalUnavailable is optional MeRegionalUnavailable.
-type OptMeRegionalUnavailable struct {
-	Value MeRegionalUnavailable
+// OptRepoPrimaries is optional RepoPrimaries.
+type OptRepoPrimaries struct {
+	Value RepoPrimaries
 	Set   bool
 }
 
-// IsSet returns true if OptMeRegionalUnavailable was set.
-func (o OptMeRegionalUnavailable) IsSet() bool { return o.Set }
+// IsSet returns true if OptRepoPrimaries was set.
+func (o OptRepoPrimaries) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptMeRegionalUnavailable) Reset() {
-	var v MeRegionalUnavailable
+func (o *OptRepoPrimaries) Reset() {
+	var v RepoPrimaries
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptMeRegionalUnavailable) SetTo(v MeRegionalUnavailable) {
+func (o *OptRepoPrimaries) SetTo(v RepoPrimaries) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptMeRegionalUnavailable) Get() (v MeRegionalUnavailable, ok bool) {
+func (o OptRepoPrimaries) Get() (v RepoPrimaries, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7379,45 +10508,45 @@ func (o OptMeRegionalUnavailable) Get() (v MeRegionalUnavailable, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptMeRegionalUnavailable) Or(d MeRegionalUnavailable) MeRegionalUnavailable {
+func (o OptRepoPrimaries) Or(d RepoPrimaries) RepoPrimaries {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptMirrorRequestFailure returns new OptMirrorRequestFailure with value set to v.
-func NewOptMirrorRequestFailure(v MirrorRequestFailure) OptMirrorRequestFailure {
-	return OptMirrorRequestFailure{
+// NewOptString returns new OptString with value set to v.
+func NewOptString(v string) OptString {
+	return OptString{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptMirrorRequestFailure is optional MirrorRequestFailure.
-type OptMirrorRequestFailure struct {
-	Value MirrorRequestFailure
+// OptString is optional string.
+type OptString struct {
+	Value string
 	Set   bool
 }
 
-// IsSet returns true if OptMirrorRequestFailure was set.
-func (o OptMirrorRequestFailure) IsSet() bool { return o.Set }
+// IsSet returns true if OptString was set.
+func (o OptString) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptMirrorRequestFailure) Reset() {
-	var v MirrorRequestFailure
+func (o *OptString) Reset() {
+	var v string
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptMirrorRequestFailure) SetTo(v MirrorRequestFailure) {
+func (o *OptString) SetTo(v string) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptMirrorRequestFailure) Get() (v MirrorRequestFailure, ok bool) {
+func (o OptString) Get() (v string, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7425,45 +10554,45 @@ func (o OptMirrorRequestFailure) Get() (v MirrorRequestFailure, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptMirrorRequestFailure) Or(d MirrorRequestFailure) MirrorRequestFailure {
+func (o OptString) Or(d string) string {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptMirrorRequestResult returns new OptMirrorRequestResult with value set to v.
-func NewOptMirrorRequestResult(v MirrorRequestResult) OptMirrorRequestResult {
-	return OptMirrorRequestResult{
+// NewOptURI returns new OptURI with value set to v.
+func NewOptURI(v url.URL) OptURI {
+	return OptURI{
 		Value: v,
 		Set:   true,
 	}
 }
 
-// OptMirrorRequestResult is optional MirrorRequestResult.
-type OptMirrorRequestResult struct {
-	Value MirrorRequestResult
+// OptURI is optional url.URL.
+type OptURI struct {
+	Value url.URL
 	Set   bool
 }
 
-// IsSet returns true if OptMirrorRequestResult was set.
-func (o OptMirrorRequestResult) IsSet() bool { return o.Set }
+// IsSet returns true if OptURI was set.
+func (o OptURI) IsSet() bool { return o.Set }
 
 // Reset unsets value.
-func (o *OptMirrorRequestResult) Reset() {
-	var v MirrorRequestResult
+func (o *OptURI) Reset() {
+	var v url.URL
 	o.Value = v
 	o.Set = false
 }
 
 // SetTo sets value to v.
-func (o *OptMirrorRequestResult) SetTo(v MirrorRequestResult) {
+func (o *OptURI) SetTo(v url.URL) {
 	o.Set = true
 	o.Value = v
 }
 
 // Get returns value and boolean that denotes whether value was set.
-func (o OptMirrorRequestResult) Get() (v MirrorRequestResult, ok bool) {
+func (o OptURI) Get() (v url.URL, ok bool) {
 	if !o.Set {
 		return v, false
 	}
@@ -7471,466 +10600,590 @@ func (o OptMirrorRequestResult) Get() (v MirrorRequestResult, ok bool) {
 }
 
 // Or returns value if set, or given parameter if does not.
-func (o OptMirrorRequestResult) Or(d MirrorRequestResult) MirrorRequestResult {
+func (o OptURI) Or(d url.URL) url.URL {
 	if v, ok := o.Get(); ok {
 		return v
 	}
 	return d
 }
 
-// NewOptMirrorStatus returns new OptMirrorStatus with value set to v.
-func NewOptMirrorStatus(v MirrorStatus) OptMirrorStatus {
-	return OptMirrorStatus{
-		Value: v,
-		Set:   true,
+// Ref: #/components/schemas/Org
+type Org struct {
+	// A URL to the JSON Schema for this object.
+	Schema               OptURI          `json:"$schema"`
+	Capabilities         OrgCapabilities `json:"capabilities"`
+	CreatedAt            time.Time       `json:"createdAt"`
+	ID                   string          `json:"id"`
+	Name                 string          `json:"name"`
+	Region               string          `json:"region"`
+	WorkosOrganizationId OptString       `json:"workosOrganizationId"`
+	AdditionalProps      OrgAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *Org) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetCapabilities returns the value of Capabilities.
+func (s *Org) GetCapabilities() OrgCapabilities {
+	return s.Capabilities
+}
+
+// GetCreatedAt returns the value of CreatedAt.
+func (s *Org) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
+// GetID returns the value of ID.
+func (s *Org) GetID() string {
+	return s.ID
+}
+
+// GetName returns the value of Name.
+func (s *Org) GetName() string {
+	return s.Name
+}
+
+// GetRegion returns the value of Region.
+func (s *Org) GetRegion() string {
+	return s.Region
+}
+
+// GetWorkosOrganizationId returns the value of WorkosOrganizationId.
+func (s *Org) GetWorkosOrganizationId() OptString {
+	return s.WorkosOrganizationId
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *Org) GetAdditionalProps() OrgAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *Org) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetCapabilities sets the value of Capabilities.
+func (s *Org) SetCapabilities(val OrgCapabilities) {
+	s.Capabilities = val
+}
+
+// SetCreatedAt sets the value of CreatedAt.
+func (s *Org) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
+// SetID sets the value of ID.
+func (s *Org) SetID(val string) {
+	s.ID = val
+}
+
+// SetName sets the value of Name.
+func (s *Org) SetName(val string) {
+	s.Name = val
+}
+
+// SetRegion sets the value of Region.
+func (s *Org) SetRegion(val string) {
+	s.Region = val
+}
+
+// SetWorkosOrganizationId sets the value of WorkosOrganizationId.
+func (s *Org) SetWorkosOrganizationId(val OptString) {
+	s.WorkosOrganizationId = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *Org) SetAdditionalProps(val OrgAdditional) {
+	s.AdditionalProps = val
+}
+
+type OrgAdditional map[string]jx.Raw
+
+func (s *OrgAdditional) init() OrgAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
 	}
+	return m
 }
 
-// OptMirrorStatus is optional MirrorStatus.
-type OptMirrorStatus struct {
-	Value MirrorStatus
-	Set   bool
+// Ref: #/components/schemas/OrgCIBuildkiteClusterView
+type OrgCIBuildkiteClusterView struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI    `json:"$schema"`
+	AuthPluginRef   string    `json:"auth_plugin_ref"`
+	BkClusterID     string    `json:"bk_cluster_id"`
+	BkOrganization  string    `json:"bk_organization"`
+	CreatedAt       time.Time `json:"created_at"`
+	Label           string    `json:"label"`
+	Owner           string    `json:"owner"`
+	UpdatedAt       time.Time `json:"updated_at"`
+	AdditionalProps OrgCIBuildkiteClusterViewAdditional
 }
 
-// IsSet returns true if OptMirrorStatus was set.
-func (o OptMirrorStatus) IsSet() bool { return o.Set }
+// GetSchema returns the value of Schema.
+func (s *OrgCIBuildkiteClusterView) GetSchema() OptURI {
+	return s.Schema
+}
 
-// Reset unsets value.
-func (o *OptMirrorStatus) Reset() {
-	var v MirrorStatus
-	o.Value = v
-	o.Set = false
+// GetAuthPluginRef returns the value of AuthPluginRef.
+func (s *OrgCIBuildkiteClusterView) GetAuthPluginRef() string {
+	return s.AuthPluginRef
 }
 
-// SetTo sets value to v.
-func (o *OptMirrorStatus) SetTo(v MirrorStatus) {
-	o.Set = true
-	o.Value = v
+// GetBkClusterID returns the value of BkClusterID.
+func (s *OrgCIBuildkiteClusterView) GetBkClusterID() string {
+	return s.BkClusterID
+}
+
+// GetBkOrganization returns the value of BkOrganization.
+func (s *OrgCIBuildkiteClusterView) GetBkOrganization() string {
+	return s.BkOrganization
+}
+
+// GetCreatedAt returns the value of CreatedAt.
+func (s *OrgCIBuildkiteClusterView) GetCreatedAt() time.Time {
+	return s.CreatedAt
+}
+
+// GetLabel returns the value of Label.
+func (s *OrgCIBuildkiteClusterView) GetLabel() string {
+	return s.Label
+}
+
+// GetOwner returns the value of Owner.
+func (s *OrgCIBuildkiteClusterView) GetOwner() string {
+	return s.Owner
+}
+
+// GetUpdatedAt returns the value of UpdatedAt.
+func (s *OrgCIBuildkiteClusterView) GetUpdatedAt() time.Time {
+	return s.UpdatedAt
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *OrgCIBuildkiteClusterView) GetAdditionalProps() OrgCIBuildkiteClusterViewAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *OrgCIBuildkiteClusterView) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetAuthPluginRef sets the value of AuthPluginRef.
+func (s *OrgCIBuildkiteClusterView) SetAuthPluginRef(val string) {
+	s.AuthPluginRef = val
+}
+
+// SetBkClusterID sets the value of BkClusterID.
+func (s *OrgCIBuildkiteClusterView) SetBkClusterID(val string) {
+	s.BkClusterID = val
+}
+
+// SetBkOrganization sets the value of BkOrganization.
+func (s *OrgCIBuildkiteClusterView) SetBkOrganization(val string) {
+	s.BkOrganization = val
+}
+
+// SetCreatedAt sets the value of CreatedAt.
+func (s *OrgCIBuildkiteClusterView) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
+}
+
+// SetLabel sets the value of Label.
+func (s *OrgCIBuildkiteClusterView) SetLabel(val string) {
+	s.Label = val
+}
+
+// SetOwner sets the value of Owner.
+func (s *OrgCIBuildkiteClusterView) SetOwner(val string) {
+	s.Owner = val
+}
+
+// SetUpdatedAt sets the value of UpdatedAt.
+func (s *OrgCIBuildkiteClusterView) SetUpdatedAt(val time.Time) {
+	s.UpdatedAt = val
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptMirrorStatus) Get() (v MirrorStatus, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *OrgCIBuildkiteClusterView) SetAdditionalProps(val OrgCIBuildkiteClusterViewAdditional) {
+	s.AdditionalProps = val
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptMirrorStatus) Or(d MirrorStatus) MirrorStatus {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
-}
+type OrgCIBuildkiteClusterViewAdditional map[string]jx.Raw
 
-// NewOptOrg returns new OptOrg with value set to v.
-func NewOptOrg(v Org) OptOrg {
-	return OptOrg{
-		Value: v,
-		Set:   true,
+func (s *OrgCIBuildkiteClusterViewAdditional) init() OrgCIBuildkiteClusterViewAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
 	}
+	return m
 }
 
-// OptOrg is optional Org.
-type OptOrg struct {
-	Value Org
-	Set   bool
+// Ref: #/components/schemas/OrgCIBuildkiteCredentialView
+type OrgCIBuildkiteCredentialView struct {
+	// A URL to the JSON Schema for this object.
+	Schema                OptURI      `json:"$schema"`
+	BkOrganization        string      `json:"bk_organization"`
+	CipherVersion         int64       `json:"cipher_version"`
+	CreatedAt             time.Time   `json:"created_at"`
+	InboundEndpointID     OptString   `json:"inbound_endpoint_id"`
+	InboundEndpointPath   OptString   `json:"inbound_endpoint_path"`
+	InboundEndpointURL    OptString   `json:"inbound_endpoint_url"`
+	InboundSecret         OptString   `json:"inbound_secret"`
+	InboundSecretIssuedAt OptDateTime `json:"inbound_secret_issued_at"`
+	InboundSecretSet      bool        `json:"inbound_secret_set"`
+	Owner                 string      `json:"owner"`
+	TokenLen              int64       `json:"token_len"`
+	UpdatedAt             time.Time   `json:"updated_at"`
+	VerifiedAt            OptDateTime `json:"verified_at"`
+	AdditionalProps       OrgCIBuildkiteCredentialViewAdditional
 }
 
-// IsSet returns true if OptOrg was set.
-func (o OptOrg) IsSet() bool { return o.Set }
-
-// Reset unsets value.
-func (o *OptOrg) Reset() {
-	var v Org
-	o.Value = v
-	o.Set = false
+// GetSchema returns the value of Schema.
+func (s *OrgCIBuildkiteCredentialView) GetSchema() OptURI {
+	return s.Schema
 }
 
-// SetTo sets value to v.
-func (o *OptOrg) SetTo(v Org) {
-	o.Set = true
-	o.Value = v
+// GetBkOrganization returns the value of BkOrganization.
+func (s *OrgCIBuildkiteCredentialView) GetBkOrganization() string {
+	return s.BkOrganization
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptOrg) Get() (v Org, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// GetCipherVersion returns the value of CipherVersion.
+func (s *OrgCIBuildkiteCredentialView) GetCipherVersion() int64 {
+	return s.CipherVersion
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptOrg) Or(d Org) Org {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// GetCreatedAt returns the value of CreatedAt.
+func (s *OrgCIBuildkiteCredentialView) GetCreatedAt() time.Time {
+	return s.CreatedAt
 }
 
-// NewOptProject returns new OptProject with value set to v.
-func NewOptProject(v Project) OptProject {
-	return OptProject{
-		Value: v,
-		Set:   true,
-	}
+// GetInboundEndpointID returns the value of InboundEndpointID.
+func (s *OrgCIBuildkiteCredentialView) GetInboundEndpointID() OptString {
+	return s.InboundEndpointID
 }
 
-// OptProject is optional Project.
-type OptProject struct {
-	Value Project
-	Set   bool
+// GetInboundEndpointPath returns the value of InboundEndpointPath.
+func (s *OrgCIBuildkiteCredentialView) GetInboundEndpointPath() OptString {
+	return s.InboundEndpointPath
 }
 
-// IsSet returns true if OptProject was set.
-func (o OptProject) IsSet() bool { return o.Set }
+// GetInboundEndpointURL returns the value of InboundEndpointURL.
+func (s *OrgCIBuildkiteCredentialView) GetInboundEndpointURL() OptString {
+	return s.InboundEndpointURL
+}
 
-// Reset unsets value.
-func (o *OptProject) Reset() {
-	var v Project
-	o.Value = v
-	o.Set = false
+// GetInboundSecret returns the value of InboundSecret.
+func (s *OrgCIBuildkiteCredentialView) GetInboundSecret() OptString {
+	return s.InboundSecret
 }
 
-// SetTo sets value to v.
-func (o *OptProject) SetTo(v Project) {
-	o.Set = true
-	o.Value = v
+// GetInboundSecretIssuedAt returns the value of InboundSecretIssuedAt.
+func (s *OrgCIBuildkiteCredentialView) GetInboundSecretIssuedAt() OptDateTime {
+	return s.InboundSecretIssuedAt
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptProject) Get() (v Project, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// GetInboundSecretSet returns the value of InboundSecretSet.
+func (s *OrgCIBuildkiteCredentialView) GetInboundSecretSet() bool {
+	return s.InboundSecretSet
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptProject) Or(d Project) Project {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// GetOwner returns the value of Owner.
+func (s *OrgCIBuildkiteCredentialView) GetOwner() string {
+	return s.Owner
 }
 
-// NewOptRepo returns new OptRepo with value set to v.
-func NewOptRepo(v Repo) OptRepo {
-	return OptRepo{
-		Value: v,
-		Set:   true,
-	}
+// GetTokenLen returns the value of TokenLen.
+func (s *OrgCIBuildkiteCredentialView) GetTokenLen() int64 {
+	return s.TokenLen
 }
 
-// OptRepo is optional Repo.
-type OptRepo struct {
-	Value Repo
-	Set   bool
+// GetUpdatedAt returns the value of UpdatedAt.
+func (s *OrgCIBuildkiteCredentialView) GetUpdatedAt() time.Time {
+	return s.UpdatedAt
 }
 
-// IsSet returns true if OptRepo was set.
-func (o OptRepo) IsSet() bool { return o.Set }
+// GetVerifiedAt returns the value of VerifiedAt.
+func (s *OrgCIBuildkiteCredentialView) GetVerifiedAt() OptDateTime {
+	return s.VerifiedAt
+}
 
-// Reset unsets value.
-func (o *OptRepo) Reset() {
-	var v Repo
-	o.Value = v
-	o.Set = false
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *OrgCIBuildkiteCredentialView) GetAdditionalProps() OrgCIBuildkiteCredentialViewAdditional {
+	return s.AdditionalProps
 }
 
-// SetTo sets value to v.
-func (o *OptRepo) SetTo(v Repo) {
-	o.Set = true
-	o.Value = v
+// SetSchema sets the value of Schema.
+func (s *OrgCIBuildkiteCredentialView) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptRepo) Get() (v Repo, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// SetBkOrganization sets the value of BkOrganization.
+func (s *OrgCIBuildkiteCredentialView) SetBkOrganization(val string) {
+	s.BkOrganization = val
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptRepo) Or(d Repo) Repo {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// SetCipherVersion sets the value of CipherVersion.
+func (s *OrgCIBuildkiteCredentialView) SetCipherVersion(val int64) {
+	s.CipherVersion = val
 }
 
-// NewOptRepoCandidate returns new OptRepoCandidate with value set to v.
-func NewOptRepoCandidate(v RepoCandidate) OptRepoCandidate {
-	return OptRepoCandidate{
-		Value: v,
-		Set:   true,
-	}
+// SetCreatedAt sets the value of CreatedAt.
+func (s *OrgCIBuildkiteCredentialView) SetCreatedAt(val time.Time) {
+	s.CreatedAt = val
 }
 
-// OptRepoCandidate is optional RepoCandidate.
-type OptRepoCandidate struct {
-	Value RepoCandidate
-	Set   bool
+// SetInboundEndpointID sets the value of InboundEndpointID.
+func (s *OrgCIBuildkiteCredentialView) SetInboundEndpointID(val OptString) {
+	s.InboundEndpointID = val
 }
 
-// IsSet returns true if OptRepoCandidate was set.
-func (o OptRepoCandidate) IsSet() bool { return o.Set }
+// SetInboundEndpointPath sets the value of InboundEndpointPath.
+func (s *OrgCIBuildkiteCredentialView) SetInboundEndpointPath(val OptString) {
+	s.InboundEndpointPath = val
+}
 
-// Reset unsets value.
-func (o *OptRepoCandidate) Reset() {
-	var v RepoCandidate
-	o.Value = v
-	o.Set = false
+// SetInboundEndpointURL sets the value of InboundEndpointURL.
+func (s *OrgCIBuildkiteCredentialView) SetInboundEndpointURL(val OptString) {
+	s.InboundEndpointURL = val
 }
 
-// SetTo sets value to v.
-func (o *OptRepoCandidate) SetTo(v RepoCandidate) {
-	o.Set = true
-	o.Value = v
+// SetInboundSecret sets the value of InboundSecret.
+func (s *OrgCIBuildkiteCredentialView) SetInboundSecret(val OptString) {
+	s.InboundSecret = val
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptRepoCandidate) Get() (v RepoCandidate, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// SetInboundSecretIssuedAt sets the value of InboundSecretIssuedAt.
+func (s *OrgCIBuildkiteCredentialView) SetInboundSecretIssuedAt(val OptDateTime) {
+	s.InboundSecretIssuedAt = val
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptRepoCandidate) Or(d RepoCandidate) RepoCandidate {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// SetInboundSecretSet sets the value of InboundSecretSet.
+func (s *OrgCIBuildkiteCredentialView) SetInboundSecretSet(val bool) {
+	s.InboundSecretSet = val
 }
 
-// NewOptRepoPrimaries returns new OptRepoPrimaries with value set to v.
-func NewOptRepoPrimaries(v RepoPrimaries) OptRepoPrimaries {
-	return OptRepoPrimaries{
-		Value: v,
-		Set:   true,
-	}
+// SetOwner sets the value of Owner.
+func (s *OrgCIBuildkiteCredentialView) SetOwner(val string) {
+	s.Owner = val
 }
 
-// OptRepoPrimaries is optional RepoPrimaries.
-type OptRepoPrimaries struct {
-	Value RepoPrimaries
-	Set   bool
+// SetTokenLen sets the value of TokenLen.
+func (s *OrgCIBuildkiteCredentialView) SetTokenLen(val int64) {
+	s.TokenLen = val
 }
 
-// IsSet returns true if OptRepoPrimaries was set.
-func (o OptRepoPrimaries) IsSet() bool { return o.Set }
+// SetUpdatedAt sets the value of UpdatedAt.
+func (s *OrgCIBuildkiteCredentialView) SetUpdatedAt(val time.Time) {
+	s.UpdatedAt = val
+}
 
-// Reset unsets value.
-func (o *OptRepoPrimaries) Reset() {
-	var v RepoPrimaries
-	o.Value = v
-	o.Set = false
+// SetVerifiedAt sets the value of VerifiedAt.
+func (s *OrgCIBuildkiteCredentialView) SetVerifiedAt(val OptDateTime) {
+	s.VerifiedAt = val
 }
 
-// SetTo sets value to v.
-func (o *OptRepoPrimaries) SetTo(v RepoPrimaries) {
-	o.Set = true
-	o.Value = v
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *OrgCIBuildkiteCredentialView) SetAdditionalProps(val OrgCIBuildkiteCredentialViewAdditional) {
+	s.AdditionalProps = val
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptRepoPrimaries) Get() (v RepoPrimaries, ok bool) {
-	if !o.Set {
-		return v, false
+type OrgCIBuildkiteCredentialViewAdditional map[string]jx.Raw
+
+func (s *OrgCIBuildkiteCredentialViewAdditional) init() OrgCIBuildkiteCredentialViewAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
 	}
-	return o.Value, true
+	return m
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptRepoPrimaries) Or(d RepoPrimaries) RepoPrimaries {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// Ref: #/components/schemas/OrgCIGitHubActionsCredentialView
+type OrgCIGitHubActionsCredentialView struct {
+	// A URL to the JSON Schema for this object.
+	Schema              OptURI    `json:"$schema"`
+	Account             string    `json:"account"`
+	HasAPIToken         OptBool   `json:"has_api_token"`
+	InboundEndpointID   OptString `json:"inbound_endpoint_id"`
+	InboundEndpointPath OptString `json:"inbound_endpoint_path"`
+	InboundEndpointURL  OptString `json:"inbound_endpoint_url"`
+	InboundSecret       OptString `json:"inbound_secret"`
+	Owner               string    `json:"owner"`
+	Provider            string    `json:"provider"`
+	AdditionalProps     OrgCIGitHubActionsCredentialViewAdditional
 }
 
-// NewOptString returns new OptString with value set to v.
-func NewOptString(v string) OptString {
-	return OptString{
-		Value: v,
-		Set:   true,
-	}
+// GetSchema returns the value of Schema.
+func (s *OrgCIGitHubActionsCredentialView) GetSchema() OptURI {
+	return s.Schema
 }
 
-// OptString is optional string.
-type OptString struct {
-	Value string
-	Set   bool
+// GetAccount returns the value of Account.
+func (s *OrgCIGitHubActionsCredentialView) GetAccount() string {
+	return s.Account
 }
 
-// IsSet returns true if OptString was set.
-func (o OptString) IsSet() bool { return o.Set }
+// GetHasAPIToken returns the value of HasAPIToken.
+func (s *OrgCIGitHubActionsCredentialView) GetHasAPIToken() OptBool {
+	return s.HasAPIToken
+}
 
-// Reset unsets value.
-func (o *OptString) Reset() {
-	var v string
-	o.Value = v
-	o.Set = false
+// GetInboundEndpointID returns the value of InboundEndpointID.
+func (s *OrgCIGitHubActionsCredentialView) GetInboundEndpointID() OptString {
+	return s.InboundEndpointID
 }
 
-// SetTo sets value to v.
-func (o *OptString) SetTo(v string) {
-	o.Set = true
-	o.Value = v
+// GetInboundEndpointPath returns the value of InboundEndpointPath.
+func (s *OrgCIGitHubActionsCredentialView) GetInboundEndpointPath() OptString {
+	return s.InboundEndpointPath
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptString) Get() (v string, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// GetInboundEndpointURL returns the value of InboundEndpointURL.
+func (s *OrgCIGitHubActionsCredentialView) GetInboundEndpointURL() OptString {
+	return s.InboundEndpointURL
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptString) Or(d string) string {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// GetInboundSecret returns the value of InboundSecret.
+func (s *OrgCIGitHubActionsCredentialView) GetInboundSecret() OptString {
+	return s.InboundSecret
 }
 
-// NewOptURI returns new OptURI with value set to v.
-func NewOptURI(v url.URL) OptURI {
-	return OptURI{
-		Value: v,
-		Set:   true,
-	}
+// GetOwner returns the value of Owner.
+func (s *OrgCIGitHubActionsCredentialView) GetOwner() string {
+	return s.Owner
 }
 
-// OptURI is optional url.URL.
-type OptURI struct {
-	Value url.URL
-	Set   bool
+// GetProvider returns the value of Provider.
+func (s *OrgCIGitHubActionsCredentialView) GetProvider() string {
+	return s.Provider
 }
 
-// IsSet returns true if OptURI was set.
-func (o OptURI) IsSet() bool { return o.Set }
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *OrgCIGitHubActionsCredentialView) GetAdditionalProps() OrgCIGitHubActionsCredentialViewAdditional {
+	return s.AdditionalProps
+}
 
-// Reset unsets value.
-func (o *OptURI) Reset() {
-	var v url.URL
-	o.Value = v
-	o.Set = false
+// SetSchema sets the value of Schema.
+func (s *OrgCIGitHubActionsCredentialView) SetSchema(val OptURI) {
+	s.Schema = val
 }
 
-// SetTo sets value to v.
-func (o *OptURI) SetTo(v url.URL) {
-	o.Set = true
-	o.Value = v
+// SetAccount sets the value of Account.
+func (s *OrgCIGitHubActionsCredentialView) SetAccount(val string) {
+	s.Account = val
 }
 
-// Get returns value and boolean that denotes whether value was set.
-func (o OptURI) Get() (v url.URL, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
+// SetHasAPIToken sets the value of HasAPIToken.
+func (s *OrgCIGitHubActionsCredentialView) SetHasAPIToken(val OptBool) {
+	s.HasAPIToken = val
 }
 
-// Or returns value if set, or given parameter if does not.
-func (o OptURI) Or(d url.URL) url.URL {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
+// SetInboundEndpointID sets the value of InboundEndpointID.
+func (s *OrgCIGitHubActionsCredentialView) SetInboundEndpointID(val OptString) {
+	s.InboundEndpointID = val
 }
 
-// Ref: #/components/schemas/Org
-type Org struct {
-	// A URL to the JSON Schema for this object.
-	Schema               OptURI    `json:"$schema"`
-	CreatedAt            time.Time `json:"createdAt"`
-	ID                   string    `json:"id"`
-	Name                 string    `json:"name"`
-	Region               string    `json:"region"`
-	WorkosOrganizationId OptString `json:"workosOrganizationId"`
-	AdditionalProps      OrgAdditional
+// SetInboundEndpointPath sets the value of InboundEndpointPath.
+func (s *OrgCIGitHubActionsCredentialView) SetInboundEndpointPath(val OptString) {
+	s.InboundEndpointPath = val
 }
 
-// GetSchema returns the value of Schema.
-func (s *Org) GetSchema() OptURI {
-	return s.Schema
+// SetInboundEndpointURL sets the value of InboundEndpointURL.
+func (s *OrgCIGitHubActionsCredentialView) SetInboundEndpointURL(val OptString) {
+	s.InboundEndpointURL = val
 }
 
-// GetCreatedAt returns the value of CreatedAt.
-func (s *Org) GetCreatedAt() time.Time {
-	return s.CreatedAt
+// SetInboundSecret sets the value of InboundSecret.
+func (s *OrgCIGitHubActionsCredentialView) SetInboundSecret(val OptString) {
+	s.InboundSecret = val
 }
 
-// GetID returns the value of ID.
-func (s *Org) GetID() string {
-	return s.ID
+// SetOwner sets the value of Owner.
+func (s *OrgCIGitHubActionsCredentialView) SetOwner(val string) {
+	s.Owner = val
 }
 
-// GetName returns the value of Name.
-func (s *Org) GetName() string {
-	return s.Name
+// SetProvider sets the value of Provider.
+func (s *OrgCIGitHubActionsCredentialView) SetProvider(val string) {
+	s.Provider = val
 }
 
-// GetRegion returns the value of Region.
-func (s *Org) GetRegion() string {
-	return s.Region
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *OrgCIGitHubActionsCredentialView) SetAdditionalProps(val OrgCIGitHubActionsCredentialViewAdditional) {
+	s.AdditionalProps = val
 }
 
-// GetWorkosOrganizationId returns the value of WorkosOrganizationId.
-func (s *Org) GetWorkosOrganizationId() OptString {
-	return s.WorkosOrganizationId
+type OrgCIGitHubActionsCredentialViewAdditional map[string]jx.Raw
+
+func (s *OrgCIGitHubActionsCredentialViewAdditional) init() OrgCIGitHubActionsCredentialViewAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *Org) GetAdditionalProps() OrgAdditional {
-	return s.AdditionalProps
+// Ref: #/components/schemas/OrgCapabilities
+type OrgCapabilities struct {
+	CanCreateProject bool `json:"canCreateProject"`
+	CanDelete        bool `json:"canDelete"`
+	CanManageMembers bool `json:"canManageMembers"`
+	AdditionalProps  OrgCapabilitiesAdditional
 }
 
-// SetSchema sets the value of Schema.
-func (s *Org) SetSchema(val OptURI) {
-	s.Schema = val
+// GetCanCreateProject returns the value of CanCreateProject.
+func (s *OrgCapabilities) GetCanCreateProject() bool {
+	return s.CanCreateProject
 }
 
-// SetCreatedAt sets the value of CreatedAt.
-func (s *Org) SetCreatedAt(val time.Time) {
-	s.CreatedAt = val
+// GetCanDelete returns the value of CanDelete.
+func (s *OrgCapabilities) GetCanDelete() bool {
+	return s.CanDelete
 }
 
-// SetID sets the value of ID.
-func (s *Org) SetID(val string) {
-	s.ID = val
+// GetCanManageMembers returns the value of CanManageMembers.
+func (s *OrgCapabilities) GetCanManageMembers() bool {
+	return s.CanManageMembers
 }
 
-// SetName sets the value of Name.
-func (s *Org) SetName(val string) {
-	s.Name = val
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *OrgCapabilities) GetAdditionalProps() OrgCapabilitiesAdditional {
+	return s.AdditionalProps
 }
 
-// SetRegion sets the value of Region.
-func (s *Org) SetRegion(val string) {
-	s.Region = val
+// SetCanCreateProject sets the value of CanCreateProject.
+func (s *OrgCapabilities) SetCanCreateProject(val bool) {
+	s.CanCreateProject = val
 }
 
-// SetWorkosOrganizationId sets the value of WorkosOrganizationId.
-func (s *Org) SetWorkosOrganizationId(val OptString) {
-	s.WorkosOrganizationId = val
+// SetCanDelete sets the value of CanDelete.
+func (s *OrgCapabilities) SetCanDelete(val bool) {
+	s.CanDelete = val
+}
+
+// SetCanManageMembers sets the value of CanManageMembers.
+func (s *OrgCapabilities) SetCanManageMembers(val bool) {
+	s.CanManageMembers = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *Org) SetAdditionalProps(val OrgAdditional) {
+func (s *OrgCapabilities) SetAdditionalProps(val OrgCapabilitiesAdditional) {
 	s.AdditionalProps = val
 }
 
-type OrgAdditional map[string]jx.Raw
+type OrgCapabilitiesAdditional map[string]jx.Raw
 
-func (s *OrgAdditional) init() OrgAdditional {
+func (s *OrgCapabilitiesAdditional) init() OrgCapabilitiesAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -7946,6 +11199,7 @@ type PatchRepoCIWebhookInputBody struct {
 	DisplayName     OptString `json:"display_name"`
 	Enabled         OptBool   `json:"enabled"`
 	Events          []string  `json:"events"`
+	PublishChecks   OptBool   `json:"publish_checks"`
 	RefFilter       OptString `json:"ref_filter"`
 	AdditionalProps PatchRepoCIWebhookInputBodyAdditional
 }
@@ -7970,6 +11224,11 @@ func (s *PatchRepoCIWebhookInputBody) GetEvents() []string {
 	return s.Events
 }
 
+// GetPublishChecks returns the value of PublishChecks.
+func (s *PatchRepoCIWebhookInputBody) GetPublishChecks() OptBool {
+	return s.PublishChecks
+}
+
 // GetRefFilter returns the value of RefFilter.
 func (s *PatchRepoCIWebhookInputBody) GetRefFilter() OptString {
 	return s.RefFilter
@@ -8000,6 +11259,11 @@ func (s *PatchRepoCIWebhookInputBody) SetEvents(val []string) {
 	s.Events = val
 }
 
+// SetPublishChecks sets the value of PublishChecks.
+func (s *PatchRepoCIWebhookInputBody) SetPublishChecks(val OptBool) {
+	s.PublishChecks = val
+}
+
 // SetRefFilter sets the value of RefFilter.
 func (s *PatchRepoCIWebhookInputBody) SetRefFilter(val OptString) {
 	s.RefFilter = val
@@ -8024,13 +11288,15 @@ func (s *PatchRepoCIWebhookInputBodyAdditional) init() PatchRepoCIWebhookInputBo
 // Ref: #/components/schemas/Project
 type Project struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI           `json:"$schema"`
-	CreatedAt       time.Time        `json:"createdAt"`
-	ID              string           `json:"id"`
-	Name            string           `json:"name"`
-	OwnerId         string           `json:"ownerId"`
-	OwnerType       ProjectOwnerType `json:"ownerType"`
-	Region          string           `json:"region"`
+	Schema          OptURI              `json:"$schema"`
+	Capabilities    ProjectCapabilities `json:"capabilities"`
+	CreatedAt       time.Time           `json:"createdAt"`
+	ID              string              `json:"id"`
+	Name            string              `json:"name"`
+	OwnerId         string              `json:"ownerId"`
+	OwnerName       OptString           `json:"ownerName"`
+	OwnerType       ProjectOwnerType    `json:"ownerType"`
+	Region          string              `json:"region"`
 	AdditionalProps ProjectAdditional
 }
 
@@ -8039,6 +11305,11 @@ func (s *Project) GetSchema() OptURI {
 	return s.Schema
 }
 
+// GetCapabilities returns the value of Capabilities.
+func (s *Project) GetCapabilities() ProjectCapabilities {
+	return s.Capabilities
+}
+
 // GetCreatedAt returns the value of CreatedAt.
 func (s *Project) GetCreatedAt() time.Time {
 	return s.CreatedAt
@@ -8059,6 +11330,11 @@ func (s *Project) GetOwnerId() string {
 	return s.OwnerId
 }
 
+// GetOwnerName returns the value of OwnerName.
+func (s *Project) GetOwnerName() OptString {
+	return s.OwnerName
+}
+
 // GetOwnerType returns the value of OwnerType.
 func (s *Project) GetOwnerType() ProjectOwnerType {
 	return s.OwnerType
@@ -8079,6 +11355,11 @@ func (s *Project) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
+// SetCapabilities sets the value of Capabilities.
+func (s *Project) SetCapabilities(val ProjectCapabilities) {
+	s.Capabilities = val
+}
+
 // SetCreatedAt sets the value of CreatedAt.
 func (s *Project) SetCreatedAt(val time.Time) {
 	s.CreatedAt = val
@@ -8099,6 +11380,11 @@ func (s *Project) SetOwnerId(val string) {
 	s.OwnerId = val
 }
 
+// SetOwnerName sets the value of OwnerName.
+func (s *Project) SetOwnerName(val OptString) {
+	s.OwnerName = val
+}
+
 // SetOwnerType sets the value of OwnerType.
 func (s *Project) SetOwnerType(val ProjectOwnerType) {
 	s.OwnerType = val
@@ -8125,6 +11411,76 @@ func (s *ProjectAdditional) init() ProjectAdditional {
 	return m
 }
 
+// Ref: #/components/schemas/ProjectCapabilities
+type ProjectCapabilities struct {
+	CanCreateRepository bool `json:"canCreateRepository"`
+	CanDelete           bool `json:"canDelete"`
+	CanManageAccess     bool `json:"canManageAccess"`
+	CanManageTrails     bool `json:"canManageTrails"`
+	AdditionalProps     ProjectCapabilitiesAdditional
+}
+
+// GetCanCreateRepository returns the value of CanCreateRepository.
+func (s *ProjectCapabilities) GetCanCreateRepository() bool {
+	return s.CanCreateRepository
+}
+
+// GetCanDelete returns the value of CanDelete.
+func (s *ProjectCapabilities) GetCanDelete() bool {
+	return s.CanDelete
+}
+
+// GetCanManageAccess returns the value of CanManageAccess.
+func (s *ProjectCapabilities) GetCanManageAccess() bool {
+	return s.CanManageAccess
+}
+
+// GetCanManageTrails returns the value of CanManageTrails.
+func (s *ProjectCapabilities) GetCanManageTrails() bool {
+	return s.CanManageTrails
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ProjectCapabilities) GetAdditionalProps() ProjectCapabilitiesAdditional {
+	return s.AdditionalProps
+}
+
+// SetCanCreateRepository sets the value of CanCreateRepository.
+func (s *ProjectCapabilities) SetCanCreateRepository(val bool) {
+	s.CanCreateRepository = val
+}
+
+// SetCanDelete sets the value of CanDelete.
+func (s *ProjectCapabilities) SetCanDelete(val bool) {
+	s.CanDelete = val
+}
+
+// SetCanManageAccess sets the value of CanManageAccess.
+func (s *ProjectCapabilities) SetCanManageAccess(val bool) {
+	s.CanManageAccess = val
+}
+
+// SetCanManageTrails sets the value of CanManageTrails.
+func (s *ProjectCapabilities) SetCanManageTrails(val bool) {
+	s.CanManageTrails = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ProjectCapabilities) SetAdditionalProps(val ProjectCapabilitiesAdditional) {
+	s.AdditionalProps = val
+}
+
+type ProjectCapabilitiesAdditional map[string]jx.Raw
+
+func (s *ProjectCapabilitiesAdditional) init() ProjectCapabilitiesAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
 // Ref: #/components/schemas/ProjectGrant
 type ProjectGrant struct {
 	GranteeId       string    `json:"granteeId"`
@@ -8191,13 +11547,136 @@ func (s *ProjectGrant) SetSource(val string) {
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *ProjectGrant) SetAdditionalProps(val ProjectGrantAdditional) {
+func (s *ProjectGrant) SetAdditionalProps(val ProjectGrantAdditional) {
+	s.AdditionalProps = val
+}
+
+type ProjectGrantAdditional map[string]jx.Raw
+
+func (s *ProjectGrantAdditional) init() ProjectGrantAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+type ProjectOwnerType string
+
+const (
+	ProjectOwnerTypeOrg     ProjectOwnerType = "org"
+	ProjectOwnerTypeAccount ProjectOwnerType = "account"
+)
+
+// AllValues returns all ProjectOwnerType values.
+func (ProjectOwnerType) AllValues() []ProjectOwnerType {
+	return []ProjectOwnerType{
+		ProjectOwnerTypeOrg,
+		ProjectOwnerTypeAccount,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s ProjectOwnerType) MarshalText() ([]byte, error) {
+	switch s {
+	case ProjectOwnerTypeOrg:
+		return []byte(s), nil
+	case ProjectOwnerTypeAccount:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *ProjectOwnerType) UnmarshalText(data []byte) error {
+	switch ProjectOwnerType(data) {
+	case ProjectOwnerTypeOrg:
+		*s = ProjectOwnerTypeOrg
+		return nil
+	case ProjectOwnerTypeAccount:
+		*s = ProjectOwnerTypeAccount
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
+// Ref: #/components/schemas/RegisterOrgCIBuildkiteClusterInputBody
+type RegisterOrgCIBuildkiteClusterInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI    `json:"$schema"`
+	AuthPluginRef   OptString `json:"auth_plugin_ref"`
+	BkClusterID     string    `json:"bk_cluster_id"`
+	BkOrganization  string    `json:"bk_organization"`
+	Label           OptString `json:"label"`
+	AdditionalProps RegisterOrgCIBuildkiteClusterInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetAuthPluginRef returns the value of AuthPluginRef.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) GetAuthPluginRef() OptString {
+	return s.AuthPluginRef
+}
+
+// GetBkClusterID returns the value of BkClusterID.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) GetBkClusterID() string {
+	return s.BkClusterID
+}
+
+// GetBkOrganization returns the value of BkOrganization.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) GetBkOrganization() string {
+	return s.BkOrganization
+}
+
+// GetLabel returns the value of Label.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) GetLabel() OptString {
+	return s.Label
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) GetAdditionalProps() RegisterOrgCIBuildkiteClusterInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetAuthPluginRef sets the value of AuthPluginRef.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) SetAuthPluginRef(val OptString) {
+	s.AuthPluginRef = val
+}
+
+// SetBkClusterID sets the value of BkClusterID.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) SetBkClusterID(val string) {
+	s.BkClusterID = val
+}
+
+// SetBkOrganization sets the value of BkOrganization.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) SetBkOrganization(val string) {
+	s.BkOrganization = val
+}
+
+// SetLabel sets the value of Label.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) SetLabel(val OptString) {
+	s.Label = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RegisterOrgCIBuildkiteClusterInputBody) SetAdditionalProps(val RegisterOrgCIBuildkiteClusterInputBodyAdditional) {
 	s.AdditionalProps = val
 }
 
-type ProjectGrantAdditional map[string]jx.Raw
+type RegisterOrgCIBuildkiteClusterInputBodyAdditional map[string]jx.Raw
 
-func (s *ProjectGrantAdditional) init() ProjectGrantAdditional {
+func (s *RegisterOrgCIBuildkiteClusterInputBodyAdditional) init() RegisterOrgCIBuildkiteClusterInputBodyAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -8206,69 +11685,33 @@ func (s *ProjectGrantAdditional) init() ProjectGrantAdditional {
 	return m
 }
 
-type ProjectOwnerType string
-
-const (
-	ProjectOwnerTypeOrg     ProjectOwnerType = "org"
-	ProjectOwnerTypeAccount ProjectOwnerType = "account"
-)
-
-// AllValues returns all ProjectOwnerType values.
-func (ProjectOwnerType) AllValues() []ProjectOwnerType {
-	return []ProjectOwnerType{
-		ProjectOwnerTypeOrg,
-		ProjectOwnerTypeAccount,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s ProjectOwnerType) MarshalText() ([]byte, error) {
-	switch s {
-	case ProjectOwnerTypeOrg:
-		return []byte(s), nil
-	case ProjectOwnerTypeAccount:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *ProjectOwnerType) UnmarshalText(data []byte) error {
-	switch ProjectOwnerType(data) {
-	case ProjectOwnerTypeOrg:
-		*s = ProjectOwnerTypeOrg
-		return nil
-	case ProjectOwnerTypeAccount:
-		*s = ProjectOwnerTypeAccount
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
-}
-
 // RemoveOrgMemberNoContent is response for RemoveOrgMember operation.
 type RemoveOrgMemberNoContent struct{}
 
 // Ref: #/components/schemas/Repo
 type Repo struct {
 	// A URL to the JSON Schema for this object.
-	Schema            OptURI    `json:"$schema"`
-	ClusterHost       OptString `json:"clusterHost"`
-	Foreign           OptBool   `json:"foreign"`
-	FullName          OptString `json:"fullName"`
-	ID                string    `json:"id"`
-	MirrorSuspended   OptBool   `json:"mirrorSuspended"`
-	MirrorSuspendedAt OptString `json:"mirrorSuspendedAt"`
-	Name              string    `json:"name"`
-	ObjectFormat      OptString `json:"objectFormat"`
-	OwningProjectId   string    `json:"owningProjectId"`
-	Path              OptString `json:"path"`
-	ProvisionAttempts OptInt64  `json:"provisionAttempts"`
-	ProvisionReason   OptString `json:"provisionReason"`
-	RepoGroupId       OptString `json:"repoGroupId"`
-	State             OptString `json:"state"`
-	Visibility        OptString `json:"visibility"`
+	Schema            OptURI              `json:"$schema"`
+	Capabilities      OptRepoCapabilities `json:"capabilities"`
+	ClusterHost       OptString           `json:"clusterHost"`
+	ClusterSlug       OptString           `json:"clusterSlug"`
+	Foreign           OptBool             `json:"foreign"`
+	FullName          OptString           `json:"fullName"`
+	ID                string              `json:"id"`
+	Jurisdiction      OptString           `json:"jurisdiction"`
+	MirrorSuspended   OptBool             `json:"mirrorSuspended"`
+	MirrorSuspendedAt OptString           `json:"mirrorSuspendedAt"`
+	Name              string              `json:"name"`
+	ObjectFormat      OptString           `json:"objectFormat"`
+	OwningProjectId   string              `json:"owningProjectId"`
+	Path              OptString           `json:"path"`
+	Primaries         OptRepoPrimaries    `json:"primaries"`
+	Provider          OptString           `json:"provider"`
+	ProvisionAttempts OptInt64            `json:"provisionAttempts"`
+	ProvisionReason   OptString           `json:"provisionReason"`
+	RepoGroupId       OptString           `json:"repoGroupId"`
+	State             OptString           `json:"state"`
+	Visibility        OptString           `json:"visibility"`
 	AdditionalProps   RepoAdditional
 }
 
@@ -8277,11 +11720,21 @@ func (s *Repo) GetSchema() OptURI {
 	return s.Schema
 }
 
+// GetCapabilities returns the value of Capabilities.
+func (s *Repo) GetCapabilities() OptRepoCapabilities {
+	return s.Capabilities
+}
+
 // GetClusterHost returns the value of ClusterHost.
 func (s *Repo) GetClusterHost() OptString {
 	return s.ClusterHost
 }
 
+// GetClusterSlug returns the value of ClusterSlug.
+func (s *Repo) GetClusterSlug() OptString {
+	return s.ClusterSlug
+}
+
 // GetForeign returns the value of Foreign.
 func (s *Repo) GetForeign() OptBool {
 	return s.Foreign
@@ -8297,6 +11750,11 @@ func (s *Repo) GetID() string {
 	return s.ID
 }
 
+// GetJurisdiction returns the value of Jurisdiction.
+func (s *Repo) GetJurisdiction() OptString {
+	return s.Jurisdiction
+}
+
 // GetMirrorSuspended returns the value of MirrorSuspended.
 func (s *Repo) GetMirrorSuspended() OptBool {
 	return s.MirrorSuspended
@@ -8327,6 +11785,16 @@ func (s *Repo) GetPath() OptString {
 	return s.Path
 }
 
+// GetPrimaries returns the value of Primaries.
+func (s *Repo) GetPrimaries() OptRepoPrimaries {
+	return s.Primaries
+}
+
+// GetProvider returns the value of Provider.
+func (s *Repo) GetProvider() OptString {
+	return s.Provider
+}
+
 // GetProvisionAttempts returns the value of ProvisionAttempts.
 func (s *Repo) GetProvisionAttempts() OptInt64 {
 	return s.ProvisionAttempts
@@ -8362,11 +11830,21 @@ func (s *Repo) SetSchema(val OptURI) {
 	s.Schema = val
 }
 
+// SetCapabilities sets the value of Capabilities.
+func (s *Repo) SetCapabilities(val OptRepoCapabilities) {
+	s.Capabilities = val
+}
+
 // SetClusterHost sets the value of ClusterHost.
 func (s *Repo) SetClusterHost(val OptString) {
 	s.ClusterHost = val
 }
 
+// SetClusterSlug sets the value of ClusterSlug.
+func (s *Repo) SetClusterSlug(val OptString) {
+	s.ClusterSlug = val
+}
+
 // SetForeign sets the value of Foreign.
 func (s *Repo) SetForeign(val OptBool) {
 	s.Foreign = val
@@ -8382,6 +11860,11 @@ func (s *Repo) SetID(val string) {
 	s.ID = val
 }
 
+// SetJurisdiction sets the value of Jurisdiction.
+func (s *Repo) SetJurisdiction(val OptString) {
+	s.Jurisdiction = val
+}
+
 // SetMirrorSuspended sets the value of MirrorSuspended.
 func (s *Repo) SetMirrorSuspended(val OptBool) {
 	s.MirrorSuspended = val
@@ -8412,6 +11895,16 @@ func (s *Repo) SetPath(val OptString) {
 	s.Path = val
 }
 
+// SetPrimaries sets the value of Primaries.
+func (s *Repo) SetPrimaries(val OptRepoPrimaries) {
+	s.Primaries = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *Repo) SetProvider(val OptString) {
+	s.Provider = val
+}
+
 // SetProvisionAttempts sets the value of ProvisionAttempts.
 func (s *Repo) SetProvisionAttempts(val OptInt64) {
 	s.ProvisionAttempts = val
@@ -8549,6 +12042,185 @@ func (s *RepoCandidateAdditional) init() RepoCandidateAdditional {
 	return m
 }
 
+// Ref: #/components/schemas/RepoCapabilities
+type RepoCapabilities struct {
+	CanManage       bool `json:"canManage"`
+	CanPull         bool `json:"canPull"`
+	CanPush         bool `json:"canPush"`
+	AdditionalProps RepoCapabilitiesAdditional
+}
+
+// GetCanManage returns the value of CanManage.
+func (s *RepoCapabilities) GetCanManage() bool {
+	return s.CanManage
+}
+
+// GetCanPull returns the value of CanPull.
+func (s *RepoCapabilities) GetCanPull() bool {
+	return s.CanPull
+}
+
+// GetCanPush returns the value of CanPush.
+func (s *RepoCapabilities) GetCanPush() bool {
+	return s.CanPush
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoCapabilities) GetAdditionalProps() RepoCapabilitiesAdditional {
+	return s.AdditionalProps
+}
+
+// SetCanManage sets the value of CanManage.
+func (s *RepoCapabilities) SetCanManage(val bool) {
+	s.CanManage = val
+}
+
+// SetCanPull sets the value of CanPull.
+func (s *RepoCapabilities) SetCanPull(val bool) {
+	s.CanPull = val
+}
+
+// SetCanPush sets the value of CanPush.
+func (s *RepoCapabilities) SetCanPush(val bool) {
+	s.CanPush = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RepoCapabilities) SetAdditionalProps(val RepoCapabilitiesAdditional) {
+	s.AdditionalProps = val
+}
+
+type RepoCapabilitiesAdditional map[string]jx.Raw
+
+func (s *RepoCapabilitiesAdditional) init() RepoCapabilitiesAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/RepoCollaborator
+type RepoCollaborator struct {
+	AccountId       string    `json:"accountId"`
+	Handle          OptString `json:"handle"`
+	Role            string    `json:"role"`
+	AdditionalProps RepoCollaboratorAdditional
+}
+
+// GetAccountId returns the value of AccountId.
+func (s *RepoCollaborator) GetAccountId() string {
+	return s.AccountId
+}
+
+// GetHandle returns the value of Handle.
+func (s *RepoCollaborator) GetHandle() OptString {
+	return s.Handle
+}
+
+// GetRole returns the value of Role.
+func (s *RepoCollaborator) GetRole() string {
+	return s.Role
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoCollaborator) GetAdditionalProps() RepoCollaboratorAdditional {
+	return s.AdditionalProps
+}
+
+// SetAccountId sets the value of AccountId.
+func (s *RepoCollaborator) SetAccountId(val string) {
+	s.AccountId = val
+}
+
+// SetHandle sets the value of Handle.
+func (s *RepoCollaborator) SetHandle(val OptString) {
+	s.Handle = val
+}
+
+// SetRole sets the value of Role.
+func (s *RepoCollaborator) SetRole(val string) {
+	s.Role = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RepoCollaborator) SetAdditionalProps(val RepoCollaboratorAdditional) {
+	s.AdditionalProps = val
+}
+
+type RepoCollaboratorAdditional map[string]jx.Raw
+
+func (s *RepoCollaboratorAdditional) init() RepoCollaboratorAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/RepoFacetPage
+type RepoFacetPage struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI   `json:"$schema"`
+	Items  []string `json:"items"`
+	// Pass back to fetch the next page; empty when no more entries.
+	NextPageToken   OptString `json:"nextPageToken"`
+	AdditionalProps RepoFacetPageAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *RepoFacetPage) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetItems returns the value of Items.
+func (s *RepoFacetPage) GetItems() []string {
+	return s.Items
+}
+
+// GetNextPageToken returns the value of NextPageToken.
+func (s *RepoFacetPage) GetNextPageToken() OptString {
+	return s.NextPageToken
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoFacetPage) GetAdditionalProps() RepoFacetPageAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *RepoFacetPage) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetItems sets the value of Items.
+func (s *RepoFacetPage) SetItems(val []string) {
+	s.Items = val
+}
+
+// SetNextPageToken sets the value of NextPageToken.
+func (s *RepoFacetPage) SetNextPageToken(val OptString) {
+	s.NextPageToken = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RepoFacetPage) SetAdditionalProps(val RepoFacetPageAdditional) {
+	s.AdditionalProps = val
+}
+
+type RepoFacetPageAdditional map[string]jx.Raw
+
+func (s *RepoFacetPageAdditional) init() RepoFacetPageAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
 // Ref: #/components/schemas/RepoGrant
 type RepoGrant struct {
 	GranteeId       string    `json:"granteeId"`
@@ -8604,24 +12276,94 @@ func (s *RepoGrant) SetGranteeType(val string) {
 	s.GranteeType = val
 }
 
-// SetRole sets the value of Role.
-func (s *RepoGrant) SetRole(val string) {
-	s.Role = val
+// SetRole sets the value of Role.
+func (s *RepoGrant) SetRole(val string) {
+	s.Role = val
+}
+
+// SetSource sets the value of Source.
+func (s *RepoGrant) SetSource(val string) {
+	s.Source = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RepoGrant) SetAdditionalProps(val RepoGrantAdditional) {
+	s.AdditionalProps = val
+}
+
+type RepoGrantAdditional map[string]jx.Raw
+
+func (s *RepoGrantAdditional) init() RepoGrantAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/RepoIDResolution
+type RepoIDResolution struct {
+	FullName        OptString              `json:"fullName"`
+	Provider        OptString              `json:"provider"`
+	RepoId          string                 `json:"repoId"`
+	Status          RepoIDResolutionStatus `json:"status"`
+	AdditionalProps RepoIDResolutionAdditional
+}
+
+// GetFullName returns the value of FullName.
+func (s *RepoIDResolution) GetFullName() OptString {
+	return s.FullName
+}
+
+// GetProvider returns the value of Provider.
+func (s *RepoIDResolution) GetProvider() OptString {
+	return s.Provider
+}
+
+// GetRepoId returns the value of RepoId.
+func (s *RepoIDResolution) GetRepoId() string {
+	return s.RepoId
+}
+
+// GetStatus returns the value of Status.
+func (s *RepoIDResolution) GetStatus() RepoIDResolutionStatus {
+	return s.Status
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoIDResolution) GetAdditionalProps() RepoIDResolutionAdditional {
+	return s.AdditionalProps
+}
+
+// SetFullName sets the value of FullName.
+func (s *RepoIDResolution) SetFullName(val OptString) {
+	s.FullName = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *RepoIDResolution) SetProvider(val OptString) {
+	s.Provider = val
+}
+
+// SetRepoId sets the value of RepoId.
+func (s *RepoIDResolution) SetRepoId(val string) {
+	s.RepoId = val
 }
 
-// SetSource sets the value of Source.
-func (s *RepoGrant) SetSource(val string) {
-	s.Source = val
+// SetStatus sets the value of Status.
+func (s *RepoIDResolution) SetStatus(val RepoIDResolutionStatus) {
+	s.Status = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *RepoGrant) SetAdditionalProps(val RepoGrantAdditional) {
+func (s *RepoIDResolution) SetAdditionalProps(val RepoIDResolutionAdditional) {
 	s.AdditionalProps = val
 }
 
-type RepoGrantAdditional map[string]jx.Raw
+type RepoIDResolutionAdditional map[string]jx.Raw
 
-func (s *RepoGrantAdditional) init() RepoGrantAdditional {
+func (s *RepoIDResolutionAdditional) init() RepoIDResolutionAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -8630,25 +12372,88 @@ func (s *RepoGrantAdditional) init() RepoGrantAdditional {
 	return m
 }
 
+type RepoIDResolutionStatus string
+
+const (
+	RepoIDResolutionStatusResolved    RepoIDResolutionStatus = "resolved"
+	RepoIDResolutionStatusUnavailable RepoIDResolutionStatus = "unavailable"
+)
+
+// AllValues returns all RepoIDResolutionStatus values.
+func (RepoIDResolutionStatus) AllValues() []RepoIDResolutionStatus {
+	return []RepoIDResolutionStatus{
+		RepoIDResolutionStatusResolved,
+		RepoIDResolutionStatusUnavailable,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s RepoIDResolutionStatus) MarshalText() ([]byte, error) {
+	switch s {
+	case RepoIDResolutionStatusResolved:
+		return []byte(s), nil
+	case RepoIDResolutionStatusUnavailable:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *RepoIDResolutionStatus) UnmarshalText(data []byte) error {
+	switch RepoIDResolutionStatus(data) {
+	case RepoIDResolutionStatusResolved:
+		*s = RepoIDResolutionStatusResolved
+		return nil
+	case RepoIDResolutionStatusUnavailable:
+		*s = RepoIDResolutionStatusUnavailable
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
 // Ref: #/components/schemas/RepoIndexEntry
 type RepoIndexEntry struct {
-	Candidate OptRepoCandidate `json:"candidate"`
+	ActivityHotness OptFloat64       `json:"activityHotness"`
+	Archived        OptBool          `json:"archived"`
+	Candidate       OptRepoCandidate `json:"candidate"`
 	// Deprecated: schema marks this property as deprecated.
-	Cell string `json:"cell"`
+	Cell            string   `json:"cell"`
+	CheckpointCount OptInt64 `json:"checkpointCount"`
 	// Deprecated: schema marks this property as deprecated.
-	ClusterSlug string `json:"clusterSlug"`
-	FullName    string `json:"full_name"`
-	ID          string `json:"id"`
+	ClusterSlug string   `json:"clusterSlug"`
+	Forks       OptInt64 `json:"forks"`
+	FullName    string   `json:"full_name"`
+	ID          string   `json:"id"`
 	// Deprecated: schema marks this property as deprecated.
-	Jurisdiction    string           `json:"jurisdiction"`
-	Name            string           `json:"name"`
-	Placements      []RepoPlacement  `json:"placements"`
-	Primaries       OptRepoPrimaries `json:"primaries"`
-	Stars           OptInt64         `json:"stars"`
-	Visibility      string           `json:"visibility"`
+	Jurisdiction    string                      `json:"jurisdiction"`
+	Language        OptString                   `json:"language"`
+	LastActivityAt  OptDateTime                 `json:"lastActivityAt"`
+	LastPushedAt    OptDateTime                 `json:"lastPushedAt"`
+	Name            string                      `json:"name"`
+	OpenPrCount     OptInt64                    `json:"openPrCount"`
+	Org             string                      `json:"org"`
+	Permission      OptRepoIndexEntryPermission `json:"permission"`
+	Placements      []RepoPlacement             `json:"placements"`
+	Primaries       OptRepoPrimaries            `json:"primaries"`
+	Provider        string                      `json:"provider"`
+	PushedAt        OptDateTime                 `json:"pushedAt"`
+	Stars           OptInt64                    `json:"stars"`
+	Visibility      string                      `json:"visibility"`
 	AdditionalProps RepoIndexEntryAdditional
 }
 
+// GetActivityHotness returns the value of ActivityHotness.
+func (s *RepoIndexEntry) GetActivityHotness() OptFloat64 {
+	return s.ActivityHotness
+}
+
+// GetArchived returns the value of Archived.
+func (s *RepoIndexEntry) GetArchived() OptBool {
+	return s.Archived
+}
+
 // GetCandidate returns the value of Candidate.
 func (s *RepoIndexEntry) GetCandidate() OptRepoCandidate {
 	return s.Candidate
@@ -8659,11 +12464,21 @@ func (s *RepoIndexEntry) GetCell() string {
 	return s.Cell
 }
 
+// GetCheckpointCount returns the value of CheckpointCount.
+func (s *RepoIndexEntry) GetCheckpointCount() OptInt64 {
+	return s.CheckpointCount
+}
+
 // GetClusterSlug returns the value of ClusterSlug.
 func (s *RepoIndexEntry) GetClusterSlug() string {
 	return s.ClusterSlug
 }
 
+// GetForks returns the value of Forks.
+func (s *RepoIndexEntry) GetForks() OptInt64 {
+	return s.Forks
+}
+
 // GetFullName returns the value of FullName.
 func (s *RepoIndexEntry) GetFullName() string {
 	return s.FullName
@@ -8679,11 +12494,41 @@ func (s *RepoIndexEntry) GetJurisdiction() string {
 	return s.Jurisdiction
 }
 
+// GetLanguage returns the value of Language.
+func (s *RepoIndexEntry) GetLanguage() OptString {
+	return s.Language
+}
+
+// GetLastActivityAt returns the value of LastActivityAt.
+func (s *RepoIndexEntry) GetLastActivityAt() OptDateTime {
+	return s.LastActivityAt
+}
+
+// GetLastPushedAt returns the value of LastPushedAt.
+func (s *RepoIndexEntry) GetLastPushedAt() OptDateTime {
+	return s.LastPushedAt
+}
+
 // GetName returns the value of Name.
 func (s *RepoIndexEntry) GetName() string {
 	return s.Name
 }
 
+// GetOpenPrCount returns the value of OpenPrCount.
+func (s *RepoIndexEntry) GetOpenPrCount() OptInt64 {
+	return s.OpenPrCount
+}
+
+// GetOrg returns the value of Org.
+func (s *RepoIndexEntry) GetOrg() string {
+	return s.Org
+}
+
+// GetPermission returns the value of Permission.
+func (s *RepoIndexEntry) GetPermission() OptRepoIndexEntryPermission {
+	return s.Permission
+}
+
 // GetPlacements returns the value of Placements.
 func (s *RepoIndexEntry) GetPlacements() []RepoPlacement {
 	return s.Placements
@@ -8694,6 +12539,16 @@ func (s *RepoIndexEntry) GetPrimaries() OptRepoPrimaries {
 	return s.Primaries
 }
 
+// GetProvider returns the value of Provider.
+func (s *RepoIndexEntry) GetProvider() string {
+	return s.Provider
+}
+
+// GetPushedAt returns the value of PushedAt.
+func (s *RepoIndexEntry) GetPushedAt() OptDateTime {
+	return s.PushedAt
+}
+
 // GetStars returns the value of Stars.
 func (s *RepoIndexEntry) GetStars() OptInt64 {
 	return s.Stars
@@ -8709,6 +12564,16 @@ func (s *RepoIndexEntry) GetAdditionalProps() RepoIndexEntryAdditional {
 	return s.AdditionalProps
 }
 
+// SetActivityHotness sets the value of ActivityHotness.
+func (s *RepoIndexEntry) SetActivityHotness(val OptFloat64) {
+	s.ActivityHotness = val
+}
+
+// SetArchived sets the value of Archived.
+func (s *RepoIndexEntry) SetArchived(val OptBool) {
+	s.Archived = val
+}
+
 // SetCandidate sets the value of Candidate.
 func (s *RepoIndexEntry) SetCandidate(val OptRepoCandidate) {
 	s.Candidate = val
@@ -8719,11 +12584,21 @@ func (s *RepoIndexEntry) SetCell(val string) {
 	s.Cell = val
 }
 
+// SetCheckpointCount sets the value of CheckpointCount.
+func (s *RepoIndexEntry) SetCheckpointCount(val OptInt64) {
+	s.CheckpointCount = val
+}
+
 // SetClusterSlug sets the value of ClusterSlug.
 func (s *RepoIndexEntry) SetClusterSlug(val string) {
 	s.ClusterSlug = val
 }
 
+// SetForks sets the value of Forks.
+func (s *RepoIndexEntry) SetForks(val OptInt64) {
+	s.Forks = val
+}
+
 // SetFullName sets the value of FullName.
 func (s *RepoIndexEntry) SetFullName(val string) {
 	s.FullName = val
@@ -8739,11 +12614,41 @@ func (s *RepoIndexEntry) SetJurisdiction(val string) {
 	s.Jurisdiction = val
 }
 
+// SetLanguage sets the value of Language.
+func (s *RepoIndexEntry) SetLanguage(val OptString) {
+	s.Language = val
+}
+
+// SetLastActivityAt sets the value of LastActivityAt.
+func (s *RepoIndexEntry) SetLastActivityAt(val OptDateTime) {
+	s.LastActivityAt = val
+}
+
+// SetLastPushedAt sets the value of LastPushedAt.
+func (s *RepoIndexEntry) SetLastPushedAt(val OptDateTime) {
+	s.LastPushedAt = val
+}
+
 // SetName sets the value of Name.
 func (s *RepoIndexEntry) SetName(val string) {
 	s.Name = val
 }
 
+// SetOpenPrCount sets the value of OpenPrCount.
+func (s *RepoIndexEntry) SetOpenPrCount(val OptInt64) {
+	s.OpenPrCount = val
+}
+
+// SetOrg sets the value of Org.
+func (s *RepoIndexEntry) SetOrg(val string) {
+	s.Org = val
+}
+
+// SetPermission sets the value of Permission.
+func (s *RepoIndexEntry) SetPermission(val OptRepoIndexEntryPermission) {
+	s.Permission = val
+}
+
 // SetPlacements sets the value of Placements.
 func (s *RepoIndexEntry) SetPlacements(val []RepoPlacement) {
 	s.Placements = val
@@ -8754,6 +12659,16 @@ func (s *RepoIndexEntry) SetPrimaries(val OptRepoPrimaries) {
 	s.Primaries = val
 }
 
+// SetProvider sets the value of Provider.
+func (s *RepoIndexEntry) SetProvider(val string) {
+	s.Provider = val
+}
+
+// SetPushedAt sets the value of PushedAt.
+func (s *RepoIndexEntry) SetPushedAt(val OptDateTime) {
+	s.PushedAt = val
+}
+
 // SetStars sets the value of Stars.
 func (s *RepoIndexEntry) SetStars(val OptInt64) {
 	s.Stars = val
@@ -8780,6 +12695,54 @@ func (s *RepoIndexEntryAdditional) init() RepoIndexEntryAdditional {
 	return m
 }
 
+type RepoIndexEntryPermission string
+
+const (
+	RepoIndexEntryPermissionRead  RepoIndexEntryPermission = "read"
+	RepoIndexEntryPermissionWrite RepoIndexEntryPermission = "write"
+	RepoIndexEntryPermissionAdmin RepoIndexEntryPermission = "admin"
+)
+
+// AllValues returns all RepoIndexEntryPermission values.
+func (RepoIndexEntryPermission) AllValues() []RepoIndexEntryPermission {
+	return []RepoIndexEntryPermission{
+		RepoIndexEntryPermissionRead,
+		RepoIndexEntryPermissionWrite,
+		RepoIndexEntryPermissionAdmin,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s RepoIndexEntryPermission) MarshalText() ([]byte, error) {
+	switch s {
+	case RepoIndexEntryPermissionRead:
+		return []byte(s), nil
+	case RepoIndexEntryPermissionWrite:
+		return []byte(s), nil
+	case RepoIndexEntryPermissionAdmin:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *RepoIndexEntryPermission) UnmarshalText(data []byte) error {
+	switch RepoIndexEntryPermission(data) {
+	case RepoIndexEntryPermissionRead:
+		*s = RepoIndexEntryPermissionRead
+		return nil
+	case RepoIndexEntryPermissionWrite:
+		*s = RepoIndexEntryPermissionWrite
+		return nil
+	case RepoIndexEntryPermissionAdmin:
+		*s = RepoIndexEntryPermissionAdmin
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
 // Ref: #/components/schemas/RepoPlacement
 type RepoPlacement struct {
 	Cell            string              `json:"cell"`
@@ -8929,44 +12892,228 @@ func (s *RepoPlacementStatus) UnmarshalText(data []byte) error {
 
 // Ref: #/components/schemas/RepoPrimaries
 type RepoPrimaries struct {
-	GitData         string `json:"git_data"`
-	Processing      string `json:"processing"`
-	AdditionalProps RepoPrimariesAdditional
+	DataPrimary       ForgeRepoIdentity    `json:"data_primary"`
+	GitData           string               `json:"git_data"`
+	Processing        string               `json:"processing"`
+	ProcessingPrimary OptForgeRepoIdentity `json:"processing_primary"`
+	AdditionalProps   RepoPrimariesAdditional
+}
+
+// GetDataPrimary returns the value of DataPrimary.
+func (s *RepoPrimaries) GetDataPrimary() ForgeRepoIdentity {
+	return s.DataPrimary
+}
+
+// GetGitData returns the value of GitData.
+func (s *RepoPrimaries) GetGitData() string {
+	return s.GitData
+}
+
+// GetProcessing returns the value of Processing.
+func (s *RepoPrimaries) GetProcessing() string {
+	return s.Processing
+}
+
+// GetProcessingPrimary returns the value of ProcessingPrimary.
+func (s *RepoPrimaries) GetProcessingPrimary() OptForgeRepoIdentity {
+	return s.ProcessingPrimary
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoPrimaries) GetAdditionalProps() RepoPrimariesAdditional {
+	return s.AdditionalProps
+}
+
+// SetDataPrimary sets the value of DataPrimary.
+func (s *RepoPrimaries) SetDataPrimary(val ForgeRepoIdentity) {
+	s.DataPrimary = val
+}
+
+// SetGitData sets the value of GitData.
+func (s *RepoPrimaries) SetGitData(val string) {
+	s.GitData = val
+}
+
+// SetProcessing sets the value of Processing.
+func (s *RepoPrimaries) SetProcessing(val string) {
+	s.Processing = val
+}
+
+// SetProcessingPrimary sets the value of ProcessingPrimary.
+func (s *RepoPrimaries) SetProcessingPrimary(val OptForgeRepoIdentity) {
+	s.ProcessingPrimary = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RepoPrimaries) SetAdditionalProps(val RepoPrimariesAdditional) {
+	s.AdditionalProps = val
+}
+
+type RepoPrimariesAdditional map[string]jx.Raw
+
+func (s *RepoPrimariesAdditional) init() RepoPrimariesAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/RepoReference
+type RepoReference struct {
+	FullName        string `json:"fullName"`
+	Provider        string `json:"provider"`
+	AdditionalProps RepoReferenceAdditional
+}
+
+// GetFullName returns the value of FullName.
+func (s *RepoReference) GetFullName() string {
+	return s.FullName
+}
+
+// GetProvider returns the value of Provider.
+func (s *RepoReference) GetProvider() string {
+	return s.Provider
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoReference) GetAdditionalProps() RepoReferenceAdditional {
+	return s.AdditionalProps
+}
+
+// SetFullName sets the value of FullName.
+func (s *RepoReference) SetFullName(val string) {
+	s.FullName = val
+}
+
+// SetProvider sets the value of Provider.
+func (s *RepoReference) SetProvider(val string) {
+	s.Provider = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *RepoReference) SetAdditionalProps(val RepoReferenceAdditional) {
+	s.AdditionalProps = val
+}
+
+type RepoReferenceAdditional map[string]jx.Raw
+
+func (s *RepoReferenceAdditional) init() RepoReferenceAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/RepoResolution
+type RepoResolution struct {
+	Candidate         OptRepoCandidate     `json:"candidate"`
+	FullName          OptString            `json:"fullName"`
+	Placements        []RepoPlacement      `json:"placements"`
+	Primaries         OptRepoPrimaries     `json:"primaries"`
+	Provider          string               `json:"provider"`
+	RepoId            OptString            `json:"repoId"`
+	RequestedFullName string               `json:"requestedFullName"`
+	Status            RepoResolutionStatus `json:"status"`
+	AdditionalProps   RepoResolutionAdditional
+}
+
+// GetCandidate returns the value of Candidate.
+func (s *RepoResolution) GetCandidate() OptRepoCandidate {
+	return s.Candidate
+}
+
+// GetFullName returns the value of FullName.
+func (s *RepoResolution) GetFullName() OptString {
+	return s.FullName
+}
+
+// GetPlacements returns the value of Placements.
+func (s *RepoResolution) GetPlacements() []RepoPlacement {
+	return s.Placements
+}
+
+// GetPrimaries returns the value of Primaries.
+func (s *RepoResolution) GetPrimaries() OptRepoPrimaries {
+	return s.Primaries
+}
+
+// GetProvider returns the value of Provider.
+func (s *RepoResolution) GetProvider() string {
+	return s.Provider
+}
+
+// GetRepoId returns the value of RepoId.
+func (s *RepoResolution) GetRepoId() OptString {
+	return s.RepoId
+}
+
+// GetRequestedFullName returns the value of RequestedFullName.
+func (s *RepoResolution) GetRequestedFullName() string {
+	return s.RequestedFullName
+}
+
+// GetStatus returns the value of Status.
+func (s *RepoResolution) GetStatus() RepoResolutionStatus {
+	return s.Status
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *RepoResolution) GetAdditionalProps() RepoResolutionAdditional {
+	return s.AdditionalProps
+}
+
+// SetCandidate sets the value of Candidate.
+func (s *RepoResolution) SetCandidate(val OptRepoCandidate) {
+	s.Candidate = val
+}
+
+// SetFullName sets the value of FullName.
+func (s *RepoResolution) SetFullName(val OptString) {
+	s.FullName = val
+}
+
+// SetPlacements sets the value of Placements.
+func (s *RepoResolution) SetPlacements(val []RepoPlacement) {
+	s.Placements = val
 }
 
-// GetGitData returns the value of GitData.
-func (s *RepoPrimaries) GetGitData() string {
-	return s.GitData
+// SetPrimaries sets the value of Primaries.
+func (s *RepoResolution) SetPrimaries(val OptRepoPrimaries) {
+	s.Primaries = val
 }
 
-// GetProcessing returns the value of Processing.
-func (s *RepoPrimaries) GetProcessing() string {
-	return s.Processing
+// SetProvider sets the value of Provider.
+func (s *RepoResolution) SetProvider(val string) {
+	s.Provider = val
 }
 
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *RepoPrimaries) GetAdditionalProps() RepoPrimariesAdditional {
-	return s.AdditionalProps
+// SetRepoId sets the value of RepoId.
+func (s *RepoResolution) SetRepoId(val OptString) {
+	s.RepoId = val
 }
 
-// SetGitData sets the value of GitData.
-func (s *RepoPrimaries) SetGitData(val string) {
-	s.GitData = val
+// SetRequestedFullName sets the value of RequestedFullName.
+func (s *RepoResolution) SetRequestedFullName(val string) {
+	s.RequestedFullName = val
 }
 
-// SetProcessing sets the value of Processing.
-func (s *RepoPrimaries) SetProcessing(val string) {
-	s.Processing = val
+// SetStatus sets the value of Status.
+func (s *RepoResolution) SetStatus(val RepoResolutionStatus) {
+	s.Status = val
 }
 
 // SetAdditionalProps sets the value of AdditionalProps.
-func (s *RepoPrimaries) SetAdditionalProps(val RepoPrimariesAdditional) {
+func (s *RepoResolution) SetAdditionalProps(val RepoResolutionAdditional) {
 	s.AdditionalProps = val
 }
 
-type RepoPrimariesAdditional map[string]jx.Raw
+type RepoResolutionAdditional map[string]jx.Raw
 
-func (s *RepoPrimariesAdditional) init() RepoPrimariesAdditional {
+func (s *RepoResolutionAdditional) init() RepoResolutionAdditional {
 	m := *s
 	if m == nil {
 		m = map[string]jx.Raw{}
@@ -8975,6 +13122,61 @@ func (s *RepoPrimariesAdditional) init() RepoPrimariesAdditional {
 	return m
 }
 
+type RepoResolutionStatus string
+
+const (
+	RepoResolutionStatusReady       RepoResolutionStatus = "ready"
+	RepoResolutionStatusProcessing  RepoResolutionStatus = "processing"
+	RepoResolutionStatusNoMirror    RepoResolutionStatus = "no-mirror"
+	RepoResolutionStatusUnavailable RepoResolutionStatus = "unavailable"
+)
+
+// AllValues returns all RepoResolutionStatus values.
+func (RepoResolutionStatus) AllValues() []RepoResolutionStatus {
+	return []RepoResolutionStatus{
+		RepoResolutionStatusReady,
+		RepoResolutionStatusProcessing,
+		RepoResolutionStatusNoMirror,
+		RepoResolutionStatusUnavailable,
+	}
+}
+
+// MarshalText implements encoding.TextMarshaler.
+func (s RepoResolutionStatus) MarshalText() ([]byte, error) {
+	switch s {
+	case RepoResolutionStatusReady:
+		return []byte(s), nil
+	case RepoResolutionStatusProcessing:
+		return []byte(s), nil
+	case RepoResolutionStatusNoMirror:
+		return []byte(s), nil
+	case RepoResolutionStatusUnavailable:
+		return []byte(s), nil
+	default:
+		return nil, errors.Errorf("invalid value: %q", s)
+	}
+}
+
+// UnmarshalText implements encoding.TextUnmarshaler.
+func (s *RepoResolutionStatus) UnmarshalText(data []byte) error {
+	switch RepoResolutionStatus(data) {
+	case RepoResolutionStatusReady:
+		*s = RepoResolutionStatusReady
+		return nil
+	case RepoResolutionStatusProcessing:
+		*s = RepoResolutionStatusProcessing
+		return nil
+	case RepoResolutionStatusNoMirror:
+		*s = RepoResolutionStatusNoMirror
+		return nil
+	case RepoResolutionStatusUnavailable:
+		*s = RepoResolutionStatusUnavailable
+		return nil
+	default:
+		return errors.Errorf("invalid value: %q", data)
+	}
+}
+
 type ResolveMirrorPlacementsProvider string
 
 const (
@@ -9058,6 +13260,202 @@ func (s *ResolvePlacementsOutputBodyAdditional) init() ResolvePlacementsOutputBo
 	return m
 }
 
+// Ref: #/components/schemas/ResolveRepoIDsInputBody
+type ResolveRepoIDsInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI   `json:"$schema"`
+	RepoIds         []string `json:"repoIds"`
+	AdditionalProps ResolveRepoIDsInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ResolveRepoIDsInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetRepoIds returns the value of RepoIds.
+func (s *ResolveRepoIDsInputBody) GetRepoIds() []string {
+	return s.RepoIds
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ResolveRepoIDsInputBody) GetAdditionalProps() ResolveRepoIDsInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ResolveRepoIDsInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetRepoIds sets the value of RepoIds.
+func (s *ResolveRepoIDsInputBody) SetRepoIds(val []string) {
+	s.RepoIds = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ResolveRepoIDsInputBody) SetAdditionalProps(val ResolveRepoIDsInputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ResolveRepoIDsInputBodyAdditional map[string]jx.Raw
+
+func (s *ResolveRepoIDsInputBodyAdditional) init() ResolveRepoIDsInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/ResolveRepoIDsResponse
+type ResolveRepoIDsResponse struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI             `json:"$schema"`
+	Resolutions     []RepoIDResolution `json:"resolutions"`
+	AdditionalProps ResolveRepoIDsResponseAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ResolveRepoIDsResponse) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetResolutions returns the value of Resolutions.
+func (s *ResolveRepoIDsResponse) GetResolutions() []RepoIDResolution {
+	return s.Resolutions
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ResolveRepoIDsResponse) GetAdditionalProps() ResolveRepoIDsResponseAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ResolveRepoIDsResponse) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetResolutions sets the value of Resolutions.
+func (s *ResolveRepoIDsResponse) SetResolutions(val []RepoIDResolution) {
+	s.Resolutions = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ResolveRepoIDsResponse) SetAdditionalProps(val ResolveRepoIDsResponseAdditional) {
+	s.AdditionalProps = val
+}
+
+type ResolveRepoIDsResponseAdditional map[string]jx.Raw
+
+func (s *ResolveRepoIDsResponseAdditional) init() ResolveRepoIDsResponseAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/ResolveReposInputBody
+type ResolveReposInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI          `json:"$schema"`
+	Repositories    []RepoReference `json:"repositories"`
+	AdditionalProps ResolveReposInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ResolveReposInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetRepositories returns the value of Repositories.
+func (s *ResolveReposInputBody) GetRepositories() []RepoReference {
+	return s.Repositories
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ResolveReposInputBody) GetAdditionalProps() ResolveReposInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ResolveReposInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetRepositories sets the value of Repositories.
+func (s *ResolveReposInputBody) SetRepositories(val []RepoReference) {
+	s.Repositories = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ResolveReposInputBody) SetAdditionalProps(val ResolveReposInputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type ResolveReposInputBodyAdditional map[string]jx.Raw
+
+func (s *ResolveReposInputBodyAdditional) init() ResolveReposInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
+// Ref: #/components/schemas/ResolveReposResponse
+type ResolveReposResponse struct {
+	// A URL to the JSON Schema for this object.
+	Schema          OptURI           `json:"$schema"`
+	Resolutions     []RepoResolution `json:"resolutions"`
+	AdditionalProps ResolveReposResponseAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *ResolveReposResponse) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetResolutions returns the value of Resolutions.
+func (s *ResolveReposResponse) GetResolutions() []RepoResolution {
+	return s.Resolutions
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *ResolveReposResponse) GetAdditionalProps() ResolveReposResponseAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *ResolveReposResponse) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetResolutions sets the value of Resolutions.
+func (s *ResolveReposResponse) SetResolutions(val []RepoResolution) {
+	s.Resolutions = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *ResolveReposResponse) SetAdditionalProps(val ResolveReposResponseAdditional) {
+	s.AdditionalProps = val
+}
+
+type ResolveReposResponseAdditional map[string]jx.Raw
+
+func (s *ResolveReposResponseAdditional) init() ResolveReposResponseAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
 // Ref: #/components/schemas/ResolvedIdentity
 type ResolvedIdentity struct {
 	// A URL to the JSON Schema for this object.
@@ -9212,54 +13610,6 @@ func (s *ResolvedPlacementAdditional) init() ResolvedPlacementAdditional {
 	return m
 }
 
-// Ref: #/components/schemas/ResourceAccess
-type ResourceAccess struct {
-	Permissions     []string `json:"permissions"`
-	ResourceId      string   `json:"resourceId"`
-	AdditionalProps ResourceAccessAdditional
-}
-
-// GetPermissions returns the value of Permissions.
-func (s *ResourceAccess) GetPermissions() []string {
-	return s.Permissions
-}
-
-// GetResourceId returns the value of ResourceId.
-func (s *ResourceAccess) GetResourceId() string {
-	return s.ResourceId
-}
-
-// GetAdditionalProps returns the value of AdditionalProps.
-func (s *ResourceAccess) GetAdditionalProps() ResourceAccessAdditional {
-	return s.AdditionalProps
-}
-
-// SetPermissions sets the value of Permissions.
-func (s *ResourceAccess) SetPermissions(val []string) {
-	s.Permissions = val
-}
-
-// SetResourceId sets the value of ResourceId.
-func (s *ResourceAccess) SetResourceId(val string) {
-	s.ResourceId = val
-}
-
-// SetAdditionalProps sets the value of AdditionalProps.
-func (s *ResourceAccess) SetAdditionalProps(val ResourceAccessAdditional) {
-	s.AdditionalProps = val
-}
-
-type ResourceAccessAdditional map[string]jx.Raw
-
-func (s *ResourceAccessAdditional) init() ResourceAccessAdditional {
-	m := *s
-	if m == nil {
-		m = map[string]jx.Raw{}
-		*s = m
-	}
-	return m
-}
-
 // RevokeProjectAccessByProviderNoContent is response for RevokeProjectAccessByProvider operation.
 type RevokeProjectAccessByProviderNoContent struct{}
 
@@ -10001,6 +14351,68 @@ func (s *TopologyRegionAdditional) init() TopologyRegionAdditional {
 	return m
 }
 
+// Ref: #/components/schemas/UpdateBranchProtectionInputBody
+type UpdateBranchProtectionInputBody struct {
+	// A URL to the JSON Schema for this object.
+	Schema OptURI `json:"$schema"`
+	// Rules to add or replace by ref: an existing rule keeps its position and takes the new flag.
+	AddRules []BranchRule `json:"addRules"`
+	// Patterns to remove; absent entries are ignored.
+	RemoveRefs      []string `json:"removeRefs"`
+	AdditionalProps UpdateBranchProtectionInputBodyAdditional
+}
+
+// GetSchema returns the value of Schema.
+func (s *UpdateBranchProtectionInputBody) GetSchema() OptURI {
+	return s.Schema
+}
+
+// GetAddRules returns the value of AddRules.
+func (s *UpdateBranchProtectionInputBody) GetAddRules() []BranchRule {
+	return s.AddRules
+}
+
+// GetRemoveRefs returns the value of RemoveRefs.
+func (s *UpdateBranchProtectionInputBody) GetRemoveRefs() []string {
+	return s.RemoveRefs
+}
+
+// GetAdditionalProps returns the value of AdditionalProps.
+func (s *UpdateBranchProtectionInputBody) GetAdditionalProps() UpdateBranchProtectionInputBodyAdditional {
+	return s.AdditionalProps
+}
+
+// SetSchema sets the value of Schema.
+func (s *UpdateBranchProtectionInputBody) SetSchema(val OptURI) {
+	s.Schema = val
+}
+
+// SetAddRules sets the value of AddRules.
+func (s *UpdateBranchProtectionInputBody) SetAddRules(val []BranchRule) {
+	s.AddRules = val
+}
+
+// SetRemoveRefs sets the value of RemoveRefs.
+func (s *UpdateBranchProtectionInputBody) SetRemoveRefs(val []string) {
+	s.RemoveRefs = val
+}
+
+// SetAdditionalProps sets the value of AdditionalProps.
+func (s *UpdateBranchProtectionInputBody) SetAdditionalProps(val UpdateBranchProtectionInputBodyAdditional) {
+	s.AdditionalProps = val
+}
+
+type UpdateBranchProtectionInputBodyAdditional map[string]jx.Raw
+
+func (s *UpdateBranchProtectionInputBodyAdditional) init() UpdateBranchProtectionInputBodyAdditional {
+	m := *s
+	if m == nil {
+		m = map[string]jx.Raw{}
+		*s = m
+	}
+	return m
+}
+
 // Ref: #/components/schemas/WillDeleteStruct
 type WillDeleteStruct struct {
 	// Blanket note: profile PII is erased across all regions the account has data in (per-region
diff --git a/internal/coreapi/oas_security_gen.go b/internal/coreapi/oas_security_gen.go
index 151bbeaa09..4565cafd7b 100644
--- a/internal/coreapi/oas_security_gen.go
+++ b/internal/coreapi/oas_security_gen.go
@@ -12,7 +12,7 @@ import (
 // SecuritySource is provider of security values (tokens, passwords, etc.).
 type SecuritySource interface {
 	// BearerAuth provides bearerAuth security value.
-	// Bearer token minted by entire-core's device-code flow or STS exchange.
+	// Bearer access token.
 	BearerAuth(ctx context.Context, operationName OperationName) (BearerAuth, error)
 	// SessionAuth provides sessionAuth security value.
 	// Console session cookie issued by the browser login flow.
@@ -21,70 +21,90 @@ type SecuritySource interface {
 
 // operationRolesBearerAuth is a private map storing roles per operation.
 var operationRolesBearerAuth = map[string][]string{
-	AddOrgMemberOperation:                  {},
-	BatchLookupOperation:                   {},
-	CancelDeletionOperation:                {},
-	CompleteOnboardingOperation:            {},
-	CreateBindingOperation:                 {},
-	CreateMirrorOperation:                  {},
-	CreateMirrorRequestOperation:           {},
-	CreateOrgOperation:                     {},
-	CreateProjectOperation:                 {},
-	CreateRepoOperation:                    {},
-	CreateRepoCIWebhookOperation:           {},
-	CreateServiceAccountOperation:          {},
-	DeleteBindingOperation:                 {},
-	DeleteMeOperation:                      {},
-	DeleteMirrorOperation:                  {},
-	DeleteOrgOperation:                     {},
-	DeleteProjectOperation:                 {},
-	DeleteRepoOperation:                    {},
-	DeleteRepoCIWebhookOperation:           {},
-	DeleteServiceAccountOperation:          {},
-	GetDeletionPreviewOperation:            {},
-	GetMeOperation:                         {},
-	GetMirrorOperation:                     {},
-	GetMirrorRequestOperation:              {},
-	GetOnboardingStatusOperation:           {},
-	GetOrgOperation:                        {},
-	GetPermissionsOperation:                {},
-	GetProjectOperation:                    {},
-	GetRepoOperation:                       {},
-	GetRepoVisibilityOperation:             {},
-	GetServiceAccountOperation:             {},
-	GetTopologyOperation:                   {},
-	GrantProjectAccessOperation:            {},
-	GrantRepoAccessOperation:               {},
-	GrantServiceAccountAccessOperation:     {},
-	ListAuditEventsOperation:               {},
-	ListAvailableMirrorsOperation:          {},
-	ListBindingsOperation:                  {},
-	ListClustersOperation:                  {},
-	ListMirrorCollaboratorsOperation:       {},
-	ListMirrorsOperation:                   {},
-	ListOIDCProvidersOperation:             {},
-	ListOrgMembersOperation:                {},
-	ListOrgProjectsOperation:               {},
-	ListOrgsOperation:                      {},
-	ListProjectMembersOperation:            {},
-	ListProjectReposOperation:              {},
-	ListProjectsOperation:                  {},
-	ListRepoCIWebhooksOperation:            {},
-	ListRepoGrantsOperation:                {},
-	ListReposOperation:                     {},
-	ListServiceAccountGrantsOperation:      {},
-	ListServiceAccountsOperation:           {},
-	LookupResourcesOperation:               {},
-	PatchRepoCIWebhookOperation:            {},
-	RemoveOrgMemberOperation:               {},
-	ResolveHandleOperation:                 {},
-	ResolveMirrorPlacementsOperation:       {},
-	RevokeProjectAccessOperation:           {},
-	RevokeProjectAccessByProviderOperation: {},
-	RevokeRepoAccessOperation:              {},
-	RevokeRepoAccessByProviderOperation:    {},
-	RevokeServiceAccountAccessOperation:    {},
-	SetRepoVisibilityOperation:             {},
+	AddOrgMemberOperation:                      {},
+	CancelDeletionOperation:                    {},
+	CompleteOnboardingOperation:                {},
+	ConnectOrgCIBuildkiteCredentialOperation:   {},
+	CreateBindingOperation:                     {},
+	CreateMirrorOperation:                      {},
+	CreateMirrorRequestOperation:               {},
+	CreateNativeMirrorOperation:                {},
+	CreateOrgOperation:                         {},
+	CreateProjectOperation:                     {},
+	CreateRepoOperation:                        {},
+	CreateRepoCIWebhookOperation:               {},
+	CreateServiceAccountOperation:              {},
+	DeleteBindingOperation:                     {},
+	DeleteMeOperation:                          {},
+	DeleteMirrorOperation:                      {},
+	DeleteNativeMirrorOperation:                {},
+	DeleteOrgOperation:                         {},
+	DeleteOrgCIBuildkiteClusterOperation:       {},
+	DeleteOrgCIBuildkiteCredentialOperation:    {},
+	DeleteProjectOperation:                     {},
+	DeleteRepoOperation:                        {},
+	DeleteRepoCIWebhookOperation:               {},
+	DeleteServiceAccountOperation:              {},
+	GetBranchProtectionOperation:               {},
+	GetDeletionPreviewOperation:                {},
+	GetMeOperation:                             {},
+	GetMirrorOperation:                         {},
+	GetMirrorRequestOperation:                  {},
+	GetOnboardingStatusOperation:               {},
+	GetOrgOperation:                            {},
+	GetPermissionsOperation:                    {},
+	GetProjectOperation:                        {},
+	GetRepoOperation:                           {},
+	GetRepoVisibilityOperation:                 {},
+	GetServiceAccountOperation:                 {},
+	GetTopologyOperation:                       {},
+	GrantProjectAccessOperation:                {},
+	GrantRepoAccessOperation:                   {},
+	GrantServiceAccountAccessOperation:         {},
+	ListAuditEventsOperation:                   {},
+	ListAvailableMirrorsOperation:              {},
+	ListBindingsOperation:                      {},
+	ListClustersOperation:                      {},
+	ListMirrorCollaboratorsOperation:           {},
+	ListMirrorsOperation:                       {},
+	ListNativeMirrorsOperation:                 {},
+	ListOIDCProvidersOperation:                 {},
+	ListOrgCIBuildkiteClustersOperation:        {},
+	ListOrgCIBuildkiteCredentialsOperation:     {},
+	ListOrgMembersOperation:                    {},
+	ListOrgProjectsOperation:                   {},
+	ListOrgsOperation:                          {},
+	ListProjectMembersOperation:                {},
+	ListProjectReposOperation:                  {},
+	ListProjectsOperation:                      {},
+	ListRepoCIBuildsOperation:                  {},
+	ListRepoCIProvidersOperation:               {},
+	ListRepoCIWebhookAuditOperation:            {},
+	ListRepoCIWebhooksOperation:                {},
+	ListRepoCollaboratorsOperation:             {},
+	ListRepoGrantsOperation:                    {},
+	ListRepoLanguageFacetsOperation:            {},
+	ListRepoOrgFacetsOperation:                 {},
+	ListReposOperation:                         {},
+	ListServiceAccountGrantsOperation:          {},
+	ListServiceAccountsOperation:               {},
+	MintOrgCIGitHubActionsCredentialOperation:  {},
+	PatchRepoCIWebhookOperation:                {},
+	RegisterOrgCIBuildkiteClusterOperation:     {},
+	RemoveOrgMemberOperation:                   {},
+	ResolveHandleOperation:                     {},
+	ResolveMirrorPlacementsOperation:           {},
+	ResolveRepoIDsOperation:                    {},
+	ResolveReposOperation:                      {},
+	RevokeProjectAccessOperation:               {},
+	RevokeProjectAccessByProviderOperation:     {},
+	RevokeRepoAccessOperation:                  {},
+	RevokeRepoAccessByProviderOperation:        {},
+	RevokeServiceAccountAccessOperation:        {},
+	RotateOrgCIBuildkiteInboundSecretOperation: {},
+	SetBranchProtectionOperation:               {},
+	SetRepoVisibilityOperation:                 {},
+	UpdateBranchProtectionOperation:            {},
 }
 
 // GetRolesForBearerAuth returns the required roles for the given operation.
@@ -110,70 +130,90 @@ func GetRolesForBearerAuth(operation string) []string {
 
 // operationRolesSessionAuth is a private map storing roles per operation.
 var operationRolesSessionAuth = map[string][]string{
-	AddOrgMemberOperation:                  {},
-	BatchLookupOperation:                   {},
-	CancelDeletionOperation:                {},
-	CompleteOnboardingOperation:            {},
-	CreateBindingOperation:                 {},
-	CreateMirrorOperation:                  {},
-	CreateMirrorRequestOperation:           {},
-	CreateOrgOperation:                     {},
-	CreateProjectOperation:                 {},
-	CreateRepoOperation:                    {},
-	CreateRepoCIWebhookOperation:           {},
-	CreateServiceAccountOperation:          {},
-	DeleteBindingOperation:                 {},
-	DeleteMeOperation:                      {},
-	DeleteMirrorOperation:                  {},
-	DeleteOrgOperation:                     {},
-	DeleteProjectOperation:                 {},
-	DeleteRepoOperation:                    {},
-	DeleteRepoCIWebhookOperation:           {},
-	DeleteServiceAccountOperation:          {},
-	GetDeletionPreviewOperation:            {},
-	GetMeOperation:                         {},
-	GetMirrorOperation:                     {},
-	GetMirrorRequestOperation:              {},
-	GetOnboardingStatusOperation:           {},
-	GetOrgOperation:                        {},
-	GetPermissionsOperation:                {},
-	GetProjectOperation:                    {},
-	GetRepoOperation:                       {},
-	GetRepoVisibilityOperation:             {},
-	GetServiceAccountOperation:             {},
-	GetTopologyOperation:                   {},
-	GrantProjectAccessOperation:            {},
-	GrantRepoAccessOperation:               {},
-	GrantServiceAccountAccessOperation:     {},
-	ListAuditEventsOperation:               {},
-	ListAvailableMirrorsOperation:          {},
-	ListBindingsOperation:                  {},
-	ListClustersOperation:                  {},
-	ListMirrorCollaboratorsOperation:       {},
-	ListMirrorsOperation:                   {},
-	ListOIDCProvidersOperation:             {},
-	ListOrgMembersOperation:                {},
-	ListOrgProjectsOperation:               {},
-	ListOrgsOperation:                      {},
-	ListProjectMembersOperation:            {},
-	ListProjectReposOperation:              {},
-	ListProjectsOperation:                  {},
-	ListRepoCIWebhooksOperation:            {},
-	ListRepoGrantsOperation:                {},
-	ListReposOperation:                     {},
-	ListServiceAccountGrantsOperation:      {},
-	ListServiceAccountsOperation:           {},
-	LookupResourcesOperation:               {},
-	PatchRepoCIWebhookOperation:            {},
-	RemoveOrgMemberOperation:               {},
-	ResolveHandleOperation:                 {},
-	ResolveMirrorPlacementsOperation:       {},
-	RevokeProjectAccessOperation:           {},
-	RevokeProjectAccessByProviderOperation: {},
-	RevokeRepoAccessOperation:              {},
-	RevokeRepoAccessByProviderOperation:    {},
-	RevokeServiceAccountAccessOperation:    {},
-	SetRepoVisibilityOperation:             {},
+	AddOrgMemberOperation:                      {},
+	CancelDeletionOperation:                    {},
+	CompleteOnboardingOperation:                {},
+	ConnectOrgCIBuildkiteCredentialOperation:   {},
+	CreateBindingOperation:                     {},
+	CreateMirrorOperation:                      {},
+	CreateMirrorRequestOperation:               {},
+	CreateNativeMirrorOperation:                {},
+	CreateOrgOperation:                         {},
+	CreateProjectOperation:                     {},
+	CreateRepoOperation:                        {},
+	CreateRepoCIWebhookOperation:               {},
+	CreateServiceAccountOperation:              {},
+	DeleteBindingOperation:                     {},
+	DeleteMeOperation:                          {},
+	DeleteMirrorOperation:                      {},
+	DeleteNativeMirrorOperation:                {},
+	DeleteOrgOperation:                         {},
+	DeleteOrgCIBuildkiteClusterOperation:       {},
+	DeleteOrgCIBuildkiteCredentialOperation:    {},
+	DeleteProjectOperation:                     {},
+	DeleteRepoOperation:                        {},
+	DeleteRepoCIWebhookOperation:               {},
+	DeleteServiceAccountOperation:              {},
+	GetBranchProtectionOperation:               {},
+	GetDeletionPreviewOperation:                {},
+	GetMeOperation:                             {},
+	GetMirrorOperation:                         {},
+	GetMirrorRequestOperation:                  {},
+	GetOnboardingStatusOperation:               {},
+	GetOrgOperation:                            {},
+	GetPermissionsOperation:                    {},
+	GetProjectOperation:                        {},
+	GetRepoOperation:                           {},
+	GetRepoVisibilityOperation:                 {},
+	GetServiceAccountOperation:                 {},
+	GetTopologyOperation:                       {},
+	GrantProjectAccessOperation:                {},
+	GrantRepoAccessOperation:                   {},
+	GrantServiceAccountAccessOperation:         {},
+	ListAuditEventsOperation:                   {},
+	ListAvailableMirrorsOperation:              {},
+	ListBindingsOperation:                      {},
+	ListClustersOperation:                      {},
+	ListMirrorCollaboratorsOperation:           {},
+	ListMirrorsOperation:                       {},
+	ListNativeMirrorsOperation:                 {},
+	ListOIDCProvidersOperation:                 {},
+	ListOrgCIBuildkiteClustersOperation:        {},
+	ListOrgCIBuildkiteCredentialsOperation:     {},
+	ListOrgMembersOperation:                    {},
+	ListOrgProjectsOperation:                   {},
+	ListOrgsOperation:                          {},
+	ListProjectMembersOperation:                {},
+	ListProjectReposOperation:                  {},
+	ListProjectsOperation:                      {},
+	ListRepoCIBuildsOperation:                  {},
+	ListRepoCIProvidersOperation:               {},
+	ListRepoCIWebhookAuditOperation:            {},
+	ListRepoCIWebhooksOperation:                {},
+	ListRepoCollaboratorsOperation:             {},
+	ListRepoGrantsOperation:                    {},
+	ListRepoLanguageFacetsOperation:            {},
+	ListRepoOrgFacetsOperation:                 {},
+	ListReposOperation:                         {},
+	ListServiceAccountGrantsOperation:          {},
+	ListServiceAccountsOperation:               {},
+	MintOrgCIGitHubActionsCredentialOperation:  {},
+	PatchRepoCIWebhookOperation:                {},
+	RegisterOrgCIBuildkiteClusterOperation:     {},
+	RemoveOrgMemberOperation:                   {},
+	ResolveHandleOperation:                     {},
+	ResolveMirrorPlacementsOperation:           {},
+	ResolveRepoIDsOperation:                    {},
+	ResolveReposOperation:                      {},
+	RevokeProjectAccessOperation:               {},
+	RevokeProjectAccessByProviderOperation:     {},
+	RevokeRepoAccessOperation:                  {},
+	RevokeRepoAccessByProviderOperation:        {},
+	RevokeServiceAccountAccessOperation:        {},
+	RotateOrgCIBuildkiteInboundSecretOperation: {},
+	SetBranchProtectionOperation:               {},
+	SetRepoVisibilityOperation:                 {},
+	UpdateBranchProtectionOperation:            {},
 }
 
 // GetRolesForSessionAuth returns the required roles for the given operation.
diff --git a/internal/coreapi/oas_validators_gen.go b/internal/coreapi/oas_validators_gen.go
index 4f09d2cc47..b86ef11d01 100644
--- a/internal/coreapi/oas_validators_gen.go
+++ b/internal/coreapi/oas_validators_gen.go
@@ -158,45 +158,51 @@ func (s AvailableMirrorStatus) Validate() error {
 	}
 }
 
-func (s *BatchLookupInputBody) Validate() error {
+func (s *BranchProtection) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Refs == nil {
+		if s.Rules == nil {
 			return errors.New("nil is invalid value")
 		}
 		if err := (validate.Array{
-			MinLength:    1,
-			MinLengthSet: true,
-			MaxLength:    100,
+			MinLength:    0,
+			MinLengthSet: false,
+			MaxLength:    64,
 			MaxLengthSet: true,
-		}).ValidateLength(len(s.Refs)); err != nil {
+		}).ValidateLength(len(s.Rules)); err != nil {
 			return errors.Wrap(err, "array")
 		}
-		var failures []validate.FieldError
-		for i, elem := range s.Refs {
-			if err := func() error {
-				if err := elem.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				failures = append(failures, validate.FieldError{
-					Name:  fmt.Sprintf("[%d]", i),
-					Error: err,
-				})
-			}
-		}
-		if len(failures) > 0 {
-			return &validate.Error{Fields: failures}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "rules",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *CIBuildView) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Jobs == nil {
+			return errors.New("nil is invalid value")
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "refs",
+			Name:  "jobs",
 			Error: err,
 		})
 	}
@@ -206,18 +212,18 @@ func (s *BatchLookupInputBody) Validate() error {
 	return nil
 }
 
-func (s *BatchLookupOutputBody) Validate() error {
+func (s *CIProviderDescriptor) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Refs == nil {
+		if s.Fields == nil {
 			return errors.New("nil is invalid value")
 		}
 		var failures []validate.FieldError
-		for i, elem := range s.Refs {
+		for i, elem := range s.Fields {
 			if err := func() error {
 				if err := elem.Validate(); err != nil {
 					return err
@@ -236,7 +242,41 @@ func (s *BatchLookupOutputBody) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "refs",
+			Name:  "fields",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if s.Modes == nil {
+			return errors.New("nil is invalid value")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "modes",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *CIProviderField) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.RequiredIn == nil {
+			return errors.New("nil is invalid value")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "required_in",
 			Error: err,
 		})
 	}
@@ -269,6 +309,64 @@ func (s *CIWebhookView) Validate() error {
 	return nil
 }
 
+func (s *ConnectOrgCIBuildkiteCredentialInputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := (validate.String{
+			MinLength:     1,
+			MinLengthSet:  true,
+			MaxLength:     0,
+			MaxLengthSet:  false,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.BkAPIToken)); err != nil {
+			return errors.Wrap(err, "string")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "bk_api_token",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if err := (validate.String{
+			MinLength:     1,
+			MinLengthSet:  true,
+			MaxLength:     0,
+			MaxLengthSet:  false,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.BkOrganization)); err != nil {
+			return errors.Wrap(err, "string")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "bk_organization",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
 func (s *CreateBindingInputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
@@ -506,6 +604,41 @@ func (s CreateMirrorRequestInputBodyProvider) Validate() error {
 	}
 }
 
+func (s *CreateNativeMirrorInputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := (validate.String{
+			MinLength:     1,
+			MinLengthSet:  true,
+			MaxLength:     0,
+			MaxLengthSet:  false,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.ClusterSlug)); err != nil {
+			return errors.Wrap(err, "string")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "clusterSlug",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
 func (s *CreateOrgInputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
@@ -621,66 +754,20 @@ func (s CreateProjectInputBodyOwnerType) Validate() error {
 	}
 }
 
-func (s *CreateRepoCIWebhookInputBody) Validate() error {
+func (s *CreateRepoCIWebhookBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if err := (validate.String{
-			MinLength:     1,
-			MinLengthSet:  true,
-			MaxLength:     0,
-			MaxLengthSet:  false,
-			Email:         false,
-			Hostname:      false,
-			Regex:         nil,
-			MinNumeric:    0,
-			MinNumericSet: false,
-			MaxNumeric:    0,
-			MaxNumericSet: false,
-		}).Validate(string(s.BkClusterID)); err != nil {
-			return errors.Wrap(err, "string")
-		}
-		return nil
-	}(); err != nil {
-		failures = append(failures, validate.FieldError{
-			Name:  "bk_cluster_id",
-			Error: err,
-		})
-	}
-	if err := func() error {
-		if err := (validate.String{
-			MinLength:     1,
-			MinLengthSet:  true,
-			MaxLength:     0,
-			MaxLengthSet:  false,
-			Email:         false,
-			Hostname:      false,
-			Regex:         nil,
-			MinNumeric:    0,
-			MinNumericSet: false,
-			MaxNumeric:    0,
-			MaxNumericSet: false,
-		}).Validate(string(s.BkOrganization)); err != nil {
-			return errors.Wrap(err, "string")
-		}
-		return nil
-	}(); err != nil {
-		failures = append(failures, validate.FieldError{
-			Name:  "bk_organization",
-			Error: err,
-		})
-	}
-	if err := func() error {
-		if err := s.Provider.Validate(); err != nil {
-			return err
+		if s.Events == nil {
+			return errors.New("nil is invalid value")
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "provider",
+			Name:  "events",
 			Error: err,
 		})
 	}
@@ -690,15 +777,6 @@ func (s *CreateRepoCIWebhookInputBody) Validate() error {
 	return nil
 }
 
-func (s CreateRepoCIWebhookInputBodyProvider) Validate() error {
-	switch s {
-	case "buildkite":
-		return nil
-	default:
-		return errors.Errorf("invalid value: %v", s)
-	}
-}
-
 func (s *CreateRepoInputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
@@ -1042,8 +1120,6 @@ func (s *GetMeOutputBody) Validate() error {
 
 func (s GetMeOutputBodyMode) Validate() error {
 	switch s {
-	case "standalone":
-		return nil
 	case "global":
 		return nil
 	case "regional":
@@ -1053,52 +1129,15 @@ func (s GetMeOutputBodyMode) Validate() error {
 	}
 }
 
-func (s *GetRepoVisibilityOutputBody) Validate() error {
-	if s == nil {
-		return validate.ErrNilPointer
-	}
-
-	var failures []validate.FieldError
-	if err := func() error {
-		if err := s.Visibility.Validate(); err != nil {
-			return err
-		}
-		return nil
-	}(); err != nil {
-		failures = append(failures, validate.FieldError{
-			Name:  "visibility",
-			Error: err,
-		})
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
-	}
-	return nil
-}
-
-func (s GetRepoVisibilityOutputBodyVisibility) Validate() error {
-	switch s {
-	case "public":
-		return nil
-	case "private":
-		return nil
-	default:
-		return errors.Errorf("invalid value: %v", s)
-	}
-}
-
-func (s *GetTopologyOutputBody) Validate() error {
+func (s *GetPermissionsOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Jurisdictions == nil {
-			return errors.New("nil is invalid value")
-		}
 		var failures []validate.FieldError
-		for i, elem := range s.Jurisdictions {
+		for i, elem := range s.Permissions {
 			if err := func() error {
 				if err := elem.Validate(); err != nil {
 					return err
@@ -1117,7 +1156,7 @@ func (s *GetTopologyOutputBody) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "jurisdictions",
+			Name:  "permissions",
 			Error: err,
 		})
 	}
@@ -1127,10 +1166,109 @@ func (s *GetTopologyOutputBody) Validate() error {
 	return nil
 }
 
-func (s *GetVersionOutputBody) Validate() error {
-	if s == nil {
-		return validate.ErrNilPointer
-	}
+func (s GetPermissionsOutputBodyPermissionsItem) Validate() error {
+	switch s {
+	case "manage":
+		return nil
+	case "view":
+		return nil
+	case "read":
+		return nil
+	case "write":
+		return nil
+	case "push":
+		return nil
+	case "pull":
+		return nil
+	case "create_repo":
+		return nil
+	case "admin":
+		return nil
+	case "admin_read":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *GetRepoVisibilityOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := s.Visibility.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "visibility",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s GetRepoVisibilityOutputBodyVisibility) Validate() error {
+	switch s {
+	case "public":
+		return nil
+	case "private":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *GetTopologyOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Jurisdictions == nil {
+			return errors.New("nil is invalid value")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.Jurisdictions {
+			if err := func() error {
+				if err := elem.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
+			}
+		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "jurisdictions",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *GetVersionOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
 
 	var failures []validate.FieldError
 	if err := func() error {
@@ -1159,8 +1297,6 @@ func (s *GetVersionOutputBody) Validate() error {
 
 func (s GetVersionOutputBodyMode) Validate() error {
 	switch s {
-	case "standalone":
-		return nil
 	case "global":
 		return nil
 	case "regional":
@@ -1383,8 +1519,6 @@ func (s GrantRepoAccessInputBodyRole) Validate() error {
 		return nil
 	case "admin":
 		return nil
-	case "ci_manager":
-		return nil
 	default:
 		return errors.Errorf("invalid value: %v", s)
 	}
@@ -1652,6 +1786,46 @@ func (s *ListMirrorsOutputBody) Validate() error {
 	return nil
 }
 
+func (s *ListNativeMirrorsOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.NativeMirrors == nil {
+			return errors.New("nil is invalid value")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.NativeMirrors {
+			if err := func() error {
+				if err := elem.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
+			}
+		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "nativeMirrors",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
 func (s *ListOIDCProvidersOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
@@ -1675,6 +1849,52 @@ func (s *ListOIDCProvidersOutputBody) Validate() error {
 	return nil
 }
 
+func (s *ListOrgCIBuildkiteClustersOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Clusters == nil {
+			return errors.New("nil is invalid value")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "clusters",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *ListOrgCIBuildkiteCredentialsOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Credentials == nil {
+			return errors.New("nil is invalid value")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "credentials",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
 func (s *ListOrgMembersOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
@@ -1831,18 +2051,18 @@ func (s *ListProjectsOutputBody) Validate() error {
 	return nil
 }
 
-func (s *ListRepoCIWebhooksOutputBody) Validate() error {
+func (s *ListRepoCIBuildsOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Subscriptions == nil {
+		if s.Builds == nil {
 			return errors.New("nil is invalid value")
 		}
 		var failures []validate.FieldError
-		for i, elem := range s.Subscriptions {
+		for i, elem := range s.Builds {
 			if err := func() error {
 				if err := elem.Validate(); err != nil {
 					return err
@@ -1861,30 +2081,7 @@ func (s *ListRepoCIWebhooksOutputBody) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "subscriptions",
-			Error: err,
-		})
-	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
-	}
-	return nil
-}
-
-func (s *ListRepoGrantsOutputBody) Validate() error {
-	if s == nil {
-		return validate.ErrNilPointer
-	}
-
-	var failures []validate.FieldError
-	if err := func() error {
-		if s.Grants == nil {
-			return errors.New("nil is invalid value")
-		}
-		return nil
-	}(); err != nil {
-		failures = append(failures, validate.FieldError{
-			Name:  "grants",
+			Name:  "builds",
 			Error: err,
 		})
 	}
@@ -1894,18 +2091,18 @@ func (s *ListRepoGrantsOutputBody) Validate() error {
 	return nil
 }
 
-func (s *ListReposOutputBody) Validate() error {
+func (s *ListRepoCIProvidersOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Repos == nil {
+		if s.Providers == nil {
 			return errors.New("nil is invalid value")
 		}
 		var failures []validate.FieldError
-		for i, elem := range s.Repos {
+		for i, elem := range s.Providers {
 			if err := func() error {
 				if err := elem.Validate(); err != nil {
 					return err
@@ -1924,7 +2121,7 @@ func (s *ListReposOutputBody) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "repos",
+			Name:  "providers",
 			Error: err,
 		})
 	}
@@ -1934,31 +2131,20 @@ func (s *ListReposOutputBody) Validate() error {
 	return nil
 }
 
-func (s ListReposScope) Validate() error {
-	switch s {
-	case "onboarded":
-		return nil
-	case "all":
-		return nil
-	default:
-		return errors.Errorf("invalid value: %v", s)
-	}
-}
-
-func (s *ListServiceAccountGrantsOutputBody) Validate() error {
+func (s *ListRepoCIWebhookAuditOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Grants == nil {
+		if s.Events == nil {
 			return errors.New("nil is invalid value")
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "grants",
+			Name:  "events",
 			Error: err,
 		})
 	}
@@ -1968,18 +2154,18 @@ func (s *ListServiceAccountGrantsOutputBody) Validate() error {
 	return nil
 }
 
-func (s *ListServiceAccountsOutputBody) Validate() error {
+func (s *ListRepoCIWebhooksOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.ServiceAccounts == nil {
+		if s.Subscriptions == nil {
 			return errors.New("nil is invalid value")
 		}
 		var failures []validate.FieldError
-		for i, elem := range s.ServiceAccounts {
+		for i, elem := range s.Subscriptions {
 			if err := func() error {
 				if err := elem.Validate(); err != nil {
 					return err
@@ -1998,7 +2184,7 @@ func (s *ListServiceAccountsOutputBody) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "serviceAccounts",
+			Name:  "subscriptions",
 			Error: err,
 		})
 	}
@@ -2008,55 +2194,43 @@ func (s *ListServiceAccountsOutputBody) Validate() error {
 	return nil
 }
 
-func (s *LookupRef) Validate() error {
+func (s *ListRepoCollaboratorsOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if err := (validate.String{
-			MinLength:     1,
-			MinLengthSet:  true,
-			MaxLength:     0,
-			MaxLengthSet:  false,
-			Email:         false,
-			Hostname:      false,
-			Regex:         nil,
-			MinNumeric:    0,
-			MinNumericSet: false,
-			MaxNumeric:    0,
-			MaxNumericSet: false,
-		}).Validate(string(s.ID)); err != nil {
-			return errors.Wrap(err, "string")
+		if s.Collaborators == nil {
+			return errors.New("nil is invalid value")
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "id",
+			Name:  "collaborators",
 			Error: err,
 		})
 	}
-	if err := func() error {
-		if err := (validate.String{
-			MinLength:     1,
-			MinLengthSet:  true,
-			MaxLength:     0,
-			MaxLengthSet:  false,
-			Email:         false,
-			Hostname:      false,
-			Regex:         nil,
-			MinNumeric:    0,
-			MinNumericSet: false,
-			MaxNumeric:    0,
-			MaxNumericSet: false,
-		}).Validate(string(s.Type)); err != nil {
-			return errors.Wrap(err, "string")
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *ListRepoGrantsOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Grants == nil {
+			return errors.New("nil is invalid value")
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "type",
+			Name:  "grants",
 			Error: err,
 		})
 	}
@@ -2066,27 +2240,70 @@ func (s *LookupRef) Validate() error {
 	return nil
 }
 
-func (s *LookupRefResult) Validate() error {
+func (s ListReposArchived) Validate() error {
+	switch s {
+	case "true":
+		return nil
+	case "false":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s ListReposHasCheckpoints) Validate() error {
+	switch s {
+	case "true":
+		return nil
+	case "false":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s ListReposOrder) Validate() error {
+	switch s {
+	case "asc":
+		return nil
+	case "desc":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *ListReposOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if value, ok := s.OwnerType.Get(); ok {
+		if s.Repos == nil {
+			return errors.New("nil is invalid value")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.Repos {
 			if err := func() error {
-				if err := value.Validate(); err != nil {
+				if err := elem.Validate(); err != nil {
 					return err
 				}
 				return nil
 			}(); err != nil {
-				return err
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
 			}
 		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "ownerType",
+			Name:  "repos",
 			Error: err,
 		})
 	}
@@ -2096,26 +2313,89 @@ func (s *LookupRefResult) Validate() error {
 	return nil
 }
 
-func (s LookupRefResultOwnerType) Validate() error {
+func (s ListReposPermission) Validate() error {
 	switch s {
-	case "org":
+	case "read":
 		return nil
-	case "account":
+	case "write":
+		return nil
+	case "admin":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s ListReposScope) Validate() error {
+	switch s {
+	case "onboarded":
+		return nil
+	case "all":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s ListReposStatus) Validate() error {
+	switch s {
+	case "mirrored":
+		return nil
+	case "processing":
+		return nil
+	case "inactive":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s ListReposVisibility) Validate() error {
+	switch s {
+	case "public":
+		return nil
+	case "private":
 		return nil
 	default:
 		return errors.Errorf("invalid value: %v", s)
 	}
 }
 
-func (s *LookupResourcesOutputBody) Validate() error {
+func (s *ListServiceAccountGrantsOutputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Grants == nil {
+			return errors.New("nil is invalid value")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "grants",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *ListServiceAccountsOutputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
+		if s.ServiceAccounts == nil {
+			return errors.New("nil is invalid value")
+		}
 		var failures []validate.FieldError
-		for i, elem := range s.Resources {
+		for i, elem := range s.ServiceAccounts {
 			if err := func() error {
 				if err := elem.Validate(); err != nil {
 					return err
@@ -2134,7 +2414,7 @@ func (s *LookupResourcesOutputBody) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "resources",
+			Name:  "serviceAccounts",
 			Error: err,
 		})
 	}
@@ -2199,6 +2479,41 @@ func (s MeRegionalUnavailableError) Validate() error {
 	}
 }
 
+func (s *MintOrgCIGitHubActionsCredentialInputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := (validate.String{
+			MinLength:     1,
+			MinLengthSet:  true,
+			MaxLength:     0,
+			MaxLengthSet:  false,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.Account)); err != nil {
+			return errors.Wrap(err, "string")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "account",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
 func (s *Mirror) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
@@ -2265,7 +2580,404 @@ func (s *MirrorRequestHeaders) Validate() error {
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "Response",
+			Name:  "Response",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s MirrorRequestStatus) Validate() error {
+	switch s {
+	case "pending":
+		return nil
+	case "processing":
+		return nil
+	case "succeeded":
+		return nil
+	case "failed":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s MirrorStatus) Validate() error {
+	switch s {
+	case "processing":
+		return nil
+	case "ready":
+		return nil
+	case "failed":
+		return nil
+	case "suspended":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *NativeMirrorPlacement) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := s.DesiredState.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "desiredState",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if err := s.Stage.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "stage",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if err := s.Status.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "status",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s NativeMirrorPlacementDesiredState) Validate() error {
+	switch s {
+	case "active":
+		return nil
+	case "deleted":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s NativeMirrorPlacementStage) Validate() error {
+	switch s {
+	case "pending":
+		return nil
+	case "provisioned":
+		return nil
+	case "registered":
+		return nil
+	case "seeded":
+		return nil
+	case "announced":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s NativeMirrorPlacementStatus) Validate() error {
+	switch s {
+	case "processing":
+		return nil
+	case "ready":
+		return nil
+	case "failed":
+		return nil
+	case "suspended":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *Project) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := s.OwnerType.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "ownerType",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s ProjectOwnerType) Validate() error {
+	switch s {
+	case "org":
+		return nil
+	case "account":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *RegisterOrgCIBuildkiteClusterInputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := (validate.String{
+			MinLength:     1,
+			MinLengthSet:  true,
+			MaxLength:     0,
+			MaxLengthSet:  false,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.BkClusterID)); err != nil {
+			return errors.Wrap(err, "string")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "bk_cluster_id",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if err := (validate.String{
+			MinLength:     1,
+			MinLengthSet:  true,
+			MaxLength:     0,
+			MaxLengthSet:  false,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.BkOrganization)); err != nil {
+			return errors.Wrap(err, "string")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "bk_organization",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *RepoCandidate) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := s.Access.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "access",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s RepoCandidateAccess) Validate() error {
+	switch s {
+	case "read":
+		return nil
+	case "write":
+		return nil
+	case "admin":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *RepoFacetPage) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Items == nil {
+			return errors.New("nil is invalid value")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "items",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *RepoIDResolution) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if err := s.Status.Validate(); err != nil {
+			return err
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "status",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s RepoIDResolutionStatus) Validate() error {
+	switch s {
+	case "resolved":
+		return nil
+	case "unavailable":
+		return nil
+	default:
+		return errors.Errorf("invalid value: %v", s)
+	}
+}
+
+func (s *RepoIndexEntry) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if value, ok := s.ActivityHotness.Get(); ok {
+			if err := func() error {
+				if err := (validate.Float{}).Validate(float64(value)); err != nil {
+					return errors.Wrap(err, "float")
+				}
+				return nil
+			}(); err != nil {
+				return err
+			}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "activityHotness",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if value, ok := s.Candidate.Get(); ok {
+			if err := func() error {
+				if err := value.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return err
+			}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "candidate",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if value, ok := s.Permission.Get(); ok {
+			if err := func() error {
+				if err := value.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				return err
+			}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "permission",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if s.Placements == nil {
+			return errors.New("nil is invalid value")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.Placements {
+			if err := func() error {
+				if err := elem.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
+			}
+		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "placements",
 			Error: err,
 		})
 	}
@@ -2275,50 +2987,33 @@ func (s *MirrorRequestHeaders) Validate() error {
 	return nil
 }
 
-func (s MirrorRequestStatus) Validate() error {
-	switch s {
-	case "pending":
-		return nil
-	case "processing":
-		return nil
-	case "succeeded":
-		return nil
-	case "failed":
-		return nil
-	default:
-		return errors.Errorf("invalid value: %v", s)
-	}
-}
-
-func (s MirrorStatus) Validate() error {
+func (s RepoIndexEntryPermission) Validate() error {
 	switch s {
-	case "processing":
-		return nil
-	case "ready":
+	case "read":
 		return nil
-	case "failed":
+	case "write":
 		return nil
-	case "suspended":
+	case "admin":
 		return nil
 	default:
 		return errors.Errorf("invalid value: %v", s)
 	}
 }
 
-func (s *Project) Validate() error {
+func (s *RepoPlacement) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if err := s.OwnerType.Validate(); err != nil {
+		if err := s.Status.Validate(); err != nil {
 			return err
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "ownerType",
+			Name:  "status",
 			Error: err,
 		})
 	}
@@ -2328,31 +3023,47 @@ func (s *Project) Validate() error {
 	return nil
 }
 
-func (s ProjectOwnerType) Validate() error {
+func (s RepoPlacementStatus) Validate() error {
 	switch s {
-	case "org":
+	case "processing":
 		return nil
-	case "account":
+	case "ready":
+		return nil
+	case "failed":
+		return nil
+	case "suspended":
 		return nil
 	default:
 		return errors.Errorf("invalid value: %v", s)
 	}
 }
 
-func (s *RepoCandidate) Validate() error {
+func (s *RepoReference) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if err := s.Access.Validate(); err != nil {
-			return err
+		if err := (validate.String{
+			MinLength:     0,
+			MinLengthSet:  false,
+			MaxLength:     256,
+			MaxLengthSet:  true,
+			Email:         false,
+			Hostname:      false,
+			Regex:         nil,
+			MinNumeric:    0,
+			MinNumericSet: false,
+			MaxNumeric:    0,
+			MaxNumericSet: false,
+		}).Validate(string(s.FullName)); err != nil {
+			return errors.Wrap(err, "string")
 		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "access",
+			Name:  "fullName",
 			Error: err,
 		})
 	}
@@ -2362,20 +3073,7 @@ func (s *RepoCandidate) Validate() error {
 	return nil
 }
 
-func (s RepoCandidateAccess) Validate() error {
-	switch s {
-	case "read":
-		return nil
-	case "write":
-		return nil
-	case "admin":
-		return nil
-	default:
-		return errors.Errorf("invalid value: %v", s)
-	}
-}
-
-func (s *RepoIndexEntry) Validate() error {
+func (s *RepoResolution) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
@@ -2400,9 +3098,6 @@ func (s *RepoIndexEntry) Validate() error {
 		})
 	}
 	if err := func() error {
-		if s.Placements == nil {
-			return errors.New("nil is invalid value")
-		}
 		var failures []validate.FieldError
 		for i, elem := range s.Placements {
 			if err := func() error {
@@ -2427,18 +3122,6 @@ func (s *RepoIndexEntry) Validate() error {
 			Error: err,
 		})
 	}
-	if len(failures) > 0 {
-		return &validate.Error{Fields: failures}
-	}
-	return nil
-}
-
-func (s *RepoPlacement) Validate() error {
-	if s == nil {
-		return validate.ErrNilPointer
-	}
-
-	var failures []validate.FieldError
 	if err := func() error {
 		if err := s.Status.Validate(); err != nil {
 			return err
@@ -2456,15 +3139,15 @@ func (s *RepoPlacement) Validate() error {
 	return nil
 }
 
-func (s RepoPlacementStatus) Validate() error {
+func (s RepoResolutionStatus) Validate() error {
 	switch s {
-	case "processing":
-		return nil
 	case "ready":
 		return nil
-	case "failed":
+	case "processing":
 		return nil
-	case "suspended":
+	case "no-mirror":
+		return nil
+	case "unavailable":
 		return nil
 	default:
 		return errors.Errorf("invalid value: %v", s)
@@ -2503,20 +3186,156 @@ func (s *ResolvePlacementsOutputBody) Validate() error {
 	return nil
 }
 
-func (s *ResourceAccess) Validate() error {
+func (s *ResolveRepoIDsInputBody) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
 	}
 
 	var failures []validate.FieldError
 	if err := func() error {
-		if s.Permissions == nil {
+		if s.RepoIds == nil {
 			return errors.New("nil is invalid value")
 		}
+		if err := (validate.Array{
+			MinLength:    0,
+			MinLengthSet: false,
+			MaxLength:    100,
+			MaxLengthSet: true,
+		}).ValidateLength(len(s.RepoIds)); err != nil {
+			return errors.Wrap(err, "array")
+		}
 		return nil
 	}(); err != nil {
 		failures = append(failures, validate.FieldError{
-			Name:  "permissions",
+			Name:  "repoIds",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *ResolveRepoIDsResponse) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Resolutions == nil {
+			return errors.New("nil is invalid value")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.Resolutions {
+			if err := func() error {
+				if err := elem.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
+			}
+		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "resolutions",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *ResolveReposInputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Repositories == nil {
+			return errors.New("nil is invalid value")
+		}
+		if err := (validate.Array{
+			MinLength:    0,
+			MinLengthSet: false,
+			MaxLength:    100,
+			MaxLengthSet: true,
+		}).ValidateLength(len(s.Repositories)); err != nil {
+			return errors.Wrap(err, "array")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.Repositories {
+			if err := func() error {
+				if err := elem.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
+			}
+		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "repositories",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
+func (s *ResolveReposResponse) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.Resolutions == nil {
+			return errors.New("nil is invalid value")
+		}
+		var failures []validate.FieldError
+		for i, elem := range s.Resolutions {
+			if err := func() error {
+				if err := elem.Validate(); err != nil {
+					return err
+				}
+				return nil
+			}(); err != nil {
+				failures = append(failures, validate.FieldError{
+					Name:  fmt.Sprintf("[%d]", i),
+					Error: err,
+				})
+			}
+		}
+		if len(failures) > 0 {
+			return &validate.Error{Fields: failures}
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "resolutions",
 			Error: err,
 		})
 	}
@@ -2691,6 +3510,56 @@ func (s *TopologyRegion) Validate() error {
 	return nil
 }
 
+func (s *UpdateBranchProtectionInputBody) Validate() error {
+	if s == nil {
+		return validate.ErrNilPointer
+	}
+
+	var failures []validate.FieldError
+	if err := func() error {
+		if s.AddRules == nil {
+			return nil // optional
+		}
+		if err := (validate.Array{
+			MinLength:    0,
+			MinLengthSet: false,
+			MaxLength:    64,
+			MaxLengthSet: true,
+		}).ValidateLength(len(s.AddRules)); err != nil {
+			return errors.Wrap(err, "array")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "addRules",
+			Error: err,
+		})
+	}
+	if err := func() error {
+		if s.RemoveRefs == nil {
+			return nil // optional
+		}
+		if err := (validate.Array{
+			MinLength:    0,
+			MinLengthSet: false,
+			MaxLength:    64,
+			MaxLengthSet: true,
+		}).ValidateLength(len(s.RemoveRefs)); err != nil {
+			return errors.Wrap(err, "array")
+		}
+		return nil
+	}(); err != nil {
+		failures = append(failures, validate.FieldError{
+			Name:  "removeRefs",
+			Error: err,
+		})
+	}
+	if len(failures) > 0 {
+		return &validate.Error{Fields: failures}
+	}
+	return nil
+}
+
 func (s *WillDeleteStruct) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
diff --git a/internal/coreapi/spec/core.gen.json b/internal/coreapi/spec/core.gen.json
index 701e63477e..fcf6ecb685 100644
--- a/internal/coreapi/spec/core.gen.json
+++ b/internal/coreapi/spec/core.gen.json
@@ -92,6 +92,11 @@
           "owner": {
             "type": "string"
           },
+          "pushedAt": {
+            "description": "Time of the latest push to the upstream repository.",
+            "format": "date-time",
+            "type": "string"
+          },
           "repo": {
             "type": "string"
           },
@@ -113,102 +118,89 @@
         ],
         "type": "object"
       },
-      "BatchLookupInputBody": {
+      "Binding": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/BatchLookupInputBody.json"
+              "/api/v1/schemas/Binding.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "refs": {
-            "items": {
-              "$ref": "#/components/schemas/LookupRef"
-            },
-            "maxItems": 100,
-            "minItems": 1,
-            "type": "array"
+          "accountId": {
+            "type": "string"
+          },
+          "attributeFilter": {},
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "providerId": {
+            "type": "string"
           }
         },
         "required": [
-          "refs"
+          "id",
+          "accountId",
+          "providerId",
+          "attributeFilter",
+          "createdAt"
         ],
         "type": "object"
       },
-      "BatchLookupOutputBody": {
+      "BranchProtection": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/BatchLookupOutputBody.json"
+              "/api/v1/schemas/BranchProtection.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "refs": {
+          "rules": {
+            "description": "Protection rules, one per pattern; each ref at most once. Empty protects nothing.",
             "items": {
-              "$ref": "#/components/schemas/LookupRefResult"
+              "$ref": "#/components/schemas/BranchRule"
             },
+            "maxItems": 64,
             "type": "array"
           }
         },
         "required": [
-          "refs"
+          "rules"
         ],
         "type": "object"
       },
-      "Binding": {
+      "BranchRule": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/Binding.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
-          },
-          "accountId": {
-            "type": "string"
-          },
-          "attributeFilter": {},
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "id": {
+          "ref": {
+            "description": "\"HEAD\" or a refs/heads/ name, fnmatch wildcards allowed.",
             "type": "string"
           },
-          "providerId": {
-            "type": "string"
+          "serverSideMergeOnly": {
+            "description": "The branch moves only through a server-side merge by Entire; every direct write, fast-forward included, is refused. Defaults to false.",
+            "type": "boolean"
           }
         },
         "required": [
-          "id",
-          "accountId",
-          "providerId",
-          "attributeFilter",
-          "createdAt"
+          "ref"
         ],
         "type": "object"
       },
-      "CIWebhookView": {
+      "CIBuildView": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CIWebhookView.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "bk_build_uuid": {
             "type": "string"
           },
           "bk_organization": {
@@ -217,1425 +209,1592 @@
           "bk_pipeline": {
             "type": "string"
           },
+          "branch": {
+            "type": "string"
+          },
+          "build_number": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "commit": {
+            "type": "string"
+          },
           "created_at": {
             "format": "date-time",
             "type": "string"
           },
-          "display_name": {
+          "event_at": {
+            "format": "date-time",
             "type": "string"
           },
-          "enabled": {
-            "type": "boolean"
+          "finished_at": {
+            "format": "date-time",
+            "type": "string"
           },
-          "events": {
+          "jobs": {
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/CIJobView"
             },
             "type": "array"
           },
-          "id": {
+          "last_event": {
             "type": "string"
           },
-          "provider": {
+          "message": {
             "type": "string"
           },
-          "ref_filter": {
+          "stale": {
+            "type": "boolean"
+          },
+          "started_at": {
+            "format": "date-time",
             "type": "string"
           },
-          "repo_id": {
+          "state": {
             "type": "string"
           },
+          "terminal": {
+            "type": "boolean"
+          },
           "updated_at": {
             "format": "date-time",
             "type": "string"
+          },
+          "web_url": {
+            "type": "string"
           }
         },
         "required": [
-          "id",
-          "repo_id",
-          "provider",
-          "display_name",
+          "bk_build_uuid",
           "bk_organization",
           "bk_pipeline",
-          "ref_filter",
-          "events",
-          "enabled",
-          "created_at",
-          "updated_at"
+          "build_number",
+          "state",
+          "commit",
+          "branch",
+          "message",
+          "web_url",
+          "last_event",
+          "event_at",
+          "terminal",
+          "stale",
+          "updated_at",
+          "jobs"
         ],
         "type": "object"
       },
-      "Cluster": {
+      "CIJobView": {
         "additionalProperties": true,
         "properties": {
-          "apiUrl": {
+          "bk_job_id": {
             "type": "string"
           },
-          "isDefault": {
-            "type": "boolean"
+          "exit_status": {
+            "format": "int64",
+            "type": "integer"
           },
-          "jurisdiction": {
+          "finished_at": {
+            "format": "date-time",
             "type": "string"
           },
-          "publicUrl": {
+          "name": {
             "type": "string"
           },
-          "slug": {
+          "started_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "state": {
+            "type": "string"
+          },
+          "step_key": {
+            "type": "string"
+          },
+          "type": {
             "type": "string"
           }
         },
         "required": [
-          "slug",
-          "jurisdiction",
-          "publicUrl",
-          "isDefault"
+          "bk_job_id",
+          "type",
+          "name",
+          "step_key",
+          "state"
         ],
         "type": "object"
       },
-      "CompleteOnboardingOutputBody": {
+      "CIProviderDescriptor": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CompleteOnboardingOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "enrollable": {
+            "description": "Whether this org can enrol into this provider right now",
+            "type": "boolean"
+          },
+          "fields": {
+            "description": "Form fields, in the order a client should render them",
+            "items": {
+              "$ref": "#/components/schemas/CIProviderField"
+            },
+            "type": "array"
+          },
+          "label": {
+            "description": "Human-readable provider name",
             "type": "string"
           },
-          "needsOnboarding": {
-            "description": "Always false after onboarding completion is recorded.",
-            "type": "boolean"
+          "modes": {
+            "description": "Ways of enrolling; exactly one is marked default",
+            "items": {
+              "$ref": "#/components/schemas/CIProviderMode"
+            },
+            "type": "array"
+          },
+          "name": {
+            "description": "Provider key, posted back as the request's provider",
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why enrolment is unavailable; set only when enrollable is false",
+            "type": "string"
           }
         },
         "required": [
-          "needsOnboarding"
+          "name",
+          "label",
+          "enrollable",
+          "modes",
+          "fields"
         ],
         "type": "object"
       },
-      "CreateBindingInputBody": {
+      "CIProviderField": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateBindingInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "help": {
+            "description": "Longer explanation shown beneath the field",
             "type": "string"
           },
-          "attributeFilter": {
-            "description": "Exact-match key/value map; empty filter matches any token."
+          "key": {
+            "description": "Body key this field's value posts under",
+            "type": "string"
           },
-          "providerId": {
-            "minLength": 1,
+          "kind": {
+            "description": "Widget to render: text, select, secret, bool",
+            "type": "string"
+          },
+          "label": {
+            "description": "Human-readable field label",
+            "type": "string"
+          },
+          "options": {
+            "description": "Choices for a select field; absent for every other kind",
+            "items": {
+              "$ref": "#/components/schemas/CIProviderOption"
+            },
+            "type": "array"
+          },
+          "placeholder": {
+            "description": "Placeholder text for an empty field",
+            "type": "string"
+          },
+          "required_in": {
+            "description": "Mode keys this field is required in; empty means never required",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "target": {
+            "description": "Where the value goes: body (top level) or config (opaque map)",
             "type": "string"
           }
         },
         "required": [
-          "providerId"
+          "key",
+          "target",
+          "kind",
+          "label",
+          "required_in"
         ],
         "type": "object"
       },
-      "CreateMirrorInputBody": {
+      "CIProviderMode": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateMirrorInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
-          },
-          "clusterHost": {
-            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
-            "minLength": 1,
-            "type": "string"
+          "default": {
+            "description": "Whether a client should preselect this mode",
+            "type": "boolean"
           },
-          "owner": {
-            "minLength": 1,
+          "help": {
+            "description": "Longer explanation of what this mode does",
             "type": "string"
           },
-          "provider": {
-            "enum": [
-              "github"
-            ],
+          "key": {
+            "description": "Mode key to post back as the request's mode",
             "type": "string"
           },
-          "repo": {
-            "minLength": 1,
+          "label": {
+            "description": "Human-readable label",
             "type": "string"
           }
         },
         "required": [
-          "provider",
-          "owner",
-          "repo",
-          "clusterHost"
+          "key",
+          "label"
         ],
         "type": "object"
       },
-      "CreateMirrorRequestInputBody": {
+      "CIProviderOption": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateMirrorRequestInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "label": {
+            "description": "Human-readable label",
             "type": "string"
           },
-          "clusterHost": {
-            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
-            "minLength": 1,
+          "value": {
+            "description": "Value to post back for this choice",
             "type": "string"
-          },
-          "owner": {
-            "minLength": 1,
+          }
+        },
+        "required": [
+          "value",
+          "label"
+        ],
+        "type": "object"
+      },
+      "CISetupBlock": {
+        "additionalProperties": true,
+        "properties": {
+          "content": {
+            "description": "The content itself, ready to use verbatim",
             "type": "string"
           },
-          "provider": {
-            "enum": [
-              "github"
-            ],
+          "format": {
+            "description": "The content's syntax, for highlighting: yaml, json",
             "type": "string"
           },
-          "repo": {
-            "minLength": 1,
+          "heading": {
+            "description": "Short instruction naming what to do with the content",
             "type": "string"
           }
         },
         "required": [
-          "provider",
-          "owner",
-          "repo",
-          "clusterHost"
+          "heading",
+          "format",
+          "content"
         ],
         "type": "object"
       },
-      "CreateOrgInputBody": {
+      "CIWebhookAuditActor": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateOrgInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "account_id": {
+            "description": "Entire account ULID that performed the action",
             "type": "string"
           },
-          "name": {
-            "description": "Display name.",
-            "maxLength": 100,
-            "minLength": 1,
+          "handle": {
+            "description": "Actor's primary handle; empty when they have none",
             "type": "string"
           },
-          "region": {
-            "description": "Jurisdiction slug; defaults to the server's home jurisdiction.",
+          "handle_provider": {
+            "description": "Provider the handle came from: github, workos, system",
             "type": "string"
           }
         },
         "required": [
-          "name"
+          "account_id"
         ],
         "type": "object"
       },
-      "CreateProjectInputBody": {
+      "CIWebhookAuditEventView": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateProjectInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
+          "actor": {
+            "$ref": "#/components/schemas/CIWebhookAuditActor",
+            "description": "Who performed the action"
           },
-          "name": {
-            "maxLength": 100,
-            "minLength": 1,
+          "event_type": {
+            "description": "ci_webhook_enrolled | ci_webhook_updated | ci_webhook_deleted | ci_webhook_identity_rolled_back | ci_webhook_identity_orphaned",
             "type": "string"
           },
-          "ownerId": {
-            "minLength": 1,
+          "id": {
+            "description": "Audit event ULID",
             "type": "string"
           },
-          "ownerType": {
-            "enum": [
-              "org",
-              "account"
-            ],
-            "type": "string"
+          "metadata": {
+            "additionalProperties": {},
+            "description": "Event detail as recorded, e.g. bk_organization/bk_pipeline",
+            "type": "object"
           },
-          "region": {
+          "occurred_at": {
+            "description": "When the action was recorded (UTC)",
+            "format": "date-time",
             "type": "string"
           }
         },
         "required": [
-          "name",
-          "ownerType",
-          "ownerId"
+          "id",
+          "event_type",
+          "actor",
+          "occurred_at"
         ],
         "type": "object"
       },
-      "CreateRepoCIWebhookInputBody": {
+      "CIWebhookView": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreateRepoCIWebhookInputBody.json"
+              "/api/v1/schemas/CIWebhookView.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "bk_cluster_id": {
-            "minLength": 1,
-            "type": "string"
-          },
           "bk_organization": {
-            "minLength": 1,
             "type": "string"
           },
           "bk_pipeline": {
             "type": "string"
           },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
           "display_name": {
             "type": "string"
           },
+          "enabled": {
+            "type": "boolean"
+          },
           "events": {
             "items": {
               "type": "string"
             },
             "type": "array"
           },
+          "id": {
+            "type": "string"
+          },
           "provider": {
-            "enum": [
-              "buildkite"
-            ],
             "type": "string"
           },
+          "publish_checks": {
+            "type": "boolean"
+          },
           "ref_filter": {
             "type": "string"
+          },
+          "repo_id": {
+            "type": "string"
+          },
+          "updated_at": {
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
+          "id",
+          "repo_id",
           "provider",
+          "display_name",
           "bk_organization",
-          "bk_cluster_id"
+          "bk_pipeline",
+          "ref_filter",
+          "events",
+          "enabled",
+          "publish_checks",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "CreateRepoInputBody": {
+      "Cluster": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateRepoInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "apiUrl": {
             "type": "string"
           },
-          "clusterHost": {
-            "description": "Public host of the cluster to pin the repo to (e.g. royalcanin.partial.to); empty lands on the jurisdiction default.",
-            "type": "string"
+          "isDefault": {
+            "type": "boolean"
           },
-          "name": {
-            "minLength": 1,
+          "jurisdiction": {
             "type": "string"
           },
-          "objectFormat": {
-            "description": "Hash format; defaults to sha1.",
-            "enum": [
-              "sha1",
-              "sha256"
-            ],
+          "publicUrl": {
             "type": "string"
           },
-          "projectId": {
-            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+          "slug": {
             "type": "string"
           }
         },
         "required": [
-          "projectId",
-          "name"
+          "slug",
+          "jurisdiction",
+          "publicUrl",
+          "isDefault"
         ],
         "type": "object"
       },
-      "CreateServiceAccountInputBody": {
+      "CompleteOnboardingOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreateServiceAccountInputBody.json"
+              "/api/v1/schemas/CompleteOnboardingOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "name": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "orgId": {
-            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-            "type": "string"
+          "needsOnboarding": {
+            "description": "Always false after onboarding completion is recorded.",
+            "type": "boolean"
           }
         },
         "required": [
-          "orgId",
-          "name"
+          "needsOnboarding"
         ],
         "type": "object"
       },
-      "CreatedMirror": {
+      "ConnectOrgCIBuildkiteCredentialInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreatedMirror.json"
+              "/api/v1/schemas/ConnectOrgCIBuildkiteCredentialInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "created": {
-            "description": "true on fresh creation; false when an existing mirror was returned.",
-            "type": "boolean"
-          },
-          "empty": {
-            "description": "Deprecated: always false. Poll the mirror status instead — an empty upstream still reaches 'ready'.",
-            "type": "boolean"
-          },
-          "mirrorId": {
-            "type": "string"
-          },
-          "mirrorUrl": {
+          "bk_api_token": {
+            "minLength": 1,
             "type": "string"
           },
-          "publicUrl": {
+          "bk_organization": {
+            "minLength": 1,
             "type": "string"
-          },
-          "suspended": {
-            "description": "true when an existing placement was returned that an admin suspended.",
-            "type": "boolean"
           }
         },
         "required": [
-          "mirrorId",
-          "mirrorUrl",
-          "publicUrl",
-          "created",
-          "empty",
-          "suspended"
+          "bk_organization",
+          "bk_api_token"
         ],
         "type": "object"
       },
-      "DeletionBlocker": {
+      "CreateBindingInputBody": {
         "additionalProperties": true,
         "properties": {
-          "deletable": {
-            "description": "True when the account can self-serve delete this org (it is the only member and the org has no projects). When false, the org has other members or data and must be transferred/removed via support. The UI should offer a delete action only when this is true.",
-            "type": "boolean"
-          },
-          "id": {
-            "description": "Resource ID (org ULID).",
-            "type": "string"
-          },
-          "kind": {
-            "description": "Blocker kind. Currently always 'owned_org'.",
-            "enum": [
-              "owned_org"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateBindingInputBody.json"
             ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "message": {
-            "description": "Copy explaining how to clear the blocker.",
-            "type": "string"
+          "attributeFilter": {
+            "description": "Exact-match key/value map; empty filter matches any token."
           },
-          "name": {
-            "description": "Human-readable resource name.",
+          "providerId": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "kind",
-          "id",
-          "name",
-          "deletable",
-          "message"
+          "providerId"
         ],
         "type": "object"
       },
-      "DeletionGrant": {
+      "CreateMirrorInputBody": {
         "additionalProperties": true,
         "properties": {
-          "jurisdiction": {
-            "description": "Region the repo lives in (us/eu/au); empty for project grants.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateMirrorInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "resourceId": {
-            "description": "Granted resource ULID.",
+          "clusterHost": {
+            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
+            "minLength": 1,
             "type": "string"
           },
-          "resourceName": {
-            "description": "Granted resource name.",
+          "owner": {
+            "minLength": 1,
             "type": "string"
           },
-          "resourceType": {
-            "description": "Granted resource type.",
+          "provider": {
             "enum": [
-              "project",
-              "repo"
+              "github"
             ],
             "type": "string"
           },
-          "role": {
-            "description": "Granted role.",
+          "repo": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "resourceType",
-          "resourceId",
-          "resourceName",
-          "role"
+          "provider",
+          "owner",
+          "repo",
+          "clusterHost"
         ],
         "type": "object"
       },
-      "DeletionMembership": {
+      "CreateMirrorRequestInputBody": {
         "additionalProperties": true,
         "properties": {
-          "name": {
-            "description": "Org name.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateMirrorRequestInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "orgId": {
-            "description": "Org ULID.",
+          "clusterHost": {
+            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
+            "minLength": 1,
             "type": "string"
-          }
-        },
-        "required": [
-          "orgId",
-          "name"
-        ],
-        "type": "object"
-      },
-      "DeletionRepo": {
-        "additionalProperties": true,
-        "properties": {
-          "cluster": {
-            "description": "Cluster slug the repo is placed on, if known.",
+          },
+          "owner": {
+            "minLength": 1,
             "type": "string"
           },
-          "id": {
-            "description": "Repo ULID.",
+          "provider": {
+            "enum": [
+              "github"
+            ],
             "type": "string"
           },
-          "name": {
-            "description": "Repo name.",
+          "repo": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "name"
+          "provider",
+          "owner",
+          "repo",
+          "clusterHost"
         ],
         "type": "object"
       },
-      "ErrorDetail": {
-        "additionalProperties": true,
-        "properties": {
-          "location": {
-            "description": "Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'",
-            "type": "string"
-          },
-          "message": {
-            "description": "Error message text",
-            "type": "string"
-          },
-          "value": {
-            "description": "The value at the given location"
-          }
-        },
-        "type": "object"
-      },
-      "ErrorModel": {
+      "CreateNativeMirrorInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ErrorModel.json"
+              "/api/v1/schemas/CreateNativeMirrorInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "detail": {
-            "description": "A human-readable explanation specific to this occurrence of the problem.",
-            "examples": [
-              "Property foo is required but is missing."
-            ],
-            "type": "string"
-          },
-          "errors": {
-            "description": "Optional list of individual error details",
-            "items": {
-              "$ref": "#/components/schemas/ErrorDetail"
-            },
-            "type": "array"
-          },
-          "instance": {
-            "description": "A URI reference that identifies the specific occurrence of the problem.",
-            "examples": [
-              "https://example.com/error-log/abc123"
-            ],
-            "format": "uri",
-            "type": "string"
-          },
-          "status": {
-            "description": "HTTP status code",
-            "examples": [
-              400
-            ],
-            "format": "int64",
-            "type": "integer"
-          },
-          "title": {
-            "description": "A short, human-readable summary of the problem type. This value should not change between occurrences of the error.",
-            "examples": [
-              "Bad Request"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "default": "about:blank",
-            "description": "A URI reference to human-readable documentation for the error.",
-            "examples": [
-              "https://example.com/errors/example"
-            ],
-            "format": "uri",
+          "clusterSlug": {
+            "minLength": 1,
             "type": "string"
           }
         },
+        "required": [
+          "clusterSlug"
+        ],
         "type": "object"
       },
-      "GetDeletionPreviewOutputBody": {
+      "CreateOrgInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetDeletionPreviewOutputBody.json"
+              "/api/v1/schemas/CreateOrgInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "blocked": {
-            "description": "True when Blockers is non-empty: DELETE /me will be refused with 409.",
-            "type": "boolean"
-          },
-          "blockers": {
-            "description": "Resources that must be resolved before deletion (owned orgs).",
-            "items": {
-              "$ref": "#/components/schemas/DeletionBlocker"
-            },
-            "type": "array"
-          },
-          "willDelete": {
-            "$ref": "#/components/schemas/WillDeleteStruct"
+          "name": {
+            "description": "Display name.",
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
           },
-          "willUnlink": {
-            "$ref": "#/components/schemas/WillUnlinkStruct"
+          "region": {
+            "description": "Jurisdiction slug; defaults to the server's home jurisdiction.",
+            "type": "string"
           }
         },
         "required": [
-          "blocked",
-          "blockers",
-          "willDelete",
-          "willUnlink"
+          "name"
         ],
         "type": "object"
       },
-      "GetMeOutputBody": {
+      "CreateProjectInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetMeOutputBody.json"
+              "/api/v1/schemas/CreateProjectInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "auth": {
-            "$ref": "#/components/schemas/MeAuth"
-          },
-          "deletion": {
-            "$ref": "#/components/schemas/MeDeletion",
-            "description": "Present only when a deletion is pending; carries the cooldown window."
-          },
-          "global": {
-            "$ref": "#/components/schemas/MeGlobal"
+          "name": {
+            "maxLength": 100,
+            "minLength": 1,
+            "type": "string"
           },
-          "jurisdiction": {
+          "ownerId": {
+            "minLength": 1,
             "type": "string"
           },
-          "mode": {
+          "ownerType": {
             "enum": [
-              "standalone",
-              "global",
-              "regional"
+              "org",
+              "account"
             ],
             "type": "string"
           },
-          "regional": {
-            "$ref": "#/components/schemas/MeRegional"
-          },
-          "regionalUnavailable": {
-            "$ref": "#/components/schemas/MeRegionalUnavailable"
+          "region": {
+            "type": "string"
           }
         },
         "required": [
-          "global",
-          "auth"
+          "name",
+          "ownerType",
+          "ownerId"
         ],
         "type": "object"
       },
-      "GetOnboardingStatusOutputBody": {
+      "CreateRepoCIWebhookBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetOnboardingStatusOutputBody.json"
+              "/api/v1/schemas/CreateRepoCIWebhookBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "needsOnboarding": {
-            "description": "True until the account completes web onboarding at least once.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "needsOnboarding"
-        ],
-        "type": "object"
-      },
-      "GetPermissionsOutputBody": {
-        "additionalProperties": true,
-        "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GetPermissionsOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "auth_plugin_ref": {
+            "description": "entire-core-auth Buildkite plugin ref this pipeline is built with: the registered cluster's override, else the pinned default; goes in the bootstrap config's plugins list",
             "type": "string"
           },
-          "explain": {
-            "additionalProperties": {},
-            "type": "object"
+          "automation_id": {
+            "description": "Automation (aut_<ulid>) the enrolled pipeline's builds exchange their OIDC token for; goes in the bootstrap config as the automation:<id> resource (ENTIRE_CORE_AUTH_RESOURCE)",
+            "type": "string"
           },
-          "permissions": {
+          "bk_organization": {
+            "type": "string"
+          },
+          "bk_pipeline": {
+            "type": "string"
+          },
+          "core_url": {
+            "description": "entire-core base URL the bootstrap auth plugin talks to; goes in the bootstrap config as ENTIRE_CORE_AUTH_URL",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "display_name": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean"
+          },
+          "events": {
             "items": {
               "type": "string"
             },
             "type": "array"
           },
-          "resourceId": {
+          "id": {
             "type": "string"
           },
-          "resourceType": {
+          "provider": {
+            "type": "string"
+          },
+          "publish_checks": {
+            "type": "boolean"
+          },
+          "ref_filter": {
+            "type": "string"
+          },
+          "repo_id": {
+            "type": "string"
+          },
+          "setup": {
+            "$ref": "#/components/schemas/CISetupBlock",
+            "description": "What to do next, rendered ready to use. Present on a self-managed enrolment."
+          },
+          "updated_at": {
+            "format": "date-time",
             "type": "string"
           }
         },
         "required": [
-          "resourceType",
-          "resourceId"
+          "automation_id",
+          "core_url",
+          "auth_plugin_ref",
+          "id",
+          "repo_id",
+          "provider",
+          "display_name",
+          "bk_organization",
+          "bk_pipeline",
+          "ref_filter",
+          "events",
+          "enabled",
+          "publish_checks",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "GetRepoVisibilityOutputBody": {
+      "CreateRepoCIWebhookInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetRepoVisibilityOutputBody.json"
+              "/api/v1/schemas/CreateRepoCIWebhookInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "visibility": {
-            "enum": [
-              "public",
-              "private"
-            ],
+          "bk_cluster_id": {
             "type": "string"
-          }
-        },
-        "required": [
-          "visibility"
-        ],
-        "type": "object"
-      },
-      "GetTopologyOutputBody": {
-        "additionalProperties": true,
-        "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GetTopologyOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          },
+          "bk_force_rescaffold": {
+            "description": "Overwrite an existing pipeline's configuration with the generated bootstrap step, DISCARDING manual edits. Repairs a pipeline left naming an automation that a teardown retired. Requires bk_provisioning_token; refused on a self-managed pipeline.",
+            "type": "boolean"
+          },
+          "bk_organization": {
             "type": "string"
           },
-          "jurisdictions": {
+          "bk_pipeline": {
+            "type": "string"
+          },
+          "bk_pipeline_self_managed": {
+            "description": "The customer created and maintains this Buildkite pipeline. entire never creates, reconciles or reads it, and bk_provisioning_token is neither required nor accepted.",
+            "type": "boolean"
+          },
+          "bk_provisioning_token": {
+            "description": "Transient Buildkite token (write_pipelines) to create the pipeline; write-only, never stored. Required on first enroll; omit on a routing-only re-enroll. Refused for an existing pipeline unless bk_force_rescaffold is also set.",
+            "type": "string"
+          },
+          "config": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider-specific values from the providers listing; opaque to core. For buildkite: cluster_id, provisioning_token, force_rescaffold.",
+            "type": "object"
+          },
+          "display_name": {
+            "type": "string"
+          },
+          "events": {
             "items": {
-              "$ref": "#/components/schemas/TopologyJurisdiction"
+              "type": "string"
             },
             "type": "array"
-          }
-        },
-        "required": [
-          "jurisdictions"
-        ],
-        "type": "object"
-      },
-      "GetVersionOutputBody": {
-        "additionalProperties": true,
-        "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GetVersionOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
           },
           "mode": {
-            "description": "Server mode.",
-            "enum": [
-              "standalone",
-              "global",
-              "regional"
-            ],
+            "description": "How to enrol, from the chosen provider's modes. For buildkite: self_managed or provisioned.",
             "type": "string"
           },
-          "version": {
-            "description": "Git commit SHA of the running entire-core binary, or \"dev\" for an untagged local build.",
+          "provider": {
+            "type": "string"
+          },
+          "provider_account": {
+            "description": "Vendor-side account to enrol against (for buildkite, the organization slug). Use with provider/mode/config; omit when sending the bk_* fields.",
+            "type": "string"
+          },
+          "ref_filter": {
+            "type": "string"
+          },
+          "target_ref": {
+            "description": "Vendor-side build target (for buildkite, the pipeline slug). Defaults to a slug derived from the repo.",
             "type": "string"
           }
         },
         "required": [
-          "version"
+          "provider"
         ],
         "type": "object"
       },
-      "GrantProjectAccessInputBody": {
+      "CreateRepoInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GrantProjectAccessInputBody.json"
+              "/api/v1/schemas/CreateRepoInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "granteeType": {
-            "default": "account",
-            "enum": [
-              "account"
-            ],
-            "type": "string"
-          },
-          "provider": {
-            "minLength": 1,
+          "clusterHost": {
+            "description": "Public host of the cluster to pin the repo to (e.g. royalcanin.partial.to); empty lands on the jurisdiction default.",
             "type": "string"
           },
-          "providerUserId": {
+          "name": {
             "minLength": 1,
             "type": "string"
           },
-          "role": {
+          "objectFormat": {
+            "description": "Hash format; defaults to sha1.",
             "enum": [
-              "reader",
-              "writer",
-              "admin"
+              "sha1",
+              "sha256"
             ],
             "type": "string"
+          },
+          "projectId": {
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+            "type": "string"
           }
         },
         "required": [
-          "provider",
-          "providerUserId",
-          "role"
+          "projectId",
+          "name"
         ],
         "type": "object"
       },
-      "GrantProjectAccessOutputBody": {
+      "CreateServiceAccountInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GrantProjectAccessOutputBody.json"
+              "/api/v1/schemas/CreateServiceAccountInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "status": {
+          "name": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "orgId": {
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
             "type": "string"
           }
         },
         "required": [
-          "status"
+          "orgId",
+          "name"
         ],
         "type": "object"
       },
-      "GrantRepoAccessInputBody": {
+      "CreatedMirror": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GrantRepoAccessInputBody.json"
+              "/api/v1/schemas/CreatedMirror.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "granteeType": {
-            "default": "account",
-            "enum": [
-              "account"
-            ],
-            "type": "string"
+          "created": {
+            "description": "true on fresh creation; false when an existing mirror was returned.",
+            "type": "boolean"
           },
-          "provider": {
-            "minLength": 1,
+          "empty": {
+            "description": "Deprecated: always false. Poll the mirror status instead — an empty upstream still reaches 'ready'.",
+            "type": "boolean"
+          },
+          "mirrorId": {
             "type": "string"
           },
-          "providerUserId": {
-            "minLength": 1,
+          "mirrorUrl": {
             "type": "string"
           },
-          "role": {
-            "enum": [
-              "reader",
-              "writer",
-              "admin",
-              "ci_manager"
-            ],
+          "publicUrl": {
             "type": "string"
+          },
+          "suspended": {
+            "description": "true when an existing placement was returned that an admin suspended.",
+            "type": "boolean"
           }
         },
         "required": [
-          "provider",
-          "providerUserId",
-          "role"
+          "mirrorId",
+          "mirrorUrl",
+          "publicUrl",
+          "created",
+          "empty",
+          "suspended"
         ],
         "type": "object"
       },
-      "GrantRepoAccessOutputBody": {
+      "DeletionBlocker": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantRepoAccessOutputBody.json"
+          "deletable": {
+            "description": "True when the account can self-serve delete this org (it is the only member and the org has no projects). When false, the org has other members or data and must be transferred/removed via support. The UI should offer a delete action only when this is true.",
+            "type": "boolean"
+          },
+          "id": {
+            "description": "Resource ID (org ULID).",
+            "type": "string"
+          },
+          "kind": {
+            "description": "Blocker kind. Currently always 'owned_org'.",
+            "enum": [
+              "owned_org"
             ],
-            "format": "uri",
-            "readOnly": true,
             "type": "string"
           },
-          "status": {
+          "message": {
+            "description": "Copy explaining how to clear the blocker.",
+            "type": "string"
+          },
+          "name": {
+            "description": "Human-readable resource name.",
             "type": "string"
           }
         },
         "required": [
-          "status"
+          "kind",
+          "id",
+          "name",
+          "deletable",
+          "message"
         ],
         "type": "object"
       },
-      "GrantServiceAccountAccessInputBody": {
+      "DeletionGrant": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantServiceAccountAccessInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "jurisdiction": {
+            "description": "Region the repo lives in (us/eu/au); empty for project grants.",
             "type": "string"
           },
           "resourceId": {
-            "minLength": 1,
+            "description": "Granted resource ULID.",
+            "type": "string"
+          },
+          "resourceName": {
+            "description": "Granted resource name.",
             "type": "string"
           },
           "resourceType": {
+            "description": "Granted resource type.",
             "enum": [
-              "repo",
-              "project"
+              "project",
+              "repo"
             ],
             "type": "string"
           },
           "role": {
-            "enum": [
-              "reader",
-              "writer",
-              "admin"
-            ],
+            "description": "Granted role.",
             "type": "string"
           }
         },
         "required": [
           "resourceType",
           "resourceId",
+          "resourceName",
           "role"
         ],
         "type": "object"
       },
-      "GrantServiceAccountAccessOutputBody": {
+      "DeletionMembership": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantServiceAccountAccessOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "name": {
+            "description": "Org name.",
             "type": "string"
           },
-          "status": {
+          "orgId": {
+            "description": "Org ULID.",
             "type": "string"
           }
         },
         "required": [
-          "status"
+          "orgId",
+          "name"
         ],
         "type": "object"
       },
-      "ListAuditEventsOutputBody": {
+      "DeletionRepo": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/ListAuditEventsOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "cluster": {
+            "description": "Cluster slug the repo is placed on, if known.",
             "type": "string"
           },
-          "events": {
-            "items": {
-              "$ref": "#/components/schemas/AuditEvent"
-            },
-            "type": "array"
+          "id": {
+            "description": "Repo ULID.",
+            "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "name": {
+            "description": "Repo name.",
             "type": "string"
           }
         },
         "required": [
-          "events"
+          "id",
+          "name"
         ],
         "type": "object"
       },
-      "ListAvailableMirrorsOutputBody": {
+      "ErrorDetail": {
+        "additionalProperties": true,
+        "properties": {
+          "location": {
+            "description": "Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'",
+            "type": "string"
+          },
+          "message": {
+            "description": "Error message text",
+            "type": "string"
+          },
+          "value": {
+            "description": "The value at the given location"
+          }
+        },
+        "type": "object"
+      },
+      "ErrorModel": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListAvailableMirrorsOutputBody.json"
+              "/api/v1/schemas/ErrorModel.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "available": {
+          "detail": {
+            "description": "A human-readable explanation specific to this occurrence of the problem.",
+            "examples": [
+              "Property foo is required but is missing."
+            ],
+            "type": "string"
+          },
+          "errors": {
+            "description": "Optional list of individual error details",
             "items": {
-              "$ref": "#/components/schemas/AvailableMirror"
+              "$ref": "#/components/schemas/ErrorDetail"
             },
             "type": "array"
+          },
+          "instance": {
+            "description": "A URI reference that identifies the specific occurrence of the problem.",
+            "examples": [
+              "https://example.com/error-log/abc123"
+            ],
+            "format": "uri",
+            "type": "string"
+          },
+          "status": {
+            "description": "HTTP status code",
+            "examples": [
+              400
+            ],
+            "format": "int64",
+            "type": "integer"
+          },
+          "title": {
+            "description": "A short, human-readable summary of the problem type. This value should not change between occurrences of the error.",
+            "examples": [
+              "Bad Request"
+            ],
+            "type": "string"
+          },
+          "type": {
+            "default": "about:blank",
+            "description": "A URI reference to human-readable documentation for the error.",
+            "examples": [
+              "https://example.com/errors/example"
+            ],
+            "format": "uri",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "ForgeRepoIdentity": {
+        "additionalProperties": true,
+        "properties": {
+          "forge": {
+            "type": "string"
+          },
+          "repo_id": {
+            "type": "string"
           }
         },
         "required": [
-          "available"
+          "forge",
+          "repo_id"
         ],
         "type": "object"
       },
-      "ListBindingsOutputBody": {
+      "GetDeletionPreviewOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListBindingsOutputBody.json"
+              "/api/v1/schemas/GetDeletionPreviewOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "bindings": {
+          "blocked": {
+            "description": "True when Blockers is non-empty: DELETE /me will be refused with 409.",
+            "type": "boolean"
+          },
+          "blockers": {
+            "description": "Resources that must be resolved before deletion (owned orgs).",
             "items": {
-              "$ref": "#/components/schemas/Binding"
+              "$ref": "#/components/schemas/DeletionBlocker"
             },
             "type": "array"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
+          "willDelete": {
+            "$ref": "#/components/schemas/WillDeleteStruct"
+          },
+          "willUnlink": {
+            "$ref": "#/components/schemas/WillUnlinkStruct"
           }
         },
         "required": [
-          "bindings"
+          "blocked",
+          "blockers",
+          "willDelete",
+          "willUnlink"
         ],
         "type": "object"
       },
-      "ListClustersOutputBody": {
+      "GetMeOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListClustersOutputBody.json"
+              "/api/v1/schemas/GetMeOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "clusters": {
-            "items": {
-              "$ref": "#/components/schemas/Cluster"
-            },
-            "type": "array"
+          "auth": {
+            "$ref": "#/components/schemas/MeAuth"
+          },
+          "deletion": {
+            "$ref": "#/components/schemas/MeDeletion",
+            "description": "Present only when a deletion is pending; carries the cooldown window."
+          },
+          "global": {
+            "$ref": "#/components/schemas/MeGlobal"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mode": {
+            "enum": [
+              "global",
+              "regional"
+            ],
+            "type": "string"
+          },
+          "regional": {
+            "$ref": "#/components/schemas/MeRegional"
+          },
+          "regionalUnavailable": {
+            "$ref": "#/components/schemas/MeRegionalUnavailable"
           }
         },
         "required": [
-          "clusters"
+          "global",
+          "auth"
         ],
         "type": "object"
       },
-      "ListMirrorCollaboratorsOutputBody": {
+      "GetOnboardingStatusOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListMirrorCollaboratorsOutputBody.json"
+              "/api/v1/schemas/GetOnboardingStatusOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "collaborators": {
-            "items": {
-              "$ref": "#/components/schemas/MirrorCollaborator"
-            },
-            "type": "array"
+          "cliLoggedIn": {
+            "description": "True once the account has completed a CLI login (either grant type).",
+            "type": "boolean"
+          },
+          "needsOnboarding": {
+            "description": "True until the account completes web onboarding at least once.",
+            "type": "boolean"
           }
         },
         "required": [
-          "collaborators"
+          "needsOnboarding",
+          "cliLoggedIn"
         ],
         "type": "object"
       },
-      "ListMirrorsOutputBody": {
+      "GetPermissionsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListMirrorsOutputBody.json"
+              "/api/v1/schemas/GetPermissionsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "mirrors": {
+          "explain": {
+            "additionalProperties": {},
+            "type": "object"
+          },
+          "permissions": {
             "items": {
-              "$ref": "#/components/schemas/Mirror"
+              "enum": [
+                "manage",
+                "view",
+                "read",
+                "write",
+                "push",
+                "pull",
+                "create_repo",
+                "admin",
+                "admin_read"
+              ],
+              "type": "string"
             },
             "type": "array"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "resourceId": {
+            "type": "string"
+          },
+          "resourceType": {
             "type": "string"
           }
         },
         "required": [
-          "mirrors"
+          "resourceType",
+          "resourceId"
         ],
         "type": "object"
       },
-      "ListOIDCProvidersOutputBody": {
+      "GetRepoVisibilityOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOIDCProvidersOutputBody.json"
+              "/api/v1/schemas/GetRepoVisibilityOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
             "type": "string"
-          },
-          "providers": {
-            "items": {
-              "$ref": "#/components/schemas/OIDCProvider"
-            },
-            "type": "array"
           }
         },
         "required": [
-          "providers"
+          "visibility"
         ],
         "type": "object"
       },
-      "ListOrgMembersOutputBody": {
+      "GetTopologyOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOrgMembersOutputBody.json"
+              "/api/v1/schemas/GetTopologyOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "members": {
+          "jurisdictions": {
             "items": {
-              "$ref": "#/components/schemas/Membership"
+              "$ref": "#/components/schemas/TopologyJurisdiction"
             },
             "type": "array"
-          },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
           }
         },
         "required": [
-          "members"
+          "jurisdictions"
         ],
         "type": "object"
       },
-      "ListOrgProjectsOutputBody": {
+      "GetVersionOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOrgProjectsOutputBody.json"
+              "/api/v1/schemas/GetVersionOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "mode": {
+            "description": "Server mode.",
+            "enum": [
+              "global",
+              "regional"
+            ],
             "type": "string"
           },
-          "project": {
-            "$ref": "#/components/schemas/Project"
-          },
-          "projects": {
-            "items": {
-              "$ref": "#/components/schemas/Project"
-            },
-            "type": "array"
+          "version": {
+            "description": "Git commit SHA of the running entire-core binary, or \"dev\" for an untagged local build.",
+            "type": "string"
           }
         },
+        "required": [
+          "version"
+        ],
         "type": "object"
       },
-      "ListOrgsOutputBody": {
+      "GrantProjectAccessInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOrgsOutputBody.json"
+              "/api/v1/schemas/GrantProjectAccessInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "granteeType": {
+            "default": "account",
+            "enum": [
+              "account"
+            ],
             "type": "string"
           },
-          "org": {
-            "$ref": "#/components/schemas/Org"
+          "provider": {
+            "minLength": 1,
+            "type": "string"
           },
-          "orgs": {
-            "items": {
-              "$ref": "#/components/schemas/Org"
-            },
-            "type": "array"
+          "providerUserId": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "role": {
+            "enum": [
+              "reader",
+              "writer",
+              "admin"
+            ],
+            "type": "string"
           }
         },
+        "required": [
+          "provider",
+          "providerUserId",
+          "role"
+        ],
         "type": "object"
       },
-      "ListProjectMembersOutputBody": {
+      "GrantProjectAccessOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListProjectMembersOutputBody.json"
+              "/api/v1/schemas/GrantProjectAccessOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "members": {
-            "items": {
-              "$ref": "#/components/schemas/ProjectGrant"
-            },
-            "type": "array"
-          },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "status": {
             "type": "string"
           }
         },
         "required": [
-          "members"
+          "status"
         ],
         "type": "object"
       },
-      "ListProjectReposOutputBody": {
+      "GrantRepoAccessInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListProjectReposOutputBody.json"
+              "/api/v1/schemas/GrantRepoAccessInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "granteeType": {
+            "default": "account",
+            "enum": [
+              "account"
+            ],
             "type": "string"
           },
-          "repo": {
-            "$ref": "#/components/schemas/Repo"
+          "provider": {
+            "minLength": 1,
+            "type": "string"
           },
-          "repos": {
-            "items": {
-              "$ref": "#/components/schemas/Repo"
-            },
-            "type": "array"
+          "providerUserId": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "role": {
+            "enum": [
+              "reader",
+              "writer",
+              "admin"
+            ],
+            "type": "string"
           }
         },
+        "required": [
+          "provider",
+          "providerUserId",
+          "role"
+        ],
         "type": "object"
       },
-      "ListProjectsOutputBody": {
+      "GrantRepoAccessOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListProjectsOutputBody.json"
+              "/api/v1/schemas/GrantRepoAccessOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "status": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "status"
+        ],
+        "type": "object"
+      },
+      "GrantServiceAccountAccessInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/GrantServiceAccountAccessInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "project": {
-            "$ref": "#/components/schemas/Project"
+          "resourceId": {
+            "minLength": 1,
+            "type": "string"
           },
-          "projects": {
-            "items": {
-              "$ref": "#/components/schemas/Project"
-            },
-            "type": "array"
+          "resourceType": {
+            "enum": [
+              "repo",
+              "project"
+            ],
+            "type": "string"
+          },
+          "role": {
+            "enum": [
+              "reader",
+              "writer",
+              "admin"
+            ],
+            "type": "string"
           }
         },
+        "required": [
+          "resourceType",
+          "resourceId",
+          "role"
+        ],
         "type": "object"
       },
-      "ListRepoCIWebhooksOutputBody": {
+      "GrantServiceAccountAccessOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListRepoCIWebhooksOutputBody.json"
+              "/api/v1/schemas/GrantServiceAccountAccessOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "subscriptions": {
-            "items": {
-              "$ref": "#/components/schemas/CIWebhookView"
-            },
-            "type": "array"
+          "status": {
+            "type": "string"
           }
         },
         "required": [
-          "subscriptions"
+          "status"
         ],
         "type": "object"
       },
-      "ListRepoGrantsOutputBody": {
+      "ListAuditEventsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListRepoGrantsOutputBody.json"
+              "/api/v1/schemas/ListAuditEventsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "grants": {
+          "events": {
             "items": {
-              "$ref": "#/components/schemas/RepoGrant"
+              "$ref": "#/components/schemas/AuditEvent"
             },
             "type": "array"
           },
@@ -1645,57 +1804,49 @@
           }
         },
         "required": [
-          "grants"
+          "events"
         ],
         "type": "object"
       },
-      "ListReposOutputBody": {
+      "ListAvailableMirrorsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListReposOutputBody.json"
+              "/api/v1/schemas/ListAvailableMirrorsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
-          },
-          "repos": {
+          "available": {
             "items": {
-              "$ref": "#/components/schemas/RepoIndexEntry"
+              "$ref": "#/components/schemas/AvailableMirror"
             },
             "type": "array"
-          },
-          "truncated": {
-            "type": "boolean"
           }
         },
         "required": [
-          "repos",
-          "truncated"
+          "available"
         ],
         "type": "object"
       },
-      "ListServiceAccountGrantsOutputBody": {
+      "ListBindingsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListServiceAccountGrantsOutputBody.json"
+              "/api/v1/schemas/ListBindingsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "grants": {
+          "bindings": {
             "items": {
-              "$ref": "#/components/schemas/ServiceAccountGrant"
+              "$ref": "#/components/schemas/Binding"
             },
             "type": "array"
           },
@@ -1705,136 +1856,117 @@
           }
         },
         "required": [
-          "grants"
+          "bindings"
         ],
         "type": "object"
       },
-      "ListServiceAccountsOutputBody": {
+      "ListClustersOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListServiceAccountsOutputBody.json"
+              "/api/v1/schemas/ListClustersOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
-          },
-          "serviceAccounts": {
+          "clusters": {
             "items": {
-              "$ref": "#/components/schemas/ServiceAccountWithGrants"
+              "$ref": "#/components/schemas/Cluster"
             },
             "type": "array"
           }
         },
         "required": [
-          "serviceAccounts"
+          "clusters"
         ],
         "type": "object"
       },
-      "LookupBySlugOutputBody": {
+      "ListMirrorCollaboratorsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/LookupBySlugOutputBody.json"
+              "/api/v1/schemas/ListMirrorCollaboratorsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "cell": {
-            "type": "string"
-          },
-          "jurisdiction": {
-            "type": "string"
-          },
-          "owner": {
-            "type": "string"
-          },
-          "repo": {
-            "type": "string"
-          },
-          "repoId": {
-            "type": "string"
+          "collaborators": {
+            "items": {
+              "$ref": "#/components/schemas/MirrorCollaborator"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "repoId",
-          "cell",
-          "jurisdiction",
-          "owner",
-          "repo"
+          "collaborators"
         ],
         "type": "object"
       },
-      "LookupRef": {
+      "ListMirrorsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "id": {
-            "minLength": 1,
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListMirrorsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "type": {
-            "description": "Resource type slug; \"org\", \"project\", \"repo\" are enriched, unknown types pass through.",
-            "minLength": 1,
+          "mirrors": {
+            "items": {
+              "$ref": "#/components/schemas/Mirror"
+            },
+            "type": "array"
+          },
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "type",
-          "id"
+          "mirrors"
         ],
         "type": "object"
       },
-      "LookupRefResult": {
+      "ListNativeMirrorsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "id": {
-            "type": "string"
-          },
-          "name": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListNativeMirrorsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "ownerId": {
-            "type": "string"
-          },
-          "ownerType": {
-            "enum": [
-              "org",
-              "account"
-            ],
-            "type": "string"
-          },
-          "projectId": {
-            "type": "string"
-          },
-          "type": {
-            "type": "string"
-          },
-          "url": {
-            "type": "string"
+          "nativeMirrors": {
+            "items": {
+              "$ref": "#/components/schemas/NativeMirrorPlacement"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "type",
-          "id"
+          "nativeMirrors"
         ],
         "type": "object"
       },
-      "LookupResourcesOutputBody": {
+      "ListOIDCProvidersOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/LookupResourcesOutputBody.json"
+              "/api/v1/schemas/ListOIDCProvidersOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
@@ -1844,747 +1976,790 @@
             "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "permission": {
-            "type": "string"
-          },
-          "resourceIds": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "resourceType": {
-            "type": "string"
-          },
-          "resources": {
+          "providers": {
             "items": {
-              "$ref": "#/components/schemas/ResourceAccess"
+              "$ref": "#/components/schemas/OIDCProvider"
             },
             "type": "array"
           }
         },
         "required": [
-          "resourceType"
+          "providers"
         ],
         "type": "object"
       },
-      "MeAuth": {
+      "ListOrgCIBuildkiteClustersOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "provider": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgCIBuildkiteClustersOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "providerUserId": {
-            "type": "string"
+          "clusters": {
+            "items": {
+              "$ref": "#/components/schemas/OrgCIBuildkiteClusterView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "provider",
-          "providerUserId"
+          "clusters"
         ],
         "type": "object"
       },
-      "MeDeletion": {
+      "ListOrgCIBuildkiteCredentialsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "cooldownEndsAt": {
-            "description": "When the cooldown elapses and the account becomes eligible for irreversible hard-deletion.",
-            "format": "date-time",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgCIBuildkiteCredentialsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "requestedAt": {
-            "description": "When deletion was requested (deletion_requested_at).",
-            "format": "date-time",
-            "type": "string"
+          "credentials": {
+            "items": {
+              "$ref": "#/components/schemas/OrgCIBuildkiteCredentialView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "requestedAt",
-          "cooldownEndsAt"
+          "credentials"
         ],
         "type": "object"
       },
-      "MeGlobal": {
+      "ListOrgMembersOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "accountId": {
-            "type": "string"
-          },
-          "avatarUrl": {
-            "type": "string"
-          },
-          "createdAt": {
-            "description": "When the account was created (accounts.created_at).",
-            "format": "date-time",
-            "type": "string"
-          },
-          "handle": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgMembersOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "handles": {
+          "members": {
             "items": {
-              "$ref": "#/components/schemas/MeIdentityHandle"
+              "$ref": "#/components/schemas/Membership"
             },
             "type": "array"
           },
-          "homeJurisdiction": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "accountId",
-          "createdAt",
-          "handles"
+          "members"
         ],
         "type": "object"
       },
-      "MeIdentityHandle": {
+      "ListOrgProjectsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "email": {
-            "description": "The provider's publicly-visible profile email (from the provider at login; may be empty). NOT the account's contact email.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgProjectsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "handle": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "provider": {
-            "type": "string"
+          "project": {
+            "$ref": "#/components/schemas/Project"
           },
-          "providerUserId": {
-            "type": "string"
+          "projects": {
+            "items": {
+              "$ref": "#/components/schemas/Project"
+            },
+            "type": "array"
           }
         },
-        "required": [
-          "provider",
-          "handle",
-          "providerUserId"
-        ],
         "type": "object"
       },
-      "MeRegional": {
+      "ListOrgsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "bio": {
-            "type": "string"
-          },
-          "company": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "displayName": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "email": {
-            "type": "string"
+          "org": {
+            "$ref": "#/components/schemas/Org"
           },
-          "location": {
-            "type": "string"
+          "orgs": {
+            "items": {
+              "$ref": "#/components/schemas/Org"
+            },
+            "type": "array"
           }
         },
         "type": "object"
       },
-      "MeRegionalUnavailable": {
+      "ListProjectMembersOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "error": {
-            "description": "Always 'foreign_jurisdiction'. Discriminator for client-side state machines.",
-            "enum": [
-              "foreign_jurisdiction"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListProjectMembersOutputBody.json"
             ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "homeCoreUrl": {
-            "description": "Deep link into the home console for this account.",
-            "type": "string"
-          },
-          "jurisdiction": {
-            "description": "The account's home jurisdiction (e.g. 'us', 'eu').",
-            "type": "string"
+          "members": {
+            "items": {
+              "$ref": "#/components/schemas/ProjectGrant"
+            },
+            "type": "array"
           },
-          "message": {
-            "description": "Human-readable copy ready to surface in a UI.",
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "error",
-          "jurisdiction",
-          "homeCoreUrl",
-          "message"
+          "members"
         ],
         "type": "object"
       },
-      "Membership": {
+      "ListProjectReposOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Membership.json"
+              "/api/v1/schemas/ListProjectReposOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "accountId": {
-            "type": "string"
-          },
-          "createdAt": {
-            "format": "date-time",
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "id": {
-            "type": "string"
+          "repo": {
+            "$ref": "#/components/schemas/Repo"
           },
-          "orgId": {
+          "repos": {
+            "items": {
+              "$ref": "#/components/schemas/Repo"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "ListProjectsOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListProjectsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "role": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "status": {
-            "type": "string"
+          "project": {
+            "$ref": "#/components/schemas/Project"
           },
-          "workosOrgMembershipId": {
-            "type": "string"
+          "projects": {
+            "items": {
+              "$ref": "#/components/schemas/Project"
+            },
+            "type": "array"
           }
         },
-        "required": [
-          "id",
-          "accountId",
-          "orgId",
-          "role",
-          "status",
-          "createdAt"
-        ],
         "type": "object"
       },
-      "Mirror": {
+      "ListRepoCIBuildsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Mirror.json"
+              "/api/v1/schemas/ListRepoCIBuildsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "cell": {
-            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
-            "type": "string"
-          },
-          "clusterHost": {
-            "description": "Public host of the cluster serving this mirror.",
-            "type": "string"
-          },
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "installationId": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "isArchived": {
-            "type": "boolean"
-          },
-          "isPrivate": {
-            "type": "boolean"
-          },
-          "jurisdiction": {
-            "type": "string"
-          },
-          "mirrorId": {
-            "type": "string"
-          },
-          "owner": {
-            "type": "string"
-          },
-          "provider": {
-            "type": "string"
-          },
-          "repo": {
-            "type": "string"
-          },
-          "status": {
-            "description": "Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or suspended.",
-            "enum": [
-              "processing",
-              "ready",
-              "failed",
-              "suspended"
-            ],
-            "type": "string"
-          },
-          "suspendedAt": {
-            "format": "date-time",
-            "type": "string"
+          "builds": {
+            "items": {
+              "$ref": "#/components/schemas/CIBuildView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "mirrorId",
-          "provider",
-          "owner",
-          "repo",
-          "clusterHost",
-          "createdAt"
+          "builds"
         ],
         "type": "object"
       },
-      "MirrorCollaborator": {
+      "ListRepoCIProvidersOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "accountId": {
-            "type": "string"
-          },
-          "handle": {
-            "description": "Primary handle (provider:label), empty if none resolves.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoCIProvidersOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "role": {
-            "description": "reader (pull) or writer (pull+push).",
-            "type": "string"
+          "providers": {
+            "items": {
+              "$ref": "#/components/schemas/CIProviderDescriptor"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "accountId",
-          "role"
+          "providers"
         ],
         "type": "object"
       },
-      "MirrorRequest": {
+      "ListRepoCIWebhookAuditOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/MirrorRequest.json"
+              "/api/v1/schemas/ListRepoCIWebhookAuditOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "failure": {
-            "$ref": "#/components/schemas/MirrorRequestFailure"
-          },
-          "requestId": {
-            "format": "uuid",
-            "type": "string"
-          },
-          "result": {
-            "$ref": "#/components/schemas/MirrorRequestResult"
-          },
-          "status": {
-            "enum": [
-              "pending",
-              "processing",
-              "succeeded",
-              "failed"
-            ],
-            "type": "string"
+          "events": {
+            "items": {
+              "$ref": "#/components/schemas/CIWebhookAuditEventView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "requestId",
-          "status"
+          "events"
         ],
         "type": "object"
       },
-      "MirrorRequestFailure": {
+      "ListRepoCIWebhooksOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "code": {
-            "description": "Stable machine-readable failure code.",
-            "type": "string"
-          },
-          "message": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoCIWebhooksOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "retryable": {
-            "description": "Whether submitting a new request may succeed without changing its inputs.",
-            "type": "boolean"
+          "subscriptions": {
+            "items": {
+              "$ref": "#/components/schemas/CIWebhookView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "code",
-          "message",
-          "retryable"
+          "subscriptions"
         ],
         "type": "object"
       },
-      "MirrorRequestResult": {
+      "ListRepoCollaboratorsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "mirrorId": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoCollaboratorsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "mirrorUrl": {
-            "type": "string"
+          "collaborators": {
+            "items": {
+              "$ref": "#/components/schemas/RepoCollaborator"
+            },
+            "type": "array"
           },
-          "publicUrl": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "mirrorId",
-          "mirrorUrl",
-          "publicUrl"
+          "collaborators"
         ],
         "type": "object"
       },
-      "OIDCProvider": {
+      "ListRepoGrantsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "description": {
-            "type": "string"
-          },
-          "displayName": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoGrantsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "id": {
-            "type": "string"
+          "grants": {
+            "items": {
+              "$ref": "#/components/schemas/RepoGrant"
+            },
+            "type": "array"
           },
-          "issuer": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "issuer"
+          "grants"
         ],
         "type": "object"
       },
-      "Org": {
+      "ListReposOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Org.json"
+              "/api/v1/schemas/ListReposOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
+          "candidatesIncomplete": {
+            "type": "boolean"
           },
-          "id": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "name": {
-            "type": "string"
+          "repos": {
+            "items": {
+              "$ref": "#/components/schemas/RepoIndexEntry"
+            },
+            "type": "array"
           },
-          "region": {
+          "truncated": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "repos",
+          "truncated",
+          "candidatesIncomplete"
+        ],
+        "type": "object"
+      },
+      "ListServiceAccountGrantsOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListServiceAccountGrantsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "workosOrganizationId": {
+          "grants": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceAccountGrant"
+            },
+            "type": "array"
+          },
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "name",
-          "region",
-          "createdAt"
+          "grants"
         ],
         "type": "object"
       },
-      "PatchRepoCIWebhookInputBody": {
+      "ListServiceAccountsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/PatchRepoCIWebhookInputBody.json"
+              "/api/v1/schemas/ListServiceAccountsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "display_name": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "enabled": {
-            "type": "boolean"
-          },
-          "events": {
+          "serviceAccounts": {
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/ServiceAccountWithGrants"
             },
             "type": "array"
-          },
-          "ref_filter": {
-            "type": "string"
           }
         },
+        "required": [
+          "serviceAccounts"
+        ],
         "type": "object"
       },
-      "Project": {
+      "LookupBySlugOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Project.json"
+              "/api/v1/schemas/LookupBySlugOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "createdAt": {
-            "format": "date-time",
+          "cell": {
             "type": "string"
           },
-          "id": {
-            "type": "string"
-          },
-          "name": {
+          "jurisdiction": {
             "type": "string"
           },
-          "ownerId": {
+          "owner": {
             "type": "string"
           },
-          "ownerType": {
-            "enum": [
-              "org",
-              "account"
-            ],
+          "repo": {
             "type": "string"
           },
-          "region": {
+          "repoId": {
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "name",
-          "ownerType",
-          "ownerId",
-          "region",
-          "createdAt"
+          "repoId",
+          "cell",
+          "jurisdiction",
+          "owner",
+          "repo"
         ],
         "type": "object"
       },
-      "ProjectGrant": {
+      "MeAuth": {
         "additionalProperties": true,
         "properties": {
-          "granteeId": {
-            "type": "string"
-          },
-          "granteeName": {
-            "type": "string"
-          },
-          "granteeType": {
-            "type": "string"
-          },
-          "role": {
+          "provider": {
             "type": "string"
           },
-          "source": {
+          "providerUserId": {
             "type": "string"
           }
         },
         "required": [
-          "granteeType",
-          "granteeId",
-          "role",
-          "source"
+          "provider",
+          "providerUserId"
         ],
         "type": "object"
       },
-      "Repo": {
+      "MeDeletion": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/Repo.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
-          },
-          "clusterHost": {
+          "cooldownEndsAt": {
+            "description": "When the cooldown elapses and the account becomes eligible for irreversible hard-deletion.",
+            "format": "date-time",
             "type": "string"
           },
-          "foreign": {
-            "type": "boolean"
-          },
-          "fullName": {
+          "requestedAt": {
+            "description": "When deletion was requested (deletion_requested_at).",
+            "format": "date-time",
             "type": "string"
-          },
-          "id": {
+          }
+        },
+        "required": [
+          "requestedAt",
+          "cooldownEndsAt"
+        ],
+        "type": "object"
+      },
+      "MeGlobal": {
+        "additionalProperties": true,
+        "properties": {
+          "accountId": {
             "type": "string"
           },
-          "mirrorSuspended": {
-            "type": "boolean"
-          },
-          "mirrorSuspendedAt": {
+          "avatarUrl": {
             "type": "string"
           },
-          "name": {
+          "createdAt": {
+            "description": "When the account was created (accounts.created_at).",
+            "format": "date-time",
             "type": "string"
           },
-          "objectFormat": {
+          "handle": {
             "type": "string"
           },
-          "owningProjectId": {
-            "type": "string"
+          "handles": {
+            "items": {
+              "$ref": "#/components/schemas/MeIdentityHandle"
+            },
+            "type": "array"
           },
-          "path": {
+          "homeJurisdiction": {
             "type": "string"
-          },
-          "provisionAttempts": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "provisionReason": {
+          }
+        },
+        "required": [
+          "accountId",
+          "createdAt",
+          "handles"
+        ],
+        "type": "object"
+      },
+      "MeIdentityHandle": {
+        "additionalProperties": true,
+        "properties": {
+          "email": {
+            "description": "The provider's publicly-visible profile email (from the provider at login; may be empty). NOT the account's contact email.",
             "type": "string"
           },
-          "repoGroupId": {
+          "handle": {
             "type": "string"
           },
-          "state": {
+          "provider": {
             "type": "string"
           },
-          "visibility": {
+          "providerUserId": {
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "owningProjectId",
-          "name"
+          "provider",
+          "handle",
+          "providerUserId"
         ],
         "type": "object"
       },
-      "RepoCandidate": {
+      "MeRegional": {
         "additionalProperties": true,
         "properties": {
-          "access": {
-            "enum": [
-              "read",
-              "write",
-              "admin"
-            ],
+          "bio": {
             "type": "string"
           },
-          "onboardable": {
-            "type": "boolean"
+          "company": {
+            "type": "string"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "email": {
+            "type": "string"
+          },
+          "location": {
+            "type": "string"
           }
         },
-        "required": [
-          "access",
-          "onboardable"
-        ],
         "type": "object"
       },
-      "RepoGrant": {
+      "MeRegionalUnavailable": {
         "additionalProperties": true,
         "properties": {
-          "granteeId": {
-            "type": "string"
-          },
-          "granteeName": {
+          "error": {
+            "description": "Always 'foreign_jurisdiction'. Discriminator for client-side state machines.",
+            "enum": [
+              "foreign_jurisdiction"
+            ],
             "type": "string"
           },
-          "granteeType": {
+          "homeCoreUrl": {
+            "description": "Origin of the account's home core — its OIDC issuer, e.g. 'https://us.auth.entire.io'. Not a browser link and not the console.",
             "type": "string"
           },
-          "role": {
+          "jurisdiction": {
+            "description": "The account's home jurisdiction (e.g. 'us', 'eu').",
             "type": "string"
           },
-          "source": {
+          "message": {
+            "description": "Human-readable copy ready to surface in a UI.",
             "type": "string"
           }
         },
         "required": [
-          "granteeType",
-          "granteeId",
-          "role",
-          "source"
+          "error",
+          "jurisdiction",
+          "homeCoreUrl",
+          "message"
         ],
         "type": "object"
       },
-      "RepoIndexEntry": {
+      "Membership": {
         "additionalProperties": true,
         "properties": {
-          "candidate": {
-            "$ref": "#/components/schemas/RepoCandidate"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Membership.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
           },
-          "cell": {
-            "deprecated": true,
+          "accountId": {
             "type": "string"
           },
-          "clusterSlug": {
-            "deprecated": true,
+          "createdAt": {
+            "format": "date-time",
             "type": "string"
           },
-          "full_name": {
+          "handle": {
             "type": "string"
           },
           "id": {
             "type": "string"
           },
-          "jurisdiction": {
-            "deprecated": true,
+          "orgId": {
             "type": "string"
           },
-          "name": {
+          "provider": {
             "type": "string"
           },
-          "placements": {
-            "items": {
-              "$ref": "#/components/schemas/RepoPlacement"
-            },
-            "type": "array"
-          },
-          "primaries": {
-            "$ref": "#/components/schemas/RepoPrimaries"
+          "role": {
+            "type": "string"
           },
-          "stars": {
-            "format": "int64",
-            "type": "integer"
+          "status": {
+            "type": "string"
           },
-          "visibility": {
+          "workosOrgMembershipId": {
             "type": "string"
           }
         },
         "required": [
           "id",
-          "jurisdiction",
-          "cell",
-          "clusterSlug",
-          "name",
-          "full_name",
-          "visibility",
-          "placements"
+          "accountId",
+          "orgId",
+          "role",
+          "status",
+          "createdAt"
         ],
         "type": "object"
       },
-      "RepoPlacement": {
+      "MintOrgCIGitHubActionsCredentialInputBody": {
         "additionalProperties": true,
         "properties": {
-          "cell": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/MintOrgCIGitHubActionsCredentialInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "clusterSlug": {
+          "account": {
+            "description": "GitHub login (user or organization) whose webhooks this credential verifies",
+            "minLength": 1,
             "type": "string"
           },
-          "id": {
+          "api_token": {
+            "description": "GitHub API token for outbound workflow dispatch. Optional: omit for an inbound-only credential. On an existing github-actions row this stores/rotates the token instead of conflicting.",
             "type": "string"
-          },
-          "jurisdiction": {
+          }
+        },
+        "required": [
+          "account"
+        ],
+        "type": "object"
+      },
+      "Mirror": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Mirror.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "mirror": {
+          "cell": {
+            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
+            "type": "string"
+          },
+          "clusterHost": {
+            "description": "Public host of the cluster serving this mirror.",
+            "type": "string"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "installationId": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "isArchived": {
+            "type": "boolean"
+          },
+          "isPrivate": {
             "type": "boolean"
           },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirrorId": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "repo": {
+            "type": "string"
+          },
           "status": {
+            "description": "Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or suspended.",
             "enum": [
               "processing",
               "ready",
@@ -2592,480 +2767,2446 @@
               "suspended"
             ],
             "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "jurisdiction",
-          "cell",
-          "clusterSlug",
-          "mirror",
-          "status"
-        ],
-        "type": "object"
-      },
-      "RepoPrimaries": {
-        "additionalProperties": true,
-        "properties": {
-          "git_data": {
-            "type": "string"
           },
-          "processing": {
+          "suspendedAt": {
+            "format": "date-time",
             "type": "string"
           }
         },
         "required": [
-          "git_data",
-          "processing"
+          "mirrorId",
+          "provider",
+          "owner",
+          "repo",
+          "clusterHost",
+          "createdAt"
         ],
         "type": "object"
       },
-      "ResolvePlacementsOutputBody": {
+      "MirrorCollaborator": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/ResolvePlacementsOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "accountId": {
             "type": "string"
           },
-          "placements": {
-            "items": {
-              "$ref": "#/components/schemas/ResolvedPlacement"
-            },
-            "type": "array"
+          "handle": {
+            "description": "Primary handle (provider:label), empty if none resolves.",
+            "type": "string"
+          },
+          "role": {
+            "description": "reader (pull) or writer (pull+push).",
+            "type": "string"
           }
         },
         "required": [
-          "placements"
+          "accountId",
+          "role"
         ],
         "type": "object"
       },
-      "ResolvedIdentity": {
+      "MirrorRequest": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ResolvedIdentity.json"
+              "/api/v1/schemas/MirrorRequest.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "accountId": {
-            "type": "string"
+          "failure": {
+            "$ref": "#/components/schemas/MirrorRequestFailure"
           },
-          "handle": {
+          "requestId": {
+            "format": "uuid",
             "type": "string"
           },
-          "provider": {
-            "type": "string"
+          "result": {
+            "$ref": "#/components/schemas/MirrorRequestResult"
           },
-          "providerUserId": {
+          "status": {
+            "enum": [
+              "pending",
+              "processing",
+              "succeeded",
+              "failed"
+            ],
             "type": "string"
           }
         },
         "required": [
-          "accountId",
-          "provider",
-          "handle",
-          "providerUserId"
+          "requestId",
+          "status"
         ],
         "type": "object"
       },
-      "ResolvedPlacement": {
+      "MirrorRequestFailure": {
         "additionalProperties": true,
         "properties": {
-          "cell": {
-            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
-            "type": "string"
-          },
-          "clusterHost": {
-            "description": "Public host of the cluster serving this mirror.",
+          "code": {
+            "description": "Stable machine-readable failure code.",
             "type": "string"
           },
-          "jurisdiction": {
+          "message": {
             "type": "string"
           },
-          "mirrorId": {
-            "type": "string"
+          "retryable": {
+            "description": "Whether submitting a new request may succeed without changing its inputs.",
+            "type": "boolean"
           }
         },
         "required": [
-          "mirrorId",
-          "clusterHost"
+          "code",
+          "message",
+          "retryable"
         ],
         "type": "object"
       },
-      "ResourceAccess": {
+      "MirrorRequestResult": {
         "additionalProperties": true,
         "properties": {
-          "permissions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
+          "mirrorId": {
+            "type": "string"
           },
-          "resourceId": {
+          "mirrorUrl": {
+            "type": "string"
+          },
+          "publicUrl": {
             "type": "string"
           }
         },
         "required": [
-          "resourceId",
-          "permissions"
+          "mirrorId",
+          "mirrorUrl",
+          "publicUrl"
         ],
         "type": "object"
       },
-      "ServiceAccount": {
+      "NativeMirrorPlacement": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ServiceAccount.json"
+              "/api/v1/schemas/NativeMirrorPlacement.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "accountId": {
+          "attempts": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "clusterSlug": {
             "type": "string"
           },
           "createdAt": {
             "format": "date-time",
             "type": "string"
           },
-          "name": {
+          "creationFailedAt": {
+            "format": "date-time",
             "type": "string"
           },
-          "orgId": {
+          "desiredState": {
+            "enum": [
+              "active",
+              "deleted"
+            ],
             "type": "string"
           },
-          "status": {
+          "lastError": {
             "type": "string"
           },
-          "systemManaged": {
-            "type": "boolean"
+          "nextRetryAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "placementId": {
+            "type": "string"
+          },
+          "stage": {
+            "enum": [
+              "pending",
+              "provisioned",
+              "registered",
+              "seeded",
+              "announced"
+            ],
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "processing",
+              "ready",
+              "failed",
+              "suspended"
+            ],
+            "type": "string"
           }
         },
         "required": [
-          "accountId",
-          "name",
-          "orgId",
+          "placementId",
+          "clusterSlug",
+          "stage",
           "status",
-          "systemManaged",
+          "desiredState",
+          "attempts",
           "createdAt"
         ],
         "type": "object"
       },
-      "ServiceAccountGrant": {
+      "OIDCProvider": {
         "additionalProperties": true,
         "properties": {
-          "resourceId": {
+          "description": {
             "type": "string"
           },
-          "resourceName": {
+          "displayName": {
             "type": "string"
           },
-          "resourceType": {
+          "id": {
             "type": "string"
           },
-          "role": {
+          "issuer": {
             "type": "string"
           }
         },
         "required": [
-          "resourceType",
-          "resourceId",
-          "role"
+          "id",
+          "issuer"
         ],
         "type": "object"
       },
-      "ServiceAccountWithGrants": {
+      "Org": {
         "additionalProperties": true,
         "properties": {
-          "accountId": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Org.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
+          "capabilities": {
+            "$ref": "#/components/schemas/OrgCapabilities"
+          },
           "createdAt": {
             "format": "date-time",
             "type": "string"
           },
-          "grants": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
+          "id": {
+            "type": "string"
           },
           "name": {
             "type": "string"
           },
-          "orgId": {
+          "region": {
             "type": "string"
           },
-          "status": {
+          "workosOrganizationId": {
             "type": "string"
-          },
-          "systemManaged": {
-            "type": "boolean"
           }
         },
         "required": [
-          "grants",
-          "accountId",
+          "id",
           "name",
-          "orgId",
-          "status",
-          "systemManaged",
-          "createdAt"
+          "region",
+          "createdAt",
+          "capabilities"
         ],
         "type": "object"
       },
-      "SetRepoVisibilityInputBody": {
+      "OrgCIBuildkiteClusterView": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/SetRepoVisibilityInputBody.json"
+              "/api/v1/schemas/OrgCIBuildkiteClusterView.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "visibility": {
-            "enum": [
-              "public",
-              "private"
-            ],
+          "auth_plugin_ref": {
+            "type": "string"
+          },
+          "bk_cluster_id": {
+            "type": "string"
+          },
+          "bk_organization": {
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "updated_at": {
+            "format": "date-time",
             "type": "string"
           }
         },
         "required": [
-          "visibility"
+          "bk_organization",
+          "owner",
+          "bk_cluster_id",
+          "label",
+          "auth_plugin_ref",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "SetRepoVisibilityOutputBody": {
+      "OrgCIBuildkiteCredentialView": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/SetRepoVisibilityOutputBody.json"
+              "/api/v1/schemas/OrgCIBuildkiteCredentialView.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "visibility": {
-            "enum": [
-              "public",
-              "private"
-            ],
+          "bk_organization": {
+            "type": "string"
+          },
+          "cipher_version": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "inbound_endpoint_id": {
+            "type": "string"
+          },
+          "inbound_endpoint_path": {
+            "type": "string"
+          },
+          "inbound_endpoint_url": {
+            "type": "string"
+          },
+          "inbound_secret": {
+            "type": "string"
+          },
+          "inbound_secret_issued_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "inbound_secret_set": {
+            "type": "boolean"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "token_len": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "updated_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "verified_at": {
+            "format": "date-time",
             "type": "string"
           }
         },
         "required": [
-          "visibility"
+          "bk_organization",
+          "owner",
+          "cipher_version",
+          "token_len",
+          "inbound_secret_set",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "TopologyCluster": {
+      "OrgCIGitHubActionsCredentialView": {
         "additionalProperties": true,
         "properties": {
-          "host": {
-            "description": "DNS host of this cluster; pass verbatim as clusterHost to POST /api/v1/mirrors.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/OrgCIGitHubActionsCredentialView.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "isDefault": {
+          "account": {
+            "type": "string"
+          },
+          "has_api_token": {
             "type": "boolean"
           },
-          "label": {
-            "description": "Human cluster label (the cluster's display name).",
+          "inbound_endpoint_id": {
             "type": "string"
           },
-          "publicUrl": {
+          "inbound_endpoint_path": {
             "type": "string"
           },
-          "slug": {
+          "inbound_endpoint_url": {
+            "type": "string"
+          },
+          "inbound_secret": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "provider": {
             "type": "string"
           }
         },
         "required": [
-          "slug",
-          "label",
-          "host",
-          "publicUrl",
-          "isDefault"
+          "provider",
+          "account",
+          "owner"
         ],
         "type": "object"
       },
-      "TopologyJurisdiction": {
+      "OrgCapabilities": {
         "additionalProperties": true,
         "properties": {
-          "id": {
-            "description": "Jurisdiction id from the cluster registry (e.g. \"us\").",
-            "type": "string"
+          "canCreateProject": {
+            "type": "boolean"
           },
-          "label": {
-            "type": "string"
+          "canDelete": {
+            "type": "boolean"
           },
-          "regions": {
-            "items": {
-              "$ref": "#/components/schemas/TopologyRegion"
-            },
-            "type": "array"
+          "canManageMembers": {
+            "type": "boolean"
           }
         },
         "required": [
-          "id",
-          "label",
-          "regions"
+          "canCreateProject",
+          "canManageMembers",
+          "canDelete"
         ],
         "type": "object"
       },
-      "TopologyRegion": {
+      "PatchRepoCIWebhookInputBody": {
         "additionalProperties": true,
         "properties": {
-          "clusters": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/PatchRepoCIWebhookInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "display_name": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean"
+          },
+          "events": {
             "items": {
-              "$ref": "#/components/schemas/TopologyCluster"
+              "type": "string"
             },
             "type": "array"
           },
+          "publish_checks": {
+            "type": "boolean"
+          },
+          "ref_filter": {
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "Project": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Project.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "capabilities": {
+            "$ref": "#/components/schemas/ProjectCapabilities"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
           "id": {
-            "description": "Region id (the cell id from the cluster registry).",
             "type": "string"
           },
-          "label": {
+          "name": {
+            "type": "string"
+          },
+          "ownerId": {
+            "type": "string"
+          },
+          "ownerName": {
+            "type": "string"
+          },
+          "ownerType": {
+            "enum": [
+              "org",
+              "account"
+            ],
+            "type": "string"
+          },
+          "region": {
             "type": "string"
           }
         },
         "required": [
           "id",
-          "label",
-          "clusters"
+          "name",
+          "ownerType",
+          "ownerId",
+          "region",
+          "createdAt",
+          "capabilities"
         ],
         "type": "object"
       },
-      "WillDeleteStruct": {
+      "ProjectCapabilities": {
         "additionalProperties": true,
         "properties": {
-          "profileDataNote": {
-            "description": "Blanket note: profile PII is erased across all regions the account has data in (per-region residency is not globally tracked).",
+          "canCreateRepository": {
+            "type": "boolean"
+          },
+          "canDelete": {
+            "type": "boolean"
+          },
+          "canManageAccess": {
+            "type": "boolean"
+          },
+          "canManageTrails": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "canDelete",
+          "canManageAccess",
+          "canCreateRepository",
+          "canManageTrails"
+        ],
+        "type": "object"
+      },
+      "ProjectGrant": {
+        "additionalProperties": true,
+        "properties": {
+          "granteeId": {
             "type": "string"
           },
-          "repos": {
-            "description": "Repos in the account's home region that will be permanently deleted (personal + mirror). Foreign-region repos are also erased by the fan-out but not enumerated here.",
-            "items": {
-              "$ref": "#/components/schemas/DeletionRepo"
-            },
-            "type": "array"
+          "granteeName": {
+            "type": "string"
+          },
+          "granteeType": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          },
+          "source": {
+            "type": "string"
           }
         },
         "required": [
-          "repos",
-          "profileDataNote"
+          "granteeType",
+          "granteeId",
+          "role",
+          "source"
         ],
         "type": "object"
       },
-      "WillUnlinkStruct": {
+      "RegisterOrgCIBuildkiteClusterInputBody": {
         "additionalProperties": true,
         "properties": {
-          "grants": {
-            "description": "Collaborator grants that will be unlinked.",
-            "items": {
-              "$ref": "#/components/schemas/DeletionGrant"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/RegisterOrgCIBuildkiteClusterInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "auth_plugin_ref": {
+            "type": "string"
+          },
+          "bk_cluster_id": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "bk_organization": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "bk_organization",
+          "bk_cluster_id"
+        ],
+        "type": "object"
+      },
+      "Repo": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Repo.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "capabilities": {
+            "$ref": "#/components/schemas/RepoCapabilities"
+          },
+          "clusterHost": {
+            "type": "string"
+          },
+          "clusterSlug": {
+            "type": "string"
+          },
+          "foreign": {
+            "type": "boolean"
+          },
+          "fullName": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirrorSuspended": {
+            "type": "boolean"
+          },
+          "mirrorSuspendedAt": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "objectFormat": {
+            "type": "string"
+          },
+          "owningProjectId": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "primaries": {
+            "$ref": "#/components/schemas/RepoPrimaries"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "provisionAttempts": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "provisionReason": {
+            "type": "string"
+          },
+          "repoGroupId": {
+            "type": "string"
+          },
+          "state": {
+            "type": "string"
+          },
+          "visibility": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "owningProjectId",
+          "name"
+        ],
+        "type": "object"
+      },
+      "RepoCandidate": {
+        "additionalProperties": true,
+        "properties": {
+          "access": {
+            "enum": [
+              "read",
+              "write",
+              "admin"
+            ],
+            "type": "string"
+          },
+          "onboardable": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "access",
+          "onboardable"
+        ],
+        "type": "object"
+      },
+      "RepoCapabilities": {
+        "additionalProperties": true,
+        "properties": {
+          "canManage": {
+            "type": "boolean"
+          },
+          "canPull": {
+            "type": "boolean"
+          },
+          "canPush": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "canManage",
+          "canPush",
+          "canPull"
+        ],
+        "type": "object"
+      },
+      "RepoCollaborator": {
+        "additionalProperties": true,
+        "properties": {
+          "accountId": {
+            "type": "string"
+          },
+          "handle": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "accountId",
+          "role"
+        ],
+        "type": "object"
+      },
+      "RepoFacetPage": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/RepoFacetPage.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "items": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "items"
+        ],
+        "type": "object"
+      },
+      "RepoGrant": {
+        "additionalProperties": true,
+        "properties": {
+          "granteeId": {
+            "type": "string"
+          },
+          "granteeName": {
+            "type": "string"
+          },
+          "granteeType": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          },
+          "source": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "granteeType",
+          "granteeId",
+          "role",
+          "source"
+        ],
+        "type": "object"
+      },
+      "RepoIDResolution": {
+        "additionalProperties": true,
+        "properties": {
+          "fullName": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "repoId": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "resolved",
+              "unavailable"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "repoId",
+          "status"
+        ],
+        "type": "object"
+      },
+      "RepoIndexEntry": {
+        "additionalProperties": true,
+        "properties": {
+          "activityHotness": {
+            "format": "double",
+            "type": "number"
+          },
+          "archived": {
+            "type": "boolean"
+          },
+          "candidate": {
+            "$ref": "#/components/schemas/RepoCandidate"
+          },
+          "cell": {
+            "deprecated": true,
+            "type": "string"
+          },
+          "checkpointCount": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "clusterSlug": {
+            "deprecated": true,
+            "type": "string"
+          },
+          "forks": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "full_name": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "jurisdiction": {
+            "deprecated": true,
+            "type": "string"
+          },
+          "language": {
+            "type": "string"
+          },
+          "lastActivityAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "lastPushedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "openPrCount": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "org": {
+            "type": "string"
+          },
+          "permission": {
+            "enum": [
+              "read",
+              "write",
+              "admin"
+            ],
+            "type": "string"
+          },
+          "placements": {
+            "items": {
+              "$ref": "#/components/schemas/RepoPlacement"
+            },
+            "type": "array"
+          },
+          "primaries": {
+            "$ref": "#/components/schemas/RepoPrimaries"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "pushedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "stars": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "visibility": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "jurisdiction",
+          "cell",
+          "clusterSlug",
+          "name",
+          "full_name",
+          "org",
+          "provider",
+          "visibility",
+          "placements"
+        ],
+        "type": "object"
+      },
+      "RepoPlacement": {
+        "additionalProperties": true,
+        "properties": {
+          "cell": {
+            "type": "string"
+          },
+          "clusterSlug": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirror": {
+            "type": "boolean"
+          },
+          "status": {
+            "enum": [
+              "processing",
+              "ready",
+              "failed",
+              "suspended"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "jurisdiction",
+          "cell",
+          "clusterSlug",
+          "mirror",
+          "status"
+        ],
+        "type": "object"
+      },
+      "RepoPrimaries": {
+        "additionalProperties": true,
+        "properties": {
+          "data_primary": {
+            "$ref": "#/components/schemas/ForgeRepoIdentity"
+          },
+          "git_data": {
+            "type": "string"
+          },
+          "processing": {
+            "type": "string"
+          },
+          "processing_primary": {
+            "$ref": "#/components/schemas/ForgeRepoIdentity"
+          }
+        },
+        "required": [
+          "git_data",
+          "processing",
+          "data_primary"
+        ],
+        "type": "object"
+      },
+      "RepoReference": {
+        "additionalProperties": true,
+        "properties": {
+          "fullName": {
+            "maxLength": 256,
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "provider",
+          "fullName"
+        ],
+        "type": "object"
+      },
+      "RepoResolution": {
+        "additionalProperties": true,
+        "properties": {
+          "candidate": {
+            "$ref": "#/components/schemas/RepoCandidate"
+          },
+          "fullName": {
+            "type": "string"
+          },
+          "placements": {
+            "items": {
+              "$ref": "#/components/schemas/RepoPlacement"
+            },
+            "type": "array"
+          },
+          "primaries": {
+            "$ref": "#/components/schemas/RepoPrimaries"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "repoId": {
+            "type": "string"
+          },
+          "requestedFullName": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "ready",
+              "processing",
+              "no-mirror",
+              "unavailable"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "provider",
+          "requestedFullName",
+          "status"
+        ],
+        "type": "object"
+      },
+      "ResolvePlacementsOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolvePlacementsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "placements": {
+            "items": {
+              "$ref": "#/components/schemas/ResolvedPlacement"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "placements"
+        ],
+        "type": "object"
+      },
+      "ResolveRepoIDsInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveRepoIDsInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "repoIds": {
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 100,
+            "type": "array"
+          }
+        },
+        "required": [
+          "repoIds"
+        ],
+        "type": "object"
+      },
+      "ResolveRepoIDsResponse": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveRepoIDsResponse.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "resolutions": {
+            "items": {
+              "$ref": "#/components/schemas/RepoIDResolution"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "resolutions"
+        ],
+        "type": "object"
+      },
+      "ResolveReposInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveReposInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "repositories": {
+            "items": {
+              "$ref": "#/components/schemas/RepoReference"
+            },
+            "maxItems": 100,
+            "type": "array"
+          }
+        },
+        "required": [
+          "repositories"
+        ],
+        "type": "object"
+      },
+      "ResolveReposResponse": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveReposResponse.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "resolutions": {
+            "items": {
+              "$ref": "#/components/schemas/RepoResolution"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "resolutions"
+        ],
+        "type": "object"
+      },
+      "ResolvedIdentity": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolvedIdentity.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "accountId": {
+            "type": "string"
+          },
+          "handle": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "providerUserId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "accountId",
+          "provider",
+          "handle",
+          "providerUserId"
+        ],
+        "type": "object"
+      },
+      "ResolvedPlacement": {
+        "additionalProperties": true,
+        "properties": {
+          "cell": {
+            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
+            "type": "string"
+          },
+          "clusterHost": {
+            "description": "Public host of the cluster serving this mirror.",
+            "type": "string"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirrorId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "mirrorId",
+          "clusterHost"
+        ],
+        "type": "object"
+      },
+      "ServiceAccount": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ServiceAccount.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "accountId": {
+            "type": "string"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "orgId": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "systemManaged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "accountId",
+          "name",
+          "orgId",
+          "status",
+          "systemManaged",
+          "createdAt"
+        ],
+        "type": "object"
+      },
+      "ServiceAccountGrant": {
+        "additionalProperties": true,
+        "properties": {
+          "resourceId": {
+            "type": "string"
+          },
+          "resourceName": {
+            "type": "string"
+          },
+          "resourceType": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "resourceType",
+          "resourceId",
+          "role"
+        ],
+        "type": "object"
+      },
+      "ServiceAccountWithGrants": {
+        "additionalProperties": true,
+        "properties": {
+          "accountId": {
+            "type": "string"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "grants": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "name": {
+            "type": "string"
+          },
+          "orgId": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "systemManaged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "grants",
+          "accountId",
+          "name",
+          "orgId",
+          "status",
+          "systemManaged",
+          "createdAt"
+        ],
+        "type": "object"
+      },
+      "SetRepoVisibilityInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/SetRepoVisibilityInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "visibility"
+        ],
+        "type": "object"
+      },
+      "SetRepoVisibilityOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/SetRepoVisibilityOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "visibility"
+        ],
+        "type": "object"
+      },
+      "TopologyCluster": {
+        "additionalProperties": true,
+        "properties": {
+          "host": {
+            "description": "DNS host of this cluster; pass verbatim as clusterHost to POST /api/v1/mirrors.",
+            "type": "string"
+          },
+          "isDefault": {
+            "type": "boolean"
+          },
+          "label": {
+            "description": "Human cluster label (the cluster's display name).",
+            "type": "string"
+          },
+          "publicUrl": {
+            "type": "string"
+          },
+          "slug": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "slug",
+          "label",
+          "host",
+          "publicUrl",
+          "isDefault"
+        ],
+        "type": "object"
+      },
+      "TopologyJurisdiction": {
+        "additionalProperties": true,
+        "properties": {
+          "id": {
+            "description": "Jurisdiction id from the cluster registry (e.g. \"us\").",
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          },
+          "regions": {
+            "items": {
+              "$ref": "#/components/schemas/TopologyRegion"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "id",
+          "label",
+          "regions"
+        ],
+        "type": "object"
+      },
+      "TopologyRegion": {
+        "additionalProperties": true,
+        "properties": {
+          "clusters": {
+            "items": {
+              "$ref": "#/components/schemas/TopologyCluster"
+            },
+            "type": "array"
+          },
+          "id": {
+            "description": "Region id (the cell id from the cluster registry).",
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "label",
+          "clusters"
+        ],
+        "type": "object"
+      },
+      "UpdateBranchProtectionInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/UpdateBranchProtectionInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "addRules": {
+            "description": "Rules to add or replace by ref: an existing rule keeps its position and takes the new flag.",
+            "items": {
+              "$ref": "#/components/schemas/BranchRule"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "removeRefs": {
+            "description": "Patterns to remove; absent entries are ignored.",
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "WillDeleteStruct": {
+        "additionalProperties": true,
+        "properties": {
+          "profileDataNote": {
+            "description": "Blanket note: profile PII is erased across all regions the account has data in (per-region residency is not globally tracked).",
+            "type": "string"
+          },
+          "repos": {
+            "description": "Repos in the account's home region that will be permanently deleted (personal + mirror). Foreign-region repos are also erased by the fan-out but not enumerated here.",
+            "items": {
+              "$ref": "#/components/schemas/DeletionRepo"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "repos",
+          "profileDataNote"
+        ],
+        "type": "object"
+      },
+      "WillUnlinkStruct": {
+        "additionalProperties": true,
+        "properties": {
+          "grants": {
+            "description": "Collaborator grants that will be unlinked.",
+            "items": {
+              "$ref": "#/components/schemas/DeletionGrant"
+            },
+            "type": "array"
+          },
+          "memberships": {
+            "description": "Org memberships that will be dropped (non-owned).",
+            "items": {
+              "$ref": "#/components/schemas/DeletionMembership"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "grants",
+          "memberships"
+        ],
+        "type": "object"
+      }
+    },
+    "securitySchemes": {
+      "bearerAuth": {
+        "bearerFormat": "JWT",
+        "description": "Bearer access token.",
+        "scheme": "bearer",
+        "type": "http"
+      },
+      "sessionAuth": {
+        "description": "Console session cookie issued by the browser login flow.",
+        "in": "cookie",
+        "name": "entire_session",
+        "type": "apiKey"
+      }
+    }
+  },
+  "info": {
+    "description": "Entire control plane: identity, orgs, projects, repos, mirrors, service accounts.",
+    "title": "Entire Core API",
+    "version": "1.0.0"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/access/{resourceType}/{resourceId}": {
+      "get": {
+        "operationId": "getPermissions",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "resourceType",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "resourceId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+            "explode": false,
+            "in": "query",
+            "name": "explain",
+            "schema": {
+              "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPermissionsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List the caller's permissions on a single resource",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/audit": {
+      "get": {
+        "operationId": "listAuditEvents",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListAuditEventsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List the calling account's recent audit events",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/clusters": {
+      "get": {
+        "operationId": "listClusters",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListClustersOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List data-plane clusters attached to this control plane",
+        "tags": [
+          "clusters"
+        ]
+      }
+    },
+    "/identity/handles/{provider}/{handle}": {
+      "get": {
+        "operationId": "resolveHandle",
+        "parameters": [
+          {
+            "description": "IdP slug (e.g. \"github\").",
+            "in": "path",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "description": "IdP slug (e.g. \"github\").",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "User-visible handle at the provider.",
+            "in": "path",
+            "name": "handle",
+            "required": true,
+            "schema": {
+              "description": "User-visible handle at the provider.",
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ResolvedIdentity"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Resolve account by external provider handle",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me": {
+      "delete": {
+        "operationId": "deleteMe",
+        "responses": {
+          "202": {
+            "description": "Accepted"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Request deletion of the calling account (7-day cooldown; cancel via POST /me/cancel-deletion)",
+        "tags": [
+          "identity"
+        ]
+      },
+      "get": {
+        "operationId": "getMe",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMeOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Get the calling account's identity and profile",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/cancel-deletion": {
+      "post": {
+        "operationId": "cancelDeletion",
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Cancel a pending deletion request for the calling account",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/deletion-preview": {
+      "get": {
+        "operationId": "getDeletionPreview",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetDeletionPreviewOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Preview what deleting the calling account will erase, unlink, and block on",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/onboarding": {
+      "get": {
+        "operationId": "getOnboardingStatus",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetOnboardingStatusOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Report whether the calling account still needs to complete onboarding",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/onboarding/complete": {
+      "post": {
+        "operationId": "completeOnboarding",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CompleteOnboardingOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Record that the calling account completed web onboarding",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/mirror-requests": {
+      "post": {
+        "description": "a validation failure may be reported synchronously at submission or as a terminal state on the request; clients must handle both.",
+        "operationId": "createMirrorRequest",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateMirrorRequestInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MirrorRequest"
+                }
+              }
+            },
+            "description": "Accepted",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Submit a mirror creation request",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirror-requests/{requestId}": {
+      "get": {
+        "description": "unknown failure codes must be treated as a generic terminal failure.",
+        "operationId": "getMirrorRequest",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "requestId",
+            "required": true,
+            "schema": {
+              "format": "uuid",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MirrorRequest"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Get a mirror creation request",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors": {
+      "delete": {
+        "operationId": "deleteMirror",
+        "parameters": [
+          {
+            "explode": false,
+            "in": "query",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "enum": [
+                "github"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "repo",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Public host of the cluster serving the mirror.",
+            "explode": false,
+            "in": "query",
+            "name": "clusterHost",
+            "required": true,
+            "schema": {
+              "description": "Public host of the cluster serving the mirror.",
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Delete a mirror by upstream coords + cluster host",
+        "tags": [
+          "mirrors"
+        ]
+      },
+      "get": {
+        "operationId": "listMirrors",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
+            "explode": false,
+            "in": "query",
+            "name": "cluster",
+            "schema": {
+              "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
+            "explode": false,
+            "in": "query",
+            "name": "provider",
+            "schema": {
+              "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "schema": {
+              "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListMirrorsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List mirrors visible to the caller",
+        "tags": [
+          "mirrors"
+        ]
+      },
+      "post": {
+        "operationId": "createMirror",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateMirrorInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CreatedMirror"
+                }
+              }
+            },
+            "description": "Created"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Create GitHub mirror",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors/available": {
+      "get": {
+        "operationId": "listAvailableMirrors",
+        "parameters": [
+          {
+            "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "schema": {
+              "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListAvailableMirrorsOutputBody"
+                }
+              }
             },
-            "type": "array"
+            "description": "OK"
           },
-          "memberships": {
-            "description": "Org memberships that will be dropped (non-owned).",
-            "items": {
-              "$ref": "#/components/schemas/DeletionMembership"
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
             },
-            "type": "array"
+            "description": "Error"
           }
         },
-        "required": [
-          "grants",
-          "memberships"
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
         ],
-        "type": "object"
+        "summary": "List GitHub repos the caller could onboard as mirrors",
+        "tags": [
+          "mirrors"
+        ]
       }
     },
-    "securitySchemes": {
-      "bearerAuth": {
-        "bearerFormat": "JWT",
-        "description": "Bearer token minted by entire-core's device-code flow or STS exchange.",
-        "scheme": "bearer",
-        "type": "http"
-      },
-      "sessionAuth": {
-        "description": "Console session cookie issued by the browser login flow.",
-        "in": "cookie",
-        "name": "entire_session",
-        "type": "apiKey"
-      }
-    }
-  },
-  "info": {
-    "description": "Entire control plane: identity, orgs, projects, repos, mirrors, service accounts.",
-    "title": "Entire Core API",
-    "version": "1.0.0"
-  },
-  "openapi": "3.1.0",
-  "paths": {
-    "/access/{resourceType}": {
+    "/mirrors/collaborators": {
       "get": {
-        "operationId": "lookupResources",
+        "operationId": "listMirrorCollaborators",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
             "explode": false,
             "in": "query",
-            "name": "pageSize",
+            "name": "provider",
+            "required": true,
             "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
+              "enum": [
+                "github"
+              ],
+              "type": "string"
             }
           },
           {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
             "explode": false,
             "in": "query",
-            "name": "pageToken",
+            "name": "owner",
+            "required": true,
             "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "minLength": 1,
               "type": "string"
             }
           },
           {
-            "description": "SpiceDB resource type (e.g. \"repo\", \"project\", \"org\").",
-            "in": "path",
-            "name": "resourceType",
+            "explode": false,
+            "in": "query",
+            "name": "repo",
             "required": true,
             "schema": {
-              "description": "SpiceDB resource type (e.g. \"repo\", \"project\", \"org\").",
               "minLength": 1,
               "type": "string"
             }
           },
           {
-            "description": "Optional: only list resources where the caller has this permission. pageSize/pageToken apply only when set.",
+            "description": "Public host of the cluster serving the mirror.",
             "explode": false,
             "in": "query",
-            "name": "permission",
+            "name": "clusterHost",
+            "required": true,
             "schema": {
-              "description": "Optional: only list resources where the caller has this permission. pageSize/pageToken apply only when set.",
+              "description": "Public host of the cluster serving the mirror.",
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -3075,7 +5216,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LookupResourcesOutputBody"
+                  "$ref": "#/components/schemas/ListMirrorCollaboratorsOutputBody"
                 }
               }
             },
@@ -3100,41 +5241,49 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List resources of a type the caller can access",
+        "summary": "List the principals with access to a mirror (live GitHub-admin gated)",
         "tags": [
-          "identity"
+          "mirrors"
         ]
       }
     },
-    "/access/{resourceType}/{resourceId}": {
+    "/mirrors/placements": {
       "get": {
-        "operationId": "getPermissions",
+        "operationId": "resolveMirrorPlacements",
         "parameters": [
           {
-            "in": "path",
-            "name": "resourceType",
+            "explode": false,
+            "in": "query",
+            "name": "provider",
             "required": true,
             "schema": {
-              "minLength": 1,
+              "enum": [
+                "github"
+              ],
               "type": "string"
             }
           },
           {
-            "in": "path",
-            "name": "resourceId",
+            "description": "Upstream owner login (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "owner",
             "required": true,
             "schema": {
+              "description": "Upstream owner login (case-insensitive).",
               "minLength": 1,
               "type": "string"
             }
           },
           {
-            "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+            "description": "Upstream repo name (case-insensitive).",
             "explode": false,
             "in": "query",
-            "name": "explain",
+            "name": "repo",
+            "required": true,
             "schema": {
-              "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+              "description": "Upstream repo name (case-insensitive).",
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -3144,7 +5293,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPermissionsOutputBody"
+                  "$ref": "#/components/schemas/ResolvePlacementsOutputBody"
                 }
               }
             },
@@ -3169,36 +5318,22 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List the caller's permissions on a single resource",
+        "summary": "Resolve the pullable cluster placements of a mirrored upstream (clone discovery)",
         "tags": [
-          "identity"
+          "mirrors"
         ]
       }
     },
-    "/audit": {
+    "/mirrors/{mirrorId}": {
       "get": {
-        "operationId": "listAuditEvents",
+        "operationId": "getMirror",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
+            "in": "path",
+            "name": "mirrorId",
+            "required": true,
             "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -3208,7 +5343,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListAuditEventsOutputBody"
+                  "$ref": "#/components/schemas/Mirror"
                 }
               }
             },
@@ -3233,21 +5368,46 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List the calling account's recent audit events",
+        "summary": "Get mirror by id",
         "tags": [
-          "identity"
+          "mirrors"
         ]
       }
     },
-    "/clusters": {
+    "/oidc-providers": {
       "get": {
-        "operationId": "listClusters",
+        "operationId": "listOIDCProviders",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListClustersOutputBody"
+                  "$ref": "#/components/schemas/ListOIDCProvidersOutputBody"
                 }
               }
             },
@@ -3272,35 +5432,53 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List data-plane clusters attached to this control plane",
+        "summary": "List federated OIDC identity providers",
         "tags": [
-          "clusters"
+          "identity"
         ]
       }
     },
-    "/identity/handles/{provider}/{handle}": {
+    "/orgs": {
       "get": {
-        "operationId": "resolveHandle",
+        "operationId": "listOrgs",
         "parameters": [
           {
-            "description": "IdP slug (e.g. \"github\").",
-            "in": "path",
-            "name": "provider",
-            "required": true,
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
             "schema": {
-              "description": "IdP slug (e.g. \"github\").",
-              "minLength": 1,
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
-            "description": "User-visible handle at the provider.",
-            "in": "path",
-            "name": "handle",
-            "required": true,
+            "description": "Optional: exact-match org name (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "name",
+            "schema": {
+              "description": "Optional: exact-match org name (case-insensitive).",
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
             "schema": {
-              "description": "User-visible handle at the provider.",
-              "minLength": 1,
               "type": "string"
             }
           }
@@ -3310,11 +5488,28 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ResolvedIdentity"
+                  "$ref": "#/components/schemas/ListOrgsOutputBody"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "schema": {
+                  "type": "string"
                 }
               }
-            },
-            "description": "OK"
+            }
           },
           "default": {
             "content": {
@@ -3335,35 +5530,33 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Resolve account by external provider handle",
+        "summary": "List organizations the caller can see (or one by name)",
         "tags": [
-          "identity"
+          "orgs"
         ]
-      }
-    },
-    "/lookup": {
+      },
       "post": {
-        "operationId": "batchLookup",
+        "operationId": "createOrg",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/BatchLookupInputBody"
+                "$ref": "#/components/schemas/CreateOrgInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/BatchLookupOutputBody"
+                  "$ref": "#/components/schemas/Org"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "default": {
             "content": {
@@ -3384,18 +5577,29 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Batch-resolve (type, id) refs to enriched records",
+        "summary": "Create organization",
         "tags": [
-          "identity"
+          "orgs"
         ]
       }
     },
-    "/me": {
+    "/orgs/{orgId}": {
       "delete": {
-        "operationId": "deleteMe",
+        "operationId": "deleteOrg",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "202": {
-            "description": "Accepted"
+          "204": {
+            "description": "No Content"
           },
           "default": {
             "content": {
@@ -3416,19 +5620,30 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Request deletion of the calling account (7-day cooldown; cancel via POST /me/cancel-deletion)",
+        "summary": "Delete an organization",
         "tags": [
-          "identity"
+          "orgs"
         ]
       },
       "get": {
-        "operationId": "getMe",
+        "operationId": "getOrg",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetMeOutputBody"
+                  "$ref": "#/components/schemas/Org"
                 }
               }
             },
@@ -3453,53 +5668,40 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get the calling account's identity and profile",
+        "summary": "Get an organization",
         "tags": [
-          "identity"
+          "orgs"
         ]
       }
     },
-    "/me/cancel-deletion": {
-      "post": {
-        "operationId": "cancelDeletion",
-        "responses": {
-          "200": {
-            "description": "OK"
-          },
-          "default": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Error"
-          }
-        },
-        "security": [
+    "/orgs/{orgId}/ci/buildkite/clusters": {
+      "get": {
+        "operationId": "listOrgCIBuildkiteClusters",
+        "parameters": [
           {
-            "bearerAuth": []
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
           },
           {
-            "sessionAuth": []
+            "explode": false,
+            "in": "query",
+            "name": "bk_organization",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
-        "summary": "Cancel a pending deletion request for the calling account",
-        "tags": [
-          "identity"
-        ]
-      }
-    },
-    "/me/deletion-preview": {
-      "get": {
-        "operationId": "getDeletionPreview",
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetDeletionPreviewOutputBody"
+                  "$ref": "#/components/schemas/ListOrgCIBuildkiteClustersOutputBody"
                 }
               }
             },
@@ -3524,25 +5726,44 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Preview what deleting the calling account will erase, unlink, and block on",
+        "summary": "List an org's registered Buildkite clusters",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
-      }
-    },
-    "/me/onboarding": {
-      "get": {
-        "operationId": "getOnboardingStatus",
+      },
+      "post": {
+        "operationId": "registerOrgCIBuildkiteCluster",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RegisterOrgCIBuildkiteClusterInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetOnboardingStatusOutputBody"
+                  "$ref": "#/components/schemas/OrgCIBuildkiteClusterView"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "default": {
             "content": {
@@ -3563,82 +5784,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Report whether the calling account still needs to complete onboarding",
+        "summary": "Register or update a Buildkite hosted cluster for an org",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/me/onboarding/complete": {
-      "post": {
-        "operationId": "completeOnboarding",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/CompleteOnboardingOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+    "/orgs/{orgId}/ci/buildkite/clusters/{bkOrg}/{bkClusterId}": {
+      "delete": {
+        "operationId": "deleteOrgCIBuildkiteCluster",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
           },
-          "default": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Error"
-          }
-        },
-        "security": [
           {
-            "bearerAuth": []
+            "in": "path",
+            "name": "bkOrg",
+            "required": true,
+            "schema": {
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
+              "type": "string"
+            }
           },
           {
-            "sessionAuth": []
+            "in": "path",
+            "name": "bkClusterId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
-        "summary": "Record that the calling account completed web onboarding",
-        "tags": [
-          "identity"
-        ]
-      }
-    },
-    "/mirror-requests": {
-      "post": {
-        "description": "a validation failure may be reported synchronously at submission or as a terminal state on the request; clients must handle both.",
-        "operationId": "createMirrorRequest",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateMirrorRequestInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "202": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/MirrorRequest"
-                }
-              }
-            },
-            "description": "Accepted",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "default": {
             "content": {
@@ -3659,37 +5845,46 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Submit a mirror creation request",
+        "summary": "Remove a registered Buildkite cluster from an org",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/mirror-requests/{requestId}": {
-      "get": {
-        "description": "unknown failure codes must be treated as a generic terminal failure.",
-        "operationId": "getMirrorRequest",
+    "/orgs/{orgId}/ci/buildkite/credential": {
+      "post": {
+        "operationId": "connectOrgCIBuildkiteCredential",
         "parameters": [
           {
             "in": "path",
-            "name": "requestId",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "format": "uuid",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          }
-        ],
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConnectOrgCIBuildkiteCredentialInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MirrorRequest"
+                  "$ref": "#/components/schemas/OrgCIBuildkiteCredentialView"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "default": {
             "content": {
@@ -3710,57 +5905,31 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get a mirror creation request",
+        "summary": "Connect or rotate an org's Buildkite API credential",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/mirrors": {
+    "/orgs/{orgId}/ci/buildkite/credential/{bkOrg}": {
       "delete": {
-        "operationId": "deleteMirror",
+        "operationId": "deleteOrgCIBuildkiteCredential",
         "parameters": [
           {
-            "explode": false,
-            "in": "query",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "enum": [
-                "github"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "owner",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "repo",
+            "in": "path",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           },
           {
-            "description": "Public host of the cluster serving the mirror.",
-            "explode": false,
-            "in": "query",
-            "name": "clusterHost",
+            "in": "path",
+            "name": "bkOrg",
             "required": true,
             "schema": {
-              "description": "Public host of the cluster serving the mirror.",
-              "minLength": 1,
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
               "type": "string"
             }
           }
@@ -3788,64 +5957,31 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete a mirror by upstream coords + cluster host",
+        "summary": "Delete an org's connected Buildkite credential",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
-      },
-      "get": {
-        "operationId": "listMirrors",
+      }
+    },
+    "/orgs/{orgId}/ci/buildkite/credential/{bkOrg}/inbound-secret": {
+      "put": {
+        "operationId": "rotateOrgCIBuildkiteInboundSecret",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
-            "explode": false,
-            "in": "query",
-            "name": "cluster",
-            "schema": {
-              "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
-            "explode": false,
-            "in": "query",
-            "name": "provider",
+            "in": "path",
+            "name": "orgId",
+            "required": true,
             "schema": {
-              "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           },
           {
-            "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "owner",
+            "in": "path",
+            "name": "bkOrg",
+            "required": true,
             "schema": {
-              "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
               "type": "string"
             }
           }
@@ -3855,7 +5991,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListMirrorsOutputBody"
+                  "$ref": "#/components/schemas/OrgCIBuildkiteCredentialView"
                 }
               }
             },
@@ -3880,33 +6016,36 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List mirrors visible to the caller",
+        "summary": "Rotate an org's inbound Buildkite webhook secret",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
-      },
-      "post": {
-        "operationId": "createMirror",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateMirrorInputBody"
-              }
+      }
+    },
+    "/orgs/{orgId}/ci/buildkite/credentials": {
+      "get": {
+        "operationId": "listOrgCIBuildkiteCredentials",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
             }
-          },
-          "required": true
-        },
+          }
+        ],
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CreatedMirror"
+                  "$ref": "#/components/schemas/ListOrgCIBuildkiteCredentialsOutputBody"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -3927,37 +6066,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create GitHub mirror",
+        "summary": "List an org's connected Buildkite credentials",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/mirrors/available": {
-      "get": {
-        "operationId": "listAvailableMirrors",
+    "/orgs/{orgId}/ci/github-actions/credential": {
+      "post": {
+        "description": "Operator-only: requires platform#admin, unlike the Buildkite routes beside it, because GitHub Actions has no enrolment path yet and a credential minted here cannot be used. Mints the inbound webhook credential for one GitHub account: a fresh webhook secret (returned once, in this 201) and the endpoint URL to configure the GitHub webhook with, plus optionally the outbound dispatch api_token (write-only, never returned; has_api_token confirms storage). With api_token, an already-minted github-actions row gets the token stored/rotated instead (200, no secret re-issued).",
+        "operationId": "mintOrgCIGitHubActionsCredential",
         "parameters": [
           {
-            "description": "Optional: restrict to repos with this owner login (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "owner",
+            "in": "path",
+            "name": "orgId",
+            "required": true,
             "schema": {
-              "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MintOrgCIGitHubActionsCredentialInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListAvailableMirrorsOutputBody"
+                  "$ref": "#/components/schemas/OrgCIGitHubActionsCredentialView"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "default": {
             "content": {
@@ -3978,57 +6127,45 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List GitHub repos the caller could onboard as mirrors",
+        "summary": "Mint an org's GitHub Actions webhook credential",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/mirrors/collaborators": {
+    "/orgs/{orgId}/members": {
       "get": {
-        "operationId": "listMirrorCollaborators",
+        "operationId": "listOrgMembers",
         "parameters": [
           {
+            "description": "Maximum entries to return; server may cap further.",
             "explode": false,
             "in": "query",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "enum": [
-                "github"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "owner",
-            "required": true,
+            "name": "pageSize",
             "schema": {
-              "minLength": 1,
-              "type": "string"
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
             }
           },
           {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
             "explode": false,
             "in": "query",
-            "name": "repo",
-            "required": true,
+            "name": "pageToken",
             "schema": {
-              "minLength": 1,
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
-            "description": "Public host of the cluster serving the mirror.",
-            "explode": false,
-            "in": "query",
-            "name": "clusterHost",
+            "in": "path",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "description": "Public host of the cluster serving the mirror.",
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -4038,7 +6175,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListMirrorCollaboratorsOutputBody"
+                  "$ref": "#/components/schemas/ListOrgMembersOutputBody"
                 }
               }
             },
@@ -4056,70 +6193,51 @@
           }
         },
         "security": [
-          {
-            "bearerAuth": []
-          },
-          {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "List the principals with access to a mirror (live GitHub-admin gated)",
-        "tags": [
-          "mirrors"
-        ]
-      }
-    },
-    "/mirrors/placements": {
-      "get": {
-        "operationId": "resolveMirrorPlacements",
-        "parameters": [
-          {
-            "explode": false,
-            "in": "query",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "enum": [
-                "github"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Upstream owner login (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "owner",
-            "required": true,
-            "schema": {
-              "description": "Upstream owner login (case-insensitive).",
-              "minLength": 1,
-              "type": "string"
-            }
+          {
+            "bearerAuth": []
           },
           {
-            "description": "Upstream repo name (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "repo",
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List members of an organization",
+        "tags": [
+          "orgs"
+        ]
+      },
+      "post": {
+        "operationId": "addOrgMember",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "description": "Upstream repo name (case-insensitive).",
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AddOrgMemberInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ResolvePlacementsOutputBody"
+                  "$ref": "#/components/schemas/Membership"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "default": {
             "content": {
@@ -4140,36 +6258,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Resolve the pullable cluster placements of a mirrored upstream (clone discovery)",
+        "summary": "Add a member to an organization",
         "tags": [
-          "mirrors"
+          "orgs"
         ]
       }
     },
-    "/mirrors/{mirrorId}": {
-      "get": {
-        "operationId": "getMirror",
+    "/orgs/{orgId}/members/{provider}/{providerUserId}": {
+      "delete": {
+        "operationId": "removeOrgMember",
         "parameters": [
           {
             "in": "path",
-            "name": "mirrorId",
+            "name": "orgId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "providerUserId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Mirror"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "default": {
             "content": {
@@ -4190,15 +6319,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get mirror by id",
+        "summary": "Remove a member from an organization",
         "tags": [
-          "mirrors"
+          "orgs"
         ]
       }
     },
-    "/oidc-providers": {
+    "/orgs/{orgId}/projects": {
       "get": {
-        "operationId": "listOIDCProviders",
+        "operationId": "listOrgProjects",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -4222,6 +6351,25 @@
               "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: exact-match project name (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "name",
+            "schema": {
+              "description": "Optional: exact-match project name (case-insensitive).",
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -4229,7 +6377,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListOIDCProvidersOutputBody"
+                  "$ref": "#/components/schemas/ListOrgProjectsOutputBody"
                 }
               }
             },
@@ -4254,15 +6402,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List federated OIDC identity providers",
+        "summary": "List projects owned by an organization",
         "tags": [
-          "identity"
+          "projects"
         ]
       }
     },
-    "/orgs": {
+    "/projects": {
       "get": {
-        "operationId": "listOrgs",
+        "operationId": "listProjects",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -4288,19 +6436,12 @@
             }
           },
           {
-            "description": "Optional: exact-match org name (case-insensitive).",
+            "description": "Optional: exact-match project name (case-insensitive).",
             "explode": false,
             "in": "query",
             "name": "name",
             "schema": {
-              "description": "Optional: exact-match org name (case-insensitive).",
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
+              "description": "Optional: exact-match project name (case-insensitive).",
               "type": "string"
             }
           }
@@ -4310,28 +6451,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListOrgsOutputBody"
+                  "$ref": "#/components/schemas/ListProjectsOutputBody"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Vary": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -4352,18 +6476,18 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List organizations the caller can see (or one by name)",
+        "summary": "List projects accessible to the caller (or one by name)",
         "tags": [
-          "orgs"
+          "projects"
         ]
       },
       "post": {
-        "operationId": "createOrg",
+        "operationId": "createProject",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateOrgInputBody"
+                "$ref": "#/components/schemas/CreateProjectInputBody"
               }
             }
           },
@@ -4374,7 +6498,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Org"
+                  "$ref": "#/components/schemas/Project"
                 }
               }
             },
@@ -4399,19 +6523,19 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create organization",
+        "summary": "Create project",
         "tags": [
-          "orgs"
+          "projects"
         ]
       }
     },
-    "/orgs/{orgId}": {
+    "/projects/{projectId}": {
       "delete": {
-        "operationId": "deleteOrg",
+        "operationId": "deleteProject",
         "parameters": [
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
@@ -4442,17 +6566,17 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete an organization",
+        "summary": "Delete a project",
         "tags": [
-          "orgs"
+          "projects"
         ]
       },
       "get": {
-        "operationId": "getOrg",
+        "operationId": "getProject",
         "parameters": [
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
@@ -4465,7 +6589,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Org"
+                  "$ref": "#/components/schemas/Project"
                 }
               }
             },
@@ -4490,59 +6614,107 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get an organization",
+        "summary": "Get a project by id",
         "tags": [
-          "orgs"
+          "projects"
         ]
       }
     },
-    "/orgs/{orgId}/members": {
-      "get": {
-        "operationId": "listOrgMembers",
+    "/projects/{projectId}/grants": {
+      "post": {
+        "operationId": "grantProjectAccess",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
+            "in": "path",
+            "name": "projectId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/GrantProjectAccessInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GrantProjectAccessOutputBody"
+                }
+              }
+            },
+            "description": "Created"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Grant project access to an identity",
+        "tags": [
+          "projects"
+        ]
+      }
+    },
+    "/projects/{projectId}/grants/account/{provider}/{providerUserId}": {
+      "delete": {
+        "operationId": "revokeProjectAccessByProvider",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "projectId",
+            "required": true,
             "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
             }
           },
           {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
+            "in": "path",
+            "name": "provider",
+            "required": true,
             "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "minLength": 1,
               "type": "string"
             }
           },
           {
             "in": "path",
-            "name": "orgId",
+            "name": "providerUserId",
             "required": true,
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ListOrgMembersOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "default": {
             "content": {
@@ -4563,44 +6735,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List members of an organization",
+        "summary": "Revoke project access by provider identity",
         "tags": [
-          "orgs"
+          "projects"
         ]
-      },
-      "post": {
-        "operationId": "addOrgMember",
+      }
+    },
+    "/projects/{projectId}/grants/{granteeType}/{granteeId}": {
+      "delete": {
+        "operationId": "revokeProjectAccess",
         "parameters": [
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AddOrgMemberInputBody"
-              }
+          },
+          {
+            "in": "path",
+            "name": "granteeType",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "in": "path",
+            "name": "granteeId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "201": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Membership"
-                }
-              }
-            },
-            "description": "Created"
+          "204": {
+            "description": "No Content"
           },
           "default": {
             "content": {
@@ -4621,47 +6796,59 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Add a member to an organization",
+        "summary": "Revoke project access by grantee id",
         "tags": [
-          "orgs"
+          "projects"
         ]
       }
     },
-    "/orgs/{orgId}/members/{provider}/{providerUserId}": {
-      "delete": {
-        "operationId": "removeOrgMember",
+    "/projects/{projectId}/members": {
+      "get": {
+        "operationId": "listProjectMembers",
         "parameters": [
           {
-            "in": "path",
-            "name": "orgId",
-            "required": true,
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
             }
           },
           {
-            "in": "path",
-            "name": "provider",
-            "required": true,
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
             "schema": {
-              "minLength": 1,
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
             "in": "path",
-            "name": "providerUserId",
+            "name": "projectId",
             "required": true,
             "schema": {
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListProjectMembersOutputBody"
+                }
+              }
+            },
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -4682,15 +6869,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Remove a member from an organization",
+        "summary": "List project members and their roles",
         "tags": [
-          "orgs"
+          "projects"
         ]
       }
     },
-    "/orgs/{orgId}/projects": {
+    "/projects/{projectId}/repos": {
       "get": {
-        "operationId": "listOrgProjects",
+        "operationId": "listProjectRepos",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -4717,7 +6904,7 @@
           },
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
@@ -4725,12 +6912,12 @@
             }
           },
           {
-            "description": "Optional: exact-match project name (case-insensitive).",
+            "description": "Optional: exact-match repo name (case-insensitive).",
             "explode": false,
             "in": "query",
             "name": "name",
             "schema": {
-              "description": "Optional: exact-match project name (case-insensitive).",
+              "description": "Optional: exact-match repo name (case-insensitive).",
               "type": "string"
             }
           }
@@ -4740,7 +6927,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListOrgProjectsOutputBody"
+                  "$ref": "#/components/schemas/ListProjectReposOutputBody"
                 }
               }
             },
@@ -4765,15 +6952,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List projects owned by an organization",
+        "summary": "List repositories in a project (or one by name)",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects": {
+    "/repos": {
       "get": {
-        "operationId": "listProjects",
+        "operationId": "listRepos",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -4799,12 +6986,153 @@
             }
           },
           {
-            "description": "Optional: exact-match project name (case-insensitive).",
+            "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
             "explode": false,
             "in": "query",
-            "name": "name",
+            "name": "scope",
             "schema": {
-              "description": "Optional: exact-match project name (case-insensitive).",
+              "default": "onboarded",
+              "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
+              "enum": [
+                "onboarded",
+                "all"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored, but the fact filters below still apply (a repo whose facts don't match returns empty).",
+            "explode": false,
+            "in": "query",
+            "name": "filter",
+            "schema": {
+              "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored, but the fact filters below still apply (a repo whose facts don't match returns empty).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Multi-key sort spec, e.g. org:asc,stars:desc. Keys: name,org,language,candidacy,stars,forks,pushed_at,last_activity_at,last_pushed_at,activity_hotness,checkpoint_count,open_pr_count. A single bare key uses the order param. Encoded into the cursor (authoritative on continuation).",
+            "explode": false,
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "description": "Multi-key sort spec, e.g. org:asc,stars:desc. Keys: name,org,language,candidacy,stars,forks,pushed_at,last_activity_at,last_pushed_at,activity_hotness,checkpoint_count,open_pr_count. A single bare key uses the order param. Encoded into the cursor (authoritative on continuation).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Direction for a single bare sort key; defaults to asc. Ignored when sort carries per-key :asc/:desc suffixes. Encoded into the cursor (authoritative on continuation).",
+            "explode": false,
+            "in": "query",
+            "name": "order",
+            "schema": {
+              "description": "Direction for a single bare sort key; defaults to asc. Ignored when sort carries per-key :asc/:desc suffixes. Encoded into the cursor (authoritative on continuation).",
+              "enum": [
+                "asc",
+                "desc"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Exact-match repo_facts.language. Also accepts language[eq]/language[ne] (bare is sugar for [eq]).",
+            "explode": false,
+            "in": "query",
+            "name": "language",
+            "schema": {
+              "description": "Exact-match repo_facts.language. Also accepts language[eq]/language[ne] (bare is sugar for [eq]).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Filter on the observed repo_facts.private fact (public: private=false; private: private=true). Also accepts visibility[eq]/visibility[ne].",
+            "explode": false,
+            "in": "query",
+            "name": "visibility",
+            "schema": {
+              "description": "Filter on the observed repo_facts.private fact (public: private=false; private: private=true). Also accepts visibility[eq]/visibility[ne].",
+              "enum": [
+                "public",
+                "private"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Filter on repo_facts.archived.",
+            "explode": false,
+            "in": "query",
+            "name": "archived",
+            "schema": {
+              "description": "Filter on repo_facts.archived.",
+              "enum": [
+                "true",
+                "false"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "true: repo_facts.checkpoint_count > 0; false: no checkpoints (0 or unobserved).",
+            "explode": false,
+            "in": "query",
+            "name": "hasCheckpoints",
+            "schema": {
+              "description": "true: repo_facts.checkpoint_count > 0; false: no checkpoints (0 or unobserved).",
+              "enum": [
+                "true",
+                "false"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Exact-match owner/project org (case-insensitive). Also accepts org[eq]/org[ne].",
+            "explode": false,
+            "in": "query",
+            "name": "org",
+            "schema": {
+              "description": "Exact-match owner/project org (case-insensitive). Also accepts org[eq]/org[ne].",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Literal case-insensitive substring match on the full name (owner/repo).",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Literal case-insensitive substring match on the full name (owner/repo).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Filter on placement/candidacy lifecycle. inactive requires scope=all. Also accepts status[eq]/status[ne].",
+            "explode": false,
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "description": "Filter on placement/candidacy lifecycle. inactive requires scope=all. Also accepts status[eq]/status[ne].",
+              "enum": [
+                "mirrored",
+                "processing",
+                "inactive"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Minimum caller access tier: read (all), write (write+admin), or admin. Also accepts permission[eq]; permission[ne] is rejected.",
+            "explode": false,
+            "in": "query",
+            "name": "permission",
+            "schema": {
+              "description": "Minimum caller access tier: read (all), write (write+admin), or admin. Also accepts permission[eq]; permission[ne] is rejected.",
+              "enum": [
+                "read",
+                "write",
+                "admin"
+              ],
               "type": "string"
             }
           }
@@ -4814,7 +7142,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListProjectsOutputBody"
+                  "$ref": "#/components/schemas/ListReposOutputBody"
                 }
               }
             },
@@ -4839,18 +7167,18 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List projects accessible to the caller (or one by name)",
+        "summary": "List the caller's readable repositories (placement index)",
         "tags": [
-          "projects"
+          "repos"
         ]
       },
       "post": {
-        "operationId": "createProject",
+        "operationId": "createRepo",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateProjectInputBody"
+                "$ref": "#/components/schemas/CreateRepoInputBody"
               }
             }
           },
@@ -4861,7 +7189,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Project"
+                  "$ref": "#/components/schemas/Repo"
                 }
               }
             },
@@ -4886,29 +7214,61 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create project",
+        "summary": "Create repository",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}": {
-      "delete": {
-        "operationId": "deleteProject",
+    "/repos/facets/languages": {
+      "get": {
+        "operationId": "listRepoLanguageFacets",
         "parameters": [
           {
-            "in": "path",
-            "name": "projectId",
-            "required": true,
+            "description": "Maximum facet values to return.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "default": 50,
+              "description": "Maximum facet values to return.",
+              "format": "int32",
+              "maximum": 100,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Case-insensitive substring match over facet values.",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Case-insensitive substring match over facet values.",
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RepoFacetPage"
+                }
+              }
+            },
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -4929,20 +7289,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete a project",
+        "summary": "List repository language facets",
         "tags": [
-          "projects"
+          "repos"
         ]
-      },
+      }
+    },
+    "/repos/facets/orgs": {
       "get": {
-        "operationId": "getProject",
+        "operationId": "listRepoOrgFacets",
         "parameters": [
           {
-            "in": "path",
-            "name": "projectId",
-            "required": true,
+            "description": "Maximum facet values to return.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "default": 50,
+              "description": "Maximum facet values to return.",
+              "format": "int32",
+              "maximum": 100,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Case-insensitive substring match over facet values.",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Case-insensitive substring match over facet values.",
               "type": "string"
             }
           }
@@ -4952,7 +7339,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Project"
+                  "$ref": "#/components/schemas/RepoFacetPage"
                 }
               }
             },
@@ -4977,46 +7364,79 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get a project by id",
+        "summary": "List repository org facets",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}/grants": {
-      "post": {
-        "operationId": "grantProjectAccess",
+    "/repos/lookup-by-slug": {
+      "get": {
+        "operationId": "lookupRepoBySlug",
         "parameters": [
           {
-            "in": "path",
-            "name": "projectId",
+            "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
+            "explode": false,
+            "in": "query",
+            "name": "slug",
             "required": true,
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
               "type": "string"
             }
           }
         ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LookupBySlugOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "summary": "Resolve a repo slug to routing info (unauthenticated)",
+        "tags": [
+          "repos"
+        ]
+      }
+    },
+    "/repos/resolve": {
+      "post": {
+        "operationId": "resolveRepos",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/GrantProjectAccessInputBody"
+                "$ref": "#/components/schemas/ResolveReposInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GrantProjectAccessOutputBody"
+                  "$ref": "#/components/schemas/ResolveReposResponse"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -5037,47 +7457,35 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Grant project access to an identity",
+        "summary": "Resolve provider-qualified repository lifecycle states",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}/grants/account/{provider}/{providerUserId}": {
-      "delete": {
-        "operationId": "revokeProjectAccessByProvider",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "projectId",
-            "required": true,
-            "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
+    "/repos/resolve-ids": {
+      "post": {
+        "operationId": "resolveRepoIDs",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ResolveRepoIDsInputBody"
+              }
             }
           },
-          {
-            "in": "path",
-            "name": "providerUserId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          }
-        ],
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ResolveRepoIDsResponse"
+                }
+              }
+            },
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -5098,42 +7506,24 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Revoke project access by provider identity",
+        "summary": "Resolve repository ids to full name and provider",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}/grants/{granteeType}/{granteeId}": {
+    "/repos/{repoId}": {
       "delete": {
-        "operationId": "revokeProjectAccess",
+        "operationId": "deleteRepo",
         "parameters": [
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "granteeType",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "granteeId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -5156,45 +7546,20 @@
             "bearerAuth": []
           },
           {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "Revoke project access by grantee id",
-        "tags": [
-          "projects"
-        ]
-      }
-    },
-    "/projects/{projectId}/members": {
-      "get": {
-        "operationId": "listProjectMembers",
-        "parameters": [
-          {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Delete repository",
+        "tags": [
+          "repos"
+        ]
+      },
+      "get": {
+        "operationId": "getRepo",
+        "parameters": [
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
@@ -5207,7 +7572,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListProjectMembersOutputBody"
+                  "$ref": "#/components/schemas/Repo"
                 }
               }
             },
@@ -5232,57 +7597,24 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List project members and their roles",
+        "summary": "Get repository",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}/repos": {
+    "/repos/{repoId}/branch-protection": {
       "get": {
-        "operationId": "listProjectRepos",
+        "operationId": "getBranchProtection",
         "parameters": [
-          {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          },
-          {
-            "description": "Optional: exact-match repo name (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "name",
-            "schema": {
-              "description": "Optional: exact-match repo name (case-insensitive).",
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -5290,7 +7622,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListProjectReposOutputBody"
+                  "$ref": "#/components/schemas/BranchProtection"
                 }
               }
             },
@@ -5315,71 +7647,40 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List repositories in a project (or one by name)",
+        "summary": "Get repository branch protection",
         "tags": [
           "repos"
         ]
-      }
-    },
-    "/repos": {
-      "get": {
-        "operationId": "listRepos",
+      },
+      "patch": {
+        "operationId": "updateBranchProtection",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
-          {
-            "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
-            "explode": false,
-            "in": "query",
-            "name": "scope",
-            "schema": {
-              "default": "onboarded",
-              "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
-              "enum": [
-                "onboarded",
-                "all"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored.",
-            "explode": false,
-            "in": "query",
-            "name": "filter",
+            "in": "path",
+            "name": "repoId",
+            "required": true,
             "schema": {
-              "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored.",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateBranchProtectionInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListReposOutputBody"
+                  "$ref": "#/components/schemas/BranchProtection"
                 }
               }
             },
@@ -5404,33 +7705,44 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List the caller's readable repositories (placement index)",
+        "summary": "Add or remove protected branches",
         "tags": [
           "repos"
         ]
       },
-      "post": {
-        "operationId": "createRepo",
+      "put": {
+        "operationId": "setBranchProtection",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateRepoInputBody"
+                "$ref": "#/components/schemas/BranchProtection"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Repo"
+                  "$ref": "#/components/schemas/BranchProtection"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -5451,26 +7763,59 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create repository",
+        "summary": "Set repository branch protection",
         "tags": [
           "repos"
         ]
       }
     },
-    "/repos/lookup-by-slug": {
+    "/repos/{repoId}/ci-builds": {
       "get": {
-        "operationId": "lookupRepoBySlug",
+        "operationId": "listRepoCIBuilds",
         "parameters": [
           {
-            "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
             "explode": false,
             "in": "query",
-            "name": "slug",
-            "required": true,
+            "name": "commit",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "pipeline",
             "schema": {
-              "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
               "type": "string"
             }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "build_number",
+            "schema": {
+              "format": "int64",
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -5478,7 +7823,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LookupBySlugOutputBody"
+                  "$ref": "#/components/schemas/ListRepoCIBuildsOutputBody"
                 }
               }
             },
@@ -5495,15 +7840,23 @@
             "description": "Error"
           }
         },
-        "summary": "Resolve a repo slug to routing info (unauthenticated)",
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List a repo's CI build statuses",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
       }
     },
-    "/repos/{repoId}": {
-      "delete": {
-        "operationId": "deleteRepo",
+    "/repos/{repoId}/ci-webhooks": {
+      "get": {
+        "operationId": "listRepoCIWebhooks",
         "parameters": [
           {
             "in": "path",
@@ -5516,8 +7869,15 @@
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListRepoCIWebhooksOutputBody"
+                }
+              }
+            },
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -5538,13 +7898,13 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete repository",
+        "summary": "List a repo's CI webhooks",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
       },
-      "get": {
-        "operationId": "getRepo",
+      "post": {
+        "operationId": "createRepoCIWebhook",
         "parameters": [
           {
             "in": "path",
@@ -5556,16 +7916,26 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateRepoCIWebhookInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Repo"
+                  "$ref": "#/components/schemas/CreateRepoCIWebhookBody"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "default": {
             "content": {
@@ -5586,23 +7956,54 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get repository",
+        "summary": "Enroll a repo into a CI webhook (Buildkite)",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
       }
     },
-    "/repos/{repoId}/ci-webhooks": {
+    "/repos/{repoId}/ci-webhooks/audit": {
       "get": {
-        "operationId": "listRepoCIWebhooks",
+        "description": "Audited ci_webhook_enrolled / _updated / _deleted / _identity_rolled_back / _identity_orphaned events for this repo, newest first, from core's domain audit log. The entire-ci-webhooks subscription row records no actor, so this is the only way to attribute an enrollment — and it covers subscriptions created before this endpoint existed. Authz: repo#manage_ci.",
+        "operationId": "listRepoCIWebhookAudit",
         "parameters": [
           {
-            "in": "path",
-            "name": "repoId",
-            "required": true,
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "event_type",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "offset",
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
+              "format": "int64",
+              "minimum": 0,
+              "type": "integer"
             }
           }
         ],
@@ -5611,7 +8012,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListRepoCIWebhooksOutputBody"
+                  "$ref": "#/components/schemas/ListRepoCIWebhookAuditOutputBody"
                 }
               }
             },
@@ -5636,13 +8037,16 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List a repo's CI webhooks",
+        "summary": "List who changed a repo's CI webhooks, and when",
         "tags": [
           "ci-webhooks"
         ]
-      },
-      "post": {
-        "operationId": "createRepoCIWebhook",
+      }
+    },
+    "/repos/{repoId}/ci-webhooks/providers": {
+      "get": {
+        "description": "Returns each provider's enrolment form AS DATA: its modes, its fields, and the select options drawn from this repo's owning org's connected credentials and registered clusters. A client renders what it is handed and posts back provider/provider_account/target_ref/mode/config, so it never names a CI vendor in its own source. A provider the org cannot enrol into yet comes back enrollable=false with a reason a customer can act on, rather than being omitted. Authz: repo#manage_ci, the same gate as enrolling.",
+        "operationId": "listRepoCIProviders",
         "parameters": [
           {
             "in": "path",
@@ -5654,26 +8058,16 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateRepoCIWebhookInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CIWebhookView"
+                  "$ref": "#/components/schemas/ListRepoCIProvidersOutputBody"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "default": {
             "content": {
@@ -5694,7 +8088,7 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Enroll a repo into a CI webhook (Buildkite)",
+        "summary": "Describe the enrolment form for every CI provider",
         "tags": [
           "ci-webhooks"
         ]
@@ -5702,6 +8096,7 @@
     },
     "/repos/{repoId}/ci-webhooks/{id}": {
       "delete": {
+        "description": "Deletes the subscription AND tears down its enrollment identity: the automation row (when no sibling repo shares it), its expiring repo grant, and its Buildkite OIDC binding. The Buildkite pipeline itself is always kept. Pass keep_identity=true to delete only the subscription — for an immediate re-enroll that must preserve automation_id, since teardown retires it and a re-enroll declares a new one that only bk_force_rescaffold pushes into the pipeline. A retained identity holds read access on this repo until its grant lapses. A subscription enrolled before the automation principal has no automation to retire: the delete succeeds and removes only the subscription, reported as identity_retired=false on the ci_webhook_deleted audit event — the list an operator queries to hand-delete the leftover service accounts.",
         "operationId": "deleteRepoCIWebhook",
         "parameters": [
           {
@@ -5724,7 +8119,7 @@
           {
             "explode": false,
             "in": "query",
-            "name": "teardown",
+            "name": "keep_identity",
             "schema": {
               "type": "boolean"
             }
@@ -5825,6 +8220,79 @@
         ]
       }
     },
+    "/repos/{repoId}/collaborators": {
+      "get": {
+        "operationId": "listRepoCollaborators",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListRepoCollaboratorsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List repo collaborators",
+        "tags": [
+          "repos"
+        ]
+      }
+    },
     "/repos/{repoId}/grants": {
       "get": {
         "operationId": "listRepoGrants",
@@ -6078,6 +8546,173 @@
         ]
       }
     },
+    "/repos/{repoId}/native-mirrors": {
+      "get": {
+        "operationId": "listNativeMirrors",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListNativeMirrorsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List native-mirror placement status",
+        "tags": [
+          "native-mirrors"
+        ]
+      },
+      "post": {
+        "operationId": "createNativeMirror",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateNativeMirrorInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NativeMirrorPlacement"
+                }
+              }
+            },
+            "description": "Accepted"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Create a native-mirror placement",
+        "tags": [
+          "native-mirrors"
+        ]
+      }
+    },
+    "/repos/{repoId}/native-mirrors/{clusterSlug}": {
+      "delete": {
+        "operationId": "deleteNativeMirror",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "clusterSlug",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NativeMirrorPlacement"
+                }
+              }
+            },
+            "description": "Accepted"
+          },
+          "default": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Delete a native-mirror placement",
+        "tags": [
+          "native-mirrors"
+        ]
+      }
+    },
     "/repos/{repoId}/visibility": {
       "get": {
         "operationId": "getRepoVisibility",
diff --git a/internal/coreapi/spec/core.openapi.json b/internal/coreapi/spec/core.openapi.json
index d5e8f6a084..85380d5d25 100644
--- a/internal/coreapi/spec/core.openapi.json
+++ b/internal/coreapi/spec/core.openapi.json
@@ -92,6 +92,11 @@
           "owner": {
             "type": "string"
           },
+          "pushedAt": {
+            "description": "Time of the latest push to the upstream repository.",
+            "format": "date-time",
+            "type": "string"
+          },
           "repo": {
             "type": "string"
           },
@@ -113,102 +118,89 @@
         ],
         "type": "object"
       },
-      "BatchLookupInputBody": {
+      "Binding": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/BatchLookupInputBody.json"
+              "/api/v1/schemas/Binding.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "refs": {
-            "items": {
-              "$ref": "#/components/schemas/LookupRef"
-            },
-            "maxItems": 100,
-            "minItems": 1,
-            "type": "array"
+          "accountId": {
+            "type": "string"
+          },
+          "attributeFilter": {},
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "providerId": {
+            "type": "string"
           }
         },
         "required": [
-          "refs"
+          "id",
+          "accountId",
+          "providerId",
+          "attributeFilter",
+          "createdAt"
         ],
         "type": "object"
       },
-      "BatchLookupOutputBody": {
+      "BranchProtection": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/BatchLookupOutputBody.json"
+              "/api/v1/schemas/BranchProtection.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "refs": {
+          "rules": {
+            "description": "Protection rules, one per pattern; each ref at most once. Empty protects nothing.",
             "items": {
-              "$ref": "#/components/schemas/LookupRefResult"
+              "$ref": "#/components/schemas/BranchRule"
             },
+            "maxItems": 64,
             "type": "array"
           }
         },
         "required": [
-          "refs"
+          "rules"
         ],
         "type": "object"
       },
-      "Binding": {
+      "BranchRule": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/Binding.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
-          },
-          "accountId": {
-            "type": "string"
-          },
-          "attributeFilter": {},
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "id": {
+          "ref": {
+            "description": "\"HEAD\" or a refs/heads/ name, fnmatch wildcards allowed.",
             "type": "string"
           },
-          "providerId": {
-            "type": "string"
+          "serverSideMergeOnly": {
+            "description": "The branch moves only through a server-side merge by Entire; every direct write, fast-forward included, is refused. Defaults to false.",
+            "type": "boolean"
           }
         },
         "required": [
-          "id",
-          "accountId",
-          "providerId",
-          "attributeFilter",
-          "createdAt"
+          "ref"
         ],
         "type": "object"
       },
-      "CIWebhookView": {
+      "CIBuildView": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CIWebhookView.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "bk_build_uuid": {
             "type": "string"
           },
           "bk_organization": {
@@ -217,2309 +209,2435 @@
           "bk_pipeline": {
             "type": "string"
           },
+          "branch": {
+            "type": "string"
+          },
+          "build_number": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "commit": {
+            "type": "string"
+          },
           "created_at": {
             "format": "date-time",
             "type": "string"
           },
-          "display_name": {
+          "event_at": {
+            "format": "date-time",
             "type": "string"
           },
-          "enabled": {
-            "type": "boolean"
+          "finished_at": {
+            "format": "date-time",
+            "type": "string"
           },
-          "events": {
+          "jobs": {
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/CIJobView"
             },
             "type": "array"
           },
-          "id": {
+          "last_event": {
             "type": "string"
           },
-          "provider": {
+          "message": {
             "type": "string"
           },
-          "ref_filter": {
+          "stale": {
+            "type": "boolean"
+          },
+          "started_at": {
+            "format": "date-time",
             "type": "string"
           },
-          "repo_id": {
+          "state": {
             "type": "string"
           },
+          "terminal": {
+            "type": "boolean"
+          },
           "updated_at": {
             "format": "date-time",
             "type": "string"
+          },
+          "web_url": {
+            "type": "string"
           }
         },
         "required": [
-          "id",
-          "repo_id",
-          "provider",
-          "display_name",
+          "bk_build_uuid",
           "bk_organization",
           "bk_pipeline",
-          "ref_filter",
-          "events",
-          "enabled",
-          "created_at",
-          "updated_at"
+          "build_number",
+          "state",
+          "commit",
+          "branch",
+          "message",
+          "web_url",
+          "last_event",
+          "event_at",
+          "terminal",
+          "stale",
+          "updated_at",
+          "jobs"
         ],
         "type": "object"
       },
-      "Cluster": {
+      "CIJobView": {
         "additionalProperties": true,
         "properties": {
-          "apiUrl": {
+          "bk_job_id": {
             "type": "string"
           },
-          "isDefault": {
-            "type": "boolean"
+          "exit_status": {
+            "format": "int64",
+            "type": "integer"
           },
-          "jurisdiction": {
+          "finished_at": {
+            "format": "date-time",
             "type": "string"
           },
-          "publicUrl": {
+          "name": {
             "type": "string"
           },
-          "slug": {
+          "started_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "state": {
+            "type": "string"
+          },
+          "step_key": {
+            "type": "string"
+          },
+          "type": {
             "type": "string"
           }
         },
         "required": [
-          "slug",
-          "jurisdiction",
-          "publicUrl",
-          "isDefault"
+          "bk_job_id",
+          "type",
+          "name",
+          "step_key",
+          "state"
         ],
         "type": "object"
       },
-      "CompleteOnboardingOutputBody": {
+      "CIProviderDescriptor": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CompleteOnboardingOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "enrollable": {
+            "description": "Whether this org can enrol into this provider right now",
+            "type": "boolean"
+          },
+          "fields": {
+            "description": "Form fields, in the order a client should render them",
+            "items": {
+              "$ref": "#/components/schemas/CIProviderField"
+            },
+            "type": "array"
+          },
+          "label": {
+            "description": "Human-readable provider name",
             "type": "string"
           },
-          "needsOnboarding": {
-            "description": "Always false after onboarding completion is recorded.",
-            "type": "boolean"
+          "modes": {
+            "description": "Ways of enrolling; exactly one is marked default",
+            "items": {
+              "$ref": "#/components/schemas/CIProviderMode"
+            },
+            "type": "array"
+          },
+          "name": {
+            "description": "Provider key, posted back as the request's provider",
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why enrolment is unavailable; set only when enrollable is false",
+            "type": "string"
           }
         },
         "required": [
-          "needsOnboarding"
+          "name",
+          "label",
+          "enrollable",
+          "modes",
+          "fields"
         ],
         "type": "object"
       },
-      "CreateBindingInputBody": {
+      "CIProviderField": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateBindingInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "help": {
+            "description": "Longer explanation shown beneath the field",
             "type": "string"
           },
-          "attributeFilter": {
-            "description": "Exact-match key/value map; empty filter matches any token."
+          "key": {
+            "description": "Body key this field's value posts under",
+            "type": "string"
           },
-          "providerId": {
-            "minLength": 1,
+          "kind": {
+            "description": "Widget to render: text, select, secret, bool",
+            "type": "string"
+          },
+          "label": {
+            "description": "Human-readable field label",
+            "type": "string"
+          },
+          "options": {
+            "description": "Choices for a select field; absent for every other kind",
+            "items": {
+              "$ref": "#/components/schemas/CIProviderOption"
+            },
+            "type": "array"
+          },
+          "placeholder": {
+            "description": "Placeholder text for an empty field",
+            "type": "string"
+          },
+          "required_in": {
+            "description": "Mode keys this field is required in; empty means never required",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "target": {
+            "description": "Where the value goes: body (top level) or config (opaque map)",
             "type": "string"
           }
         },
         "required": [
-          "providerId"
+          "key",
+          "target",
+          "kind",
+          "label",
+          "required_in"
         ],
         "type": "object"
       },
-      "CreateMirrorInputBody": {
+      "CIProviderMode": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateMirrorInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
+          "default": {
+            "description": "Whether a client should preselect this mode",
+            "type": "boolean"
           },
-          "clusterHost": {
-            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
-            "minLength": 1,
+          "help": {
+            "description": "Longer explanation of what this mode does",
             "type": "string"
           },
-          "owner": {
-            "minLength": 1,
+          "key": {
+            "description": "Mode key to post back as the request's mode",
             "type": "string"
           },
-          "provider": {
-            "enum": [
-              "github"
-            ],
+          "label": {
+            "description": "Human-readable label",
+            "type": "string"
+          }
+        },
+        "required": [
+          "key",
+          "label"
+        ],
+        "type": "object"
+      },
+      "CIProviderOption": {
+        "additionalProperties": true,
+        "properties": {
+          "label": {
+            "description": "Human-readable label",
             "type": "string"
           },
-          "repo": {
-            "minLength": 1,
+          "value": {
+            "description": "Value to post back for this choice",
             "type": "string"
           }
         },
         "required": [
-          "provider",
-          "owner",
-          "repo",
-          "clusterHost"
+          "value",
+          "label"
         ],
         "type": "object"
       },
-      "CreateOrgInputBody": {
+      "CISetupBlock": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateOrgInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "content": {
+            "description": "The content itself, ready to use verbatim",
             "type": "string"
           },
-          "name": {
-            "description": "Display name.",
-            "maxLength": 100,
-            "minLength": 1,
+          "format": {
+            "description": "The content's syntax, for highlighting: yaml, json",
             "type": "string"
           },
-          "region": {
-            "description": "Jurisdiction slug; defaults to the server's home jurisdiction.",
+          "heading": {
+            "description": "Short instruction naming what to do with the content",
             "type": "string"
           }
         },
         "required": [
-          "name"
+          "heading",
+          "format",
+          "content"
         ],
         "type": "object"
       },
-      "CreateProjectInputBody": {
+      "CIWebhookAuditActor": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateProjectInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "account_id": {
+            "description": "Entire account ULID that performed the action",
             "type": "string"
           },
-          "name": {
-            "maxLength": 100,
-            "minLength": 1,
+          "handle": {
+            "description": "Actor's primary handle; empty when they have none",
             "type": "string"
           },
-          "ownerId": {
-            "minLength": 1,
+          "handle_provider": {
+            "description": "Provider the handle came from: github, workos, system",
             "type": "string"
-          },
-          "ownerType": {
-            "enum": [
-              "org",
-              "account"
-            ],
+          }
+        },
+        "required": [
+          "account_id"
+        ],
+        "type": "object"
+      },
+      "CIWebhookAuditEventView": {
+        "additionalProperties": true,
+        "properties": {
+          "actor": {
+            "$ref": "#/components/schemas/CIWebhookAuditActor",
+            "description": "Who performed the action"
+          },
+          "event_type": {
+            "description": "ci_webhook_enrolled | ci_webhook_updated | ci_webhook_deleted | ci_webhook_identity_rolled_back | ci_webhook_identity_orphaned",
             "type": "string"
           },
-          "region": {
+          "id": {
+            "description": "Audit event ULID",
+            "type": "string"
+          },
+          "metadata": {
+            "additionalProperties": {},
+            "description": "Event detail as recorded, e.g. bk_organization/bk_pipeline",
+            "type": "object"
+          },
+          "occurred_at": {
+            "description": "When the action was recorded (UTC)",
+            "format": "date-time",
             "type": "string"
           }
         },
         "required": [
-          "name",
-          "ownerType",
-          "ownerId"
+          "id",
+          "event_type",
+          "actor",
+          "occurred_at"
         ],
         "type": "object"
       },
-      "CreateRepoCIWebhookInputBody": {
+      "CIWebhookView": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreateRepoCIWebhookInputBody.json"
+              "/api/v1/schemas/CIWebhookView.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "bk_cluster_id": {
-            "minLength": 1,
-            "type": "string"
-          },
           "bk_organization": {
-            "minLength": 1,
             "type": "string"
           },
           "bk_pipeline": {
             "type": "string"
           },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
           "display_name": {
             "type": "string"
           },
+          "enabled": {
+            "type": "boolean"
+          },
           "events": {
             "items": {
               "type": "string"
             },
             "type": "array"
           },
+          "id": {
+            "type": "string"
+          },
           "provider": {
-            "enum": [
-              "buildkite"
-            ],
             "type": "string"
           },
+          "publish_checks": {
+            "type": "boolean"
+          },
           "ref_filter": {
             "type": "string"
+          },
+          "repo_id": {
+            "type": "string"
+          },
+          "updated_at": {
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
+          "id",
+          "repo_id",
           "provider",
+          "display_name",
           "bk_organization",
-          "bk_cluster_id"
+          "bk_pipeline",
+          "ref_filter",
+          "events",
+          "enabled",
+          "publish_checks",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "CreateRepoInputBody": {
+      "Cluster": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/CreateRepoInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "apiUrl": {
             "type": "string"
           },
-          "clusterHost": {
-            "description": "Public host of the cluster to pin the repo to (e.g. royalcanin.partial.to); empty lands on the jurisdiction default.",
-            "type": "string"
+          "isDefault": {
+            "type": "boolean"
           },
-          "name": {
-            "minLength": 1,
+          "jurisdiction": {
             "type": "string"
           },
-          "objectFormat": {
-            "description": "Hash format; defaults to sha1.",
-            "enum": [
-              "sha1",
-              "sha256"
-            ],
+          "publicUrl": {
             "type": "string"
           },
-          "projectId": {
-            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+          "slug": {
             "type": "string"
           }
         },
         "required": [
-          "projectId",
-          "name"
+          "slug",
+          "jurisdiction",
+          "publicUrl",
+          "isDefault"
         ],
         "type": "object"
       },
-      "CreateServiceAccountInputBody": {
+      "CompleteOnboardingOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreateServiceAccountInputBody.json"
+              "/api/v1/schemas/CompleteOnboardingOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "name": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "orgId": {
-            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-            "type": "string"
+          "needsOnboarding": {
+            "description": "Always false after onboarding completion is recorded.",
+            "type": "boolean"
           }
         },
         "required": [
-          "orgId",
-          "name"
+          "needsOnboarding"
         ],
         "type": "object"
       },
-      "CreatedMirror": {
+      "ConnectOrgCIBuildkiteCredentialInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreatedMirror.json"
+              "/api/v1/schemas/ConnectOrgCIBuildkiteCredentialInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "created": {
-            "description": "true on fresh creation; false when an existing mirror was returned.",
-            "type": "boolean"
-          },
-          "empty": {
-            "description": "Deprecated: always false. Poll the mirror status instead — an empty upstream still reaches 'ready'.",
-            "type": "boolean"
-          },
-          "mirrorId": {
-            "type": "string"
-          },
-          "mirrorUrl": {
+          "bk_api_token": {
+            "minLength": 1,
             "type": "string"
           },
-          "publicUrl": {
+          "bk_organization": {
+            "minLength": 1,
             "type": "string"
-          },
-          "suspended": {
-            "description": "true when an existing placement was returned that an admin suspended.",
-            "type": "boolean"
           }
         },
         "required": [
-          "mirrorId",
-          "mirrorUrl",
-          "publicUrl",
-          "created",
-          "empty",
-          "suspended"
+          "bk_organization",
+          "bk_api_token"
         ],
         "type": "object"
       },
-      "DeletionBlocker": {
+      "CreateBindingInputBody": {
         "additionalProperties": true,
         "properties": {
-          "deletable": {
-            "description": "True when the account can self-serve delete this org (it is the only member and the org has no projects). When false, the org has other members or data and must be transferred/removed via support. The UI should offer a delete action only when this is true.",
-            "type": "boolean"
-          },
-          "id": {
-            "description": "Resource ID (org ULID).",
-            "type": "string"
-          },
-          "kind": {
-            "description": "Blocker kind. Currently always 'owned_org'.",
-            "enum": [
-              "owned_org"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateBindingInputBody.json"
             ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "message": {
-            "description": "Copy explaining how to clear the blocker.",
-            "type": "string"
+          "attributeFilter": {
+            "description": "Exact-match key/value map; empty filter matches any token."
           },
-          "name": {
-            "description": "Human-readable resource name.",
+          "providerId": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "kind",
-          "id",
-          "name",
-          "deletable",
-          "message"
+          "providerId"
         ],
         "type": "object"
       },
-      "DeletionGrant": {
+      "CreateMirrorInputBody": {
         "additionalProperties": true,
         "properties": {
-          "jurisdiction": {
-            "description": "Region the repo lives in (us/eu/au); empty for project grants.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateMirrorInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "resourceId": {
-            "description": "Granted resource ULID.",
+          "clusterHost": {
+            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
+            "minLength": 1,
             "type": "string"
           },
-          "resourceName": {
-            "description": "Granted resource name.",
+          "owner": {
+            "minLength": 1,
             "type": "string"
           },
-          "resourceType": {
-            "description": "Granted resource type.",
+          "provider": {
             "enum": [
-              "project",
-              "repo"
+              "github"
             ],
             "type": "string"
           },
-          "role": {
-            "description": "Granted role.",
+          "repo": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "resourceType",
-          "resourceId",
-          "resourceName",
-          "role"
+          "provider",
+          "owner",
+          "repo",
+          "clusterHost"
         ],
         "type": "object"
       },
-      "DeletionMembership": {
+      "CreateMirrorRequestInputBody": {
         "additionalProperties": true,
         "properties": {
-          "name": {
-            "description": "Org name.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateMirrorRequestInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "orgId": {
-            "description": "Org ULID.",
+          "clusterHost": {
+            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
+            "minLength": 1,
+            "type": "string"
+          },
+          "owner": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "provider": {
+            "enum": [
+              "github"
+            ],
+            "type": "string"
+          },
+          "repo": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "orgId",
-          "name"
+          "provider",
+          "owner",
+          "repo",
+          "clusterHost"
         ],
         "type": "object"
       },
-      "DeletionRepo": {
+      "CreateNativeMirrorInputBody": {
         "additionalProperties": true,
         "properties": {
-          "cluster": {
-            "description": "Cluster slug the repo is placed on, if known.",
-            "type": "string"
-          },
-          "id": {
-            "description": "Repo ULID.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateNativeMirrorInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "name": {
-            "description": "Repo name.",
+          "clusterSlug": {
+            "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "name"
+          "clusterSlug"
         ],
         "type": "object"
       },
-      "ErrorDetail": {
+      "CreateOrgInputBody": {
         "additionalProperties": true,
         "properties": {
-          "location": {
-            "description": "Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/CreateOrgInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "message": {
-            "description": "Error message text",
+          "name": {
+            "description": "Display name.",
+            "maxLength": 100,
+            "minLength": 1,
             "type": "string"
           },
-          "value": {
-            "description": "The value at the given location"
+          "region": {
+            "description": "Jurisdiction slug; defaults to the server's home jurisdiction.",
+            "type": "string"
           }
         },
+        "required": [
+          "name"
+        ],
         "type": "object"
       },
-      "ErrorModel": {
+      "CreateProjectInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ErrorModel.json"
+              "/api/v1/schemas/CreateProjectInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "detail": {
-            "description": "A human-readable explanation specific to this occurrence of the problem.",
-            "examples": [
-              "Property foo is required but is missing."
-            ],
+          "name": {
+            "maxLength": 100,
+            "minLength": 1,
             "type": "string"
           },
-          "errors": {
-            "description": "Optional list of individual error details",
-            "items": {
-              "$ref": "#/components/schemas/ErrorDetail"
-            },
-            "type": "array"
-          },
-          "instance": {
-            "description": "A URI reference that identifies the specific occurrence of the problem.",
-            "examples": [
-              "https://example.com/error-log/abc123"
-            ],
-            "format": "uri",
+          "ownerId": {
+            "minLength": 1,
             "type": "string"
           },
-          "status": {
-            "description": "HTTP status code",
-            "examples": [
-              400
-            ],
-            "format": "int64",
-            "type": "integer"
-          },
-          "title": {
-            "description": "A short, human-readable summary of the problem type. This value should not change between occurrences of the error.",
-            "examples": [
-              "Bad Request"
+          "ownerType": {
+            "enum": [
+              "org",
+              "account"
             ],
             "type": "string"
           },
-          "type": {
-            "default": "about:blank",
-            "description": "A URI reference to human-readable documentation for the error.",
-            "examples": [
-              "https://example.com/errors/example"
-            ],
-            "format": "uri",
+          "region": {
             "type": "string"
           }
         },
+        "required": [
+          "name",
+          "ownerType",
+          "ownerId"
+        ],
         "type": "object"
       },
-      "GetDeletionPreviewOutputBody": {
+      "CreateRepoCIWebhookBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetDeletionPreviewOutputBody.json"
+              "/api/v1/schemas/CreateRepoCIWebhookBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "blocked": {
-            "description": "True when Blockers is non-empty: DELETE /me will be refused with 409.",
+          "auth_plugin_ref": {
+            "description": "entire-core-auth Buildkite plugin ref this pipeline is built with: the registered cluster's override, else the pinned default; goes in the bootstrap config's plugins list",
+            "type": "string"
+          },
+          "automation_id": {
+            "description": "Automation (aut_<ulid>) the enrolled pipeline's builds exchange their OIDC token for; goes in the bootstrap config as the automation:<id> resource (ENTIRE_CORE_AUTH_RESOURCE)",
+            "type": "string"
+          },
+          "bk_organization": {
+            "type": "string"
+          },
+          "bk_pipeline": {
+            "type": "string"
+          },
+          "core_url": {
+            "description": "entire-core base URL the bootstrap auth plugin talks to; goes in the bootstrap config as ENTIRE_CORE_AUTH_URL",
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "display_name": {
+            "type": "string"
+          },
+          "enabled": {
             "type": "boolean"
           },
-          "blockers": {
-            "description": "Resources that must be resolved before deletion (owned orgs).",
+          "events": {
             "items": {
-              "$ref": "#/components/schemas/DeletionBlocker"
+              "type": "string"
             },
             "type": "array"
           },
-          "willDelete": {
-            "$ref": "#/components/schemas/WillDeleteStruct"
+          "id": {
+            "type": "string"
           },
-          "willUnlink": {
-            "$ref": "#/components/schemas/WillUnlinkStruct"
+          "provider": {
+            "type": "string"
+          },
+          "publish_checks": {
+            "type": "boolean"
+          },
+          "ref_filter": {
+            "type": "string"
+          },
+          "repo_id": {
+            "type": "string"
+          },
+          "setup": {
+            "$ref": "#/components/schemas/CISetupBlock",
+            "description": "What to do next, rendered ready to use. Present on a self-managed enrolment."
+          },
+          "updated_at": {
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
-          "blocked",
-          "blockers",
-          "willDelete",
-          "willUnlink"
+          "automation_id",
+          "core_url",
+          "auth_plugin_ref",
+          "id",
+          "repo_id",
+          "provider",
+          "display_name",
+          "bk_organization",
+          "bk_pipeline",
+          "ref_filter",
+          "events",
+          "enabled",
+          "publish_checks",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "GetMeOutputBody": {
+      "CreateRepoCIWebhookInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetMeOutputBody.json"
+              "/api/v1/schemas/CreateRepoCIWebhookInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "auth": {
-            "$ref": "#/components/schemas/MeAuth"
+          "bk_cluster_id": {
+            "type": "string"
           },
-          "deletion": {
-            "$ref": "#/components/schemas/MeDeletion",
-            "description": "Present only when a deletion is pending; carries the cooldown window."
+          "bk_force_rescaffold": {
+            "description": "Overwrite an existing pipeline's configuration with the generated bootstrap step, DISCARDING manual edits. Repairs a pipeline left naming an automation that a teardown retired. Requires bk_provisioning_token; refused on a self-managed pipeline.",
+            "type": "boolean"
           },
-          "global": {
-            "$ref": "#/components/schemas/MeGlobal"
+          "bk_organization": {
+            "type": "string"
           },
-          "jurisdiction": {
+          "bk_pipeline": {
+            "type": "string"
+          },
+          "bk_pipeline_self_managed": {
+            "description": "The customer created and maintains this Buildkite pipeline. entire never creates, reconciles or reads it, and bk_provisioning_token is neither required nor accepted.",
+            "type": "boolean"
+          },
+          "bk_provisioning_token": {
+            "description": "Transient Buildkite token (write_pipelines) to create the pipeline; write-only, never stored. Required on first enroll; omit on a routing-only re-enroll. Refused for an existing pipeline unless bk_force_rescaffold is also set.",
+            "type": "string"
+          },
+          "config": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Provider-specific values from the providers listing; opaque to core. For buildkite: cluster_id, provisioning_token, force_rescaffold.",
+            "type": "object"
+          },
+          "display_name": {
             "type": "string"
           },
+          "events": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
           "mode": {
-            "enum": [
-              "standalone",
-              "global",
-              "regional"
-            ],
+            "description": "How to enrol, from the chosen provider's modes. For buildkite: self_managed or provisioned.",
             "type": "string"
           },
-          "regional": {
-            "$ref": "#/components/schemas/MeRegional"
+          "provider": {
+            "type": "string"
           },
-          "regionalUnavailable": {
-            "$ref": "#/components/schemas/MeRegionalUnavailable"
+          "provider_account": {
+            "description": "Vendor-side account to enrol against (for buildkite, the organization slug). Use with provider/mode/config; omit when sending the bk_* fields.",
+            "type": "string"
+          },
+          "ref_filter": {
+            "type": "string"
+          },
+          "target_ref": {
+            "description": "Vendor-side build target (for buildkite, the pipeline slug). Defaults to a slug derived from the repo.",
+            "type": "string"
           }
         },
         "required": [
-          "global",
-          "auth"
+          "provider"
         ],
         "type": "object"
       },
-      "GetOnboardingStatusOutputBody": {
+      "CreateRepoInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetOnboardingStatusOutputBody.json"
+              "/api/v1/schemas/CreateRepoInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "needsOnboarding": {
-            "description": "True until the account completes web onboarding at least once.",
-            "type": "boolean"
+          "clusterHost": {
+            "description": "Public host of the cluster to pin the repo to (e.g. royalcanin.partial.to); empty lands on the jurisdiction default.",
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "objectFormat": {
+            "description": "Hash format; defaults to sha1.",
+            "enum": [
+              "sha1",
+              "sha256"
+            ],
+            "type": "string"
+          },
+          "projectId": {
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+            "type": "string"
           }
         },
         "required": [
-          "needsOnboarding"
+          "projectId",
+          "name"
         ],
         "type": "object"
       },
-      "GetPermissionsOutputBody": {
+      "CreateServiceAccountInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetPermissionsOutputBody.json"
+              "/api/v1/schemas/CreateServiceAccountInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "explain": {
-            "additionalProperties": {},
-            "type": "object"
-          },
-          "permissions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "resourceId": {
+          "name": {
+            "minLength": 1,
             "type": "string"
           },
-          "resourceType": {
+          "orgId": {
+            "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
             "type": "string"
           }
         },
         "required": [
-          "resourceType",
-          "resourceId"
+          "orgId",
+          "name"
         ],
         "type": "object"
       },
-      "GetRepoVisibilityOutputBody": {
+      "CreatedMirror": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GetRepoVisibilityOutputBody.json"
+              "/api/v1/schemas/CreatedMirror.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "visibility": {
-            "enum": [
-              "public",
-              "private"
-            ],
+          "created": {
+            "description": "true on fresh creation; false when an existing mirror was returned.",
+            "type": "boolean"
+          },
+          "empty": {
+            "description": "Deprecated: always false. Poll the mirror status instead — an empty upstream still reaches 'ready'.",
+            "type": "boolean"
+          },
+          "mirrorId": {
             "type": "string"
-          }
-        },
-        "required": [
-          "visibility"
-        ],
-        "type": "object"
-      },
-      "GetTopologyOutputBody": {
-        "additionalProperties": true,
-        "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GetTopologyOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          },
+          "mirrorUrl": {
             "type": "string"
           },
-          "jurisdictions": {
-            "items": {
-              "$ref": "#/components/schemas/TopologyJurisdiction"
-            },
-            "type": "array"
+          "publicUrl": {
+            "type": "string"
+          },
+          "suspended": {
+            "description": "true when an existing placement was returned that an admin suspended.",
+            "type": "boolean"
           }
         },
         "required": [
-          "jurisdictions"
+          "mirrorId",
+          "mirrorUrl",
+          "publicUrl",
+          "created",
+          "empty",
+          "suspended"
         ],
         "type": "object"
       },
-      "GetVersionOutputBody": {
+      "DeletionBlocker": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GetVersionOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "deletable": {
+            "description": "True when the account can self-serve delete this org (it is the only member and the org has no projects). When false, the org has other members or data and must be transferred/removed via support. The UI should offer a delete action only when this is true.",
+            "type": "boolean"
+          },
+          "id": {
+            "description": "Resource ID (org ULID).",
             "type": "string"
           },
-          "mode": {
-            "description": "Server mode.",
+          "kind": {
+            "description": "Blocker kind. Currently always 'owned_org'.",
             "enum": [
-              "standalone",
-              "global",
-              "regional"
+              "owned_org"
             ],
             "type": "string"
           },
-          "version": {
-            "description": "Git commit SHA of the running entire-core binary, or \"dev\" for an untagged local build.",
+          "message": {
+            "description": "Copy explaining how to clear the blocker.",
+            "type": "string"
+          },
+          "name": {
+            "description": "Human-readable resource name.",
             "type": "string"
           }
         },
         "required": [
-          "version"
+          "kind",
+          "id",
+          "name",
+          "deletable",
+          "message"
         ],
         "type": "object"
       },
-      "GrantProjectAccessInputBody": {
+      "DeletionGrant": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantProjectAccessInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "jurisdiction": {
+            "description": "Region the repo lives in (us/eu/au); empty for project grants.",
             "type": "string"
           },
-          "granteeType": {
-            "default": "account",
-            "enum": [
-              "account"
-            ],
+          "resourceId": {
+            "description": "Granted resource ULID.",
             "type": "string"
           },
-          "provider": {
-            "minLength": 1,
+          "resourceName": {
+            "description": "Granted resource name.",
             "type": "string"
           },
-          "providerUserId": {
-            "minLength": 1,
+          "resourceType": {
+            "description": "Granted resource type.",
+            "enum": [
+              "project",
+              "repo"
+            ],
             "type": "string"
           },
           "role": {
-            "enum": [
-              "reader",
-              "writer",
-              "admin"
-            ],
+            "description": "Granted role.",
             "type": "string"
           }
         },
         "required": [
-          "provider",
-          "providerUserId",
+          "resourceType",
+          "resourceId",
+          "resourceName",
           "role"
         ],
         "type": "object"
       },
-      "GrantProjectAccessOutputBody": {
+      "DeletionMembership": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantProjectAccessOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "name": {
+            "description": "Org name.",
             "type": "string"
           },
-          "status": {
+          "orgId": {
+            "description": "Org ULID.",
             "type": "string"
           }
         },
         "required": [
-          "status"
+          "orgId",
+          "name"
         ],
         "type": "object"
       },
-      "GrantRepoAccessInputBody": {
+      "DeletionRepo": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantRepoAccessInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
-            "type": "string"
-          },
-          "granteeType": {
-            "default": "account",
-            "enum": [
-              "account"
-            ],
-            "type": "string"
-          },
-          "provider": {
-            "minLength": 1,
+          "cluster": {
+            "description": "Cluster slug the repo is placed on, if known.",
             "type": "string"
           },
-          "providerUserId": {
-            "minLength": 1,
+          "id": {
+            "description": "Repo ULID.",
             "type": "string"
           },
-          "role": {
-            "enum": [
-              "reader",
-              "writer",
-              "admin",
-              "ci_manager"
-            ],
+          "name": {
+            "description": "Repo name.",
             "type": "string"
           }
         },
         "required": [
-          "provider",
-          "providerUserId",
-          "role"
+          "id",
+          "name"
         ],
         "type": "object"
       },
-      "GrantRepoAccessOutputBody": {
+      "ErrorDetail": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantRepoAccessOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "location": {
+            "description": "Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id'",
             "type": "string"
           },
-          "status": {
+          "message": {
+            "description": "Error message text",
             "type": "string"
+          },
+          "value": {
+            "description": "The value at the given location"
           }
         },
-        "required": [
-          "status"
-        ],
         "type": "object"
       },
-      "GrantServiceAccountAccessInputBody": {
+      "ErrorModel": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/GrantServiceAccountAccessInputBody.json"
+              "/api/v1/schemas/ErrorModel.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "resourceId": {
-            "minLength": 1,
-            "type": "string"
-          },
-          "resourceType": {
-            "enum": [
-              "repo",
-              "project"
+          "detail": {
+            "description": "A human-readable explanation specific to this occurrence of the problem.",
+            "examples": [
+              "Property foo is required but is missing."
             ],
             "type": "string"
           },
-          "role": {
-            "enum": [
-              "reader",
-              "writer",
-              "admin"
+          "errors": {
+            "description": "Optional list of individual error details",
+            "items": {
+              "$ref": "#/components/schemas/ErrorDetail"
+            },
+            "type": "array"
+          },
+          "instance": {
+            "description": "A URI reference that identifies the specific occurrence of the problem.",
+            "examples": [
+              "https://example.com/error-log/abc123"
             ],
+            "format": "uri",
+            "type": "string"
+          },
+          "status": {
+            "description": "HTTP status code",
+            "examples": [
+              400
+            ],
+            "format": "int64",
+            "type": "integer"
+          },
+          "title": {
+            "description": "A short, human-readable summary of the problem type. This value should not change between occurrences of the error.",
+            "examples": [
+              "Bad Request"
+            ],
+            "type": "string"
+          },
+          "type": {
+            "default": "about:blank",
+            "description": "A URI reference to human-readable documentation for the error.",
+            "examples": [
+              "https://example.com/errors/example"
+            ],
+            "format": "uri",
             "type": "string"
           }
         },
-        "required": [
-          "resourceType",
-          "resourceId",
-          "role"
-        ],
         "type": "object"
       },
-      "GrantServiceAccountAccessOutputBody": {
+      "ForgeRepoIdentity": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/GrantServiceAccountAccessOutputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "forge": {
             "type": "string"
           },
-          "status": {
+          "repo_id": {
             "type": "string"
           }
         },
         "required": [
-          "status"
+          "forge",
+          "repo_id"
         ],
         "type": "object"
       },
-      "ListAuditEventsOutputBody": {
+      "GetDeletionPreviewOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListAuditEventsOutputBody.json"
+              "/api/v1/schemas/GetDeletionPreviewOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "events": {
+          "blocked": {
+            "description": "True when Blockers is non-empty: DELETE /me will be refused with 409.",
+            "type": "boolean"
+          },
+          "blockers": {
+            "description": "Resources that must be resolved before deletion (owned orgs).",
             "items": {
-              "$ref": "#/components/schemas/AuditEvent"
+              "$ref": "#/components/schemas/DeletionBlocker"
             },
             "type": "array"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
+          "willDelete": {
+            "$ref": "#/components/schemas/WillDeleteStruct"
+          },
+          "willUnlink": {
+            "$ref": "#/components/schemas/WillUnlinkStruct"
           }
         },
         "required": [
-          "events"
+          "blocked",
+          "blockers",
+          "willDelete",
+          "willUnlink"
         ],
         "type": "object"
       },
-      "ListAvailableMirrorsOutputBody": {
+      "GetMeOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListAvailableMirrorsOutputBody.json"
+              "/api/v1/schemas/GetMeOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "available": {
-            "items": {
-              "$ref": "#/components/schemas/AvailableMirror"
-            },
-            "type": "array"
+          "auth": {
+            "$ref": "#/components/schemas/MeAuth"
+          },
+          "deletion": {
+            "$ref": "#/components/schemas/MeDeletion",
+            "description": "Present only when a deletion is pending; carries the cooldown window."
+          },
+          "global": {
+            "$ref": "#/components/schemas/MeGlobal"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mode": {
+            "enum": [
+              "global",
+              "regional"
+            ],
+            "type": "string"
+          },
+          "regional": {
+            "$ref": "#/components/schemas/MeRegional"
+          },
+          "regionalUnavailable": {
+            "$ref": "#/components/schemas/MeRegionalUnavailable"
           }
         },
         "required": [
-          "available"
+          "global",
+          "auth"
         ],
         "type": "object"
       },
-      "ListBindingsOutputBody": {
+      "GetOnboardingStatusOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListBindingsOutputBody.json"
+              "/api/v1/schemas/GetOnboardingStatusOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "bindings": {
-            "items": {
-              "$ref": "#/components/schemas/Binding"
-            },
-            "type": "array"
+          "cliLoggedIn": {
+            "description": "True once the account has completed a CLI login (either grant type).",
+            "type": "boolean"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
+          "needsOnboarding": {
+            "description": "True until the account completes web onboarding at least once.",
+            "type": "boolean"
           }
         },
         "required": [
-          "bindings"
+          "needsOnboarding",
+          "cliLoggedIn"
         ],
         "type": "object"
       },
-      "ListClustersOutputBody": {
+      "GetPermissionsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListClustersOutputBody.json"
+              "/api/v1/schemas/GetPermissionsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "clusters": {
+          "explain": {
+            "additionalProperties": {},
+            "type": "object"
+          },
+          "permissions": {
             "items": {
-              "$ref": "#/components/schemas/Cluster"
+              "enum": [
+                "manage",
+                "view",
+                "read",
+                "write",
+                "push",
+                "pull",
+                "create_repo",
+                "admin",
+                "admin_read"
+              ],
+              "type": "string"
             },
             "type": "array"
+          },
+          "resourceId": {
+            "type": "string"
+          },
+          "resourceType": {
+            "type": "string"
           }
         },
         "required": [
-          "clusters"
+          "resourceType",
+          "resourceId"
         ],
         "type": "object"
       },
-      "ListMirrorCollaboratorsOutputBody": {
+      "GetRepoVisibilityOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListMirrorCollaboratorsOutputBody.json"
+              "/api/v1/schemas/GetRepoVisibilityOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "collaborators": {
-            "items": {
-              "$ref": "#/components/schemas/MirrorCollaborator"
-            },
-            "type": "array"
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
+            "type": "string"
           }
         },
         "required": [
-          "collaborators"
+          "visibility"
         ],
         "type": "object"
       },
-      "ListMirrorsOutputBody": {
+      "GetTopologyOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListMirrorsOutputBody.json"
+              "/api/v1/schemas/GetTopologyOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "mirrors": {
+          "jurisdictions": {
             "items": {
-              "$ref": "#/components/schemas/Mirror"
+              "$ref": "#/components/schemas/TopologyJurisdiction"
             },
             "type": "array"
-          },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
           }
         },
         "required": [
-          "mirrors"
+          "jurisdictions"
         ],
         "type": "object"
       },
-      "ListOIDCProvidersOutputBody": {
+      "GetVersionOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOIDCProvidersOutputBody.json"
+              "/api/v1/schemas/GetVersionOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "mode": {
+            "description": "Server mode.",
+            "enum": [
+              "global",
+              "regional"
+            ],
             "type": "string"
           },
-          "providers": {
-            "items": {
-              "$ref": "#/components/schemas/OIDCProvider"
-            },
-            "type": "array"
+          "version": {
+            "description": "Git commit SHA of the running entire-core binary, or \"dev\" for an untagged local build.",
+            "type": "string"
           }
         },
         "required": [
-          "providers"
+          "version"
         ],
         "type": "object"
       },
-      "ListOrgMembersOutputBody": {
+      "GrantProjectAccessInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOrgMembersOutputBody.json"
+              "/api/v1/schemas/GrantProjectAccessInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "members": {
-            "items": {
-              "$ref": "#/components/schemas/Membership"
-            },
-            "type": "array"
+          "granteeType": {
+            "default": "account",
+            "enum": [
+              "account"
+            ],
+            "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "provider": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "providerUserId": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "role": {
+            "enum": [
+              "reader",
+              "writer",
+              "admin"
+            ],
             "type": "string"
           }
         },
         "required": [
-          "members"
+          "provider",
+          "providerUserId",
+          "role"
         ],
         "type": "object"
       },
-      "ListOrgProjectsOutputBody": {
+      "GrantProjectAccessOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOrgProjectsOutputBody.json"
+              "/api/v1/schemas/GrantProjectAccessOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "status": {
             "type": "string"
-          },
-          "project": {
-            "$ref": "#/components/schemas/Project"
-          },
-          "projects": {
-            "items": {
-              "$ref": "#/components/schemas/Project"
-            },
-            "type": "array"
           }
         },
+        "required": [
+          "status"
+        ],
         "type": "object"
       },
-      "ListOrgsOutputBody": {
+      "GrantRepoAccessInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListOrgsOutputBody.json"
+              "/api/v1/schemas/GrantRepoAccessInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "granteeType": {
+            "default": "account",
+            "enum": [
+              "account"
+            ],
             "type": "string"
           },
-          "org": {
-            "$ref": "#/components/schemas/Org"
+          "provider": {
+            "minLength": 1,
+            "type": "string"
           },
-          "orgs": {
-            "items": {
-              "$ref": "#/components/schemas/Org"
-            },
-            "type": "array"
+          "providerUserId": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "role": {
+            "enum": [
+              "reader",
+              "writer",
+              "admin"
+            ],
+            "type": "string"
           }
         },
+        "required": [
+          "provider",
+          "providerUserId",
+          "role"
+        ],
         "type": "object"
       },
-      "ListProjectMembersOutputBody": {
+      "GrantRepoAccessOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListProjectMembersOutputBody.json"
+              "/api/v1/schemas/GrantRepoAccessOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "members": {
-            "items": {
-              "$ref": "#/components/schemas/ProjectGrant"
-            },
-            "type": "array"
-          },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "status": {
             "type": "string"
           }
         },
         "required": [
-          "members"
+          "status"
         ],
         "type": "object"
       },
-      "ListProjectReposOutputBody": {
+      "GrantServiceAccountAccessInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListProjectReposOutputBody.json"
+              "/api/v1/schemas/GrantServiceAccountAccessInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "resourceId": {
+            "minLength": 1,
             "type": "string"
           },
-          "repo": {
-            "$ref": "#/components/schemas/Repo"
+          "resourceType": {
+            "enum": [
+              "repo",
+              "project"
+            ],
+            "type": "string"
           },
-          "repos": {
-            "items": {
-              "$ref": "#/components/schemas/Repo"
-            },
-            "type": "array"
+          "role": {
+            "enum": [
+              "reader",
+              "writer",
+              "admin"
+            ],
+            "type": "string"
           }
         },
+        "required": [
+          "resourceType",
+          "resourceId",
+          "role"
+        ],
         "type": "object"
       },
-      "ListProjectsOutputBody": {
+      "GrantServiceAccountAccessOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListProjectsOutputBody.json"
+              "/api/v1/schemas/GrantServiceAccountAccessOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
+          "status": {
             "type": "string"
-          },
-          "project": {
-            "$ref": "#/components/schemas/Project"
-          },
-          "projects": {
-            "items": {
-              "$ref": "#/components/schemas/Project"
-            },
-            "type": "array"
           }
         },
+        "required": [
+          "status"
+        ],
         "type": "object"
       },
-      "ListRepoCIWebhooksOutputBody": {
+      "ListAuditEventsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListRepoCIWebhooksOutputBody.json"
+              "/api/v1/schemas/ListAuditEventsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "subscriptions": {
+          "events": {
             "items": {
-              "$ref": "#/components/schemas/CIWebhookView"
+              "$ref": "#/components/schemas/AuditEvent"
             },
             "type": "array"
+          },
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
+            "type": "string"
           }
         },
         "required": [
-          "subscriptions"
+          "events"
         ],
         "type": "object"
       },
-      "ListRepoGrantsOutputBody": {
+      "ListAvailableMirrorsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListRepoGrantsOutputBody.json"
+              "/api/v1/schemas/ListAvailableMirrorsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "grants": {
+          "available": {
             "items": {
-              "$ref": "#/components/schemas/RepoGrant"
+              "$ref": "#/components/schemas/AvailableMirror"
             },
             "type": "array"
-          },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
           }
         },
         "required": [
-          "grants"
+          "available"
         ],
         "type": "object"
       },
-      "ListReposOutputBody": {
+      "ListBindingsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListReposOutputBody.json"
+              "/api/v1/schemas/ListBindingsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
-          },
-          "repos": {
+          "bindings": {
             "items": {
-              "$ref": "#/components/schemas/RepoIndexEntry"
+              "$ref": "#/components/schemas/Binding"
             },
             "type": "array"
           },
-          "truncated": {
-            "type": "boolean"
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
+            "type": "string"
           }
         },
         "required": [
-          "repos",
-          "truncated"
+          "bindings"
         ],
         "type": "object"
       },
-      "ListServiceAccountGrantsOutputBody": {
+      "ListClustersOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListServiceAccountGrantsOutputBody.json"
+              "/api/v1/schemas/ListClustersOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "grants": {
+          "clusters": {
             "items": {
-              "$ref": "#/components/schemas/ServiceAccountGrant"
+              "$ref": "#/components/schemas/Cluster"
             },
             "type": "array"
-          },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
           }
         },
         "required": [
-          "grants"
+          "clusters"
         ],
         "type": "object"
       },
-      "ListServiceAccountsOutputBody": {
+      "ListMirrorCollaboratorsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ListServiceAccountsOutputBody.json"
+              "/api/v1/schemas/ListMirrorCollaboratorsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
-          },
-          "serviceAccounts": {
+          "collaborators": {
             "items": {
-              "$ref": "#/components/schemas/ServiceAccountWithGrants"
+              "$ref": "#/components/schemas/MirrorCollaborator"
             },
             "type": "array"
           }
         },
         "required": [
-          "serviceAccounts"
+          "collaborators"
         ],
         "type": "object"
       },
-      "LookupBySlugOutputBody": {
+      "ListMirrorsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/LookupBySlugOutputBody.json"
+              "/api/v1/schemas/ListMirrorsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "cell": {
-            "type": "string"
-          },
-          "jurisdiction": {
-            "type": "string"
-          },
-          "owner": {
-            "type": "string"
-          },
-          "repo": {
-            "type": "string"
+          "mirrors": {
+            "items": {
+              "$ref": "#/components/schemas/Mirror"
+            },
+            "type": "array"
           },
-          "repoId": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "repoId",
-          "cell",
-          "jurisdiction",
-          "owner",
-          "repo"
+          "mirrors"
         ],
         "type": "object"
       },
-      "LookupRef": {
+      "ListNativeMirrorsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "id": {
-            "minLength": 1,
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListNativeMirrorsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "type": {
-            "description": "Resource type slug; \"org\", \"project\", \"repo\" are enriched, unknown types pass through.",
-            "minLength": 1,
-            "type": "string"
+          "nativeMirrors": {
+            "items": {
+              "$ref": "#/components/schemas/NativeMirrorPlacement"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "type",
-          "id"
+          "nativeMirrors"
         ],
         "type": "object"
       },
-      "LookupRefResult": {
+      "ListOIDCProvidersOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "id": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          },
-          "ownerId": {
-            "type": "string"
-          },
-          "ownerType": {
-            "enum": [
-              "org",
-              "account"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOIDCProvidersOutputBody.json"
             ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "projectId": {
-            "type": "string"
-          },
-          "type": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "url": {
-            "type": "string"
+          "providers": {
+            "items": {
+              "$ref": "#/components/schemas/OIDCProvider"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "type",
-          "id"
+          "providers"
         ],
         "type": "object"
       },
-      "LookupResourcesOutputBody": {
+      "ListOrgCIBuildkiteClustersOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/LookupResourcesOutputBody.json"
+              "/api/v1/schemas/ListOrgCIBuildkiteClustersOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "nextPageToken": {
-            "description": "Pass back to fetch the next page; empty when no more entries.",
-            "type": "string"
-          },
-          "permission": {
-            "type": "string"
-          },
-          "resourceIds": {
+          "clusters": {
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/OrgCIBuildkiteClusterView"
             },
             "type": "array"
-          },
-          "resourceType": {
+          }
+        },
+        "required": [
+          "clusters"
+        ],
+        "type": "object"
+      },
+      "ListOrgCIBuildkiteCredentialsOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgCIBuildkiteCredentialsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "resources": {
+          "credentials": {
             "items": {
-              "$ref": "#/components/schemas/ResourceAccess"
+              "$ref": "#/components/schemas/OrgCIBuildkiteCredentialView"
             },
             "type": "array"
           }
         },
         "required": [
-          "resourceType"
+          "credentials"
         ],
         "type": "object"
       },
-      "MeAuth": {
+      "ListOrgMembersOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "provider": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgMembersOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "providerUserId": {
+          "members": {
+            "items": {
+              "$ref": "#/components/schemas/Membership"
+            },
+            "type": "array"
+          },
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "provider",
-          "providerUserId"
+          "members"
         ],
         "type": "object"
       },
-      "MeDeletion": {
+      "ListOrgProjectsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "cooldownEndsAt": {
-            "description": "When the cooldown elapses and the account becomes eligible for irreversible hard-deletion.",
-            "format": "date-time",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgProjectsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "requestedAt": {
-            "description": "When deletion was requested (deletion_requested_at).",
-            "format": "date-time",
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
+          },
+          "project": {
+            "$ref": "#/components/schemas/Project"
+          },
+          "projects": {
+            "items": {
+              "$ref": "#/components/schemas/Project"
+            },
+            "type": "array"
           }
         },
-        "required": [
-          "requestedAt",
-          "cooldownEndsAt"
-        ],
         "type": "object"
       },
-      "MeGlobal": {
+      "ListOrgsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "accountId": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListOrgsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "avatarUrl": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "createdAt": {
-            "description": "When the account was created (accounts.created_at).",
-            "format": "date-time",
-            "type": "string"
+          "org": {
+            "$ref": "#/components/schemas/Org"
           },
-          "handle": {
+          "orgs": {
+            "items": {
+              "$ref": "#/components/schemas/Org"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "ListProjectMembersOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListProjectMembersOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "handles": {
+          "members": {
             "items": {
-              "$ref": "#/components/schemas/MeIdentityHandle"
+              "$ref": "#/components/schemas/ProjectGrant"
             },
             "type": "array"
           },
-          "homeJurisdiction": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "accountId",
-          "createdAt",
-          "handles"
+          "members"
         ],
         "type": "object"
       },
-      "MeIdentityHandle": {
+      "ListProjectReposOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "email": {
-            "description": "The provider's publicly-visible profile email (from the provider at login; may be empty). NOT the account's contact email.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListProjectReposOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "handle": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "provider": {
-            "type": "string"
+          "repo": {
+            "$ref": "#/components/schemas/Repo"
           },
-          "providerUserId": {
-            "type": "string"
+          "repos": {
+            "items": {
+              "$ref": "#/components/schemas/Repo"
+            },
+            "type": "array"
           }
         },
-        "required": [
-          "provider",
-          "handle",
-          "providerUserId"
-        ],
         "type": "object"
       },
-      "MeRegional": {
+      "ListProjectsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "bio": {
-            "type": "string"
-          },
-          "company": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListProjectsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "displayName": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "email": {
-            "type": "string"
+          "project": {
+            "$ref": "#/components/schemas/Project"
           },
-          "location": {
-            "type": "string"
+          "projects": {
+            "items": {
+              "$ref": "#/components/schemas/Project"
+            },
+            "type": "array"
           }
         },
         "type": "object"
       },
-      "MeRegionalUnavailable": {
+      "ListRepoCIBuildsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "error": {
-            "description": "Always 'foreign_jurisdiction'. Discriminator for client-side state machines.",
-            "enum": [
-              "foreign_jurisdiction"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoCIBuildsOutputBody.json"
             ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "homeCoreUrl": {
-            "description": "Deep link into the home console for this account.",
-            "type": "string"
-          },
-          "jurisdiction": {
-            "description": "The account's home jurisdiction (e.g. 'us', 'eu').",
-            "type": "string"
-          },
-          "message": {
-            "description": "Human-readable copy ready to surface in a UI.",
-            "type": "string"
+          "builds": {
+            "items": {
+              "$ref": "#/components/schemas/CIBuildView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "error",
-          "jurisdiction",
-          "homeCoreUrl",
-          "message"
+          "builds"
         ],
         "type": "object"
       },
-      "Membership": {
+      "ListRepoCIProvidersOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Membership.json"
+              "/api/v1/schemas/ListRepoCIProvidersOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "accountId": {
-            "type": "string"
-          },
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "id": {
-            "type": "string"
-          },
-          "orgId": {
-            "type": "string"
-          },
-          "role": {
-            "type": "string"
-          },
-          "status": {
-            "type": "string"
-          },
-          "workosOrgMembershipId": {
-            "type": "string"
+          "providers": {
+            "items": {
+              "$ref": "#/components/schemas/CIProviderDescriptor"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "id",
-          "accountId",
-          "orgId",
-          "role",
-          "status",
-          "createdAt"
+          "providers"
         ],
         "type": "object"
       },
-      "Mirror": {
+      "ListRepoCIWebhookAuditOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Mirror.json"
+              "/api/v1/schemas/ListRepoCIWebhookAuditOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "cell": {
-            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
-            "type": "string"
-          },
-          "clusterHost": {
-            "description": "Public host of the cluster serving this mirror.",
-            "type": "string"
-          },
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "installationId": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "isArchived": {
-            "type": "boolean"
-          },
-          "isPrivate": {
-            "type": "boolean"
-          },
-          "jurisdiction": {
-            "type": "string"
-          },
-          "mirrorId": {
-            "type": "string"
-          },
-          "owner": {
-            "type": "string"
-          },
-          "provider": {
-            "type": "string"
-          },
-          "repo": {
-            "type": "string"
-          },
-          "status": {
-            "description": "Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or suspended.",
-            "enum": [
-              "processing",
-              "ready",
-              "failed",
-              "suspended"
-            ],
-            "type": "string"
-          },
-          "suspendedAt": {
-            "format": "date-time",
-            "type": "string"
+          "events": {
+            "items": {
+              "$ref": "#/components/schemas/CIWebhookAuditEventView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "mirrorId",
-          "provider",
-          "owner",
-          "repo",
-          "clusterHost",
-          "createdAt"
+          "events"
         ],
         "type": "object"
       },
-      "MirrorCollaborator": {
+      "ListRepoCIWebhooksOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "accountId": {
-            "type": "string"
-          },
-          "handle": {
-            "description": "Primary handle (provider:label), empty if none resolves.",
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoCIWebhooksOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "role": {
-            "description": "reader (pull) or writer (pull+push).",
-            "type": "string"
+          "subscriptions": {
+            "items": {
+              "$ref": "#/components/schemas/CIWebhookView"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "accountId",
-          "role"
+          "subscriptions"
         ],
         "type": "object"
       },
-      "OIDCProvider": {
+      "ListRepoCollaboratorsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "description": {
-            "type": "string"
-          },
-          "displayName": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListRepoCollaboratorsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "id": {
-            "type": "string"
+          "collaborators": {
+            "items": {
+              "$ref": "#/components/schemas/RepoCollaborator"
+            },
+            "type": "array"
           },
-          "issuer": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "issuer"
+          "collaborators"
         ],
         "type": "object"
       },
-      "Org": {
+      "ListRepoGrantsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Org.json"
+              "/api/v1/schemas/ListRepoGrantsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "id": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          },
-          "region": {
-            "type": "string"
+          "grants": {
+            "items": {
+              "$ref": "#/components/schemas/RepoGrant"
+            },
+            "type": "array"
           },
-          "workosOrganizationId": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "name",
-          "region",
-          "createdAt"
+          "grants"
         ],
         "type": "object"
       },
-      "PatchRepoCIWebhookInputBody": {
+      "ListReposOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/PatchRepoCIWebhookInputBody.json"
+              "/api/v1/schemas/ListReposOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "display_name": {
-            "type": "string"
-          },
-          "enabled": {
+          "candidatesIncomplete": {
             "type": "boolean"
           },
-          "events": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
+            "type": "string"
+          },
+          "repos": {
             "items": {
-              "type": "string"
+              "$ref": "#/components/schemas/RepoIndexEntry"
             },
             "type": "array"
           },
-          "ref_filter": {
-            "type": "string"
+          "truncated": {
+            "type": "boolean"
           }
         },
+        "required": [
+          "repos",
+          "truncated",
+          "candidatesIncomplete"
+        ],
         "type": "object"
       },
-      "Project": {
+      "ListServiceAccountGrantsOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Project.json"
+              "/api/v1/schemas/ListServiceAccountGrantsOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "createdAt": {
-            "format": "date-time",
-            "type": "string"
-          },
-          "id": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          },
-          "ownerId": {
-            "type": "string"
-          },
-          "ownerType": {
-            "enum": [
-              "org",
-              "account"
-            ],
-            "type": "string"
+          "grants": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceAccountGrant"
+            },
+            "type": "array"
           },
-          "region": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "name",
-          "ownerType",
-          "ownerId",
-          "region",
-          "createdAt"
+          "grants"
         ],
         "type": "object"
       },
-      "ProjectGrant": {
+      "ListServiceAccountsOutputBody": {
         "additionalProperties": true,
         "properties": {
-          "granteeId": {
-            "type": "string"
-          },
-          "granteeName": {
-            "type": "string"
-          },
-          "granteeType": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ListServiceAccountsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "role": {
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
             "type": "string"
           },
-          "source": {
-            "type": "string"
+          "serviceAccounts": {
+            "items": {
+              "$ref": "#/components/schemas/ServiceAccountWithGrants"
+            },
+            "type": "array"
           }
         },
         "required": [
-          "granteeType",
-          "granteeId",
-          "role",
-          "source"
+          "serviceAccounts"
         ],
         "type": "object"
       },
-      "Repo": {
+      "LookupBySlugOutputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/Repo.json"
+              "/api/v1/schemas/LookupBySlugOutputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "clusterHost": {
+          "cell": {
             "type": "string"
           },
-          "foreign": {
-            "type": "boolean"
-          },
-          "fullName": {
+          "jurisdiction": {
             "type": "string"
           },
-          "id": {
+          "owner": {
             "type": "string"
           },
-          "mirrorSuspended": {
-            "type": "boolean"
-          },
-          "mirrorSuspendedAt": {
+          "repo": {
             "type": "string"
           },
-          "name": {
+          "repoId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "repoId",
+          "cell",
+          "jurisdiction",
+          "owner",
+          "repo"
+        ],
+        "type": "object"
+      },
+      "MeAuth": {
+        "additionalProperties": true,
+        "properties": {
+          "provider": {
             "type": "string"
           },
-          "objectFormat": {
-            "enum": [
-              "sha1",
-              "sha256"
-            ],
-            "type": "string"
-          },
-          "owningProjectId": {
-            "type": "string"
-          },
-          "path": {
-            "type": "string"
-          },
-          "provisionAttempts": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "provisionReason": {
-            "type": "string"
-          },
-          "repoGroupId": {
-            "type": "string"
-          },
-          "state": {
-            "enum": [
-              "provisioning",
-              "active",
-              "failed"
-            ],
-            "type": "string"
-          },
-          "visibility": {
-            "enum": [
-              "public",
-              "private"
-            ],
+          "providerUserId": {
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "owningProjectId",
-          "name"
+          "provider",
+          "providerUserId"
         ],
         "type": "object"
       },
-      "RepoCandidate": {
+      "MeDeletion": {
         "additionalProperties": true,
         "properties": {
-          "access": {
-            "enum": [
-              "read",
-              "write",
-              "admin"
-            ],
+          "cooldownEndsAt": {
+            "description": "When the cooldown elapses and the account becomes eligible for irreversible hard-deletion.",
+            "format": "date-time",
             "type": "string"
           },
-          "onboardable": {
-            "type": "boolean"
+          "requestedAt": {
+            "description": "When deletion was requested (deletion_requested_at).",
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
-          "access",
-          "onboardable"
+          "requestedAt",
+          "cooldownEndsAt"
         ],
         "type": "object"
       },
-      "RepoGrant": {
+      "MeGlobal": {
         "additionalProperties": true,
         "properties": {
-          "granteeId": {
+          "accountId": {
             "type": "string"
           },
-          "granteeName": {
+          "avatarUrl": {
             "type": "string"
           },
-          "granteeType": {
+          "createdAt": {
+            "description": "When the account was created (accounts.created_at).",
+            "format": "date-time",
             "type": "string"
           },
-          "role": {
+          "handle": {
             "type": "string"
           },
-          "source": {
+          "handles": {
+            "items": {
+              "$ref": "#/components/schemas/MeIdentityHandle"
+            },
+            "type": "array"
+          },
+          "homeJurisdiction": {
             "type": "string"
           }
         },
         "required": [
-          "granteeType",
-          "granteeId",
-          "role",
-          "source"
+          "accountId",
+          "createdAt",
+          "handles"
         ],
         "type": "object"
       },
-      "RepoIndexEntry": {
+      "MeIdentityHandle": {
         "additionalProperties": true,
         "properties": {
-          "candidate": {
-            "$ref": "#/components/schemas/RepoCandidate"
-          },
-          "cell": {
-            "deprecated": true,
-            "type": "string"
-          },
-          "clusterSlug": {
-            "deprecated": true,
-            "type": "string"
-          },
-          "full_name": {
-            "type": "string"
-          },
-          "id": {
+          "email": {
+            "description": "The provider's publicly-visible profile email (from the provider at login; may be empty). NOT the account's contact email.",
             "type": "string"
           },
-          "jurisdiction": {
-            "deprecated": true,
+          "handle": {
             "type": "string"
           },
-          "name": {
+          "provider": {
             "type": "string"
           },
-          "placements": {
-            "items": {
-              "$ref": "#/components/schemas/RepoPlacement"
-            },
-            "type": "array"
-          },
-          "primaries": {
-            "$ref": "#/components/schemas/RepoPrimaries"
-          },
-          "stars": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "visibility": {
+          "providerUserId": {
             "type": "string"
           }
         },
         "required": [
-          "id",
-          "jurisdiction",
-          "cell",
-          "clusterSlug",
-          "name",
-          "full_name",
-          "visibility",
-          "placements"
+          "provider",
+          "handle",
+          "providerUserId"
         ],
         "type": "object"
       },
-      "RepoPlacement": {
+      "MeRegional": {
         "additionalProperties": true,
         "properties": {
-          "cell": {
+          "bio": {
             "type": "string"
           },
-          "clusterSlug": {
+          "company": {
             "type": "string"
           },
-          "id": {
+          "displayName": {
             "type": "string"
           },
-          "jurisdiction": {
+          "email": {
             "type": "string"
           },
-          "mirror": {
-            "type": "boolean"
-          },
-          "status": {
-            "enum": [
-              "processing",
-              "ready",
-              "failed",
-              "suspended"
-            ],
+          "location": {
             "type": "string"
           }
         },
-        "required": [
-          "id",
-          "jurisdiction",
-          "cell",
-          "clusterSlug",
-          "mirror",
-          "status"
-        ],
         "type": "object"
       },
-      "RepoPrimaries": {
+      "MeRegionalUnavailable": {
         "additionalProperties": true,
         "properties": {
-          "git_data": {
+          "error": {
+            "description": "Always 'foreign_jurisdiction'. Discriminator for client-side state machines.",
+            "enum": [
+              "foreign_jurisdiction"
+            ],
             "type": "string"
           },
-          "processing": {
+          "homeCoreUrl": {
+            "description": "Origin of the account's home core — its OIDC issuer, e.g. 'https://us.auth.entire.io'. Not a browser link and not the console.",
+            "type": "string"
+          },
+          "jurisdiction": {
+            "description": "The account's home jurisdiction (e.g. 'us', 'eu').",
+            "type": "string"
+          },
+          "message": {
+            "description": "Human-readable copy ready to surface in a UI.",
             "type": "string"
           }
         },
         "required": [
-          "git_data",
-          "processing"
+          "error",
+          "jurisdiction",
+          "homeCoreUrl",
+          "message"
         ],
         "type": "object"
       },
-      "ResolvedIdentity": {
+      "Membership": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ResolvedIdentity.json"
+              "/api/v1/schemas/Membership.json"
             ],
             "format": "uri",
             "readOnly": true,
@@ -2528,571 +2646,4197 @@
           "accountId": {
             "type": "string"
           },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
           "handle": {
             "type": "string"
           },
+          "id": {
+            "type": "string"
+          },
+          "orgId": {
+            "type": "string"
+          },
           "provider": {
             "type": "string"
           },
-          "providerUserId": {
+          "role": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "workosOrgMembershipId": {
             "type": "string"
           }
         },
         "required": [
+          "id",
           "accountId",
-          "provider",
-          "handle",
-          "providerUserId"
+          "orgId",
+          "role",
+          "status",
+          "createdAt"
         ],
         "type": "object"
       },
-      "ResourceAccess": {
+      "MintOrgCIGitHubActionsCredentialInputBody": {
         "additionalProperties": true,
         "properties": {
-          "permissions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/MintOrgCIGitHubActionsCredentialInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
           },
-          "resourceId": {
+          "account": {
+            "description": "GitHub login (user or organization) whose webhooks this credential verifies",
+            "minLength": 1,
+            "type": "string"
+          },
+          "api_token": {
+            "description": "GitHub API token for outbound workflow dispatch. Optional: omit for an inbound-only credential. On an existing github-actions row this stores/rotates the token instead of conflicting.",
             "type": "string"
           }
         },
         "required": [
-          "resourceId",
-          "permissions"
+          "account"
         ],
         "type": "object"
       },
-      "ServiceAccount": {
+      "Mirror": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ServiceAccount.json"
+              "/api/v1/schemas/Mirror.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "accountId": {
+          "cell": {
+            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
+            "type": "string"
+          },
+          "clusterHost": {
+            "description": "Public host of the cluster serving this mirror.",
             "type": "string"
           },
           "createdAt": {
             "format": "date-time",
             "type": "string"
           },
-          "name": {
-            "type": "string"
+          "installationId": {
+            "format": "int64",
+            "type": "integer"
           },
-          "orgId": {
-            "type": "string"
+          "isArchived": {
+            "type": "boolean"
+          },
+          "isPrivate": {
+            "type": "boolean"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirrorId": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "repo": {
+            "type": "string"
           },
           "status": {
+            "description": "Clone lifecycle: processing (cloning), ready (clonable), failed (initial clone failed), or suspended.",
+            "enum": [
+              "processing",
+              "ready",
+              "failed",
+              "suspended"
+            ],
             "type": "string"
           },
-          "systemManaged": {
-            "type": "boolean"
+          "suspendedAt": {
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
-          "accountId",
-          "name",
-          "orgId",
-          "status",
-          "systemManaged",
+          "mirrorId",
+          "provider",
+          "owner",
+          "repo",
+          "clusterHost",
           "createdAt"
         ],
         "type": "object"
       },
-      "ServiceAccountGrant": {
+      "MirrorCollaborator": {
         "additionalProperties": true,
         "properties": {
-          "resourceId": {
-            "type": "string"
-          },
-          "resourceName": {
+          "accountId": {
             "type": "string"
           },
-          "resourceType": {
+          "handle": {
+            "description": "Primary handle (provider:label), empty if none resolves.",
             "type": "string"
           },
           "role": {
+            "description": "reader (pull) or writer (pull+push).",
             "type": "string"
           }
         },
         "required": [
-          "resourceType",
-          "resourceId",
+          "accountId",
           "role"
         ],
         "type": "object"
       },
-      "ServiceAccountWithGrants": {
+      "MirrorRequest": {
         "additionalProperties": true,
         "properties": {
-          "accountId": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/MirrorRequest.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
             "type": "string"
           },
-          "createdAt": {
-            "format": "date-time",
+          "failure": {
+            "$ref": "#/components/schemas/MirrorRequestFailure"
+          },
+          "requestId": {
+            "format": "uuid",
             "type": "string"
           },
-          "grants": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
+          "result": {
+            "$ref": "#/components/schemas/MirrorRequestResult"
           },
-          "name": {
+          "status": {
+            "enum": [
+              "pending",
+              "processing",
+              "succeeded",
+              "failed"
+            ],
             "type": "string"
-          },
-          "orgId": {
+          }
+        },
+        "required": [
+          "requestId",
+          "status"
+        ],
+        "type": "object"
+      },
+      "MirrorRequestFailure": {
+        "additionalProperties": true,
+        "properties": {
+          "code": {
+            "description": "Stable machine-readable failure code.",
             "type": "string"
           },
-          "status": {
+          "message": {
             "type": "string"
           },
-          "systemManaged": {
+          "retryable": {
+            "description": "Whether submitting a new request may succeed without changing its inputs.",
             "type": "boolean"
           }
         },
         "required": [
-          "grants",
-          "accountId",
-          "name",
-          "orgId",
-          "status",
-          "systemManaged",
-          "createdAt"
+          "code",
+          "message",
+          "retryable"
         ],
         "type": "object"
       },
-      "SetRepoVisibilityInputBody": {
+      "MirrorRequestResult": {
         "additionalProperties": true,
         "properties": {
-          "$schema": {
-            "description": "A URL to the JSON Schema for this object.",
-            "examples": [
-              "/api/v1/schemas/SetRepoVisibilityInputBody.json"
-            ],
-            "format": "uri",
-            "readOnly": true,
+          "mirrorId": {
             "type": "string"
           },
-          "visibility": {
-            "enum": [
-              "public",
-              "private"
-            ],
+          "mirrorUrl": {
+            "type": "string"
+          },
+          "publicUrl": {
             "type": "string"
           }
         },
         "required": [
-          "visibility"
+          "mirrorId",
+          "mirrorUrl",
+          "publicUrl"
         ],
         "type": "object"
       },
-      "SetRepoVisibilityOutputBody": {
+      "NativeMirrorPlacement": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/SetRepoVisibilityOutputBody.json"
+              "/api/v1/schemas/NativeMirrorPlacement.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "visibility": {
+          "attempts": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "clusterSlug": {
+            "type": "string"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "creationFailedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "desiredState": {
             "enum": [
-              "public",
-              "private"
+              "active",
+              "deleted"
             ],
             "type": "string"
-          }
-        },
-        "required": [
-          "visibility"
-        ],
-        "type": "object"
-      },
-      "TopologyCluster": {
-        "additionalProperties": true,
-        "properties": {
-          "host": {
-            "description": "DNS host of this cluster; pass verbatim as clusterHost to POST /api/v1/mirrors.",
+          },
+          "lastError": {
             "type": "string"
           },
-          "isDefault": {
-            "type": "boolean"
+          "nextRetryAt": {
+            "format": "date-time",
+            "type": "string"
           },
-          "label": {
-            "description": "Human cluster label (the cluster's display name).",
+          "placementId": {
             "type": "string"
           },
-          "publicUrl": {
+          "stage": {
+            "enum": [
+              "pending",
+              "provisioned",
+              "registered",
+              "seeded",
+              "announced"
+            ],
             "type": "string"
           },
-          "slug": {
+          "status": {
+            "enum": [
+              "processing",
+              "ready",
+              "failed",
+              "suspended"
+            ],
             "type": "string"
           }
         },
         "required": [
-          "slug",
-          "label",
-          "host",
-          "publicUrl",
-          "isDefault"
+          "placementId",
+          "clusterSlug",
+          "stage",
+          "status",
+          "desiredState",
+          "attempts",
+          "createdAt"
         ],
         "type": "object"
       },
-      "TopologyJurisdiction": {
+      "OIDCProvider": {
         "additionalProperties": true,
         "properties": {
-          "id": {
-            "description": "Jurisdiction id from the cluster registry (e.g. \"us\").",
+          "description": {
             "type": "string"
           },
-          "label": {
+          "displayName": {
             "type": "string"
           },
-          "regions": {
-            "items": {
-              "$ref": "#/components/schemas/TopologyRegion"
-            },
-            "type": "array"
+          "id": {
+            "type": "string"
+          },
+          "issuer": {
+            "type": "string"
           }
         },
         "required": [
           "id",
-          "label",
-          "regions"
+          "issuer"
         ],
         "type": "object"
       },
-      "TopologyRegion": {
+      "Org": {
         "additionalProperties": true,
         "properties": {
-          "clusters": {
-            "items": {
-              "$ref": "#/components/schemas/TopologyCluster"
-            },
-            "type": "array"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Org.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "capabilities": {
+            "$ref": "#/components/schemas/OrgCapabilities"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
           },
           "id": {
-            "description": "Region id (the cell id from the cluster registry).",
             "type": "string"
           },
-          "label": {
+          "name": {
+            "type": "string"
+          },
+          "region": {
+            "type": "string"
+          },
+          "workosOrganizationId": {
             "type": "string"
           }
         },
         "required": [
           "id",
-          "label",
-          "clusters"
+          "name",
+          "region",
+          "createdAt",
+          "capabilities"
         ],
         "type": "object"
       },
-      "WillDeleteStruct": {
+      "OrgCIBuildkiteClusterView": {
         "additionalProperties": true,
         "properties": {
-          "profileDataNote": {
-            "description": "Blanket note: profile PII is erased across all regions the account has data in (per-region residency is not globally tracked).",
-            "type": "string"
-          },
-          "repos": {
-            "description": "Repos in the account's home region that will be permanently deleted (personal + mirror). Foreign-region repos are also erased by the fan-out but not enumerated here.",
-            "items": {
-              "$ref": "#/components/schemas/DeletionRepo"
-            },
-            "type": "array"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/OrgCIBuildkiteClusterView.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "auth_plugin_ref": {
+            "type": "string"
+          },
+          "bk_cluster_id": {
+            "type": "string"
+          },
+          "bk_organization": {
+            "type": "string"
+          },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "updated_at": {
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
-          "repos",
-          "profileDataNote"
+          "bk_organization",
+          "owner",
+          "bk_cluster_id",
+          "label",
+          "auth_plugin_ref",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "WillUnlinkStruct": {
+      "OrgCIBuildkiteCredentialView": {
         "additionalProperties": true,
         "properties": {
-          "grants": {
-            "description": "Collaborator grants that will be unlinked.",
-            "items": {
-              "$ref": "#/components/schemas/DeletionGrant"
-            },
-            "type": "array"
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/OrgCIBuildkiteCredentialView.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
           },
-          "memberships": {
-            "description": "Org memberships that will be dropped (non-owned).",
-            "items": {
-              "$ref": "#/components/schemas/DeletionMembership"
-            },
-            "type": "array"
+          "bk_organization": {
+            "type": "string"
+          },
+          "cipher_version": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "inbound_endpoint_id": {
+            "type": "string"
+          },
+          "inbound_endpoint_path": {
+            "type": "string"
+          },
+          "inbound_endpoint_url": {
+            "type": "string"
+          },
+          "inbound_secret": {
+            "type": "string"
+          },
+          "inbound_secret_issued_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "inbound_secret_set": {
+            "type": "boolean"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "token_len": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "updated_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "verified_at": {
+            "format": "date-time",
+            "type": "string"
           }
         },
         "required": [
-          "grants",
-          "memberships"
+          "bk_organization",
+          "owner",
+          "cipher_version",
+          "token_len",
+          "inbound_secret_set",
+          "created_at",
+          "updated_at"
         ],
         "type": "object"
       },
-      "ResolvePlacementsOutputBody": {
+      "OrgCIGitHubActionsCredentialView": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/ResolvePlacementsOutputBody.json"
+              "/api/v1/schemas/OrgCIGitHubActionsCredentialView.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "placements": {
-            "items": {
-              "$ref": "#/components/schemas/ResolvedPlacement"
-            },
-            "type": "array"
+          "account": {
+            "type": "string"
+          },
+          "has_api_token": {
+            "type": "boolean"
+          },
+          "inbound_endpoint_id": {
+            "type": "string"
+          },
+          "inbound_endpoint_path": {
+            "type": "string"
+          },
+          "inbound_endpoint_url": {
+            "type": "string"
+          },
+          "inbound_secret": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
           }
         },
         "required": [
-          "placements"
+          "provider",
+          "account",
+          "owner"
         ],
         "type": "object"
       },
-      "ResolvedPlacement": {
+      "OrgCapabilities": {
         "additionalProperties": true,
         "properties": {
-          "cell": {
-            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
-            "type": "string"
-          },
-          "clusterHost": {
-            "description": "Public host of the cluster serving this mirror.",
-            "type": "string"
+          "canCreateProject": {
+            "type": "boolean"
           },
-          "jurisdiction": {
-            "type": "string"
+          "canDelete": {
+            "type": "boolean"
           },
-          "mirrorId": {
-            "type": "string"
+          "canManageMembers": {
+            "type": "boolean"
           }
         },
         "required": [
-          "mirrorId",
-          "clusterHost"
+          "canCreateProject",
+          "canManageMembers",
+          "canDelete"
         ],
         "type": "object"
       },
-      "CreateMirrorRequestInputBody": {
+      "PatchRepoCIWebhookInputBody": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/CreateMirrorRequestInputBody.json"
+              "/api/v1/schemas/PatchRepoCIWebhookInputBody.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "clusterHost": {
-            "description": "Destination cluster, as either a bare DNS host or the publicUrl returned by GET /api/v1/clusters.",
-            "minLength": 1,
+          "display_name": {
             "type": "string"
           },
-          "owner": {
-            "minLength": 1,
-            "type": "string"
+          "enabled": {
+            "type": "boolean"
           },
-          "provider": {
-            "enum": [
-              "github"
-            ],
-            "type": "string"
+          "events": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
           },
-          "repo": {
-            "minLength": 1,
+          "publish_checks": {
+            "type": "boolean"
+          },
+          "ref_filter": {
             "type": "string"
           }
         },
-        "required": [
-          "provider",
-          "owner",
-          "repo",
-          "clusterHost"
-        ],
         "type": "object"
       },
-      "MirrorRequest": {
+      "Project": {
         "additionalProperties": true,
         "properties": {
           "$schema": {
             "description": "A URL to the JSON Schema for this object.",
             "examples": [
-              "/api/v1/schemas/MirrorRequest.json"
+              "/api/v1/schemas/Project.json"
             ],
             "format": "uri",
             "readOnly": true,
             "type": "string"
           },
-          "failure": {
-            "$ref": "#/components/schemas/MirrorRequestFailure"
+          "capabilities": {
+            "$ref": "#/components/schemas/ProjectCapabilities"
           },
-          "requestId": {
-            "format": "uuid",
+          "createdAt": {
+            "format": "date-time",
             "type": "string"
           },
-          "result": {
-            "$ref": "#/components/schemas/MirrorRequestResult"
+          "id": {
+            "type": "string"
           },
-          "status": {
+          "name": {
+            "type": "string"
+          },
+          "ownerId": {
+            "type": "string"
+          },
+          "ownerName": {
+            "type": "string"
+          },
+          "ownerType": {
             "enum": [
-              "pending",
-              "processing",
-              "succeeded",
-              "failed"
+              "org",
+              "account"
             ],
             "type": "string"
+          },
+          "region": {
+            "type": "string"
           }
         },
         "required": [
-          "requestId",
-          "status"
+          "id",
+          "name",
+          "ownerType",
+          "ownerId",
+          "region",
+          "createdAt",
+          "capabilities"
         ],
         "type": "object"
       },
-      "MirrorRequestFailure": {
+      "ProjectCapabilities": {
         "additionalProperties": true,
         "properties": {
-          "code": {
-            "description": "Stable machine-readable failure code.",
-            "type": "string"
+          "canCreateRepository": {
+            "type": "boolean"
           },
-          "message": {
-            "type": "string"
+          "canDelete": {
+            "type": "boolean"
           },
-          "retryable": {
-            "description": "Whether submitting a new request may succeed without changing its inputs.",
+          "canManageAccess": {
+            "type": "boolean"
+          },
+          "canManageTrails": {
             "type": "boolean"
           }
         },
         "required": [
-          "code",
-          "message",
-          "retryable"
+          "canDelete",
+          "canManageAccess",
+          "canCreateRepository",
+          "canManageTrails"
         ],
         "type": "object"
       },
-      "MirrorRequestResult": {
+      "ProjectGrant": {
         "additionalProperties": true,
         "properties": {
-          "mirrorId": {
+          "granteeId": {
             "type": "string"
           },
-          "mirrorUrl": {
+          "granteeName": {
             "type": "string"
           },
-          "publicUrl": {
+          "granteeType": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          },
+          "source": {
             "type": "string"
           }
         },
         "required": [
-          "mirrorId",
-          "mirrorUrl",
-          "publicUrl"
-        ],
-        "type": "object"
-      }
+          "granteeType",
+          "granteeId",
+          "role",
+          "source"
+        ],
+        "type": "object"
+      },
+      "RegisterOrgCIBuildkiteClusterInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/RegisterOrgCIBuildkiteClusterInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "auth_plugin_ref": {
+            "type": "string"
+          },
+          "bk_cluster_id": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "bk_organization": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "bk_organization",
+          "bk_cluster_id"
+        ],
+        "type": "object"
+      },
+      "Repo": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/Repo.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "capabilities": {
+            "$ref": "#/components/schemas/RepoCapabilities"
+          },
+          "clusterHost": {
+            "type": "string"
+          },
+          "clusterSlug": {
+            "type": "string"
+          },
+          "foreign": {
+            "type": "boolean"
+          },
+          "fullName": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirrorSuspended": {
+            "type": "boolean"
+          },
+          "mirrorSuspendedAt": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "objectFormat": {
+            "enum": [
+              "sha1",
+              "sha256"
+            ],
+            "type": "string"
+          },
+          "owningProjectId": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "primaries": {
+            "$ref": "#/components/schemas/RepoPrimaries"
+          },
+          "provider": {
+            "enum": [
+              "github",
+              "entire"
+            ],
+            "type": "string"
+          },
+          "provisionAttempts": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "provisionReason": {
+            "type": "string"
+          },
+          "repoGroupId": {
+            "type": "string"
+          },
+          "state": {
+            "enum": [
+              "provisioning",
+              "active",
+              "failed"
+            ],
+            "type": "string"
+          },
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "owningProjectId",
+          "name",
+          "provider",
+          "capabilities"
+        ],
+        "type": "object"
+      },
+      "RepoCandidate": {
+        "additionalProperties": true,
+        "properties": {
+          "access": {
+            "enum": [
+              "read",
+              "write",
+              "admin"
+            ],
+            "type": "string"
+          },
+          "onboardable": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "access",
+          "onboardable"
+        ],
+        "type": "object"
+      },
+      "RepoCapabilities": {
+        "additionalProperties": true,
+        "properties": {
+          "canManage": {
+            "type": "boolean"
+          },
+          "canPull": {
+            "type": "boolean"
+          },
+          "canPush": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "canManage",
+          "canPush",
+          "canPull"
+        ],
+        "type": "object"
+      },
+      "RepoCollaborator": {
+        "additionalProperties": true,
+        "properties": {
+          "accountId": {
+            "type": "string"
+          },
+          "handle": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "accountId",
+          "role"
+        ],
+        "type": "object"
+      },
+      "RepoFacetPage": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/RepoFacetPage.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "items": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "nextPageToken": {
+            "description": "Pass back to fetch the next page; empty when no more entries.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "items"
+        ],
+        "type": "object"
+      },
+      "RepoGrant": {
+        "additionalProperties": true,
+        "properties": {
+          "granteeId": {
+            "type": "string"
+          },
+          "granteeName": {
+            "type": "string"
+          },
+          "granteeType": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          },
+          "source": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "granteeType",
+          "granteeId",
+          "role",
+          "source"
+        ],
+        "type": "object"
+      },
+      "RepoIDResolution": {
+        "additionalProperties": true,
+        "properties": {
+          "fullName": {
+            "type": "string"
+          },
+          "provider": {
+            "enum": [
+              "github",
+              "entire"
+            ],
+            "type": "string"
+          },
+          "repoId": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "resolved",
+              "unavailable"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "repoId",
+          "status"
+        ],
+        "type": "object"
+      },
+      "RepoIndexEntry": {
+        "additionalProperties": true,
+        "properties": {
+          "activityHotness": {
+            "format": "double",
+            "type": "number"
+          },
+          "archived": {
+            "type": "boolean"
+          },
+          "candidate": {
+            "$ref": "#/components/schemas/RepoCandidate"
+          },
+          "cell": {
+            "deprecated": true,
+            "type": "string"
+          },
+          "checkpointCount": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "clusterSlug": {
+            "deprecated": true,
+            "type": "string"
+          },
+          "forks": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "full_name": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "jurisdiction": {
+            "deprecated": true,
+            "type": "string"
+          },
+          "language": {
+            "type": "string"
+          },
+          "lastActivityAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "lastPushedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "openPrCount": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "org": {
+            "type": "string"
+          },
+          "permission": {
+            "enum": [
+              "read",
+              "write",
+              "admin"
+            ],
+            "type": "string"
+          },
+          "placements": {
+            "items": {
+              "$ref": "#/components/schemas/RepoPlacement"
+            },
+            "type": "array"
+          },
+          "primaries": {
+            "$ref": "#/components/schemas/RepoPrimaries"
+          },
+          "provider": {
+            "enum": [
+              "github",
+              "entire"
+            ],
+            "type": "string"
+          },
+          "pushedAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "stars": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "visibility": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "jurisdiction",
+          "cell",
+          "clusterSlug",
+          "name",
+          "full_name",
+          "org",
+          "provider",
+          "visibility",
+          "placements"
+        ],
+        "type": "object"
+      },
+      "RepoPlacement": {
+        "additionalProperties": true,
+        "properties": {
+          "cell": {
+            "type": "string"
+          },
+          "clusterSlug": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirror": {
+            "type": "boolean"
+          },
+          "status": {
+            "enum": [
+              "processing",
+              "ready",
+              "failed",
+              "suspended"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "jurisdiction",
+          "cell",
+          "clusterSlug",
+          "mirror",
+          "status"
+        ],
+        "type": "object"
+      },
+      "RepoPrimaries": {
+        "additionalProperties": true,
+        "properties": {
+          "data_primary": {
+            "$ref": "#/components/schemas/ForgeRepoIdentity"
+          },
+          "git_data": {
+            "type": "string"
+          },
+          "processing": {
+            "type": "string"
+          },
+          "processing_primary": {
+            "$ref": "#/components/schemas/ForgeRepoIdentity"
+          }
+        },
+        "required": [
+          "git_data",
+          "processing",
+          "data_primary"
+        ],
+        "type": "object"
+      },
+      "RepoReference": {
+        "additionalProperties": true,
+        "properties": {
+          "fullName": {
+            "maxLength": 256,
+            "type": "string"
+          },
+          "provider": {
+            "enum": [
+              "github",
+              "entire"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "provider",
+          "fullName"
+        ],
+        "type": "object"
+      },
+      "RepoResolution": {
+        "additionalProperties": true,
+        "properties": {
+          "candidate": {
+            "$ref": "#/components/schemas/RepoCandidate"
+          },
+          "fullName": {
+            "type": "string"
+          },
+          "placements": {
+            "items": {
+              "$ref": "#/components/schemas/RepoPlacement"
+            },
+            "type": "array"
+          },
+          "primaries": {
+            "$ref": "#/components/schemas/RepoPrimaries"
+          },
+          "provider": {
+            "enum": [
+              "github",
+              "entire"
+            ],
+            "type": "string"
+          },
+          "repoId": {
+            "type": "string"
+          },
+          "requestedFullName": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "ready",
+              "processing",
+              "no-mirror",
+              "unavailable"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "provider",
+          "requestedFullName",
+          "status"
+        ],
+        "type": "object"
+      },
+      "ResolvePlacementsOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolvePlacementsOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "placements": {
+            "items": {
+              "$ref": "#/components/schemas/ResolvedPlacement"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "placements"
+        ],
+        "type": "object"
+      },
+      "ResolveRepoIDsInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveRepoIDsInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "repoIds": {
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 100,
+            "type": "array"
+          }
+        },
+        "required": [
+          "repoIds"
+        ],
+        "type": "object"
+      },
+      "ResolveRepoIDsResponse": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveRepoIDsResponse.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "resolutions": {
+            "items": {
+              "$ref": "#/components/schemas/RepoIDResolution"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "resolutions"
+        ],
+        "type": "object"
+      },
+      "ResolveReposInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveReposInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "repositories": {
+            "items": {
+              "$ref": "#/components/schemas/RepoReference"
+            },
+            "maxItems": 100,
+            "type": "array"
+          }
+        },
+        "required": [
+          "repositories"
+        ],
+        "type": "object"
+      },
+      "ResolveReposResponse": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolveReposResponse.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "resolutions": {
+            "items": {
+              "$ref": "#/components/schemas/RepoResolution"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "resolutions"
+        ],
+        "type": "object"
+      },
+      "ResolvedIdentity": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ResolvedIdentity.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "accountId": {
+            "type": "string"
+          },
+          "handle": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          },
+          "providerUserId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "accountId",
+          "provider",
+          "handle",
+          "providerUserId"
+        ],
+        "type": "object"
+      },
+      "ResolvedPlacement": {
+        "additionalProperties": true,
+        "properties": {
+          "cell": {
+            "description": "Physical cell the mirror's cluster runs in, e.g. aws-us-east-2.",
+            "type": "string"
+          },
+          "clusterHost": {
+            "description": "Public host of the cluster serving this mirror.",
+            "type": "string"
+          },
+          "jurisdiction": {
+            "type": "string"
+          },
+          "mirrorId": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "mirrorId",
+          "clusterHost"
+        ],
+        "type": "object"
+      },
+      "ServiceAccount": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/ServiceAccount.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "accountId": {
+            "type": "string"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "orgId": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "systemManaged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "accountId",
+          "name",
+          "orgId",
+          "status",
+          "systemManaged",
+          "createdAt"
+        ],
+        "type": "object"
+      },
+      "ServiceAccountGrant": {
+        "additionalProperties": true,
+        "properties": {
+          "resourceId": {
+            "type": "string"
+          },
+          "resourceName": {
+            "type": "string"
+          },
+          "resourceType": {
+            "type": "string"
+          },
+          "role": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "resourceType",
+          "resourceId",
+          "role"
+        ],
+        "type": "object"
+      },
+      "ServiceAccountWithGrants": {
+        "additionalProperties": true,
+        "properties": {
+          "accountId": {
+            "type": "string"
+          },
+          "createdAt": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "grants": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "name": {
+            "type": "string"
+          },
+          "orgId": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          },
+          "systemManaged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "grants",
+          "accountId",
+          "name",
+          "orgId",
+          "status",
+          "systemManaged",
+          "createdAt"
+        ],
+        "type": "object"
+      },
+      "SetRepoVisibilityInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/SetRepoVisibilityInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "visibility"
+        ],
+        "type": "object"
+      },
+      "SetRepoVisibilityOutputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/SetRepoVisibilityOutputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "visibility": {
+            "enum": [
+              "public",
+              "private"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "visibility"
+        ],
+        "type": "object"
+      },
+      "TopologyCluster": {
+        "additionalProperties": true,
+        "properties": {
+          "host": {
+            "description": "DNS host of this cluster; pass verbatim as clusterHost to POST /api/v1/mirrors.",
+            "type": "string"
+          },
+          "isDefault": {
+            "type": "boolean"
+          },
+          "label": {
+            "description": "Human cluster label (the cluster's display name).",
+            "type": "string"
+          },
+          "publicUrl": {
+            "type": "string"
+          },
+          "slug": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "slug",
+          "label",
+          "host",
+          "publicUrl",
+          "isDefault"
+        ],
+        "type": "object"
+      },
+      "TopologyJurisdiction": {
+        "additionalProperties": true,
+        "properties": {
+          "id": {
+            "description": "Jurisdiction id from the cluster registry (e.g. \"us\").",
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          },
+          "regions": {
+            "items": {
+              "$ref": "#/components/schemas/TopologyRegion"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "id",
+          "label",
+          "regions"
+        ],
+        "type": "object"
+      },
+      "TopologyRegion": {
+        "additionalProperties": true,
+        "properties": {
+          "clusters": {
+            "items": {
+              "$ref": "#/components/schemas/TopologyCluster"
+            },
+            "type": "array"
+          },
+          "id": {
+            "description": "Region id (the cell id from the cluster registry).",
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "label",
+          "clusters"
+        ],
+        "type": "object"
+      },
+      "UpdateBranchProtectionInputBody": {
+        "additionalProperties": true,
+        "properties": {
+          "$schema": {
+            "description": "A URL to the JSON Schema for this object.",
+            "examples": [
+              "/api/v1/schemas/UpdateBranchProtectionInputBody.json"
+            ],
+            "format": "uri",
+            "readOnly": true,
+            "type": "string"
+          },
+          "addRules": {
+            "description": "Rules to add or replace by ref: an existing rule keeps its position and takes the new flag.",
+            "items": {
+              "$ref": "#/components/schemas/BranchRule"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "removeRefs": {
+            "description": "Patterns to remove; absent entries are ignored.",
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "WillDeleteStruct": {
+        "additionalProperties": true,
+        "properties": {
+          "profileDataNote": {
+            "description": "Blanket note: profile PII is erased across all regions the account has data in (per-region residency is not globally tracked).",
+            "type": "string"
+          },
+          "repos": {
+            "description": "Repos in the account's home region that will be permanently deleted (personal + mirror). Foreign-region repos are also erased by the fan-out but not enumerated here.",
+            "items": {
+              "$ref": "#/components/schemas/DeletionRepo"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "repos",
+          "profileDataNote"
+        ],
+        "type": "object"
+      },
+      "WillUnlinkStruct": {
+        "additionalProperties": true,
+        "properties": {
+          "grants": {
+            "description": "Collaborator grants that will be unlinked.",
+            "items": {
+              "$ref": "#/components/schemas/DeletionGrant"
+            },
+            "type": "array"
+          },
+          "memberships": {
+            "description": "Org memberships that will be dropped (non-owned).",
+            "items": {
+              "$ref": "#/components/schemas/DeletionMembership"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "grants",
+          "memberships"
+        ],
+        "type": "object"
+      }
+    },
+    "securitySchemes": {
+      "bearerAuth": {
+        "bearerFormat": "JWT",
+        "description": "Bearer access token.",
+        "scheme": "bearer",
+        "type": "http"
+      },
+      "oauth2": {
+        "description": "Authorization code flow with PKCE-S256. RFC 8628 device flow is also supported.",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "/authorize",
+            "scopes": {
+              "offline_access": "Request a refresh token.",
+              "openid": "Authenticate using OpenID Connect."
+            },
+            "tokenUrl": "/oauth/token"
+          }
+        },
+        "type": "oauth2"
+      },
+      "oidc": {
+        "description": "OpenID Connect discovery for browser and RFC 8628 device authentication.",
+        "openIdConnectUrl": "/.well-known/openid-configuration",
+        "type": "openIdConnect"
+      },
+      "sessionAuth": {
+        "description": "Console session cookie issued by the browser login flow.",
+        "in": "cookie",
+        "name": "entire_session",
+        "type": "apiKey"
+      }
+    }
+  },
+  "info": {
+    "description": "Entire control plane: identity, orgs, projects, repos, mirrors, service accounts.",
+    "title": "Entire Core API",
+    "version": "1.0.0"
+  },
+  "openapi": "3.1.0",
+  "paths": {
+    "/access/{resourceType}/{resourceId}": {
+      "get": {
+        "operationId": "getPermissions",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "resourceType",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "resourceId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+            "explode": false,
+            "in": "query",
+            "name": "explain",
+            "schema": {
+              "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPermissionsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List the caller's permissions on a single resource",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/audit": {
+      "get": {
+        "operationId": "listAuditEvents",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListAuditEventsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List the calling account's recent audit events",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/clusters": {
+      "get": {
+        "operationId": "listClusters",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListClustersOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List data-plane clusters attached to this control plane",
+        "tags": [
+          "clusters"
+        ]
+      }
+    },
+    "/identity/handles/{provider}/{handle}": {
+      "get": {
+        "operationId": "resolveHandle",
+        "parameters": [
+          {
+            "description": "IdP slug (e.g. \"github\").",
+            "in": "path",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "description": "IdP slug (e.g. \"github\").",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "User-visible handle at the provider.",
+            "in": "path",
+            "name": "handle",
+            "required": true,
+            "schema": {
+              "description": "User-visible handle at the provider.",
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ResolvedIdentity"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Resolve account by external provider handle",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me": {
+      "delete": {
+        "operationId": "deleteMe",
+        "responses": {
+          "202": {
+            "description": "Accepted"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Request deletion of the calling account (7-day cooldown; cancel via POST /me/cancel-deletion)",
+        "tags": [
+          "identity"
+        ]
+      },
+      "get": {
+        "operationId": "getMe",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMeOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Get the calling account's identity and profile",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/cancel-deletion": {
+      "post": {
+        "operationId": "cancelDeletion",
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Cancel a pending deletion request for the calling account",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/deletion-preview": {
+      "get": {
+        "operationId": "getDeletionPreview",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetDeletionPreviewOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Preview what deleting the calling account will erase, unlink, and block on",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/onboarding": {
+      "get": {
+        "operationId": "getOnboardingStatus",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetOnboardingStatusOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Report whether the calling account still needs to complete onboarding",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/me/onboarding/complete": {
+      "post": {
+        "operationId": "completeOnboarding",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CompleteOnboardingOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Record that the calling account completed web onboarding",
+        "tags": [
+          "identity"
+        ]
+      }
+    },
+    "/mirror-requests": {
+      "post": {
+        "description": "a validation failure may be reported synchronously at submission or as a terminal state on the request; clients must handle both.",
+        "operationId": "createMirrorRequest",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateMirrorRequestInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MirrorRequest"
+                }
+              }
+            },
+            "description": "Accepted",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Submit a mirror creation request",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirror-requests/{requestId}": {
+      "get": {
+        "description": "unknown failure codes must be treated as a generic terminal failure.",
+        "operationId": "getMirrorRequest",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "requestId",
+            "required": true,
+            "schema": {
+              "format": "uuid",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MirrorRequest"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Get a mirror creation request",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors": {
+      "delete": {
+        "operationId": "deleteMirror",
+        "parameters": [
+          {
+            "explode": false,
+            "in": "query",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "enum": [
+                "github"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "repo",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Public host of the cluster serving the mirror.",
+            "explode": false,
+            "in": "query",
+            "name": "clusterHost",
+            "required": true,
+            "schema": {
+              "description": "Public host of the cluster serving the mirror.",
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Delete a mirror by upstream coords + cluster host",
+        "tags": [
+          "mirrors"
+        ]
+      },
+      "get": {
+        "operationId": "listMirrors",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
+            "explode": false,
+            "in": "query",
+            "name": "cluster",
+            "schema": {
+              "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
+            "explode": false,
+            "in": "query",
+            "name": "provider",
+            "schema": {
+              "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "schema": {
+              "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListMirrorsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List mirrors visible to the caller",
+        "tags": [
+          "mirrors"
+        ]
+      },
+      "post": {
+        "operationId": "createMirror",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateMirrorInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CreatedMirror"
+                }
+              }
+            },
+            "description": "Created"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Precondition Failed"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Create GitHub mirror",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors/available": {
+      "get": {
+        "operationId": "listAvailableMirrors",
+        "parameters": [
+          {
+            "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "schema": {
+              "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListAvailableMirrorsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List GitHub repos the caller could onboard as mirrors",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors/collaborators": {
+      "get": {
+        "operationId": "listMirrorCollaborators",
+        "parameters": [
+          {
+            "explode": false,
+            "in": "query",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "enum": [
+                "github"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "repo",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Public host of the cluster serving the mirror.",
+            "explode": false,
+            "in": "query",
+            "name": "clusterHost",
+            "required": true,
+            "schema": {
+              "description": "Public host of the cluster serving the mirror.",
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListMirrorCollaboratorsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List the principals with access to a mirror (live GitHub-admin gated)",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors/placements": {
+      "get": {
+        "operationId": "resolveMirrorPlacements",
+        "parameters": [
+          {
+            "explode": false,
+            "in": "query",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "enum": [
+                "github"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Upstream owner login (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "owner",
+            "required": true,
+            "schema": {
+              "description": "Upstream owner login (case-insensitive).",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Upstream repo name (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "repo",
+            "required": true,
+            "schema": {
+              "description": "Upstream repo name (case-insensitive).",
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ResolvePlacementsOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Resolve the pullable cluster placements of a mirrored upstream (clone discovery)",
+        "tags": [
+          "mirrors"
+        ]
+      }
+    },
+    "/mirrors/{mirrorId}": {
+      "get": {
+        "operationId": "getMirror",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "mirrorId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Mirror"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Get mirror by id",
+        "tags": [
+          "mirrors"
+        ]
+      }
     },
-    "securitySchemes": {
-      "bearerAuth": {
-        "bearerFormat": "JWT",
-        "description": "Bearer token minted by entire-core's device-code flow or STS exchange.",
-        "scheme": "bearer",
-        "type": "http"
-      },
-      "sessionAuth": {
-        "description": "Console session cookie issued by the browser login flow.",
-        "in": "cookie",
-        "name": "entire_session",
-        "type": "apiKey"
+    "/oidc-providers": {
+      "get": {
+        "operationId": "listOIDCProviders",
+        "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListOIDCProvidersOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List federated OIDC identity providers",
+        "tags": [
+          "identity"
+        ]
       }
-    }
-  },
-  "info": {
-    "description": "Entire control plane: identity, orgs, projects, repos, mirrors, service accounts.",
-    "title": "Entire Core API",
-    "version": "1.0.0"
-  },
-  "openapi": "3.1.0",
-  "paths": {
-    "/access/{resourceType}": {
+    },
+    "/orgs": {
       "get": {
-        "operationId": "lookupResources",
+        "operationId": "listOrgs",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: exact-match org name (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "name",
+            "schema": {
+              "description": "Optional: exact-match org name (case-insensitive).",
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ListOrgsOutputBody"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Vary": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
           },
           {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
+            "oidc": []
           },
           {
-            "description": "SpiceDB resource type (e.g. \"repo\", \"project\", \"org\").",
-            "in": "path",
-            "name": "resourceType",
-            "required": true,
-            "schema": {
-              "description": "SpiceDB resource type (e.g. \"repo\", \"project\", \"org\").",
-              "minLength": 1,
-              "type": "string"
-            }
+            "bearerAuth": []
           },
           {
-            "description": "Optional: only list resources where the caller has this permission. pageSize/pageToken apply only when set.",
-            "explode": false,
-            "in": "query",
-            "name": "permission",
-            "schema": {
-              "description": "Optional: only list resources where the caller has this permission. pageSize/pageToken apply only when set.",
-              "type": "string"
-            }
+            "sessionAuth": []
           }
         ],
+        "summary": "List organizations the caller can see (or one by name)",
+        "tags": [
+          "orgs"
+        ]
+      },
+      "post": {
+        "operationId": "createOrg",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateOrgInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LookupResourcesOutputBody"
+                  "$ref": "#/components/schemas/Org"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -3124,6 +6868,16 @@
             },
             "description": "Forbidden"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -3146,6 +6900,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3153,41 +6913,139 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List resources of a type the caller can access",
+        "summary": "Create organization",
         "tags": [
-          "identity"
+          "orgs"
         ]
       }
     },
-    "/access/{resourceType}/{resourceId}": {
-      "get": {
-        "operationId": "getPermissions",
+    "/orgs/{orgId}": {
+      "delete": {
+        "operationId": "deleteOrg",
         "parameters": [
           {
             "in": "path",
-            "name": "resourceType",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
           },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
           {
-            "in": "path",
-            "name": "resourceId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
+            "oauth2": []
           },
           {
-            "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
-            "explode": false,
-            "in": "query",
-            "name": "explain",
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Delete an organization",
+        "tags": [
+          "orgs"
+        ]
+      },
+      "get": {
+        "operationId": "getOrg",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
             "schema": {
-              "description": "If set, return the SpiceDB trace for this permission instead of the permission list.",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -3197,7 +7055,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPermissionsOutputBody"
+                  "$ref": "#/components/schemas/Org"
                 }
               }
             },
@@ -3233,6 +7091,16 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -3255,6 +7123,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3262,36 +7136,30 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List the caller's permissions on a single resource",
+        "summary": "Get an organization",
         "tags": [
-          "identity"
+          "orgs"
         ]
       }
     },
-    "/audit": {
+    "/orgs/{orgId}/ci/buildkite/clusters": {
       "get": {
-        "operationId": "listAuditEvents",
+        "operationId": "listOrgCIBuildkiteClusters",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
+            "in": "path",
+            "name": "orgId",
+            "required": true,
             "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
             }
           },
           {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
             "explode": false,
             "in": "query",
-            "name": "pageToken",
+            "name": "bk_organization",
             "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           }
@@ -3301,7 +7169,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListAuditEventsOutputBody"
+                  "$ref": "#/components/schemas/ListOrgCIBuildkiteClustersOutputBody"
                 }
               }
             },
@@ -3337,17 +7205,7 @@
             },
             "description": "Forbidden"
           },
-          "422": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Unprocessable Entity"
-          },
-          "500": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3355,38 +7213,9 @@
                 }
               }
             },
-            "description": "Internal Server Error"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          },
-          {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "List the calling account's recent audit events",
-        "tags": [
-          "identity"
-        ]
-      }
-    },
-    "/clusters": {
-      "get": {
-        "operationId": "listClusters",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ListClustersOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+            "description": "Not Found"
           },
-          "400": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3394,9 +7223,9 @@
                 }
               }
             },
-            "description": "Bad Request"
+            "description": "Unprocessable Entity"
           },
-          "401": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3404,9 +7233,9 @@
                 }
               }
             },
-            "description": "Unauthorized"
+            "description": "Internal Server Error"
           },
-          "403": {
+          "502": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3414,9 +7243,9 @@
                 }
               }
             },
-            "description": "Forbidden"
+            "description": "Bad Gateway"
           },
-          "500": {
+          "503": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3424,10 +7253,16 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3435,49 +7270,44 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List data-plane clusters attached to this control plane",
+        "summary": "List an org's registered Buildkite clusters",
         "tags": [
-          "clusters"
+          "org-ci-webhooks"
         ]
-      }
-    },
-    "/identity/handles/{provider}/{handle}": {
-      "get": {
-        "operationId": "resolveHandle",
+      },
+      "post": {
+        "operationId": "registerOrgCIBuildkiteCluster",
         "parameters": [
           {
-            "description": "IdP slug (e.g. \"github\").",
-            "in": "path",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "description": "IdP slug (e.g. \"github\").",
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "description": "User-visible handle at the provider.",
             "in": "path",
-            "name": "handle",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "description": "User-visible handle at the provider.",
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RegisterOrgCIBuildkiteClusterInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ResolvedIdentity"
+                  "$ref": "#/components/schemas/OrgCIBuildkiteClusterView"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -3519,6 +7349,16 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -3538,9 +7378,35 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3548,35 +7414,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Resolve account by external provider handle",
+        "summary": "Register or update a Buildkite hosted cluster for an org",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/lookup": {
-      "post": {
-        "operationId": "batchLookup",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/BatchLookupInputBody"
-              }
+    "/orgs/{orgId}/ci/buildkite/clusters/{bkOrg}/{bkClusterId}": {
+      "delete": {
+        "operationId": "deleteOrgCIBuildkiteCluster",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "in": "path",
+            "name": "bkOrg",
+            "required": true,
+            "schema": {
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "bkClusterId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/BatchLookupOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -3608,6 +7486,16 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -3627,9 +7515,35 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3637,18 +7551,46 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Batch-resolve (type, id) refs to enriched records",
+        "summary": "Remove a registered Buildkite cluster from an org",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/me": {
-      "delete": {
-        "operationId": "deleteMe",
+    "/orgs/{orgId}/ci/buildkite/credential": {
+      "post": {
+        "operationId": "connectOrgCIBuildkiteCredential",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConnectOrgCIBuildkiteCredentialInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "202": {
-            "description": "Accepted"
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrgCIBuildkiteCredentialView"
+                }
+              }
+            },
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -3680,6 +7622,16 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -3690,6 +7642,16 @@
             },
             "description": "Conflict"
           },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
           "500": {
             "content": {
               "application/problem+json": {
@@ -3700,6 +7662,16 @@
             },
             "description": "Internal Server Error"
           },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -3712,6 +7684,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3719,23 +7697,38 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Request deletion of the calling account (7-day cooldown; cancel via POST /me/cancel-deletion)",
+        "summary": "Connect or rotate an org's Buildkite API credential",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
-      },
-      "get": {
-        "operationId": "getMe",
+      }
+    },
+    "/orgs/{orgId}/ci/buildkite/credential/{bkOrg}": {
+      "delete": {
+        "operationId": "deleteOrgCIBuildkiteCredential",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "bkOrg",
+            "required": true,
+            "schema": {
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetMeOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -3767,39 +7760,7 @@
             },
             "description": "Forbidden"
           },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          },
-          {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "Get the calling account's identity and profile",
-        "tags": [
-          "identity"
-        ]
-      }
-    },
-    "/me/cancel-deletion": {
-      "post": {
-        "operationId": "cancelDeletion",
-        "responses": {
-          "200": {
-            "description": "OK"
-          },
-          "400": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3807,9 +7768,9 @@
                 }
               }
             },
-            "description": "Bad Request"
+            "description": "Not Found"
           },
-          "401": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3817,9 +7778,9 @@
                 }
               }
             },
-            "description": "Unauthorized"
+            "description": "Unprocessable Entity"
           },
-          "403": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3827,9 +7788,9 @@
                 }
               }
             },
-            "description": "Forbidden"
+            "description": "Internal Server Error"
           },
-          "500": {
+          "502": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3837,7 +7798,7 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Bad Gateway"
           },
           "503": {
             "content": {
@@ -3851,6 +7812,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -3858,21 +7825,41 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Cancel a pending deletion request for the calling account",
+        "summary": "Delete an org's connected Buildkite credential",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/me/deletion-preview": {
-      "get": {
-        "operationId": "getDeletionPreview",
+    "/orgs/{orgId}/ci/buildkite/credential/{bkOrg}/inbound-secret": {
+      "put": {
+        "operationId": "rotateOrgCIBuildkiteInboundSecret",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "bkOrg",
+            "required": true,
+            "schema": {
+              "pattern": "^[a-z0-9][a-z0-9-]*$",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetDeletionPreviewOutputBody"
+                  "$ref": "#/components/schemas/OrgCIBuildkiteCredentialView"
                 }
               }
             },
@@ -3908,17 +7895,7 @@
             },
             "description": "Forbidden"
           },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          },
-          "503": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3926,38 +7903,9 @@
                 }
               }
             },
-            "description": "Service Unavailable"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          },
-          {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "Preview what deleting the calling account will erase, unlink, and block on",
-        "tags": [
-          "identity"
-        ]
-      }
-    },
-    "/me/onboarding": {
-      "get": {
-        "operationId": "getOnboardingStatus",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetOnboardingStatusOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+            "description": "Not Found"
           },
-          "400": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3965,9 +7913,9 @@
                 }
               }
             },
-            "description": "Bad Request"
+            "description": "Unprocessable Entity"
           },
-          "401": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3975,9 +7923,9 @@
                 }
               }
             },
-            "description": "Unauthorized"
+            "description": "Internal Server Error"
           },
-          "403": {
+          "502": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3985,9 +7933,9 @@
                 }
               }
             },
-            "description": "Forbidden"
+            "description": "Bad Gateway"
           },
-          "500": {
+          "503": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -3995,10 +7943,16 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4006,21 +7960,32 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Report whether the calling account still needs to complete onboarding",
+        "summary": "Rotate an org's inbound Buildkite webhook secret",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/me/onboarding/complete": {
-      "post": {
-        "operationId": "completeOnboarding",
+    "/orgs/{orgId}/ci/buildkite/credentials": {
+      "get": {
+        "operationId": "listOrgCIBuildkiteCredentials",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CompleteOnboardingOutputBody"
+                  "$ref": "#/components/schemas/ListOrgCIBuildkiteCredentialsOutputBody"
                 }
               }
             },
@@ -4056,7 +8021,7 @@
             },
             "description": "Forbidden"
           },
-          "409": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4064,7 +8029,17 @@
                 }
               }
             },
-            "description": "Conflict"
+            "description": "Not Found"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
           },
           "500": {
             "content": {
@@ -4076,6 +8051,16 @@
             },
             "description": "Internal Server Error"
           },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -4088,6 +8073,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4095,64 +8086,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Record that the calling account completed web onboarding",
+        "summary": "List an org's connected Buildkite credentials",
         "tags": [
-          "identity"
+          "org-ci-webhooks"
         ]
       }
     },
-    "/mirrors": {
-      "delete": {
-        "operationId": "deleteMirror",
+    "/orgs/{orgId}/ci/github-actions/credential": {
+      "post": {
+        "description": "Operator-only: requires platform#admin, unlike the Buildkite routes beside it, because GitHub Actions has no enrolment path yet and a credential minted here cannot be used. Mints the inbound webhook credential for one GitHub account: a fresh webhook secret (returned once, in this 201) and the endpoint URL to configure the GitHub webhook with, plus optionally the outbound dispatch api_token (write-only, never returned; has_api_token confirms storage). With api_token, an already-minted github-actions row gets the token stored/rotated instead (200, no secret re-issued).",
+        "operationId": "mintOrgCIGitHubActionsCredential",
         "parameters": [
           {
-            "explode": false,
-            "in": "query",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "enum": [
-                "github"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "owner",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "repo",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "description": "Public host of the cluster serving the mirror.",
-            "explode": false,
-            "in": "query",
-            "name": "clusterHost",
+            "in": "path",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "description": "Public host of the cluster serving the mirror.",
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MintOrgCIGitHubActionsCredentialInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OrgCIGitHubActionsCredentialView"
+                }
+              }
+            },
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -4194,7 +8168,7 @@
             },
             "description": "Not Found"
           },
-          "421": {
+          "409": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4202,7 +8176,7 @@
                 }
               }
             },
-            "description": "Misdirected Request"
+            "description": "Conflict"
           },
           "422": {
             "content": {
@@ -4246,6 +8220,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4253,13 +8233,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete a mirror by upstream coords + cluster host",
+        "summary": "Mint an org's GitHub Actions webhook credential",
         "tags": [
-          "mirrors"
+          "org-ci-webhooks"
         ]
-      },
+      }
+    },
+    "/orgs/{orgId}/members": {
       "get": {
-        "operationId": "listMirrors",
+        "operationId": "listOrgMembers",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -4285,32 +8267,11 @@
             }
           },
           {
-            "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
-            "explode": false,
-            "in": "query",
-            "name": "cluster",
-            "schema": {
-              "description": "Optional: restrict to mirrors on this cluster (public host, e.g. royalcanin.partial.to). Case-sensitive exact match.",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
-            "explode": false,
-            "in": "query",
-            "name": "provider",
-            "schema": {
-              "description": "Optional: restrict to mirrors of this upstream provider, case-insensitive (e.g. \"github\").",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "owner",
+            "in": "path",
+            "name": "orgId",
+            "required": true,
             "schema": {
-              "description": "Optional: restrict to mirrors with this upstream owner login (case-insensitive).",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -4320,7 +8281,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListMirrorsOutputBody"
+                  "$ref": "#/components/schemas/ListOrgMembersOutputBody"
                 }
               }
             },
@@ -4356,6 +8317,16 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -4378,6 +8349,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4385,18 +8362,29 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List mirrors visible to the caller",
+        "summary": "List members of an organization",
         "tags": [
-          "mirrors"
+          "orgs"
         ]
       },
       "post": {
-        "operationId": "createMirror",
+        "operationId": "addOrgMember",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateMirrorInputBody"
+                "$ref": "#/components/schemas/AddOrgMemberInputBody"
               }
             }
           },
@@ -4407,7 +8395,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CreatedMirror"
+                  "$ref": "#/components/schemas/Membership"
                 }
               }
             },
@@ -4463,7 +8451,7 @@
             },
             "description": "Conflict"
           },
-          "412": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4471,9 +8459,9 @@
                 }
               }
             },
-            "description": "Precondition Failed"
+            "description": "Unprocessable Entity"
           },
-          "421": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4481,9 +8469,66 @@
                 }
               }
             },
-            "description": "Misdirected Request"
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
           },
-          "422": {
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Add a member to an organization",
+        "tags": [
+          "orgs"
+        ]
+      }
+    },
+    "/orgs/{orgId}/members/{provider}/{providerUserId}": {
+      "delete": {
+        "operationId": "removeOrgMember",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "providerUserId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4491,9 +8536,9 @@
                 }
               }
             },
-            "description": "Unprocessable Entity"
+            "description": "Bad Request"
           },
-          "500": {
+          "401": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4501,9 +8546,9 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Unauthorized"
           },
-          "502": {
+          "403": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4511,9 +8556,39 @@
                 }
               }
             },
-            "description": "Bad Gateway"
+            "description": "Forbidden"
           },
-          "503": {
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4521,10 +8596,16 @@
                 }
               }
             },
-            "description": "Service Unavailable"
+            "description": "Internal Server Error"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4532,23 +8613,55 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create GitHub mirror",
+        "summary": "Remove a member from an organization",
         "tags": [
-          "mirrors"
+          "orgs"
         ]
       }
     },
-    "/mirrors/available": {
+    "/orgs/{orgId}/projects": {
       "get": {
-        "operationId": "listAvailableMirrors",
+        "operationId": "listOrgProjects",
         "parameters": [
           {
-            "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+            "description": "Maximum entries to return; server may cap further.",
             "explode": false,
             "in": "query",
-            "name": "owner",
+            "name": "pageSize",
             "schema": {
-              "description": "Optional: restrict to repos with this owner login (case-insensitive).",
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "orgId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional: exact-match project name (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "name",
+            "schema": {
+              "description": "Optional: exact-match project name (case-insensitive).",
               "type": "string"
             }
           }
@@ -4558,7 +8671,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListAvailableMirrorsOutputBody"
+                  "$ref": "#/components/schemas/ListOrgProjectsOutputBody"
                 }
               }
             },
@@ -4594,17 +8707,7 @@
             },
             "description": "Forbidden"
           },
-          "422": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Unprocessable Entity"
-          },
-          "500": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4612,9 +8715,9 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Not Found"
           },
-          "502": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4622,9 +8725,9 @@
                 }
               }
             },
-            "description": "Bad Gateway"
+            "description": "Unprocessable Entity"
           },
-          "503": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4632,10 +8735,16 @@
                 }
               }
             },
-            "description": "Service Unavailable"
+            "description": "Internal Server Error"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4643,57 +8752,46 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List GitHub repos the caller could onboard as mirrors",
+        "summary": "List projects owned by an organization",
         "tags": [
-          "mirrors"
+          "projects"
         ]
       }
     },
-    "/mirrors/collaborators": {
+    "/projects": {
       "get": {
-        "operationId": "listMirrorCollaborators",
+        "operationId": "listProjects",
         "parameters": [
           {
+            "description": "Maximum entries to return; server may cap further.",
             "explode": false,
             "in": "query",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "enum": [
-                "github"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "owner",
-            "required": true,
+            "name": "pageSize",
             "schema": {
-              "minLength": 1,
-              "type": "string"
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
             }
           },
           {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
             "explode": false,
             "in": "query",
-            "name": "repo",
-            "required": true,
+            "name": "pageToken",
             "schema": {
-              "minLength": 1,
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
-            "description": "Public host of the cluster serving the mirror.",
+            "description": "Optional: exact-match project name (case-insensitive).",
             "explode": false,
             "in": "query",
-            "name": "clusterHost",
-            "required": true,
+            "name": "name",
             "schema": {
-              "description": "Public host of the cluster serving the mirror.",
-              "minLength": 1,
+              "description": "Optional: exact-match project name (case-insensitive).",
               "type": "string"
             }
           }
@@ -4703,7 +8801,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListMirrorCollaboratorsOutputBody"
+                  "$ref": "#/components/schemas/ListProjectsOutputBody"
                 }
               }
             },
@@ -4749,16 +8847,6 @@
             },
             "description": "Not Found"
           },
-          "421": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Misdirected Request"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -4778,29 +8866,15 @@
               }
             },
             "description": "Internal Server Error"
-          },
-          "502": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Bad Gateway"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4808,36 +8882,33 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List the principals with access to a mirror (live GitHub-admin gated)",
+        "summary": "List projects accessible to the caller (or one by name)",
         "tags": [
-          "mirrors"
+          "projects"
         ]
-      }
-    },
-    "/mirrors/{mirrorId}": {
-      "get": {
-        "operationId": "getMirror",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "mirrorId",
-            "required": true,
-            "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
+      },
+      "post": {
+        "operationId": "createProject",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateProjectInputBody"
+              }
             }
-          }
-        ],
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Mirror"
+                  "$ref": "#/components/schemas/Project"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -4879,6 +8950,16 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -4901,6 +8982,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -4908,50 +8995,29 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get mirror by id",
+        "summary": "Create project",
         "tags": [
-          "mirrors"
+          "projects"
         ]
       }
     },
-    "/oidc-providers": {
-      "get": {
-        "operationId": "listOIDCProviders",
+    "/projects/{projectId}": {
+      "delete": {
+        "operationId": "deleteProject",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
+            "in": "path",
+            "name": "projectId",
+            "required": true,
             "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ListOIDCProvidersOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -4983,7 +9049,7 @@
             },
             "description": "Forbidden"
           },
-          "422": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -4991,9 +9057,9 @@
                 }
               }
             },
-            "description": "Unprocessable Entity"
+            "description": "Not Found"
           },
-          "500": {
+          "409": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -5001,9 +9067,9 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Conflict"
           },
-          "503": {
+          "421": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -5011,10 +9077,36 @@
                 }
               }
             },
-            "description": "Service Unavailable"
+            "description": "Misdirected Request"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5022,53 +9114,20 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List federated OIDC identity providers",
+        "summary": "Delete a project",
         "tags": [
-          "identity"
+          "projects"
         ]
-      }
-    },
-    "/orgs": {
+      },
       "get": {
-        "operationId": "listOrgs",
+        "operationId": "getProject",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: exact-match org name (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "name",
-            "schema": {
-              "description": "Optional: exact-match org name (case-insensitive).",
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
+            "in": "path",
+            "name": "projectId",
+            "required": true,
             "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -5078,28 +9137,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListOrgsOutputBody"
+                  "$ref": "#/components/schemas/Project"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Vary": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -5163,6 +9205,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5170,18 +9218,31 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List organizations the caller can see (or one by name)",
+        "summary": "Get a project by id",
         "tags": [
-          "orgs"
+          "projects"
         ]
-      },
+      }
+    },
+    "/projects/{projectId}/grants": {
       "post": {
-        "operationId": "createOrg",
+        "operationId": "grantProjectAccess",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "projectId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateOrgInputBody"
+                "$ref": "#/components/schemas/GrantProjectAccessInputBody"
               }
             }
           },
@@ -5192,7 +9253,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Org"
+                  "$ref": "#/components/schemas/GrantProjectAccessOutputBody"
                 }
               }
             },
@@ -5228,6 +9289,16 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -5260,6 +9331,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5267,24 +9344,42 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create organization",
+        "summary": "Grant project access to an identity",
         "tags": [
-          "orgs"
+          "projects"
         ]
       }
     },
-    "/orgs/{orgId}": {
+    "/projects/{projectId}/grants/account/{provider}/{providerUserId}": {
       "delete": {
-        "operationId": "deleteOrg",
+        "operationId": "revokeProjectAccessByProvider",
         "parameters": [
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "provider",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "providerUserId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -5341,16 +9436,6 @@
             },
             "description": "Conflict"
           },
-          "421": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Misdirected Request"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -5373,6 +9458,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5380,34 +9471,47 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete an organization",
+        "summary": "Revoke project access by provider identity",
         "tags": [
-          "orgs"
+          "projects"
         ]
-      },
-      "get": {
-        "operationId": "getOrg",
+      }
+    },
+    "/projects/{projectId}/grants/{granteeType}/{granteeId}": {
+      "delete": {
+        "operationId": "revokeProjectAccess",
         "parameters": [
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "granteeType",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "granteeId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Org"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -5449,6 +9553,16 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -5471,6 +9585,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5478,15 +9598,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get an organization",
+        "summary": "Revoke project access by grantee id",
         "tags": [
-          "orgs"
+          "projects"
         ]
       }
     },
-    "/orgs/{orgId}/members": {
+    "/projects/{projectId}/members": {
       "get": {
-        "operationId": "listOrgMembers",
+        "operationId": "listProjectMembers",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -5513,7 +9633,7 @@
           },
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
@@ -5526,7 +9646,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListOrgMembersOutputBody"
+                  "$ref": "#/components/schemas/ListProjectMembersOutputBody"
                 }
               }
             },
@@ -5594,6 +9714,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5601,44 +9727,69 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List members of an organization",
+        "summary": "List project members and their roles",
         "tags": [
-          "orgs"
+          "projects"
         ]
-      },
-      "post": {
-        "operationId": "addOrgMember",
+      }
+    },
+    "/projects/{projectId}/repos": {
+      "get": {
+        "operationId": "listProjectRepos",
         "parameters": [
+          {
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
           {
             "in": "path",
-            "name": "orgId",
+            "name": "projectId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
+          },
+          {
+            "description": "Optional: exact-match repo name (case-insensitive).",
+            "explode": false,
+            "in": "query",
+            "name": "name",
+            "schema": {
+              "description": "Optional: exact-match repo name (case-insensitive).",
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AddOrgMemberInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Membership"
+                  "$ref": "#/components/schemas/ListProjectReposOutputBody"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -5680,16 +9831,6 @@
             },
             "description": "Not Found"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -5712,6 +9853,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5719,69 +9866,203 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Add a member to an organization",
+        "summary": "List repositories in a project (or one by name)",
         "tags": [
-          "orgs"
+          "repos"
         ]
       }
     },
-    "/orgs/{orgId}/members/{provider}/{providerUserId}": {
-      "delete": {
-        "operationId": "removeOrgMember",
+    "/repos": {
+      "get": {
+        "operationId": "listRepos",
         "parameters": [
           {
-            "in": "path",
-            "name": "orgId",
-            "required": true,
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
-            "in": "path",
-            "name": "provider",
-            "required": true,
+            "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
+            "explode": false,
+            "in": "query",
+            "name": "scope",
             "schema": {
-              "minLength": 1,
+              "default": "onboarded",
+              "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
+              "enum": [
+                "onboarded",
+                "all"
+              ],
               "type": "string"
             }
           },
           {
-            "in": "path",
-            "name": "providerUserId",
-            "required": true,
+            "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored, but the fact filters below still apply (a repo whose facts don't match returns empty).",
+            "explode": false,
+            "in": "query",
+            "name": "filter",
             "schema": {
-              "minLength": 1,
+              "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored, but the fact filters below still apply (a repo whose facts don't match returns empty).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Multi-key sort spec, e.g. org:asc,stars:desc. Keys: name,org,language,candidacy,stars,forks,pushed_at,last_activity_at,last_pushed_at,activity_hotness,checkpoint_count,open_pr_count. A single bare key uses the order param. Encoded into the cursor (authoritative on continuation).",
+            "explode": false,
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "description": "Multi-key sort spec, e.g. org:asc,stars:desc. Keys: name,org,language,candidacy,stars,forks,pushed_at,last_activity_at,last_pushed_at,activity_hotness,checkpoint_count,open_pr_count. A single bare key uses the order param. Encoded into the cursor (authoritative on continuation).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Direction for a single bare sort key; defaults to asc. Ignored when sort carries per-key :asc/:desc suffixes. Encoded into the cursor (authoritative on continuation).",
+            "explode": false,
+            "in": "query",
+            "name": "order",
+            "schema": {
+              "description": "Direction for a single bare sort key; defaults to asc. Ignored when sort carries per-key :asc/:desc suffixes. Encoded into the cursor (authoritative on continuation).",
+              "enum": [
+                "asc",
+                "desc"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Exact-match repo_facts.language. Also accepts language[eq]/language[ne] (bare is sugar for [eq]).",
+            "explode": false,
+            "in": "query",
+            "name": "language",
+            "schema": {
+              "description": "Exact-match repo_facts.language. Also accepts language[eq]/language[ne] (bare is sugar for [eq]).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Filter on the observed repo_facts.private fact (public: private=false; private: private=true). Also accepts visibility[eq]/visibility[ne].",
+            "explode": false,
+            "in": "query",
+            "name": "visibility",
+            "schema": {
+              "description": "Filter on the observed repo_facts.private fact (public: private=false; private: private=true). Also accepts visibility[eq]/visibility[ne].",
+              "enum": [
+                "public",
+                "private"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Filter on repo_facts.archived.",
+            "explode": false,
+            "in": "query",
+            "name": "archived",
+            "schema": {
+              "description": "Filter on repo_facts.archived.",
+              "enum": [
+                "true",
+                "false"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "true: repo_facts.checkpoint_count > 0; false: no checkpoints (0 or unobserved).",
+            "explode": false,
+            "in": "query",
+            "name": "hasCheckpoints",
+            "schema": {
+              "description": "true: repo_facts.checkpoint_count > 0; false: no checkpoints (0 or unobserved).",
+              "enum": [
+                "true",
+                "false"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Exact-match owner/project org (case-insensitive). Also accepts org[eq]/org[ne].",
+            "explode": false,
+            "in": "query",
+            "name": "org",
+            "schema": {
+              "description": "Exact-match owner/project org (case-insensitive). Also accepts org[eq]/org[ne].",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Literal case-insensitive substring match on the full name (owner/repo).",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Literal case-insensitive substring match on the full name (owner/repo).",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Filter on placement/candidacy lifecycle. inactive requires scope=all. Also accepts status[eq]/status[ne].",
+            "explode": false,
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "description": "Filter on placement/candidacy lifecycle. inactive requires scope=all. Also accepts status[eq]/status[ne].",
+              "enum": [
+                "mirrored",
+                "processing",
+                "inactive"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Minimum caller access tier: read (all), write (write+admin), or admin. Also accepts permission[eq]; permission[ne] is rejected.",
+            "explode": false,
+            "in": "query",
+            "name": "permission",
+            "schema": {
+              "description": "Minimum caller access tier: read (all), write (write+admin), or admin. Also accepts permission[eq]; permission[ne] is rejected.",
+              "enum": [
+                "read",
+                "write",
+                "admin"
+              ],
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
+          "200": {
             "content": {
-              "application/problem+json": {
+              "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
+                  "$ref": "#/components/schemas/ListReposOutputBody"
                 }
               }
             },
-            "description": "Unauthorized"
+            "description": "OK"
           },
-          "403": {
+          "400": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -5789,9 +10070,9 @@
                 }
               }
             },
-            "description": "Forbidden"
+            "description": "Bad Request"
           },
-          "404": {
+          "401": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -5799,9 +10080,9 @@
                 }
               }
             },
-            "description": "Not Found"
+            "description": "Unauthorized"
           },
-          "409": {
+          "403": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -5809,7 +10090,7 @@
                 }
               }
             },
-            "description": "Conflict"
+            "description": "Forbidden"
           },
           "422": {
             "content": {
@@ -5833,6 +10114,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5840,69 +10127,33 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Remove a member from an organization",
+        "summary": "List the caller's readable repositories (placement index)",
         "tags": [
-          "orgs"
+          "repos"
         ]
-      }
-    },
-    "/orgs/{orgId}/projects": {
-      "get": {
-        "operationId": "listOrgProjects",
-        "parameters": [
-          {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "orgId",
-            "required": true,
-            "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
+      },
+      "post": {
+        "operationId": "createRepo",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateRepoInputBody"
+              }
             }
           },
-          {
-            "description": "Optional: exact-match project name (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "name",
-            "schema": {
-              "description": "Optional: exact-match project name (case-insensitive).",
-              "type": "string"
-            }
-          }
-        ],
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListOrgProjectsOutputBody"
+                  "$ref": "#/components/schemas/Repo"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -5944,6 +10195,16 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -5963,9 +10224,25 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -5973,26 +10250,27 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List projects owned by an organization",
+        "summary": "Create repository",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects": {
+    "/repos/facets/languages": {
       "get": {
-        "operationId": "listProjects",
+        "operationId": "listRepoLanguageFacets",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
+            "description": "Maximum facet values to return.",
             "explode": false,
             "in": "query",
             "name": "pageSize",
             "schema": {
-              "description": "Maximum entries to return; server may cap further.",
+              "default": 50,
+              "description": "Maximum facet values to return.",
               "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
+              "maximum": 100,
+              "minimum": 1,
               "type": "integer"
             }
           },
@@ -6007,12 +10285,12 @@
             }
           },
           {
-            "description": "Optional: exact-match project name (case-insensitive).",
+            "description": "Case-insensitive substring match over facet values.",
             "explode": false,
             "in": "query",
-            "name": "name",
+            "name": "q",
             "schema": {
-              "description": "Optional: exact-match project name (case-insensitive).",
+              "description": "Case-insensitive substring match over facet values.",
               "type": "string"
             }
           }
@@ -6022,7 +10300,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListProjectsOutputBody"
+                  "$ref": "#/components/schemas/RepoFacetPage"
                 }
               }
             },
@@ -6058,16 +10336,6 @@
             },
             "description": "Forbidden"
           },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -6090,6 +10358,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6097,33 +10371,61 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List projects accessible to the caller (or one by name)",
+        "summary": "List repository language facets",
         "tags": [
-          "projects"
+          "repos"
         ]
-      },
-      "post": {
-        "operationId": "createProject",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateProjectInputBody"
-              }
+      }
+    },
+    "/repos/facets/orgs": {
+      "get": {
+        "operationId": "listRepoOrgFacets",
+        "parameters": [
+          {
+            "description": "Maximum facet values to return.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "default": 50,
+              "description": "Maximum facet values to return.",
+              "format": "int32",
+              "maximum": 100,
+              "minimum": 1,
+              "type": "integer"
             }
           },
-          "required": true
-        },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Case-insensitive substring match over facet values.",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Case-insensitive substring match over facet values.",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Project"
+                  "$ref": "#/components/schemas/RepoFacetPage"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -6155,26 +10457,6 @@
             },
             "description": "Forbidden"
           },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -6197,6 +10479,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6204,59 +10492,38 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create project",
+        "summary": "List repository org facets",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}": {
-      "delete": {
-        "operationId": "deleteProject",
+    "/repos/lookup-by-slug": {
+      "get": {
+        "operationId": "lookupRepoBySlug",
         "parameters": [
           {
-            "in": "path",
-            "name": "projectId",
+            "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
+            "explode": false,
+            "in": "query",
+            "name": "slug",
             "required": true,
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Unauthorized"
-          },
-          "403": {
+          "200": {
             "content": {
-              "application/problem+json": {
+              "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
+                  "$ref": "#/components/schemas/LookupBySlugOutputBody"
                 }
               }
             },
-            "description": "Forbidden"
+            "description": "OK"
           },
           "404": {
             "content": {
@@ -6266,19 +10533,9 @@
                 }
               }
             },
-            "description": "Not Found"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
+            "description": "Not Found"
           },
-          "421": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -6286,9 +10543,9 @@
                 }
               }
             },
-            "description": "Misdirected Request"
+            "description": "Unprocessable Entity"
           },
-          "422": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -6296,9 +10553,9 @@
                 }
               }
             },
-            "description": "Unprocessable Entity"
+            "description": "Internal Server Error"
           },
-          "500": {
+          "503": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -6306,41 +10563,34 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Service Unavailable"
           }
         },
-        "security": [
-          {
-            "bearerAuth": []
-          },
-          {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "Delete a project",
+        "summary": "Resolve a repo slug to routing info (unauthenticated)",
         "tags": [
-          "projects"
+          "repos"
         ]
-      },
-      "get": {
-        "operationId": "getProject",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "projectId",
-            "required": true,
-            "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
+      }
+    },
+    "/repos/resolve": {
+      "post": {
+        "operationId": "resolveRepos",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ResolveReposInputBody"
+              }
             }
-          }
-        ],
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Project"
+                  "$ref": "#/components/schemas/ResolveReposResponse"
                 }
               }
             },
@@ -6376,16 +10626,6 @@
             },
             "description": "Forbidden"
           },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -6408,6 +10648,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6415,46 +10661,35 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get a project by id",
+        "summary": "Resolve provider-qualified repository lifecycle states",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}/grants": {
+    "/repos/resolve-ids": {
       "post": {
-        "operationId": "grantProjectAccess",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "projectId",
-            "required": true,
-            "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
-              "type": "string"
-            }
-          }
-        ],
+        "operationId": "resolveRepoIDs",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/GrantProjectAccessInputBody"
+                "$ref": "#/components/schemas/ResolveRepoIDsInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GrantProjectAccessOutputBody"
+                  "$ref": "#/components/schemas/ResolveRepoIDsResponse"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -6486,26 +10721,6 @@
             },
             "description": "Forbidden"
           },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -6528,6 +10743,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6535,42 +10756,24 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Grant project access to an identity",
+        "summary": "Resolve repository ids to full name and provider",
         "tags": [
-          "projects"
+          "repos"
         ]
       }
     },
-    "/projects/{projectId}/grants/account/{provider}/{providerUserId}": {
+    "/repos/{repoId}": {
       "delete": {
-        "operationId": "revokeProjectAccessByProvider",
+        "operationId": "deleteRepo",
         "parameters": [
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "provider",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "providerUserId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -6617,7 +10820,7 @@
             },
             "description": "Not Found"
           },
-          "409": {
+          "421": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -6625,7 +10828,7 @@
                 }
               }
             },
-            "description": "Conflict"
+            "description": "Misdirected Request"
           },
           "422": {
             "content": {
@@ -6646,9 +10849,35 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6656,47 +10885,34 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Revoke project access by provider identity",
+        "summary": "Delete repository",
         "tags": [
-          "projects"
+          "repos"
         ]
-      }
-    },
-    "/projects/{projectId}/grants/{granteeType}/{granteeId}": {
-      "delete": {
-        "operationId": "revokeProjectAccess",
+      },
+      "get": {
+        "operationId": "getRepo",
         "parameters": [
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "granteeType",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "granteeId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Repo"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -6738,16 +10954,6 @@
             },
             "description": "Not Found"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -6770,6 +10976,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6777,42 +10989,19 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Revoke project access by grantee id",
-        "tags": [
-          "projects"
-        ]
-      }
-    },
-    "/projects/{projectId}/members": {
-      "get": {
-        "operationId": "listProjectMembers",
-        "parameters": [
-          {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
+        "summary": "Get repository",
+        "tags": [
+          "repos"
+        ]
+      }
+    },
+    "/repos/{repoId}/branch-protection": {
+      "get": {
+        "operationId": "getBranchProtection",
+        "parameters": [
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
@@ -6825,7 +11014,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListProjectMembersOutputBody"
+                  "$ref": "#/components/schemas/BranchProtection"
                 }
               }
             },
@@ -6871,6 +11060,16 @@
             },
             "description": "Not Found"
           },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -6893,6 +11092,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -6900,65 +11105,40 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List project members and their roles",
+        "summary": "Get repository branch protection",
         "tags": [
-          "projects"
+          "repos"
         ]
-      }
-    },
-    "/projects/{projectId}/repos": {
-      "get": {
-        "operationId": "listProjectRepos",
+      },
+      "patch": {
+        "operationId": "updateBranchProtection",
         "parameters": [
-          {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
           {
             "in": "path",
-            "name": "projectId",
+            "name": "repoId",
             "required": true,
             "schema": {
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          },
-          {
-            "description": "Optional: exact-match repo name (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "name",
-            "schema": {
-              "description": "Optional: exact-match repo name (case-insensitive).",
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdateBranchProtectionInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListProjectReposOutputBody"
+                  "$ref": "#/components/schemas/BranchProtection"
                 }
               }
             },
@@ -7004,6 +11184,26 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -7026,6 +11226,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7033,71 +11239,40 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List repositories in a project (or one by name)",
+        "summary": "Add or remove protected branches",
         "tags": [
           "repos"
         ]
-      }
-    },
-    "/repos": {
-      "get": {
-        "operationId": "listRepos",
+      },
+      "put": {
+        "operationId": "setBranchProtection",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
-            }
-          },
-          {
-            "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
-            "explode": false,
-            "in": "query",
-            "name": "scope",
-            "schema": {
-              "default": "onboarded",
-              "description": "onboarded (default): repos in Entire; all: also include onboardable GitHub candidates.",
-              "enum": [
-                "onboarded",
-                "all"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored.",
-            "explode": false,
-            "in": "query",
-            "name": "filter",
+            "in": "path",
+            "name": "repoId",
+            "required": true,
             "schema": {
-              "description": "Optional: exact-match full_name (owner/repo, case-insensitive). Returns that repo's zero-or-one entries; pagination and scope are ignored.",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BranchProtection"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListReposOutputBody"
+                  "$ref": "#/components/schemas/BranchProtection"
                 }
               }
             },
@@ -7133,6 +11308,36 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -7155,6 +11360,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7162,33 +11373,71 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List the caller's readable repositories (placement index)",
+        "summary": "Set repository branch protection",
         "tags": [
           "repos"
         ]
-      },
-      "post": {
-        "operationId": "createRepo",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateRepoInputBody"
-              }
+      }
+    },
+    "/repos/{repoId}/ci-builds": {
+      "get": {
+        "operationId": "listRepoCIBuilds",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "commit",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "pipeline",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "build_number",
+            "schema": {
+              "format": "int64",
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            }
+          }
+        ],
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Repo"
+                  "$ref": "#/components/schemas/ListRepoCIBuildsOutputBody"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -7230,7 +11479,7 @@
             },
             "description": "Not Found"
           },
-          "409": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -7238,9 +11487,9 @@
                 }
               }
             },
-            "description": "Conflict"
+            "description": "Unprocessable Entity"
           },
-          "422": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -7248,9 +11497,9 @@
                 }
               }
             },
-            "description": "Unprocessable Entity"
+            "description": "Internal Server Error"
           },
-          "500": {
+          "502": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -7258,7 +11507,7 @@
                 }
               }
             },
-            "description": "Internal Server Error"
+            "description": "Bad Gateway"
           },
           "503": {
             "content": {
@@ -7272,6 +11521,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7279,24 +11534,22 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create repository",
+        "summary": "List a repo's CI build statuses",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
       }
     },
-    "/repos/lookup-by-slug": {
+    "/repos/{repoId}/ci-webhooks": {
       "get": {
-        "operationId": "lookupRepoBySlug",
+        "operationId": "listRepoCIWebhooks",
         "parameters": [
           {
-            "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
-            "explode": false,
-            "in": "query",
-            "name": "slug",
+            "in": "path",
+            "name": "repoId",
             "required": true,
             "schema": {
-              "description": "Provider-scoped slug, e.g. gh/acme/oss-lib or et/my-project/my-repo",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -7306,12 +11559,42 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LookupBySlugOutputBody"
+                  "$ref": "#/components/schemas/ListRepoCIWebhooksOutputBody"
                 }
               }
             },
             "description": "OK"
           },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
           "404": {
             "content": {
               "application/problem+json": {
@@ -7342,6 +11625,16 @@
             },
             "description": "Internal Server Error"
           },
+          "502": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Gateway"
+          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -7353,15 +11646,27 @@
             "description": "Service Unavailable"
           }
         },
-        "summary": "Resolve a repo slug to routing info (unauthenticated)",
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "List a repo's CI webhooks",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
-      }
-    },
-    "/repos/{repoId}": {
-      "delete": {
-        "operationId": "deleteRepo",
+      },
+      "post": {
+        "operationId": "createRepoCIWebhook",
         "parameters": [
           {
             "in": "path",
@@ -7373,9 +11678,26 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateRepoCIWebhookInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CreateRepoCIWebhookBody"
+                }
+              }
+            },
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -7417,16 +11739,6 @@
             },
             "description": "Not Found"
           },
-          "421": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Misdirected Request"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -7469,6 +11781,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7476,13 +11794,16 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete repository",
+        "summary": "Enroll a repo into a CI webhook (Buildkite)",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
-      },
+      }
+    },
+    "/repos/{repoId}/ci-webhooks/audit": {
       "get": {
-        "operationId": "getRepo",
+        "description": "Audited ci_webhook_enrolled / _updated / _deleted / _identity_rolled_back / _identity_orphaned events for this repo, newest first, from core's domain audit log. The entire-ci-webhooks subscription row records no actor, so this is the only way to attribute an enrollment — and it covers subscriptions created before this endpoint existed. Authz: repo#manage_ci.",
+        "operationId": "listRepoCIWebhookAudit",
         "parameters": [
           {
             "in": "path",
@@ -7492,6 +11813,36 @@
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "event_type",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "offset",
+            "schema": {
+              "format": "int64",
+              "minimum": 0,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -7499,7 +11850,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Repo"
+                  "$ref": "#/components/schemas/ListRepoCIWebhookAuditOutputBody"
                 }
               }
             },
@@ -7564,9 +11915,25 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7574,15 +11941,16 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get repository",
+        "summary": "List who changed a repo's CI webhooks, and when",
         "tags": [
-          "repos"
+          "ci-webhooks"
         ]
       }
     },
-    "/repos/{repoId}/ci-webhooks": {
+    "/repos/{repoId}/ci-webhooks/providers": {
       "get": {
-        "operationId": "listRepoCIWebhooks",
+        "description": "Returns each provider's enrolment form AS DATA: its modes, its fields, and the select options drawn from this repo's owning org's connected credentials and registered clusters. A client renders what it is handed and posts back provider/provider_account/target_ref/mode/config, so it never names a CI vendor in its own source. A provider the org cannot enrol into yet comes back enrollable=false with a reason a customer can act on, rather than being omitted. Authz: repo#manage_ci, the same gate as enrolling.",
+        "operationId": "listRepoCIProviders",
         "parameters": [
           {
             "in": "path",
@@ -7599,7 +11967,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListRepoCIWebhooksOutputBody"
+                  "$ref": "#/components/schemas/ListRepoCIProvidersOutputBody"
                 }
               }
             },
@@ -7687,6 +12055,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7694,13 +12068,16 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List a repo's CI webhooks",
+        "summary": "Describe the enrolment form for every CI provider",
         "tags": [
           "ci-webhooks"
         ]
-      },
-      "post": {
-        "operationId": "createRepoCIWebhook",
+      }
+    },
+    "/repos/{repoId}/ci-webhooks/{id}": {
+      "delete": {
+        "description": "Deletes the subscription AND tears down its enrollment identity: the automation row (when no sibling repo shares it), its expiring repo grant, and its Buildkite OIDC binding. The Buildkite pipeline itself is always kept. Pass keep_identity=true to delete only the subscription — for an immediate re-enroll that must preserve automation_id, since teardown retires it and a re-enroll declares a new one that only bk_force_rescaffold pushes into the pipeline. A retained identity holds read access on this repo until its grant lapses. A subscription enrolled before the automation principal has no automation to retire: the delete succeeds and removes only the subscription, reported as identity_retired=false on the ci_webhook_deleted audit event — the list an operator queries to hand-delete the leftover service accounts.",
+        "operationId": "deleteRepoCIWebhook",
         "parameters": [
           {
             "in": "path",
@@ -7710,28 +12087,27 @@
               "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateRepoCIWebhookInputBody"
-              }
+          },
+          {
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "keep_identity",
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
         "responses": {
-          "201": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/CIWebhookView"
-                }
-              }
-            },
-            "description": "Created"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -7815,6 +12191,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7822,15 +12204,13 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Enroll a repo into a CI webhook (Buildkite)",
+        "summary": "Delete a repo's CI webhook",
         "tags": [
           "ci-webhooks"
         ]
-      }
-    },
-    "/repos/{repoId}/ci-webhooks/{id}": {
-      "delete": {
-        "operationId": "deleteRepoCIWebhook",
+      },
+      "patch": {
+        "operationId": "patchRepoCIWebhook",
         "parameters": [
           {
             "in": "path",
@@ -7843,24 +12223,33 @@
           },
           {
             "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "teardown",
+            "name": "id",
+            "required": true,
             "schema": {
-              "type": "boolean"
+              "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchRepoCIWebhookInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CIWebhookView"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -7944,6 +12333,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -7951,48 +12346,55 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete a repo's CI webhook",
+        "summary": "Update a repo's CI webhook",
         "tags": [
           "ci-webhooks"
         ]
-      },
-      "patch": {
-        "operationId": "patchRepoCIWebhook",
+      }
+    },
+    "/repos/{repoId}/collaborators": {
+      "get": {
+        "operationId": "listRepoCollaborators",
         "parameters": [
           {
-            "in": "path",
-            "name": "repoId",
-            "required": true,
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
             "in": "path",
-            "name": "id",
+            "name": "repoId",
             "required": true,
             "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PatchRepoCIWebhookInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CIWebhookView"
+                  "$ref": "#/components/schemas/ListRepoCollaboratorsOutputBody"
                 }
               }
             },
@@ -8057,29 +12459,15 @@
               }
             },
             "description": "Internal Server Error"
-          },
-          "502": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Bad Gateway"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8087,9 +12475,9 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Update a repo's CI webhook",
+        "summary": "List repo collaborators",
         "tags": [
-          "ci-webhooks"
+          "repos"
         ]
       }
     },
@@ -8203,6 +12591,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8321,6 +12715,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8442,6 +12842,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8563,6 +12969,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8576,9 +12988,9 @@
         ]
       }
     },
-    "/repos/{repoId}/visibility": {
+    "/repos/{repoId}/native-mirrors": {
       "get": {
-        "operationId": "getRepoVisibility",
+        "operationId": "listNativeMirrors",
         "parameters": [
           {
             "in": "path",
@@ -8595,7 +13007,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetRepoVisibilityOutputBody"
+                  "$ref": "#/components/schemas/ListNativeMirrorsOutputBody"
                 }
               }
             },
@@ -8641,6 +13053,16 @@
             },
             "description": "Not Found"
           },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -8660,9 +13082,25 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8670,13 +13108,13 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get repository visibility",
+        "summary": "List native-mirror placement status",
         "tags": [
-          "repos"
+          "native-mirrors"
         ]
       },
-      "put": {
-        "operationId": "setRepoVisibility",
+      "post": {
+        "operationId": "createNativeMirror",
         "parameters": [
           {
             "in": "path",
@@ -8692,22 +13130,22 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/SetRepoVisibilityInputBody"
+                "$ref": "#/components/schemas/CreateNativeMirrorInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SetRepoVisibilityOutputBody"
+                  "$ref": "#/components/schemas/NativeMirrorPlacement"
                 }
               }
             },
-            "description": "OK"
+            "description": "Accepted"
           },
           "400": {
             "content": {
@@ -8749,6 +13187,36 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Precondition Failed"
+          },
+          "421": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Misdirected Request"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -8768,9 +13236,25 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8778,62 +13262,67 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Set repository visibility",
+        "summary": "Create a native-mirror placement",
         "tags": [
-          "repos"
+          "native-mirrors"
         ]
       }
     },
-    "/service-accounts": {
-      "get": {
-        "operationId": "listServiceAccounts",
+    "/repos/{repoId}/native-mirrors/{clusterSlug}": {
+      "delete": {
+        "operationId": "deleteNativeMirror",
         "parameters": [
           {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
+            "in": "path",
+            "name": "repoId",
+            "required": true,
             "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           },
           {
-            "explode": false,
-            "in": "query",
-            "name": "orgId",
+            "in": "path",
+            "name": "clusterSlug",
             "required": true,
             "schema": {
-              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListServiceAccountsOutputBody"
+                  "$ref": "#/components/schemas/NativeMirrorPlacement"
                 }
               }
             },
-            "description": "OK"
+            "description": "Accepted"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
           },
-          "400": {
+          "403": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -8841,9 +13330,9 @@
                 }
               }
             },
-            "description": "Bad Request"
+            "description": "Forbidden"
           },
-          "401": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -8851,9 +13340,9 @@
                 }
               }
             },
-            "description": "Unauthorized"
+            "description": "Not Found"
           },
-          "403": {
+          "409": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -8861,9 +13350,9 @@
                 }
               }
             },
-            "description": "Forbidden"
+            "description": "Conflict"
           },
-          "404": {
+          "421": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -8871,7 +13360,7 @@
                 }
               }
             },
-            "description": "Not Found"
+            "description": "Misdirected Request"
           },
           "422": {
             "content": {
@@ -8905,6 +13394,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -8912,33 +13407,36 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List service accounts in an org",
+        "summary": "Delete a native-mirror placement",
         "tags": [
-          "service-accounts"
+          "native-mirrors"
         ]
-      },
-      "post": {
-        "operationId": "createServiceAccount",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateServiceAccountInputBody"
-              }
+      }
+    },
+    "/repos/{repoId}/visibility": {
+      "get": {
+        "operationId": "getRepoVisibility",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "repoId",
+            "required": true,
+            "schema": {
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
+              "type": "string"
             }
-          },
-          "required": true
-        },
+          }
+        ],
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ServiceAccount"
+                  "$ref": "#/components/schemas/GetRepoVisibilityOutputBody"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -8980,16 +13478,6 @@
             },
             "description": "Not Found"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -9009,19 +13497,15 @@
               }
             },
             "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9029,29 +13513,44 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create service account",
+        "summary": "Get repository visibility",
         "tags": [
-          "service-accounts"
+          "repos"
         ]
-      }
-    },
-    "/service-accounts/{accountId}": {
-      "delete": {
-        "operationId": "deleteServiceAccount",
+      },
+      "put": {
+        "operationId": "setRepoVisibility",
         "parameters": [
           {
             "in": "path",
-            "name": "accountId",
+            "name": "repoId",
             "required": true,
             "schema": {
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SetRepoVisibilityInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SetRepoVisibilityOutputBody"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -9112,19 +13611,15 @@
               }
             },
             "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9132,20 +13627,46 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete service account",
+        "summary": "Set repository visibility",
         "tags": [
-          "service-accounts"
+          "repos"
         ]
-      },
+      }
+    },
+    "/service-accounts": {
       "get": {
-        "operationId": "getServiceAccount",
+        "operationId": "listServiceAccounts",
         "parameters": [
           {
-            "in": "path",
-            "name": "accountId",
+            "description": "Maximum entries to return; server may cap further.",
+            "explode": false,
+            "in": "query",
+            "name": "pageSize",
+            "schema": {
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from a previous response's nextPageToken.",
+            "explode": false,
+            "in": "query",
+            "name": "pageToken",
+            "schema": {
+              "description": "Opaque cursor from a previous response's nextPageToken.",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "orgId",
             "required": true,
             "schema": {
-              "minLength": 1,
+              "pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
               "type": "string"
             }
           }
@@ -9155,7 +13676,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ServiceAccount"
+                  "$ref": "#/components/schemas/ListServiceAccountsOutputBody"
                 }
               }
             },
@@ -9233,6 +13754,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9240,59 +13767,33 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get service account",
+        "summary": "List service accounts in an org",
         "tags": [
           "service-accounts"
         ]
-      }
-    },
-    "/service-accounts/{accountId}/bindings": {
-      "get": {
-        "operationId": "listBindings",
-        "parameters": [
-          {
-            "description": "Maximum entries to return; server may cap further.",
-            "explode": false,
-            "in": "query",
-            "name": "pageSize",
-            "schema": {
-              "description": "Maximum entries to return; server may cap further.",
-              "format": "int32",
-              "maximum": 500,
-              "minimum": 0,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from a previous response's nextPageToken.",
-            "explode": false,
-            "in": "query",
-            "name": "pageToken",
-            "schema": {
-              "description": "Opaque cursor from a previous response's nextPageToken.",
-              "type": "string"
+      },
+      "post": {
+        "operationId": "createServiceAccount",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateServiceAccountInputBody"
+              }
             }
           },
-          {
-            "in": "path",
-            "name": "accountId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
-          }
-        ],
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListBindingsOutputBody"
+                  "$ref": "#/components/schemas/ServiceAccount"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -9334,6 +13835,16 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -9366,6 +13877,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9373,13 +13890,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List OIDC bindings",
+        "summary": "Create service account",
         "tags": [
           "service-accounts"
         ]
-      },
-      "post": {
-        "operationId": "createBinding",
+      }
+    },
+    "/service-accounts/{accountId}": {
+      "delete": {
+        "operationId": "deleteServiceAccount",
         "parameters": [
           {
             "in": "path",
@@ -9391,26 +13910,9 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateBindingInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Binding"
-                }
-              }
-            },
-            "description": "Created"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -9452,16 +13954,6 @@
             },
             "description": "Not Found"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -9494,6 +13986,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9501,15 +13999,13 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Create OIDC binding",
+        "summary": "Delete service account",
         "tags": [
           "service-accounts"
         ]
-      }
-    },
-    "/service-accounts/{accountId}/bindings/{bindingId}": {
-      "delete": {
-        "operationId": "deleteBinding",
+      },
+      "get": {
+        "operationId": "getServiceAccount",
         "parameters": [
           {
             "in": "path",
@@ -9519,20 +14015,18 @@
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "bindingId",
-            "required": true,
-            "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ServiceAccount"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -9606,6 +14100,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9613,15 +14113,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Delete OIDC binding",
+        "summary": "Get service account",
         "tags": [
           "service-accounts"
         ]
       }
     },
-    "/service-accounts/{accountId}/grants": {
+    "/service-accounts/{accountId}/bindings": {
       "get": {
-        "operationId": "listServiceAccountGrants",
+        "operationId": "listBindings",
         "parameters": [
           {
             "description": "Maximum entries to return; server may cap further.",
@@ -9661,7 +14161,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListServiceAccountGrantsOutputBody"
+                  "$ref": "#/components/schemas/ListBindingsOutputBody"
                 }
               }
             },
@@ -9739,6 +14239,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9746,13 +14252,13 @@
             "sessionAuth": []
           }
         ],
-        "summary": "List service account grants",
+        "summary": "List OIDC bindings",
         "tags": [
           "service-accounts"
         ]
       },
       "post": {
-        "operationId": "grantServiceAccountAccess",
+        "operationId": "createBinding",
         "parameters": [
           {
             "in": "path",
@@ -9768,7 +14274,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/GrantServiceAccountAccessInputBody"
+                "$ref": "#/components/schemas/CreateBindingInputBody"
               }
             }
           },
@@ -9779,7 +14285,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GrantServiceAccountAccessOutputBody"
+                  "$ref": "#/components/schemas/Binding"
                 }
               }
             },
@@ -9867,6 +14373,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -9874,15 +14386,15 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Grant service account access on a repo or project",
+        "summary": "Create OIDC binding",
         "tags": [
           "service-accounts"
         ]
       }
     },
-    "/service-accounts/{accountId}/grants/{resourceType}/{resourceId}": {
+    "/service-accounts/{accountId}/bindings/{bindingId}": {
       "delete": {
-        "operationId": "revokeServiceAccountAccess",
+        "operationId": "deleteBinding",
         "parameters": [
           {
             "in": "path",
@@ -9895,19 +14407,7 @@
           },
           {
             "in": "path",
-            "name": "resourceType",
-            "required": true,
-            "schema": {
-              "enum": [
-                "repo",
-                "project"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "resourceId",
+            "name": "bindingId",
             "required": true,
             "schema": {
               "minLength": 1,
@@ -9959,16 +14459,6 @@
             },
             "description": "Not Found"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -10002,74 +14492,11 @@
         },
         "security": [
           {
-            "bearerAuth": []
+            "oauth2": []
           },
           {
-            "sessionAuth": []
-          }
-        ],
-        "summary": "Revoke service account access",
-        "tags": [
-          "service-accounts"
-        ]
-      }
-    },
-    "/topology": {
-      "get": {
-        "operationId": "getTopology",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetTopologyOutputBody"
-                }
-              }
-            },
-            "description": "OK"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Unauthorized"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Forbidden"
+            "oidc": []
           },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          }
-        },
-        "security": [
           {
             "bearerAuth": []
           },
@@ -10077,79 +14504,44 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get the cluster topology as a jurisdiction → region → cluster tree",
-        "tags": [
-          "clusters"
-        ]
-      }
-    },
-    "/version": {
-      "get": {
-        "operationId": "getVersion",
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetVersionOutputBody"
-                }
-              }
-            },
-            "description": "OK"
-          },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          }
-        },
-        "summary": "Get the server version and mode",
+        "summary": "Delete OIDC binding",
         "tags": [
-          "meta"
+          "service-accounts"
         ]
       }
     },
-    "/mirrors/placements": {
+    "/service-accounts/{accountId}/grants": {
       "get": {
-        "operationId": "resolveMirrorPlacements",
+        "operationId": "listServiceAccountGrants",
         "parameters": [
           {
+            "description": "Maximum entries to return; server may cap further.",
             "explode": false,
             "in": "query",
-            "name": "provider",
-            "required": true,
+            "name": "pageSize",
             "schema": {
-              "enum": [
-                "github"
-              ],
-              "type": "string"
+              "description": "Maximum entries to return; server may cap further.",
+              "format": "int32",
+              "maximum": 500,
+              "minimum": 0,
+              "type": "integer"
             }
           },
           {
-            "description": "Upstream owner login (case-insensitive).",
+            "description": "Opaque cursor from a previous response's nextPageToken.",
             "explode": false,
             "in": "query",
-            "name": "owner",
-            "required": true,
+            "name": "pageToken",
             "schema": {
-              "description": "Upstream owner login (case-insensitive).",
-              "minLength": 1,
+              "description": "Opaque cursor from a previous response's nextPageToken.",
               "type": "string"
             }
           },
           {
-            "description": "Upstream repo name (case-insensitive).",
-            "explode": false,
-            "in": "query",
-            "name": "repo",
+            "in": "path",
+            "name": "accountId",
             "required": true,
             "schema": {
-              "description": "Upstream repo name (case-insensitive).",
               "minLength": 1,
               "type": "string"
             }
@@ -10160,7 +14552,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ResolvePlacementsOutputBody"
+                  "$ref": "#/components/schemas/ListServiceAccountGrantsOutputBody"
                 }
               }
             },
@@ -10196,6 +14588,16 @@
             },
             "description": "Forbidden"
           },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -10215,9 +14617,25 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -10225,43 +14643,44 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Resolve the pullable cluster placements of a mirrored upstream (clone discovery)",
+        "summary": "List service account grants",
         "tags": [
-          "mirrors"
+          "service-accounts"
         ]
-      }
-    },
-    "/mirror-requests": {
+      },
       "post": {
-        "description": "a validation failure may be reported synchronously at submission or as a terminal state on the request; clients must handle both.",
-        "operationId": "createMirrorRequest",
+        "operationId": "grantServiceAccountAccess",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "accountId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateMirrorRequestInputBody"
+                "$ref": "#/components/schemas/GrantServiceAccountAccessInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "202": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MirrorRequest"
+                  "$ref": "#/components/schemas/GrantServiceAccountAccessOutputBody"
                 }
               }
             },
-            "description": "Accepted",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -10313,16 +14732,6 @@
             },
             "description": "Conflict"
           },
-          "421": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Misdirected Request"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -10343,16 +14752,6 @@
             },
             "description": "Internal Server Error"
           },
-          "502": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorModel"
-                }
-              }
-            },
-            "description": "Bad Gateway"
-          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -10365,6 +14764,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -10372,37 +14777,50 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Submit a mirror creation request",
+        "summary": "Grant service account access on a repo or project",
         "tags": [
-          "mirrors"
+          "service-accounts"
         ]
       }
     },
-    "/mirror-requests/{requestId}": {
-      "get": {
-        "description": "unknown failure codes must be treated as a generic terminal failure.",
-        "operationId": "getMirrorRequest",
+    "/service-accounts/{accountId}/grants/{resourceType}/{resourceId}": {
+      "delete": {
+        "operationId": "revokeServiceAccountAccess",
         "parameters": [
           {
             "in": "path",
-            "name": "requestId",
+            "name": "accountId",
             "required": true,
             "schema": {
-              "format": "uuid",
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "resourceType",
+            "required": true,
+            "schema": {
+              "enum": [
+                "repo",
+                "project"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "resourceId",
+            "required": true,
+            "schema": {
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/MirrorRequest"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -10444,6 +14862,16 @@
             },
             "description": "Not Found"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -10476,6 +14904,12 @@
           }
         },
         "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
           {
             "bearerAuth": []
           },
@@ -10483,9 +14917,115 @@
             "sessionAuth": []
           }
         ],
-        "summary": "Get a mirror creation request",
+        "summary": "Revoke service account access",
         "tags": [
-          "mirrors"
+          "service-accounts"
+        ]
+      }
+    },
+    "/topology": {
+      "get": {
+        "operationId": "getTopology",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetTopologyOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "security": [
+          {
+            "oauth2": []
+          },
+          {
+            "oidc": []
+          },
+          {
+            "bearerAuth": []
+          },
+          {
+            "sessionAuth": []
+          }
+        ],
+        "summary": "Get the cluster topology as a jurisdiction → region → cluster tree",
+        "tags": [
+          "clusters"
+        ]
+      }
+    },
+    "/version": {
+      "get": {
+        "operationId": "getVersion",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetVersionOutputBody"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorModel"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          }
+        },
+        "summary": "Get the server version and mode",
+        "tags": [
+          "meta"
         ]
       }
     }
diff --git a/internal/coreapi/spec/normalize.go b/internal/coreapi/spec/normalize.go
index 8878314aa7..ee99572176 100644
--- a/internal/coreapi/spec/normalize.go
+++ b/internal/coreapi/spec/normalize.go
@@ -6,7 +6,7 @@
 // committed artifact (core.gen.json) that ogen consumes; the upstream
 // file is never mutated, so a refresh is a clean `curl` overwrite.
 //
-// This command applies two transforms, documented below. The running
+// This command applies four transforms, documented below. The running
 // checklist of upstream fixes lives in internal/coreapi/UPSTREAM.md.
 //
 // Transform 1 (codegen-ergonomics fold, not a bug workaround): fold every
@@ -34,6 +34,16 @@
 // response read models are loosened; request-body enums stay strict so we
 // still reject a bad value we are about to send.
 //
+// Transform 2b (forward- and backward-compat, unread read-model fields): drop
+// selected fields from a read model's "required" list (see
+// readModelOptionalFields). The client never reads them, so a server that
+// does not send them yet must not fail the whole request.
+//
+// Transform 3 (unsupported security schemes): drop the interactive login
+// schemes (oauth2, oidc) the spec lists on every operation. The CLI never
+// drives them through the generated client, and ogen has no generator for
+// openIdConnect, so leaving them in stops generation outright.
+//
 // Run via `go generate ./internal/coreapi/...` (the first generate step in
 // gen.go), or by hand after refreshing the spec:
 //
@@ -47,6 +57,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"slices"
 )
 
 const (
@@ -78,6 +89,8 @@ func run() error {
 
 	ops := foldErrorResponses(doc)
 	loosened := loosenReadModelEnums(doc)
+	optional := loosenReadModelRequired(doc)
+	schemes := dropInteractiveSecurity(doc)
 
 	var buf bytes.Buffer
 	enc := json.NewEncoder(&buf)
@@ -90,10 +103,85 @@ func run() error {
 		return fmt.Errorf("write spec: %w", err)
 	}
 
-	fmt.Printf("normalize: folded error responses on %d operation(s), loosened %d read-model enum field(s) → %s\n", ops, loosened, outPath)
+	fmt.Printf("normalize: folded error responses on %d operation(s), loosened %d read-model enum field(s), made %d read-model field(s) optional, dropped %d interactive security scheme(s) → %s\n", ops, loosened, optional, schemes, outPath)
 	return nil
 }
 
+// interactiveSecuritySchemes are the browser and device login schemes the
+// spec advertises on every operation. The CLI drives none of them through
+// the generated client: it mints a bearer itself and hands it over as
+// bearerAuth. ogen also has no generator for openIdConnect and stops on it.
+var interactiveSecuritySchemes = map[string]bool{"oauth2": true, "oidc": true}
+
+// dropInteractiveSecurity removes interactiveSecuritySchemes from
+// components.securitySchemes, from the document-level security list, and
+// from every operation's security list, so the generated SecuritySource
+// keeps exactly the bearerAuth and sessionAuth methods the client
+// implements. It returns the number of schemes removed from components.
+func dropInteractiveSecurity(doc map[string]any) int {
+	count := 0
+	if components, ok := doc["components"].(map[string]any); ok {
+		if schemes, ok := components["securitySchemes"].(map[string]any); ok {
+			for name := range interactiveSecuritySchemes {
+				if _, present := schemes[name]; present {
+					delete(schemes, name)
+					count++
+				}
+			}
+		}
+	}
+	if sec, ok := doc["security"].([]any); ok {
+		doc["security"] = filterSecurityRequirements(sec)
+	}
+	paths, ok := doc["paths"].(map[string]any)
+	if !ok {
+		return count
+	}
+	for _, item := range paths {
+		pathItem, ok := item.(map[string]any)
+		if !ok {
+			continue
+		}
+		for method, op := range pathItem {
+			if !httpMethods[method] {
+				continue
+			}
+			operation, ok := op.(map[string]any)
+			if !ok {
+				continue
+			}
+			if sec, ok := operation["security"].([]any); ok {
+				operation["security"] = filterSecurityRequirements(sec)
+			}
+		}
+	}
+	return count
+}
+
+// filterSecurityRequirements drops the alternatives that name only
+// interactive schemes. A requirement in this spec is a one-key object, so
+// dropping the object drops the alternative.
+func filterSecurityRequirements(reqs []any) []any {
+	kept := make([]any, 0, len(reqs))
+	for _, r := range reqs {
+		req, ok := r.(map[string]any)
+		if !ok {
+			kept = append(kept, r)
+			continue
+		}
+		interactive := len(req) > 0
+		for name := range req {
+			if !interactiveSecuritySchemes[name] {
+				interactive = false
+			}
+		}
+		if !interactive {
+			kept = append(kept, r)
+		}
+	}
+	return kept
+}
+
 // readModelEnumFields lists the response read-model schema fields whose
 // "enum" constraint is dropped by loosenReadModelEnums, keyed by component
 // schema name. These are display-only on the client: the CLI prints them
@@ -104,7 +192,55 @@ func run() error {
 // SetRepoVisibilityInputBody) keep their enums so we still reject a bad
 // value before sending it.
 var readModelEnumFields = map[string][]string{
-	"Repo": {"objectFormat", "state", "visibility"},
+	"Repo":             {"objectFormat", "provider", "state", "visibility"},
+	"RepoIDResolution": {"provider"},
+	"RepoIndexEntry":   {"provider"},
+	"RepoReference":    {"provider"},
+	"RepoResolution":   {"provider"},
+}
+
+// readModelOptionalFields lists response read-model fields the spec marks
+// required but the client never reads, keyed by component schema name.
+// loosenReadModelRequired drops them from "required" so a server that
+// predates the field, or a test fake that omits it, still decodes. A field
+// the CLI starts reading must leave this list.
+var readModelOptionalFields = map[string][]string{
+	"Repo": {"capabilities", "provider"},
+}
+
+// loosenReadModelRequired removes each field named in readModelOptionalFields
+// from its schema's "required" list. Returns the number of fields removed.
+func loosenReadModelRequired(doc map[string]any) int {
+	components, ok := doc["components"].(map[string]any)
+	if !ok {
+		return 0
+	}
+	schemas, ok := components["schemas"].(map[string]any)
+	if !ok {
+		return 0
+	}
+	count := 0
+	for schemaName, fields := range readModelOptionalFields {
+		schema, ok := schemas[schemaName].(map[string]any)
+		if !ok {
+			continue
+		}
+		required, ok := schema["required"].([]any)
+		if !ok {
+			continue
+		}
+		kept := make([]any, 0, len(required))
+		for _, r := range required {
+			name, _ := r.(string)
+			if slices.Contains(fields, name) {
+				count++
+				continue
+			}
+			kept = append(kept, r)
+		}
+		schema["required"] = kept
+	}
+	return count
 }
 
 // loosenReadModelEnums deletes the "enum" key from each field named in

From c0bb11d780765cde790bbe39daa8782a4bd6ab93 Mon Sep 17 00:00:00 2001
From: Kai Ramuenke <kai@entire.io>
Date: Thu, 10 Sep 2026 10:35:31 +1000
Subject: [PATCH 20/59] repo: add the branch-protection subtree

`entire repo protection list|add|remove` edits a native repository's
branch-protection rules through core's /repos/{repoId}/branch-protection
resource. Each rule is a branch pattern and a level: protected (no force
push, no delete) or, with --server-side-merge-only, no direct push at all.
add and remove are one PATCH each; add upserts by ref, so re-adding a
branch changes its level. A short name expands to refs/heads/, HEAD and
refs/... pass through. Every verb prints the resulting rules and honours
--json.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 CLAUDE.md                                |  10 +-
 cmd/entire/cli/corecmd_json_flag_test.go |   4 +
 cmd/entire/cli/repo.go                   |   7 +-
 cmd/entire/cli/repo_protection.go        | 184 ++++++++++++++++++
 cmd/entire/cli/repo_protection_test.go   | 236 +++++++++++++++++++++++
 5 files changed, 436 insertions(+), 5 deletions(-)
 create mode 100644 cmd/entire/cli/repo_protection.go
 create mode 100644 cmd/entire/cli/repo_protection_test.go

diff --git a/CLAUDE.md b/CLAUDE.md
index d81a505389..3460a5de37 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -80,8 +80,14 @@ the commands are always runnable in every build.
 - `org`: control-plane organization management — `create`, `list`, `get`, `delete`
 - `project`: control-plane project management — `create`, `list`, `get`, `delete`
 - `repo`: control-plane repository lifecycle — `create`, `list`, `get`, `delete`,
-  `clone`, plus the `mirror` and `visibility` subtrees. Git content operations
-  (log, diff, …) are intentionally out of scope. The `mirror` subtree is
+  `clone`, plus the `mirror`, `visibility` and `protection` subtrees. Git
+  content operations (log, diff, …) are intentionally out of scope.
+  `protection` (`list`, `add [--server-side-merge-only]`, `remove`) edits a
+  native repo's branch-protection rules through core's
+  `/repos/{repoId}/branch-protection` resource: `add` and `remove` are one
+  PATCH each (`addRules` upserts by ref, so re-adding a branch changes its
+  level), never a read-modify-write of the list; a short branch name expands
+  to `refs/heads/`, `HEAD` and `refs/...` pass through. The `mirror` subtree is
   server-side (`create`, `list`, `get`, `remove`, `collaborators`) with one
   exception: `mirror use` repoints the *current clone's* git remote at a mirror
   (local git config only — it creates nothing server-side). Interactively it
diff --git a/cmd/entire/cli/corecmd_json_flag_test.go b/cmd/entire/cli/corecmd_json_flag_test.go
index 137ff33f18..c859330cae 100644
--- a/cmd/entire/cli/corecmd_json_flag_test.go
+++ b/cmd/entire/cli/corecmd_json_flag_test.go
@@ -50,6 +50,10 @@ func TestControlPlaneJSONFlag_OnlyOnHonoringCommands(t *testing.T) {
 		"repo mirror collaborators list": true,
 		"repo visibility get":            true,
 		"repo visibility set":            true,
+		// add/remove print the resulting rule list, so they render JSON too.
+		"repo protection list":   true,
+		"repo protection add":    true,
+		"repo protection remove": true,
 		// grant
 		"grant org add":        true,
 		"grant org list":       true,
diff --git a/cmd/entire/cli/repo.go b/cmd/entire/cli/repo.go
index 2ba5a46fb4..070e9e7dab 100644
--- a/cmd/entire/cli/repo.go
+++ b/cmd/entire/cli/repo.go
@@ -15,9 +15,9 @@ import (
 
 // newRepoCmd is the `entire repo` command group: control-plane
 // repository lifecycle (create, list within a project, get, delete), the
-// `mirror` and `visibility` subtrees, plus the `clone` convenience that
-// resolves a mirror and shells out to `git clone`. Other git content
-// operations (log, diff, …) remain intentionally out of scope here.
+// `mirror`, `visibility` and `protection` subtrees, plus the `clone`
+// convenience that resolves a mirror and shells out to `git clone`. Other git
+// content operations (log, diff, …) remain intentionally out of scope here.
 func newRepoCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "repo",
@@ -31,6 +31,7 @@ func newRepoCmd() *cobra.Command {
 	cmd.AddCommand(newRepoCloneCmd())
 	cmd.AddCommand(newRepoMirrorCmd())
 	cmd.AddCommand(newRepoVisibilityCmd())
+	cmd.AddCommand(newRepoProtectionCmd())
 	return cmd
 }
 
diff --git a/cmd/entire/cli/repo_protection.go b/cmd/entire/cli/repo_protection.go
new file mode 100644
index 0000000000..fee6ee75de
--- /dev/null
+++ b/cmd/entire/cli/repo_protection.go
@@ -0,0 +1,184 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"github.com/entireio/cli/internal/coreapi"
+)
+
+// branchRule is the JSON/table view of one branch-protection rule: the
+// pattern as the server stores it and its level.
+type branchRule struct {
+	Ref                 string `json:"ref"`
+	ServerSideMergeOnly bool   `json:"serverSideMergeOnly"`
+}
+
+var protectionColumns = []string{"BRANCH", "LEVEL"}
+
+const (
+	protectionLevelProtected = "protected"
+	protectionLevelMergeOnly = "server-side merge only"
+	protectionEmpty          = "Nothing is protected yet."
+	// headBranchPattern is the server's pattern for "whatever branch HEAD
+	// points at"; it follows a default-branch rename.
+	headBranchPattern = "HEAD"
+)
+
+func protectionRow(r branchRule) []string {
+	level := protectionLevelProtected
+	if r.ServerSideMergeOnly {
+		level = protectionLevelMergeOnly
+	}
+	return []string{r.Ref, level}
+}
+
+func branchRulesFromWire(p *coreapi.BranchProtection) []branchRule {
+	rules := make([]branchRule, 0, len(p.Rules))
+	for _, r := range p.Rules {
+		rules = append(rules, branchRule{Ref: r.Ref, ServerSideMergeOnly: r.ServerSideMergeOnly.Or(false)})
+	}
+	return rules
+}
+
+// expandBranchRef maps the CLI argument onto the server's pattern syntax:
+// "HEAD" and anything under refs/ pass through, a short name is a branch
+// under refs/heads/. Wildcards are left to the server to validate.
+func expandBranchRef(s string) (string, error) {
+	switch {
+	case s == "":
+		return "", errors.New("branch must not be empty")
+	case s == headBranchPattern, strings.HasPrefix(s, "refs/"):
+		return s, nil
+	default:
+		return "refs/heads/" + s, nil
+	}
+}
+
+// newRepoProtectionCmd groups the verbs for a repository's branch protection.
+// Each rule names a branch pattern and one of two levels. "protected" refuses
+// force pushes and deletion; fast-forward pushes stay allowed. "server-side
+// merge only" also refuses every direct push: the branch moves only through a
+// merge Entire performs, such as a trail merge, and whether that merge runs is
+// decided by the repository's gates.
+func newRepoProtectionCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "protection",
+		Short: "List, add, or remove branch-protection rules",
+		Long: "List, add, or remove a repository's branch-protection rules.\n\n" +
+			"Each rule names a branch pattern and a level. \"protected\" refuses force pushes " +
+			"and deletion; fast-forward pushes stay allowed. \"server-side merge only\" also " +
+			"refuses every direct push: the branch moves only through a merge Entire performs, " +
+			"such as a trail merge. A pattern is \"HEAD\" (the default branch), a branch name, " +
+			"or a branch pattern with * and ? wildcards such as release/*. Entire-native " +
+			"repositories only; a GitHub mirror's protection is the upstream's.",
+	}
+	cmd.AddCommand(newRepoProtectionListCmd())
+	cmd.AddCommand(newRepoProtectionAddCmd())
+	cmd.AddCommand(newRepoProtectionRemoveCmd())
+	return cmd
+}
+
+func newRepoProtectionListCmd() *cobra.Command {
+	var project string
+	cmd := &cobra.Command{
+		Use:   "list <repo>",
+		Short: "Show a repository's branch-protection rules",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runCoreList(cmd, protectionEmpty, protectionColumns, protectionRow, func(ctx context.Context, c *coreapi.Client) ([]branchRule, error) {
+				repoID, err := resolveRepoRef(ctx, c, args[0], project)
+				if err != nil {
+					return nil, err
+				}
+				out, err := c.GetBranchProtection(ctx, coreapi.GetBranchProtectionParams{RepoId: repoID})
+				if err != nil {
+					return nil, err
+				}
+				return branchRulesFromWire(out), nil
+			})
+		},
+	}
+	bindRepoProjectFlag(cmd, &project)
+	addJSONFlag(cmd)
+	return cmd
+}
+
+func newRepoProtectionAddCmd() *cobra.Command {
+	var project string
+	var mergeOnly bool
+	cmd := &cobra.Command{
+		Use:   "add <repo> <branch>",
+		Short: "Protect a branch, or change the level of an existing rule",
+		Long: "Protect a branch, or change the level of an existing rule.\n\n" +
+			"<branch> is \"HEAD\", a branch name such as main, or a pattern such as release/*. " +
+			"Without --server-side-merge-only the branch is protected from force pushes and " +
+			"deletion. With it, every direct push is refused and the branch moves only through " +
+			"a merge Entire performs. Adding a branch that already has a rule replaces that " +
+			"rule's level. Prints the resulting rules. Requires manage permission on the repo.",
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ref, err := expandBranchRef(args[1])
+			if err != nil {
+				cmd.SilenceUsage = true
+				return err
+			}
+			return runCoreList(cmd, protectionEmpty, protectionColumns, protectionRow, func(ctx context.Context, c *coreapi.Client) ([]branchRule, error) {
+				repoID, err := resolveRepoRef(ctx, c, args[0], project)
+				if err != nil {
+					return nil, err
+				}
+				body := &coreapi.UpdateBranchProtectionInputBody{
+					AddRules: []coreapi.BranchRule{{Ref: ref, ServerSideMergeOnly: coreapi.NewOptBool(mergeOnly)}},
+				}
+				out, err := c.UpdateBranchProtection(ctx, body, coreapi.UpdateBranchProtectionParams{RepoId: repoID})
+				if err != nil {
+					return nil, err
+				}
+				return branchRulesFromWire(out), nil
+			})
+		},
+	}
+	bindRepoProjectFlag(cmd, &project)
+	cmd.Flags().BoolVar(&mergeOnly, "server-side-merge-only", false, "Refuse every direct push; the branch moves only through a merge Entire performs")
+	addJSONFlag(cmd)
+	return cmd
+}
+
+func newRepoProtectionRemoveCmd() *cobra.Command {
+	var project string
+	cmd := &cobra.Command{
+		Use:   "remove <repo> <branch>",
+		Short: "Remove a branch-protection rule",
+		Long: "Remove a branch-protection rule.\n\n" +
+			"<branch> names the rule as it was added: \"HEAD\", a branch name, or a pattern. " +
+			"Removing a branch that has no rule changes nothing. Prints the resulting rules. " +
+			"Requires manage permission on the repo.",
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			ref, err := expandBranchRef(args[1])
+			if err != nil {
+				cmd.SilenceUsage = true
+				return err
+			}
+			return runCoreList(cmd, protectionEmpty, protectionColumns, protectionRow, func(ctx context.Context, c *coreapi.Client) ([]branchRule, error) {
+				repoID, err := resolveRepoRef(ctx, c, args[0], project)
+				if err != nil {
+					return nil, err
+				}
+				body := &coreapi.UpdateBranchProtectionInputBody{RemoveRefs: []string{ref}}
+				out, err := c.UpdateBranchProtection(ctx, body, coreapi.UpdateBranchProtectionParams{RepoId: repoID})
+				if err != nil {
+					return nil, err
+				}
+				return branchRulesFromWire(out), nil
+			})
+		},
+	}
+	bindRepoProjectFlag(cmd, &project)
+	addJSONFlag(cmd)
+	return cmd
+}
diff --git a/cmd/entire/cli/repo_protection_test.go b/cmd/entire/cli/repo_protection_test.go
new file mode 100644
index 0000000000..8c1de96b44
--- /dev/null
+++ b/cmd/entire/cli/repo_protection_test.go
@@ -0,0 +1,236 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/entireio/cli/internal/coreapi"
+)
+
+const testProtectionRepoULID = "01KS6KFJR2XS6PZ188MVYE07AN"
+
+func TestExpandBranchRef(t *testing.T) {
+	t.Parallel()
+	cases := map[string]string{
+		"main":               "refs/heads/main",
+		"release/*":          "refs/heads/release/*",
+		"HEAD":               "HEAD",
+		"refs/heads/main":    "refs/heads/main",
+		"refs/heads/hotfix/": "refs/heads/hotfix/",
+	}
+	for in, want := range cases {
+		got, err := expandBranchRef(in)
+		require.NoError(t, err, in)
+		assert.Equal(t, want, got, in)
+	}
+	_, err := expandBranchRef("")
+	require.Error(t, err)
+}
+
+func TestProtectionRow(t *testing.T) {
+	t.Parallel()
+	assert.Equal(t, []string{"refs/heads/main", protectionLevelMergeOnly}, protectionRow(branchRule{Ref: "refs/heads/main", ServerSideMergeOnly: true}))
+	assert.Equal(t, []string{"HEAD", protectionLevelProtected}, protectionRow(branchRule{Ref: "HEAD"}))
+}
+
+// fakeProtectionServer stands in for core's branch-protection resource. It
+// applies PATCH bodies with the server's upsert-by-ref rule so a test sees the
+// same resulting list the real core would return.
+type fakeProtectionServer struct {
+	mu      sync.Mutex
+	rules   []coreapi.BranchRule
+	patches []coreapi.UpdateBranchProtectionInputBody
+}
+
+func (f *fakeProtectionServer) handler(t *testing.T) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/"+testProtectionRepoULID+"/branch-protection" {
+			t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		switch r.Method {
+		case http.MethodGet:
+		case http.MethodPatch:
+			raw, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Errorf("read patch body: %v", err)
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			var body coreapi.UpdateBranchProtectionInputBody
+			if err := json.Unmarshal(raw, &body); err != nil {
+				t.Errorf("decode patch body %s: %v", raw, err)
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			f.patches = append(f.patches, body)
+			f.apply(body)
+		default:
+			t.Errorf("unexpected method %s", r.Method)
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if err := printJSON(w, &coreapi.BranchProtection{Rules: f.rules}); err != nil {
+			t.Errorf("encode response: %v", err)
+		}
+	}
+}
+
+func (f *fakeProtectionServer) apply(body coreapi.UpdateBranchProtectionInputBody) {
+	var next []coreapi.BranchRule
+	for _, r := range f.rules {
+		removed := false
+		for _, ref := range body.RemoveRefs {
+			if ref == r.Ref {
+				removed = true
+			}
+		}
+		if removed {
+			continue
+		}
+		for _, a := range body.AddRules {
+			if a.Ref == r.Ref {
+				r.ServerSideMergeOnly = a.ServerSideMergeOnly
+			}
+		}
+		next = append(next, r)
+	}
+	for _, a := range body.AddRules {
+		present := false
+		for _, r := range next {
+			if r.Ref == a.Ref {
+				present = true
+			}
+		}
+		if !present {
+			next = append(next, a)
+		}
+	}
+	f.rules = next
+}
+
+// newProtectionFixture installs the fake as the active core client.
+// Not parallel: swaps the package-level activeCoreClient seam.
+func newProtectionFixture(t *testing.T, rules ...coreapi.BranchRule) *fakeProtectionServer {
+	t.Helper()
+	fake := &fakeProtectionServer{rules: rules}
+	srv := httptest.NewServer(fake.handler(t))
+	t.Cleanup(srv.Close)
+	prev := activeCoreClient
+	activeCoreClient = func(context.Context) (*coreapi.Client, error) {
+		return coreapi.NewWithBearer(srv.URL, "tok")
+	}
+	t.Cleanup(func() { activeCoreClient = prev })
+	return fake
+}
+
+// rulesView projects wire rules onto the comparable view; the decoded wire
+// structs carry an empty AdditionalProps map that a literal does not.
+func rulesView(rs []coreapi.BranchRule) []branchRule {
+	return branchRulesFromWire(&coreapi.BranchProtection{Rules: rs})
+}
+
+func execRepoProtection(t *testing.T, args ...string) (stdout string, err error) {
+	t.Helper()
+	parent := &cobra.Command{Use: "repo"}
+	addControlPlaneFlags(parent)
+	parent.AddCommand(newRepoProtectionCmd())
+	var out, errOut bytes.Buffer
+	parent.SetOut(&out)
+	parent.SetErr(&errOut)
+	parent.SetArgs(append([]string{"protection"}, args...))
+	err = parent.ExecuteContext(t.Context())
+	return out.String(), err
+}
+
+func TestRepoProtection_ListEmpty(t *testing.T) {
+	newProtectionFixture(t)
+	out, err := execRepoProtection(t, "list", testProtectionRepoULID)
+	require.NoError(t, err)
+	assert.Equal(t, protectionEmpty+"\n", out)
+
+	out, err = execRepoProtection(t, "list", testProtectionRepoULID, "--json")
+	require.NoError(t, err)
+	assert.Equal(t, "[]", strings.TrimSpace(out), "an empty list is a JSON array, not null")
+}
+
+func TestRepoProtection_ListShowsLevels(t *testing.T) {
+	newProtectionFixture(t,
+		coreapi.BranchRule{Ref: "HEAD", ServerSideMergeOnly: coreapi.NewOptBool(true)},
+		coreapi.BranchRule{Ref: "refs/heads/release/*"},
+	)
+	out, err := execRepoProtection(t, "list", testProtectionRepoULID)
+	require.NoError(t, err)
+	assert.Contains(t, out, "BRANCH")
+	assert.Contains(t, out, "HEAD")
+	assert.Contains(t, out, protectionLevelMergeOnly)
+	assert.Contains(t, out, "refs/heads/release/*")
+	assert.Contains(t, out, protectionLevelProtected)
+
+	out, err = execRepoProtection(t, "list", testProtectionRepoULID, "--json")
+	require.NoError(t, err)
+	var got []branchRule
+	require.NoError(t, json.Unmarshal([]byte(out), &got))
+	assert.Equal(t, []branchRule{{Ref: "HEAD", ServerSideMergeOnly: true}, {Ref: "refs/heads/release/*"}}, got)
+}
+
+// add expands a short branch name, sends the level as given, and re-adding a
+// branch changes its level in place; remove sends only removeRefs. Each verb
+// prints the resulting rules.
+func TestRepoProtection_AddAndRemove(t *testing.T) {
+	fake := newProtectionFixture(t, coreapi.BranchRule{Ref: "HEAD"})
+
+	out, err := execRepoProtection(t, "add", testProtectionRepoULID, "release/*")
+	require.NoError(t, err)
+	require.Len(t, fake.patches, 1)
+	assert.Equal(t, []branchRule{{Ref: "refs/heads/release/*"}}, rulesView(fake.patches[0].AddRules))
+	assert.True(t, fake.patches[0].AddRules[0].ServerSideMergeOnly.IsSet(), "the level is always sent explicitly")
+	assert.Empty(t, fake.patches[0].RemoveRefs)
+	assert.Contains(t, out, "refs/heads/release/*")
+
+	out, err = execRepoProtection(t, "add", testProtectionRepoULID, "HEAD", "--server-side-merge-only")
+	require.NoError(t, err)
+	require.Len(t, fake.patches, 2)
+	assert.Equal(t, []branchRule{{Ref: "HEAD", ServerSideMergeOnly: true}}, rulesView(fake.patches[1].AddRules))
+	assert.Contains(t, out, protectionLevelMergeOnly)
+	assert.Equal(t, []branchRule{
+		{Ref: "HEAD", ServerSideMergeOnly: true},
+		{Ref: "refs/heads/release/*"},
+	}, rulesView(fake.rules), "re-adding HEAD raised its level in place")
+
+	out, err = execRepoProtection(t, "remove", testProtectionRepoULID, "HEAD")
+	require.NoError(t, err)
+	require.Len(t, fake.patches, 3)
+	assert.Equal(t, []string{"HEAD"}, fake.patches[2].RemoveRefs)
+	assert.Empty(t, fake.patches[2].AddRules)
+	assert.NotContains(t, out, "HEAD")
+	assert.Contains(t, out, "refs/heads/release/*")
+
+	out, err = execRepoProtection(t, "remove", testProtectionRepoULID, "refs/heads/release/*")
+	require.NoError(t, err)
+	assert.Equal(t, protectionEmpty+"\n", out)
+}
+
+func TestRepoProtection_NameNeedsProject(t *testing.T) {
+	fake := newProtectionFixture(t)
+	_, err := execRepoProtection(t, "list", "web")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--project")
+	assert.Empty(t, fake.patches)
+}

From 63a57983fedf4524b0de4b4539b198e3962292f1 Mon Sep 17 00:00:00 2001
From: Kai Ramuenke <kai@entire.io>
Date: Thu, 10 Sep 2026 11:01:21 +1000
Subject: [PATCH 21/59] coreapi: loosen the other new read-model fields the
 client never reads

The same refresh made capabilities required on Org and Project, org and
provider required on RepoIndexEntry, and added the RepoIndexEntry.permission
enum. None is read by the CLI, so they get the same treatment as Repo's new
fields: optional, and display enums open. An older core, or a value the
server adds later, then cannot fail org list, project list, or repo routing.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 internal/coreapi/UPSTREAM.md           |  17 +-
 internal/coreapi/oas_json_gen.go       | 181 ++++++++---------
 internal/coreapi/oas_schemas_gen.go    | 266 ++++++++++++-------------
 internal/coreapi/oas_validators_gen.go |  31 ---
 internal/coreapi/spec/core.gen.json    |  13 +-
 internal/coreapi/spec/normalize.go     |   7 +-
 6 files changed, 236 insertions(+), 279 deletions(-)

diff --git a/internal/coreapi/UPSTREAM.md b/internal/coreapi/UPSTREAM.md
index 4d370d8a34..430a5d3288 100644
--- a/internal/coreapi/UPSTREAM.md
+++ b/internal/coreapi/UPSTREAM.md
@@ -53,19 +53,20 @@ Retire the allowlist entries as upstream loosens the corresponding fields.
 
 ## 2b. New read-model fields ship as `required`
 
-**Symptom:** `Repo.provider` and `Repo.capabilities` were added as
-`required`. ogen's decoder then fails the whole response when a field is
-absent, so a core that predates the field, or a mixed-version roll, breaks
-every `repo list` and repo-get call in a client that never reads either
-field.
+**Symptom:** `capabilities` on `Org`, `Project` and `Repo`, `Repo.provider`,
+and `org`/`provider` on `RepoIndexEntry` were added as `required`. ogen's
+decoder then fails the whole response when a field is absent, so a core that
+predates the field, or a mixed-version roll, breaks every list, get and
+repo-routing call in a client that never reads any of them.
 
 **Fix upstream:** add read-model fields as optional until every deployment
 sends them, then tighten.
 
 **Workaround:** `spec/normalize.go` (`loosenReadModelRequired`, allowlist
-`readModelOptionalFields`) drops the listed fields from `required`.
-`Repo.provider` is also in `readModelEnumFields`, since it is a display-only
-enum. Remove an entry when the CLI starts reading the field.
+`readModelOptionalFields`) drops the listed fields from `required`. The new
+`provider` and `RepoIndexEntry.permission` enums are also in
+`readModelEnumFields`, since the CLI only displays or ignores them. Remove an
+entry when the CLI starts reading the field.
 
 ## 3. Every operation advertises the interactive login schemes
 
diff --git a/internal/coreapi/oas_json_gen.go b/internal/coreapi/oas_json_gen.go
index b94b85d419..25a2bd9c56 100644
--- a/internal/coreapi/oas_json_gen.go
+++ b/internal/coreapi/oas_json_gen.go
@@ -23326,6 +23326,39 @@ func (s *OptOrg) UnmarshalJSON(data []byte) error {
 	return s.Decode(d)
 }
 
+// Encode encodes OrgCapabilities as json.
+func (o OptOrgCapabilities) Encode(e *jx.Encoder) {
+	if !o.Set {
+		return
+	}
+	o.Value.Encode(e)
+}
+
+// Decode decodes OrgCapabilities from json.
+func (o *OptOrgCapabilities) Decode(d *jx.Decoder) error {
+	if o == nil {
+		return errors.New("invalid: unable to decode OptOrgCapabilities to nil")
+	}
+	o.Set = true
+	if err := o.Value.Decode(d); err != nil {
+		return err
+	}
+	return nil
+}
+
+// MarshalJSON implements stdjson.Marshaler.
+func (s OptOrgCapabilities) MarshalJSON() ([]byte, error) {
+	e := jx.Encoder{}
+	s.Encode(&e)
+	return e.Bytes(), nil
+}
+
+// UnmarshalJSON implements stdjson.Unmarshaler.
+func (s *OptOrgCapabilities) UnmarshalJSON(data []byte) error {
+	d := jx.DecodeBytes(data)
+	return s.Decode(d)
+}
+
 // Encode encodes Project as json.
 func (o OptProject) Encode(e *jx.Encoder) {
 	if !o.Set {
@@ -23359,18 +23392,18 @@ func (s *OptProject) UnmarshalJSON(data []byte) error {
 	return s.Decode(d)
 }
 
-// Encode encodes Repo as json.
-func (o OptRepo) Encode(e *jx.Encoder) {
+// Encode encodes ProjectCapabilities as json.
+func (o OptProjectCapabilities) Encode(e *jx.Encoder) {
 	if !o.Set {
 		return
 	}
 	o.Value.Encode(e)
 }
 
-// Decode decodes Repo from json.
-func (o *OptRepo) Decode(d *jx.Decoder) error {
+// Decode decodes ProjectCapabilities from json.
+func (o *OptProjectCapabilities) Decode(d *jx.Decoder) error {
 	if o == nil {
-		return errors.New("invalid: unable to decode OptRepo to nil")
+		return errors.New("invalid: unable to decode OptProjectCapabilities to nil")
 	}
 	o.Set = true
 	if err := o.Value.Decode(d); err != nil {
@@ -23380,30 +23413,30 @@ func (o *OptRepo) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptRepo) MarshalJSON() ([]byte, error) {
+func (s OptProjectCapabilities) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepo) UnmarshalJSON(data []byte) error {
+func (s *OptProjectCapabilities) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes RepoCandidate as json.
-func (o OptRepoCandidate) Encode(e *jx.Encoder) {
+// Encode encodes Repo as json.
+func (o OptRepo) Encode(e *jx.Encoder) {
 	if !o.Set {
 		return
 	}
 	o.Value.Encode(e)
 }
 
-// Decode decodes RepoCandidate from json.
-func (o *OptRepoCandidate) Decode(d *jx.Decoder) error {
+// Decode decodes Repo from json.
+func (o *OptRepo) Decode(d *jx.Decoder) error {
 	if o == nil {
-		return errors.New("invalid: unable to decode OptRepoCandidate to nil")
+		return errors.New("invalid: unable to decode OptRepo to nil")
 	}
 	o.Set = true
 	if err := o.Value.Decode(d); err != nil {
@@ -23413,30 +23446,30 @@ func (o *OptRepoCandidate) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptRepoCandidate) MarshalJSON() ([]byte, error) {
+func (s OptRepo) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepoCandidate) UnmarshalJSON(data []byte) error {
+func (s *OptRepo) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes RepoCapabilities as json.
-func (o OptRepoCapabilities) Encode(e *jx.Encoder) {
+// Encode encodes RepoCandidate as json.
+func (o OptRepoCandidate) Encode(e *jx.Encoder) {
 	if !o.Set {
 		return
 	}
 	o.Value.Encode(e)
 }
 
-// Decode decodes RepoCapabilities from json.
-func (o *OptRepoCapabilities) Decode(d *jx.Decoder) error {
+// Decode decodes RepoCandidate from json.
+func (o *OptRepoCandidate) Decode(d *jx.Decoder) error {
 	if o == nil {
-		return errors.New("invalid: unable to decode OptRepoCapabilities to nil")
+		return errors.New("invalid: unable to decode OptRepoCandidate to nil")
 	}
 	o.Set = true
 	if err := o.Value.Decode(d); err != nil {
@@ -23446,30 +23479,30 @@ func (o *OptRepoCapabilities) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptRepoCapabilities) MarshalJSON() ([]byte, error) {
+func (s OptRepoCandidate) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepoCapabilities) UnmarshalJSON(data []byte) error {
+func (s *OptRepoCandidate) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
 
-// Encode encodes RepoIndexEntryPermission as json.
-func (o OptRepoIndexEntryPermission) Encode(e *jx.Encoder) {
+// Encode encodes RepoCapabilities as json.
+func (o OptRepoCapabilities) Encode(e *jx.Encoder) {
 	if !o.Set {
 		return
 	}
-	e.Str(string(o.Value))
+	o.Value.Encode(e)
 }
 
-// Decode decodes RepoIndexEntryPermission from json.
-func (o *OptRepoIndexEntryPermission) Decode(d *jx.Decoder) error {
+// Decode decodes RepoCapabilities from json.
+func (o *OptRepoCapabilities) Decode(d *jx.Decoder) error {
 	if o == nil {
-		return errors.New("invalid: unable to decode OptRepoIndexEntryPermission to nil")
+		return errors.New("invalid: unable to decode OptRepoCapabilities to nil")
 	}
 	o.Set = true
 	if err := o.Value.Decode(d); err != nil {
@@ -23479,14 +23512,14 @@ func (o *OptRepoIndexEntryPermission) Decode(d *jx.Decoder) error {
 }
 
 // MarshalJSON implements stdjson.Marshaler.
-func (s OptRepoIndexEntryPermission) MarshalJSON() ([]byte, error) {
+func (s OptRepoCapabilities) MarshalJSON() ([]byte, error) {
 	e := jx.Encoder{}
 	s.Encode(&e)
 	return e.Bytes(), nil
 }
 
 // UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *OptRepoIndexEntryPermission) UnmarshalJSON(data []byte) error {
+func (s *OptRepoCapabilities) UnmarshalJSON(data []byte) error {
 	d := jx.DecodeBytes(data)
 	return s.Decode(d)
 }
@@ -23610,8 +23643,10 @@ func (s *Org) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("capabilities")
-		s.Capabilities.Encode(e)
+		if s.Capabilities.Set {
+			e.FieldStart("capabilities")
+			s.Capabilities.Encode(e)
+		}
 	}
 	{
 		e.FieldStart("createdAt")
@@ -23675,8 +23710,8 @@ func (s *Org) Decode(d *jx.Decoder) error {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
 		case "capabilities":
-			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
+				s.Capabilities.Reset()
 				if err := s.Capabilities.Decode(d); err != nil {
 					return err
 				}
@@ -23763,7 +23798,7 @@ func (s *Org) Decode(d *jx.Decoder) error {
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00111110,
+		0b00111100,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -25325,8 +25360,10 @@ func (s *Project) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("capabilities")
-		s.Capabilities.Encode(e)
+		if s.Capabilities.Set {
+			e.FieldStart("capabilities")
+			s.Capabilities.Encode(e)
+		}
 	}
 	{
 		e.FieldStart("createdAt")
@@ -25400,8 +25437,8 @@ func (s *Project) Decode(d *jx.Decoder) error {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
 		case "capabilities":
-			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
+				s.Capabilities.Reset()
 				if err := s.Capabilities.Decode(d); err != nil {
 					return err
 				}
@@ -25510,7 +25547,7 @@ func (s *Project) Decode(d *jx.Decoder) error {
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [2]uint8{
-		0b10111110,
+		0b10111100,
 		0b00000001,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
@@ -28330,8 +28367,10 @@ func (s *RepoIndexEntry) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("org")
-		e.Str(s.Org)
+		if s.Org.Set {
+			e.FieldStart("org")
+			s.Org.Encode(e)
+		}
 	}
 	{
 		if s.Permission.Set {
@@ -28354,8 +28393,10 @@ func (s *RepoIndexEntry) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("provider")
-		e.Str(s.Provider)
+		if s.Provider.Set {
+			e.FieldStart("provider")
+			s.Provider.Encode(e)
+		}
 	}
 	{
 		if s.PushedAt.Set {
@@ -28581,11 +28622,9 @@ func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 				return errors.Wrap(err, "decode field \"openPrCount\"")
 			}
 		case "org":
-			requiredBitSet[1] |= 1 << 7
 			if err := func() error {
-				v, err := d.Str()
-				s.Org = string(v)
-				if err != nil {
+				s.Org.Reset()
+				if err := s.Org.Decode(d); err != nil {
 					return err
 				}
 				return nil
@@ -28631,11 +28670,9 @@ func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 				return errors.Wrap(err, "decode field \"primaries\"")
 			}
 		case "provider":
-			requiredBitSet[2] |= 1 << 3
 			if err := func() error {
-				v, err := d.Str()
-				s.Provider = string(v)
-				if err != nil {
+				s.Provider.Reset()
+				if err := s.Provider.Decode(d); err != nil {
 					return err
 				}
 				return nil
@@ -28696,8 +28733,8 @@ func (s *RepoIndexEntry) Decode(d *jx.Decoder) error {
 	var failures []validate.FieldError
 	for i, mask := range [3]uint8{
 		0b10101000,
-		0b10100011,
-		0b01001010,
+		0b00100011,
+		0b01000010,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
@@ -28801,48 +28838,6 @@ func (s *RepoIndexEntryAdditional) UnmarshalJSON(data []byte) error {
 	return s.Decode(d)
 }
 
-// Encode encodes RepoIndexEntryPermission as json.
-func (s RepoIndexEntryPermission) Encode(e *jx.Encoder) {
-	e.Str(string(s))
-}
-
-// Decode decodes RepoIndexEntryPermission from json.
-func (s *RepoIndexEntryPermission) Decode(d *jx.Decoder) error {
-	if s == nil {
-		return errors.New("invalid: unable to decode RepoIndexEntryPermission to nil")
-	}
-	v, err := d.StrBytes()
-	if err != nil {
-		return err
-	}
-	// Try to use constant string.
-	switch RepoIndexEntryPermission(v) {
-	case RepoIndexEntryPermissionRead:
-		*s = RepoIndexEntryPermissionRead
-	case RepoIndexEntryPermissionWrite:
-		*s = RepoIndexEntryPermissionWrite
-	case RepoIndexEntryPermissionAdmin:
-		*s = RepoIndexEntryPermissionAdmin
-	default:
-		*s = RepoIndexEntryPermission(v)
-	}
-
-	return nil
-}
-
-// MarshalJSON implements stdjson.Marshaler.
-func (s RepoIndexEntryPermission) MarshalJSON() ([]byte, error) {
-	e := jx.Encoder{}
-	s.Encode(&e)
-	return e.Bytes(), nil
-}
-
-// UnmarshalJSON implements stdjson.Unmarshaler.
-func (s *RepoIndexEntryPermission) UnmarshalJSON(data []byte) error {
-	d := jx.DecodeBytes(data)
-	return s.Decode(d)
-}
-
 // Encode implements json.Marshaler.
 func (s *RepoPlacement) Encode(e *jx.Encoder) {
 	e.ObjStart()
diff --git a/internal/coreapi/oas_schemas_gen.go b/internal/coreapi/oas_schemas_gen.go
index 87557b5d32..cbc8535232 100644
--- a/internal/coreapi/oas_schemas_gen.go
+++ b/internal/coreapi/oas_schemas_gen.go
@@ -10239,6 +10239,52 @@ func (o OptOrg) Or(d Org) Org {
 	return d
 }
 
+// NewOptOrgCapabilities returns new OptOrgCapabilities with value set to v.
+func NewOptOrgCapabilities(v OrgCapabilities) OptOrgCapabilities {
+	return OptOrgCapabilities{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptOrgCapabilities is optional OrgCapabilities.
+type OptOrgCapabilities struct {
+	Value OrgCapabilities
+	Set   bool
+}
+
+// IsSet returns true if OptOrgCapabilities was set.
+func (o OptOrgCapabilities) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptOrgCapabilities) Reset() {
+	var v OrgCapabilities
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptOrgCapabilities) SetTo(v OrgCapabilities) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptOrgCapabilities) Get() (v OrgCapabilities, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptOrgCapabilities) Or(d OrgCapabilities) OrgCapabilities {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
 // NewOptProject returns new OptProject with value set to v.
 func NewOptProject(v Project) OptProject {
 	return OptProject{
@@ -10285,6 +10331,52 @@ func (o OptProject) Or(d Project) Project {
 	return d
 }
 
+// NewOptProjectCapabilities returns new OptProjectCapabilities with value set to v.
+func NewOptProjectCapabilities(v ProjectCapabilities) OptProjectCapabilities {
+	return OptProjectCapabilities{
+		Value: v,
+		Set:   true,
+	}
+}
+
+// OptProjectCapabilities is optional ProjectCapabilities.
+type OptProjectCapabilities struct {
+	Value ProjectCapabilities
+	Set   bool
+}
+
+// IsSet returns true if OptProjectCapabilities was set.
+func (o OptProjectCapabilities) IsSet() bool { return o.Set }
+
+// Reset unsets value.
+func (o *OptProjectCapabilities) Reset() {
+	var v ProjectCapabilities
+	o.Value = v
+	o.Set = false
+}
+
+// SetTo sets value to v.
+func (o *OptProjectCapabilities) SetTo(v ProjectCapabilities) {
+	o.Set = true
+	o.Value = v
+}
+
+// Get returns value and boolean that denotes whether value was set.
+func (o OptProjectCapabilities) Get() (v ProjectCapabilities, ok bool) {
+	if !o.Set {
+		return v, false
+	}
+	return o.Value, true
+}
+
+// Or returns value if set, or given parameter if does not.
+func (o OptProjectCapabilities) Or(d ProjectCapabilities) ProjectCapabilities {
+	if v, ok := o.Get(); ok {
+		return v
+	}
+	return d
+}
+
 // NewOptRepo returns new OptRepo with value set to v.
 func NewOptRepo(v Repo) OptRepo {
 	return OptRepo{
@@ -10423,52 +10515,6 @@ func (o OptRepoCapabilities) Or(d RepoCapabilities) RepoCapabilities {
 	return d
 }
 
-// NewOptRepoIndexEntryPermission returns new OptRepoIndexEntryPermission with value set to v.
-func NewOptRepoIndexEntryPermission(v RepoIndexEntryPermission) OptRepoIndexEntryPermission {
-	return OptRepoIndexEntryPermission{
-		Value: v,
-		Set:   true,
-	}
-}
-
-// OptRepoIndexEntryPermission is optional RepoIndexEntryPermission.
-type OptRepoIndexEntryPermission struct {
-	Value RepoIndexEntryPermission
-	Set   bool
-}
-
-// IsSet returns true if OptRepoIndexEntryPermission was set.
-func (o OptRepoIndexEntryPermission) IsSet() bool { return o.Set }
-
-// Reset unsets value.
-func (o *OptRepoIndexEntryPermission) Reset() {
-	var v RepoIndexEntryPermission
-	o.Value = v
-	o.Set = false
-}
-
-// SetTo sets value to v.
-func (o *OptRepoIndexEntryPermission) SetTo(v RepoIndexEntryPermission) {
-	o.Set = true
-	o.Value = v
-}
-
-// Get returns value and boolean that denotes whether value was set.
-func (o OptRepoIndexEntryPermission) Get() (v RepoIndexEntryPermission, ok bool) {
-	if !o.Set {
-		return v, false
-	}
-	return o.Value, true
-}
-
-// Or returns value if set, or given parameter if does not.
-func (o OptRepoIndexEntryPermission) Or(d RepoIndexEntryPermission) RepoIndexEntryPermission {
-	if v, ok := o.Get(); ok {
-		return v
-	}
-	return d
-}
-
 // NewOptRepoPrimaries returns new OptRepoPrimaries with value set to v.
 func NewOptRepoPrimaries(v RepoPrimaries) OptRepoPrimaries {
 	return OptRepoPrimaries{
@@ -10610,13 +10656,13 @@ func (o OptURI) Or(d url.URL) url.URL {
 // Ref: #/components/schemas/Org
 type Org struct {
 	// A URL to the JSON Schema for this object.
-	Schema               OptURI          `json:"$schema"`
-	Capabilities         OrgCapabilities `json:"capabilities"`
-	CreatedAt            time.Time       `json:"createdAt"`
-	ID                   string          `json:"id"`
-	Name                 string          `json:"name"`
-	Region               string          `json:"region"`
-	WorkosOrganizationId OptString       `json:"workosOrganizationId"`
+	Schema               OptURI             `json:"$schema"`
+	Capabilities         OptOrgCapabilities `json:"capabilities"`
+	CreatedAt            time.Time          `json:"createdAt"`
+	ID                   string             `json:"id"`
+	Name                 string             `json:"name"`
+	Region               string             `json:"region"`
+	WorkosOrganizationId OptString          `json:"workosOrganizationId"`
 	AdditionalProps      OrgAdditional
 }
 
@@ -10626,7 +10672,7 @@ func (s *Org) GetSchema() OptURI {
 }
 
 // GetCapabilities returns the value of Capabilities.
-func (s *Org) GetCapabilities() OrgCapabilities {
+func (s *Org) GetCapabilities() OptOrgCapabilities {
 	return s.Capabilities
 }
 
@@ -10666,7 +10712,7 @@ func (s *Org) SetSchema(val OptURI) {
 }
 
 // SetCapabilities sets the value of Capabilities.
-func (s *Org) SetCapabilities(val OrgCapabilities) {
+func (s *Org) SetCapabilities(val OptOrgCapabilities) {
 	s.Capabilities = val
 }
 
@@ -11288,15 +11334,15 @@ func (s *PatchRepoCIWebhookInputBodyAdditional) init() PatchRepoCIWebhookInputBo
 // Ref: #/components/schemas/Project
 type Project struct {
 	// A URL to the JSON Schema for this object.
-	Schema          OptURI              `json:"$schema"`
-	Capabilities    ProjectCapabilities `json:"capabilities"`
-	CreatedAt       time.Time           `json:"createdAt"`
-	ID              string              `json:"id"`
-	Name            string              `json:"name"`
-	OwnerId         string              `json:"ownerId"`
-	OwnerName       OptString           `json:"ownerName"`
-	OwnerType       ProjectOwnerType    `json:"ownerType"`
-	Region          string              `json:"region"`
+	Schema          OptURI                 `json:"$schema"`
+	Capabilities    OptProjectCapabilities `json:"capabilities"`
+	CreatedAt       time.Time              `json:"createdAt"`
+	ID              string                 `json:"id"`
+	Name            string                 `json:"name"`
+	OwnerId         string                 `json:"ownerId"`
+	OwnerName       OptString              `json:"ownerName"`
+	OwnerType       ProjectOwnerType       `json:"ownerType"`
+	Region          string                 `json:"region"`
 	AdditionalProps ProjectAdditional
 }
 
@@ -11306,7 +11352,7 @@ func (s *Project) GetSchema() OptURI {
 }
 
 // GetCapabilities returns the value of Capabilities.
-func (s *Project) GetCapabilities() ProjectCapabilities {
+func (s *Project) GetCapabilities() OptProjectCapabilities {
 	return s.Capabilities
 }
 
@@ -11356,7 +11402,7 @@ func (s *Project) SetSchema(val OptURI) {
 }
 
 // SetCapabilities sets the value of Capabilities.
-func (s *Project) SetCapabilities(val ProjectCapabilities) {
+func (s *Project) SetCapabilities(val OptProjectCapabilities) {
 	s.Capabilities = val
 }
 
@@ -12427,20 +12473,20 @@ type RepoIndexEntry struct {
 	FullName    string   `json:"full_name"`
 	ID          string   `json:"id"`
 	// Deprecated: schema marks this property as deprecated.
-	Jurisdiction    string                      `json:"jurisdiction"`
-	Language        OptString                   `json:"language"`
-	LastActivityAt  OptDateTime                 `json:"lastActivityAt"`
-	LastPushedAt    OptDateTime                 `json:"lastPushedAt"`
-	Name            string                      `json:"name"`
-	OpenPrCount     OptInt64                    `json:"openPrCount"`
-	Org             string                      `json:"org"`
-	Permission      OptRepoIndexEntryPermission `json:"permission"`
-	Placements      []RepoPlacement             `json:"placements"`
-	Primaries       OptRepoPrimaries            `json:"primaries"`
-	Provider        string                      `json:"provider"`
-	PushedAt        OptDateTime                 `json:"pushedAt"`
-	Stars           OptInt64                    `json:"stars"`
-	Visibility      string                      `json:"visibility"`
+	Jurisdiction    string           `json:"jurisdiction"`
+	Language        OptString        `json:"language"`
+	LastActivityAt  OptDateTime      `json:"lastActivityAt"`
+	LastPushedAt    OptDateTime      `json:"lastPushedAt"`
+	Name            string           `json:"name"`
+	OpenPrCount     OptInt64         `json:"openPrCount"`
+	Org             OptString        `json:"org"`
+	Permission      OptString        `json:"permission"`
+	Placements      []RepoPlacement  `json:"placements"`
+	Primaries       OptRepoPrimaries `json:"primaries"`
+	Provider        OptString        `json:"provider"`
+	PushedAt        OptDateTime      `json:"pushedAt"`
+	Stars           OptInt64         `json:"stars"`
+	Visibility      string           `json:"visibility"`
 	AdditionalProps RepoIndexEntryAdditional
 }
 
@@ -12520,12 +12566,12 @@ func (s *RepoIndexEntry) GetOpenPrCount() OptInt64 {
 }
 
 // GetOrg returns the value of Org.
-func (s *RepoIndexEntry) GetOrg() string {
+func (s *RepoIndexEntry) GetOrg() OptString {
 	return s.Org
 }
 
 // GetPermission returns the value of Permission.
-func (s *RepoIndexEntry) GetPermission() OptRepoIndexEntryPermission {
+func (s *RepoIndexEntry) GetPermission() OptString {
 	return s.Permission
 }
 
@@ -12540,7 +12586,7 @@ func (s *RepoIndexEntry) GetPrimaries() OptRepoPrimaries {
 }
 
 // GetProvider returns the value of Provider.
-func (s *RepoIndexEntry) GetProvider() string {
+func (s *RepoIndexEntry) GetProvider() OptString {
 	return s.Provider
 }
 
@@ -12640,12 +12686,12 @@ func (s *RepoIndexEntry) SetOpenPrCount(val OptInt64) {
 }
 
 // SetOrg sets the value of Org.
-func (s *RepoIndexEntry) SetOrg(val string) {
+func (s *RepoIndexEntry) SetOrg(val OptString) {
 	s.Org = val
 }
 
 // SetPermission sets the value of Permission.
-func (s *RepoIndexEntry) SetPermission(val OptRepoIndexEntryPermission) {
+func (s *RepoIndexEntry) SetPermission(val OptString) {
 	s.Permission = val
 }
 
@@ -12660,7 +12706,7 @@ func (s *RepoIndexEntry) SetPrimaries(val OptRepoPrimaries) {
 }
 
 // SetProvider sets the value of Provider.
-func (s *RepoIndexEntry) SetProvider(val string) {
+func (s *RepoIndexEntry) SetProvider(val OptString) {
 	s.Provider = val
 }
 
@@ -12695,54 +12741,6 @@ func (s *RepoIndexEntryAdditional) init() RepoIndexEntryAdditional {
 	return m
 }
 
-type RepoIndexEntryPermission string
-
-const (
-	RepoIndexEntryPermissionRead  RepoIndexEntryPermission = "read"
-	RepoIndexEntryPermissionWrite RepoIndexEntryPermission = "write"
-	RepoIndexEntryPermissionAdmin RepoIndexEntryPermission = "admin"
-)
-
-// AllValues returns all RepoIndexEntryPermission values.
-func (RepoIndexEntryPermission) AllValues() []RepoIndexEntryPermission {
-	return []RepoIndexEntryPermission{
-		RepoIndexEntryPermissionRead,
-		RepoIndexEntryPermissionWrite,
-		RepoIndexEntryPermissionAdmin,
-	}
-}
-
-// MarshalText implements encoding.TextMarshaler.
-func (s RepoIndexEntryPermission) MarshalText() ([]byte, error) {
-	switch s {
-	case RepoIndexEntryPermissionRead:
-		return []byte(s), nil
-	case RepoIndexEntryPermissionWrite:
-		return []byte(s), nil
-	case RepoIndexEntryPermissionAdmin:
-		return []byte(s), nil
-	default:
-		return nil, errors.Errorf("invalid value: %q", s)
-	}
-}
-
-// UnmarshalText implements encoding.TextUnmarshaler.
-func (s *RepoIndexEntryPermission) UnmarshalText(data []byte) error {
-	switch RepoIndexEntryPermission(data) {
-	case RepoIndexEntryPermissionRead:
-		*s = RepoIndexEntryPermissionRead
-		return nil
-	case RepoIndexEntryPermissionWrite:
-		*s = RepoIndexEntryPermissionWrite
-		return nil
-	case RepoIndexEntryPermissionAdmin:
-		*s = RepoIndexEntryPermissionAdmin
-		return nil
-	default:
-		return errors.Errorf("invalid value: %q", data)
-	}
-}
-
 // Ref: #/components/schemas/RepoPlacement
 type RepoPlacement struct {
 	Cell            string              `json:"cell"`
diff --git a/internal/coreapi/oas_validators_gen.go b/internal/coreapi/oas_validators_gen.go
index b86ef11d01..f20c7b3ce3 100644
--- a/internal/coreapi/oas_validators_gen.go
+++ b/internal/coreapi/oas_validators_gen.go
@@ -2935,24 +2935,6 @@ func (s *RepoIndexEntry) Validate() error {
 			Error: err,
 		})
 	}
-	if err := func() error {
-		if value, ok := s.Permission.Get(); ok {
-			if err := func() error {
-				if err := value.Validate(); err != nil {
-					return err
-				}
-				return nil
-			}(); err != nil {
-				return err
-			}
-		}
-		return nil
-	}(); err != nil {
-		failures = append(failures, validate.FieldError{
-			Name:  "permission",
-			Error: err,
-		})
-	}
 	if err := func() error {
 		if s.Placements == nil {
 			return errors.New("nil is invalid value")
@@ -2987,19 +2969,6 @@ func (s *RepoIndexEntry) Validate() error {
 	return nil
 }
 
-func (s RepoIndexEntryPermission) Validate() error {
-	switch s {
-	case "read":
-		return nil
-	case "write":
-		return nil
-	case "admin":
-		return nil
-	default:
-		return errors.Errorf("invalid value: %v", s)
-	}
-}
-
 func (s *RepoPlacement) Validate() error {
 	if s == nil {
 		return validate.ErrNilPointer
diff --git a/internal/coreapi/spec/core.gen.json b/internal/coreapi/spec/core.gen.json
index fcf6ecb685..1d3451f626 100644
--- a/internal/coreapi/spec/core.gen.json
+++ b/internal/coreapi/spec/core.gen.json
@@ -3017,8 +3017,7 @@
           "id",
           "name",
           "region",
-          "createdAt",
-          "capabilities"
+          "createdAt"
         ],
         "type": "object"
       },
@@ -3283,8 +3282,7 @@
           "ownerType",
           "ownerId",
           "region",
-          "createdAt",
-          "capabilities"
+          "createdAt"
         ],
         "type": "object"
       },
@@ -3655,11 +3653,6 @@
             "type": "string"
           },
           "permission": {
-            "enum": [
-              "read",
-              "write",
-              "admin"
-            ],
             "type": "string"
           },
           "placements": {
@@ -3693,8 +3686,6 @@
           "clusterSlug",
           "name",
           "full_name",
-          "org",
-          "provider",
           "visibility",
           "placements"
         ],
diff --git a/internal/coreapi/spec/normalize.go b/internal/coreapi/spec/normalize.go
index ee99572176..172eb00c95 100644
--- a/internal/coreapi/spec/normalize.go
+++ b/internal/coreapi/spec/normalize.go
@@ -194,7 +194,7 @@ func filterSecurityRequirements(reqs []any) []any {
 var readModelEnumFields = map[string][]string{
 	"Repo":             {"objectFormat", "provider", "state", "visibility"},
 	"RepoIDResolution": {"provider"},
-	"RepoIndexEntry":   {"provider"},
+	"RepoIndexEntry":   {"permission", "provider"},
 	"RepoReference":    {"provider"},
 	"RepoResolution":   {"provider"},
 }
@@ -205,7 +205,10 @@ var readModelEnumFields = map[string][]string{
 // predates the field, or a test fake that omits it, still decodes. A field
 // the CLI starts reading must leave this list.
 var readModelOptionalFields = map[string][]string{
-	"Repo": {"capabilities", "provider"},
+	"Org":            {"capabilities"},
+	"Project":        {"capabilities"},
+	"Repo":           {"capabilities", "provider"},
+	"RepoIndexEntry": {"org", "provider"},
 }
 
 // loosenReadModelRequired removes each field named in readModelOptionalFields

From bbbf523482b5748ae457eb935334afe363cb53a5 Mon Sep 17 00:00:00 2001
From: Kai Ramuenke <kai@entire.io>
Date: Thu, 10 Sep 2026 11:13:29 +1000
Subject: [PATCH 22/59] repo protection: say what an empty list means on a
 GitHub mirror

Core reports no rules for a mirror, but "Nothing is protected yet" misstates
it: the data plane protects a mirror's default branch regardless, and its
rules are the upstream's. list now reads the repo's provider and prints
that instead. --json keeps the plain array for scripts.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 cmd/entire/cli/repo_protection.go      | 30 +++++++++++++++++++---
 cmd/entire/cli/repo_protection_test.go | 35 +++++++++++++++++++++++---
 2 files changed, 57 insertions(+), 8 deletions(-)

diff --git a/cmd/entire/cli/repo_protection.go b/cmd/entire/cli/repo_protection.go
index fee6ee75de..80ae91d009 100644
--- a/cmd/entire/cli/repo_protection.go
+++ b/cmd/entire/cli/repo_protection.go
@@ -3,6 +3,7 @@ package cli
 import (
 	"context"
 	"errors"
+	"fmt"
 	"strings"
 
 	"github.com/spf13/cobra"
@@ -23,6 +24,8 @@ const (
 	protectionLevelProtected = "protected"
 	protectionLevelMergeOnly = "server-side merge only"
 	protectionEmpty          = "Nothing is protected yet."
+	protectionMirrorNote     = "GitHub mirror: branch protection is governed by the upstream repository. " +
+		"Its default branch is always protected on Entire; no rules can be added here."
 	// headBranchPattern is the server's pattern for "whatever branch HEAD
 	// points at"; it follows a default-branch rename.
 	headBranchPattern = "HEAD"
@@ -89,16 +92,35 @@ func newRepoProtectionListCmd() *cobra.Command {
 		Short: "Show a repository's branch-protection rules",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCoreList(cmd, protectionEmpty, protectionColumns, protectionRow, func(ctx context.Context, c *coreapi.Client) ([]branchRule, error) {
+			return runCore(cmd, func(ctx context.Context, c *coreapi.Client) error {
 				repoID, err := resolveRepoRef(ctx, c, args[0], project)
 				if err != nil {
-					return nil, err
+					return err
+				}
+				repo, err := c.GetRepo(ctx, coreapi.GetRepoParams{RepoId: repoID})
+				if err != nil {
+					return err
 				}
 				out, err := c.GetBranchProtection(ctx, coreapi.GetBranchProtectionParams{RepoId: repoID})
 				if err != nil {
-					return nil, err
+					return err
 				}
-				return branchRulesFromWire(out), nil
+				rules := branchRulesFromWire(out)
+				if jsonRequested(cmd) {
+					return printJSON(cmd.OutOrStdout(), rules)
+				}
+				if len(rules) == 0 {
+					// A GitHub mirror always reads as empty: its rules are the
+					// upstream's, and the data plane protects its default branch
+					// regardless. "Nothing is protected" would misstate both.
+					if repo.Provider.Or("") == providerGitHub {
+						fmt.Fprintln(cmd.OutOrStdout(), protectionMirrorNote)
+						return nil
+					}
+					fmt.Fprintln(cmd.OutOrStdout(), protectionEmpty)
+					return nil
+				}
+				return printTable(cmd.OutOrStdout(), protectionColumns, rules, protectionRow)
 			})
 		},
 	}
diff --git a/cmd/entire/cli/repo_protection_test.go b/cmd/entire/cli/repo_protection_test.go
index 8c1de96b44..e8662b9f47 100644
--- a/cmd/entire/cli/repo_protection_test.go
+++ b/cmd/entire/cli/repo_protection_test.go
@@ -48,13 +48,25 @@ func TestProtectionRow(t *testing.T) {
 // applies PATCH bodies with the server's upsert-by-ref rule so a test sees the
 // same resulting list the real core would return.
 type fakeProtectionServer struct {
-	mu      sync.Mutex
-	rules   []coreapi.BranchRule
-	patches []coreapi.UpdateBranchProtectionInputBody
+	mu       sync.Mutex
+	provider string // the repo's provider as GET /repos/{id} reports it
+	rules    []coreapi.BranchRule
+	patches  []coreapi.UpdateBranchProtectionInputBody
 }
 
 func (f *fakeProtectionServer) handler(t *testing.T) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet && r.URL.Path == "/api/v1/repos/"+testProtectionRepoULID {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			if err := printJSON(w, &coreapi.Repo{
+				ID: testProtectionRepoULID, Name: "web", OwningProjectId: testProjectULID,
+				Provider: coreapi.NewOptString(f.provider),
+			}); err != nil {
+				t.Errorf("encode repo response: %v", err)
+			}
+			return
+		}
 		if r.URL.Path != "/api/v1/repos/"+testProtectionRepoULID+"/branch-protection" {
 			t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
 			w.WriteHeader(http.StatusNotFound)
@@ -129,7 +141,7 @@ func (f *fakeProtectionServer) apply(body coreapi.UpdateBranchProtectionInputBod
 // Not parallel: swaps the package-level activeCoreClient seam.
 func newProtectionFixture(t *testing.T, rules ...coreapi.BranchRule) *fakeProtectionServer {
 	t.Helper()
-	fake := &fakeProtectionServer{rules: rules}
+	fake := &fakeProtectionServer{provider: "entire", rules: rules}
 	srv := httptest.NewServer(fake.handler(t))
 	t.Cleanup(srv.Close)
 	prev := activeCoreClient
@@ -170,6 +182,21 @@ func TestRepoProtection_ListEmpty(t *testing.T) {
 	assert.Equal(t, "[]", strings.TrimSpace(out), "an empty list is a JSON array, not null")
 }
 
+// A GitHub mirror reads as empty from core, but "nothing is protected" would
+// misstate it: its default branch is always protected and its rules are the
+// upstream's. --json keeps the plain array for scripts.
+func TestRepoProtection_ListOnMirrorExplains(t *testing.T) {
+	fake := newProtectionFixture(t)
+	fake.provider = providerGitHub
+	out, err := execRepoProtection(t, "list", testProtectionRepoULID)
+	require.NoError(t, err)
+	assert.Equal(t, protectionMirrorNote+"\n", out)
+
+	out, err = execRepoProtection(t, "list", testProtectionRepoULID, "--json")
+	require.NoError(t, err)
+	assert.Equal(t, "[]", strings.TrimSpace(out))
+}
+
 func TestRepoProtection_ListShowsLevels(t *testing.T) {
 	newProtectionFixture(t,
 		coreapi.BranchRule{Ref: "HEAD", ServerSideMergeOnly: coreapi.NewOptBool(true)},

From 1024f14d56ff6fb7b5f9e5f90301097a4ca76d0a Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 15:09:21 +0200
Subject: [PATCH 23/59] repo protection: look up the repo only for an empty
 rule list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`list` fetched the repo unconditionally but read `provider` only when the
rule list was empty and --json was off, so every call cost two control-plane
round trips, --json paid for a response it discarded, and a GetRepo failure
sank a list whose real answer was already in hand.

The lookup moves into the empty-list rendering, which is the one branch that
needs it. That branch now also serves --json: stdout stays the bare array a
script parses, and the mirror caveat goes to stderr, because a script
concluding "no rules ⇒ nothing is protected" is wrong on a GitHub mirror —
the exact misreading the human-facing note exists to prevent. The note is
therefore load-bearing for the text rendering and advisory for --json, so a
failed provider lookup is fatal only to the former.

Reading `Repo.provider` also needed a constant of its own. `providerGitHub`
is documented as the *account* identity slug behind a grantee handle like
"github:alice", and already carried a note distinguishing it from
setup.go's `checkpointProviderGitHub`; which forge backs a repository is a
third concern spelling GitHub the same way, so it gets `repoProviderGitHub`
and the note now names all three.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25PZST8D96JE5769N2M4AEJ
---
 cmd/entire/cli/repo_protection.go      | 59 ++++++++++++++++++--------
 cmd/entire/cli/repo_protection_test.go | 48 ++++++++++++++++++---
 cmd/entire/cli/resolveref.go           | 16 ++++++-
 3 files changed, 99 insertions(+), 24 deletions(-)

diff --git a/cmd/entire/cli/repo_protection.go b/cmd/entire/cli/repo_protection.go
index 80ae91d009..1352a36b3b 100644
--- a/cmd/entire/cli/repo_protection.go
+++ b/cmd/entire/cli/repo_protection.go
@@ -97,30 +97,20 @@ func newRepoProtectionListCmd() *cobra.Command {
 				if err != nil {
 					return err
 				}
-				repo, err := c.GetRepo(ctx, coreapi.GetRepoParams{RepoId: repoID})
-				if err != nil {
-					return err
-				}
 				out, err := c.GetBranchProtection(ctx, coreapi.GetBranchProtectionParams{RepoId: repoID})
 				if err != nil {
 					return err
 				}
 				rules := branchRulesFromWire(out)
-				if jsonRequested(cmd) {
-					return printJSON(cmd.OutOrStdout(), rules)
-				}
-				if len(rules) == 0 {
-					// A GitHub mirror always reads as empty: its rules are the
-					// upstream's, and the data plane protects its default branch
-					// regardless. "Nothing is protected" would misstate both.
-					if repo.Provider.Or("") == providerGitHub {
-						fmt.Fprintln(cmd.OutOrStdout(), protectionMirrorNote)
-						return nil
+				if len(rules) > 0 {
+					// Only the empty list needs the repo's provider, so the
+					// common case costs one round trip rather than two.
+					if jsonRequested(cmd) {
+						return printJSON(cmd.OutOrStdout(), rules)
 					}
-					fmt.Fprintln(cmd.OutOrStdout(), protectionEmpty)
-					return nil
+					return printTable(cmd.OutOrStdout(), protectionColumns, rules, protectionRow)
 				}
-				return printTable(cmd.OutOrStdout(), protectionColumns, rules, protectionRow)
+				return reportNoProtectionRules(ctx, cmd, c, repoID)
 			})
 		},
 	}
@@ -129,6 +119,41 @@ func newRepoProtectionListCmd() *cobra.Command {
 	return cmd
 }
 
+// reportNoProtectionRules renders an empty rule list. A GitHub mirror always
+// reads as empty — its rules are the upstream's, and the data plane protects
+// its default branch regardless — so "nothing is protected" would misstate
+// both, and the caller is told which kind of empty this is.
+//
+// The caveat reaches --json callers too, on stderr: stdout stays the bare
+// array a script parses, but a script concluding "no rules ⇒ nothing is
+// protected" is wrong on a mirror, which is the misreading the note exists to
+// prevent. That makes the note advisory for --json and load-bearing for the
+// human rendering, so a failed provider lookup is fatal only to the latter —
+// the branch-protection answer is already in hand, and a script must not lose
+// its array because a secondary lookup flaked.
+func reportNoProtectionRules(ctx context.Context, cmd *cobra.Command, c *coreapi.Client, repoID string) error {
+	mirror := false
+	repo, err := c.GetRepo(ctx, coreapi.GetRepoParams{RepoId: repoID})
+	switch {
+	case err != nil && !jsonRequested(cmd):
+		return err
+	case err == nil:
+		mirror = repo.Provider.Or("") == repoProviderGitHub
+	}
+	if jsonRequested(cmd) {
+		if mirror {
+			fmt.Fprintln(cmd.ErrOrStderr(), protectionMirrorNote)
+		}
+		return printJSON(cmd.OutOrStdout(), []branchRule{})
+	}
+	if mirror {
+		fmt.Fprintln(cmd.OutOrStdout(), protectionMirrorNote)
+		return nil
+	}
+	fmt.Fprintln(cmd.OutOrStdout(), protectionEmpty)
+	return nil
+}
+
 func newRepoProtectionAddCmd() *cobra.Command {
 	var project string
 	var mergeOnly bool
diff --git a/cmd/entire/cli/repo_protection_test.go b/cmd/entire/cli/repo_protection_test.go
index e8662b9f47..91f1f5f2b1 100644
--- a/cmd/entire/cli/repo_protection_test.go
+++ b/cmd/entire/cli/repo_protection_test.go
@@ -52,11 +52,18 @@ type fakeProtectionServer struct {
 	provider string // the repo's provider as GET /repos/{id} reports it
 	rules    []coreapi.BranchRule
 	patches  []coreapi.UpdateBranchProtectionInputBody
+	// repoGets counts GET /repos/{id}. Only the empty-list rendering needs
+	// the provider, so every other path must leave this at zero — see
+	// TestRepoProtection_LooksUpTheRepoOnlyForAnEmptyList.
+	repoGets int
 }
 
 func (f *fakeProtectionServer) handler(t *testing.T) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodGet && r.URL.Path == "/api/v1/repos/"+testProtectionRepoULID {
+			f.mu.Lock()
+			f.repoGets++
+			f.mu.Unlock()
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			if err := printJSON(w, &coreapi.Repo{
@@ -159,6 +166,12 @@ func rulesView(rs []coreapi.BranchRule) []branchRule {
 }
 
 func execRepoProtection(t *testing.T, args ...string) (stdout string, err error) {
+	t.Helper()
+	stdout, _, err = execRepoProtectionBothStreams(t, args...)
+	return stdout, err
+}
+
+func execRepoProtectionBothStreams(t *testing.T, args ...string) (stdout, stderr string, err error) {
 	t.Helper()
 	parent := &cobra.Command{Use: "repo"}
 	addControlPlaneFlags(parent)
@@ -168,7 +181,7 @@ func execRepoProtection(t *testing.T, args ...string) (stdout string, err error)
 	parent.SetErr(&errOut)
 	parent.SetArgs(append([]string{"protection"}, args...))
 	err = parent.ExecuteContext(t.Context())
-	return out.String(), err
+	return out.String(), errOut.String(), err
 }
 
 func TestRepoProtection_ListEmpty(t *testing.T) {
@@ -184,17 +197,42 @@ func TestRepoProtection_ListEmpty(t *testing.T) {
 
 // A GitHub mirror reads as empty from core, but "nothing is protected" would
 // misstate it: its default branch is always protected and its rules are the
-// upstream's. --json keeps the plain array for scripts.
+// upstream's. --json keeps the plain array on stdout so a script still parses
+// it, and puts the caveat on stderr — a script concluding "no rules ⇒ nothing
+// is protected" is wrong on a mirror, which is what the note exists to say.
 func TestRepoProtection_ListOnMirrorExplains(t *testing.T) {
 	fake := newProtectionFixture(t)
-	fake.provider = providerGitHub
+	fake.provider = repoProviderGitHub
 	out, err := execRepoProtection(t, "list", testProtectionRepoULID)
 	require.NoError(t, err)
 	assert.Equal(t, protectionMirrorNote+"\n", out)
 
-	out, err = execRepoProtection(t, "list", testProtectionRepoULID, "--json")
+	out, errOut, err := execRepoProtectionBothStreams(t, "list", testProtectionRepoULID, "--json")
+	require.NoError(t, err)
+	assert.Equal(t, "[]", strings.TrimSpace(out), "stdout stays a bare array")
+	assert.Equal(t, protectionMirrorNote+"\n", errOut, "the caveat reaches --json callers on stderr")
+}
+
+// The provider is needed only to render an empty list, so a list that has
+// rules — and a --json render of one — costs a single round trip. A repo
+// lookup here would also be a second way for `list` to fail after the
+// branch-protection answer is already in hand.
+func TestRepoProtection_LooksUpTheRepoOnlyForAnEmptyList(t *testing.T) {
+	fake := newProtectionFixture(t, coreapi.BranchRule{Ref: "HEAD"})
+
+	_, err := execRepoProtection(t, "list", testProtectionRepoULID)
+	require.NoError(t, err)
+	_, err = execRepoProtection(t, "list", testProtectionRepoULID, "--json")
+	require.NoError(t, err)
+	assert.Zero(t, fake.repoGets, "a non-empty list must not fetch the repo")
+
+	_, err = execRepoProtection(t, "remove", testProtectionRepoULID, "HEAD")
+	require.NoError(t, err)
+	assert.Zero(t, fake.repoGets, "add/remove render their own result and never need the provider")
+
+	_, err = execRepoProtection(t, "list", testProtectionRepoULID)
 	require.NoError(t, err)
-	assert.Equal(t, "[]", strings.TrimSpace(out))
+	assert.Equal(t, 1, fake.repoGets, "the empty rendering is the one branch that needs it")
 }
 
 func TestRepoProtection_ListShowsLevels(t *testing.T) {
diff --git a/cmd/entire/cli/resolveref.go b/cmd/entire/cli/resolveref.go
index 199d1245f3..b91d7fb70d 100644
--- a/cmd/entire/cli/resolveref.go
+++ b/cmd/entire/cli/resolveref.go
@@ -23,10 +23,22 @@ import (
 // providerGitHub is the identity-provider slug for GitHub-backed accounts, the
 // provider half of a qualified grantee handle like "github:alice". GitHub is the
 // only provider with backing accounts today; other slugs resolve once they exist
-// server-side. (Distinct from setup.go's checkpointProviderGitHub, which names
-// the checkpoint hosting provider — same string, unrelated concern.)
+// server-side.
+//
+// Three unrelated concerns spell GitHub the same way, and each keeps its own
+// constant so a rename upstream moves one of them rather than all three: this
+// one (which account provider backs a grantee), repoProviderGitHub below (which
+// forge backs a repository), and setup.go's checkpointProviderGitHub (which
+// service hosts a repo's checkpoints).
 const providerGitHub = "github"
 
+// repoProviderGitHub is the value of a repository's `provider` field when the
+// repo is a GitHub mirror rather than Entire-native; the wire enum is
+// "github" | "entire". It answers "which forge backs this repo", which is a
+// different question from providerGitHub's "which provider backs this account"
+// — see the note there.
+const repoProviderGitHub = "github"
+
 // projectRefClient and repoRefClient are the narrow control-plane surfaces the
 // name resolvers need. Keeping the helpers on interfaces lets repo-scoped
 // callers resolve a native /et/<project>/<repo> identity with the same client

From 8f76772066973f9b08cf5caf991129f542608a90 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 15:09:29 +0200
Subject: [PATCH 24/59] coreapi: refuse to empty a security list, and say what
 the loosenings claim
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two corrections to spec/normalize.go, both in the transforms it documents.

dropInteractiveSecurity removes the alternatives naming only oauth2/oidc. If
an operation's *only* alternatives were interactive, the result was an empty
array — and in OpenAPI an empty operation-level "security" means the
operation needs no authentication at all, so ogen would generate it with no
security source and the client would quietly stop sending the bearer.
Nothing in today's spec has that shape (all 86 operations also offer
bearerAuth), but a device-code or authorize endpoint added upstream would,
and this is the only failure here that would not announce itself: the
sibling case, a requirement mixing oauth2 with bearerAuth, survives whole
and makes ogen abort at generate time on the now-dangling scheme.
filterSecurityRequirements now errors instead, naming the operation.

readModelOptionalFields said the client "never reads" its fields and that "a
field the CLI starts reading must leave this list", which the commit adding
Repo.provider to it also made false — `repo protection list` reads it. The
bar is not being read, it is being *depended on*: a field read through its
Opt accessor with a safe default degrades one branch instead of failing the
response, which is exactly how Repo.provider is used. readModelEnumFields
said the same thing in enum terms ("display-only … never branches on their
value") and is restated as an open-set contract, since the CLI tests one
value and treats every other as "not that one".

core.gen.json is unchanged: the guard does not fire on the current spec, and
comments are not part of the output.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25Q0MET4PP2SPP5GSA3W6E3
---
 internal/coreapi/spec/normalize.go | 93 +++++++++++++++++++++++-------
 1 file changed, 71 insertions(+), 22 deletions(-)

diff --git a/internal/coreapi/spec/normalize.go b/internal/coreapi/spec/normalize.go
index 172eb00c95..9f4ab2884d 100644
--- a/internal/coreapi/spec/normalize.go
+++ b/internal/coreapi/spec/normalize.go
@@ -34,15 +34,19 @@
 // response read models are loosened; request-body enums stay strict so we
 // still reject a bad value we are about to send.
 //
-// Transform 2b (forward- and backward-compat, unread read-model fields): drop
-// selected fields from a read model's "required" list (see
-// readModelOptionalFields). The client never reads them, so a server that
-// does not send them yet must not fail the whole request.
+// Transform 2b (forward- and backward-compat, non-load-bearing read-model
+// fields): drop selected fields from a read model's "required" list (see
+// readModelOptionalFields). The client does not depend on their presence —
+// it either ignores them or reads them through an Opt accessor with a safe
+// default — so a server that does not send them yet must not fail the whole
+// request.
 //
 // Transform 3 (unsupported security schemes): drop the interactive login
 // schemes (oauth2, oidc) the spec lists on every operation. The CLI never
 // drives them through the generated client, and ogen has no generator for
-// openIdConnect, so leaving them in stops generation outright.
+// openIdConnect, so leaving them in stops generation outright. Emptying an
+// operation's security list is refused rather than performed — see
+// dropInteractiveSecurity.
 //
 // Run via `go generate ./internal/coreapi/...` (the first generate step in
 // gen.go), or by hand after refreshing the spec:
@@ -55,9 +59,11 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"slices"
+	"strings"
 )
 
 const (
@@ -90,7 +96,10 @@ func run() error {
 	ops := foldErrorResponses(doc)
 	loosened := loosenReadModelEnums(doc)
 	optional := loosenReadModelRequired(doc)
-	schemes := dropInteractiveSecurity(doc)
+	schemes, err := dropInteractiveSecurity(doc)
+	if err != nil {
+		return err
+	}
 
 	var buf bytes.Buffer
 	enc := json.NewEncoder(&buf)
@@ -118,7 +127,18 @@ var interactiveSecuritySchemes = map[string]bool{"oauth2": true, "oidc": true}
 // from every operation's security list, so the generated SecuritySource
 // keeps exactly the bearerAuth and sessionAuth methods the client
 // implements. It returns the number of schemes removed from components.
-func dropInteractiveSecurity(doc map[string]any) int {
+//
+// It fails rather than empty a security list that had entries: in OpenAPI an
+// empty operation-level "security" means the operation needs NO
+// authentication, so filtering an oauth2-only operation down to nothing
+// would quietly generate a client that stops sending the bearer to it. No
+// operation in today's spec has that shape — every one also offers
+// bearerAuth — but a device-code or authorize endpoint added upstream would,
+// and it is the one failure here that is otherwise silent. (Its sibling
+// announces itself: a multi-key requirement mixing oauth2 with bearerAuth
+// survives whole, leaving a reference to a scheme this function deleted, and
+// ogen aborts at generate time.)
+func dropInteractiveSecurity(doc map[string]any) (int, error) {
 	count := 0
 	if components, ok := doc["components"].(map[string]any); ok {
 		if schemes, ok := components["securitySchemes"].(map[string]any); ok {
@@ -131,13 +151,17 @@ func dropInteractiveSecurity(doc map[string]any) int {
 		}
 	}
 	if sec, ok := doc["security"].([]any); ok {
-		doc["security"] = filterSecurityRequirements(sec)
+		kept, err := filterSecurityRequirements(sec)
+		if err != nil {
+			return count, fmt.Errorf("document-level security: %w", err)
+		}
+		doc["security"] = kept
 	}
 	paths, ok := doc["paths"].(map[string]any)
 	if !ok {
-		return count
+		return count, nil
 	}
-	for _, item := range paths {
+	for path, item := range paths {
 		pathItem, ok := item.(map[string]any)
 		if !ok {
 			continue
@@ -150,18 +174,26 @@ func dropInteractiveSecurity(doc map[string]any) int {
 			if !ok {
 				continue
 			}
-			if sec, ok := operation["security"].([]any); ok {
-				operation["security"] = filterSecurityRequirements(sec)
+			sec, ok := operation["security"].([]any)
+			if !ok {
+				continue
+			}
+			kept, err := filterSecurityRequirements(sec)
+			if err != nil {
+				return count, fmt.Errorf("%s %s: %w", strings.ToUpper(method), path, err)
 			}
+			operation["security"] = kept
 		}
 	}
-	return count
+	return count, nil
 }
 
 // filterSecurityRequirements drops the alternatives that name only
 // interactive schemes. A requirement in this spec is a one-key object, so
-// dropping the object drops the alternative.
-func filterSecurityRequirements(reqs []any) []any {
+// dropping the object drops the alternative. It errors when that would empty
+// a non-empty list — see dropInteractiveSecurity for why an empty list is
+// not the same as no list.
+func filterSecurityRequirements(reqs []any) ([]any, error) {
 	kept := make([]any, 0, len(reqs))
 	for _, r := range reqs {
 		req, ok := r.(map[string]any)
@@ -179,14 +211,25 @@ func filterSecurityRequirements(reqs []any) []any {
 			kept = append(kept, r)
 		}
 	}
-	return kept
+	if len(kept) == 0 && len(reqs) > 0 {
+		return nil, errors.New("every security alternative names only interactive schemes; " +
+			"an empty \"security\" list would declare the operation unauthenticated. " +
+			"Give it a bearerAuth alternative upstream, or teach normalize how this operation " +
+			"should authenticate")
+	}
+	return kept, nil
 }
 
 // readModelEnumFields lists the response read-model schema fields whose
 // "enum" constraint is dropped by loosenReadModelEnums, keyed by component
-// schema name. These are display-only on the client: the CLI prints them
-// but never branches on their value, so a value the server adds later must
-// pass through rather than fail the whole request in ogen's Validate().
+// schema name. The client treats these as open sets: it prints them, or
+// tests one value and treats every other as "not that one", so a value the
+// server adds later must pass through rather than fail the whole request in
+// ogen's Validate(). Repo.provider is the branching case — `repo protection
+// list` compares it against "github" and any other value, known or not,
+// simply is not a mirror. A field whose *unknown* values the CLI would have
+// to handle differently does not belong here; it belongs in a switch with an
+// explicit default.
 //
 // Only response read models belong here. Request-body schemas (e.g.
 // SetRepoVisibilityInputBody) keep their enums so we still reject a bad
@@ -200,10 +243,16 @@ var readModelEnumFields = map[string][]string{
 }
 
 // readModelOptionalFields lists response read-model fields the spec marks
-// required but the client never reads, keyed by component schema name.
+// required but the client does not depend on, keyed by component schema name.
 // loosenReadModelRequired drops them from "required" so a server that
-// predates the field, or a test fake that omits it, still decodes. A field
-// the CLI starts reading must leave this list.
+// predates the field, or a test fake that omits it, still decodes.
+//
+// "Does not depend on" is the bar, not "never reads": a field may be read
+// through its Opt accessor with a safe default, where absence degrades one
+// branch rather than failing the response — Repo.provider is read exactly
+// that way by `repo protection list`, which falls back to the generic empty
+// message when the server omits it. A field must leave this list when the
+// CLI needs it to be *present* to be correct.
 var readModelOptionalFields = map[string][]string{
 	"Org":            {"capabilities"},
 	"Project":        {"capabilities"},

From 4227aa466ab1878e954e35e27555d976373dd07c Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 15:09:57 +0200
Subject: [PATCH 25/59] coreapi: pin the read-model required-field loosenings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

UPSTREAM.md's convention is that each workaround is "Locked in by" a test,
and the new required-field loosening had none: the existing enum test was
extended for Repo, but the other three schemas went unpinned.

RepoIndexEntry gets a dedicated test because ListRepos is the widest
consumer of the loosening — the consolidated repos index is what
resolveRepoCellTarget routes repo-scoped requests with, and what search,
repo mirror and the dispatch wizard page through — so a decode failure
there takes out cell routing and search together rather than one command.
It omits org and provider (both required upstream, neither depended on) and
carries an unknown `permission`, pinning the matching enum loosening in the
same request. Org and Project get a smaller table test for capabilities.

Verified non-vacuous: the same fixture with a still-required field removed
fails to decode ("invalid: visibility (field required)"), so ogen really
does reject an absent required field and these tests pin the loosening
rather than passing regardless.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25Q0WSHCKMJ40JPPG4FRTCM
---
 internal/coreapi/UPSTREAM.md    |  26 ++++++-
 internal/coreapi/client_test.go | 126 ++++++++++++++++++++++++++++++++
 2 files changed, 149 insertions(+), 3 deletions(-)

diff --git a/internal/coreapi/UPSTREAM.md b/internal/coreapi/UPSTREAM.md
index 430a5d3288..afee429908 100644
--- a/internal/coreapi/UPSTREAM.md
+++ b/internal/coreapi/UPSTREAM.md
@@ -57,7 +57,7 @@ Retire the allowlist entries as upstream loosens the corresponding fields.
 and `org`/`provider` on `RepoIndexEntry` were added as `required`. ogen's
 decoder then fails the whole response when a field is absent, so a core that
 predates the field, or a mixed-version roll, breaks every list, get and
-repo-routing call in a client that never reads any of them.
+repo-routing call in a client that does not depend on any of them.
 
 **Fix upstream:** add read-model fields as optional until every deployment
 sends them, then tighten.
@@ -65,8 +65,19 @@ sends them, then tighten.
 **Workaround:** `spec/normalize.go` (`loosenReadModelRequired`, allowlist
 `readModelOptionalFields`) drops the listed fields from `required`. The new
 `provider` and `RepoIndexEntry.permission` enums are also in
-`readModelEnumFields`, since the CLI only displays or ignores them. Remove an
-entry when the CLI starts reading the field.
+`readModelEnumFields`, since the CLI displays them or tests a single value
+and treats every other as "not that one" (`repo protection list` compares
+`Repo.provider` against `"github"`). Remove an entry when the CLI needs the
+field to be *present* to be correct — reading it through its `Opt` accessor
+with a safe default is not that.
+
+Locked in by `TestListRepos_UnsentRequiredReadFieldsDecode` and
+`TestListOrgsAndProjects_UnsentCapabilitiesDecode` in `client_test.go`.
+`RepoIndexEntry` gets the dedicated test because `ListRepos` is the widest
+consumer: the consolidated index is what `resolveRepoCellTarget` routes with
+and what `search`, `repo mirror` and the dispatch wizard page through, so a
+decode failure there takes out cell routing and search together rather than
+one command.
 
 ## 3. Every operation advertises the interactive login schemes
 
@@ -85,6 +96,15 @@ per-operation requirements, since those are what a request actually carries.
 and from every security list, so the generated `SecuritySource` keeps the
 `BearerAuth` and `SessionAuth` methods the client implements.
 
+The transform refuses to *empty* a security list that had entries. An empty
+operation-level `security` means "no authentication required" in OpenAPI, so
+filtering an oauth2-only operation down to nothing would silently generate a
+client that stops sending the bearer to it. Nothing in today's spec has that
+shape; a device-code or authorize endpoint added upstream would, and it is
+the only failure mode here that would not announce itself (a requirement
+mixing `oauth2` with `bearerAuth` survives whole and makes ogen abort at
+generate time on the now-dangling scheme).
+
 <!-- Resolved upstream and removed:
   - Nullable arrays (`"type": ["array","null"]`) — entiredb now emits
     non-nullable arrays (`"type": "array"`, absent ⇒ `[]`), so the
diff --git a/internal/coreapi/client_test.go b/internal/coreapi/client_test.go
index 5b69b81d58..091b570a86 100644
--- a/internal/coreapi/client_test.go
+++ b/internal/coreapi/client_test.go
@@ -294,3 +294,129 @@ func TestListProjectRepos_UnknownEnumValuesPassThrough(t *testing.T) {
 		t.Errorf("ObjectFormat = %q, want the unknown value %q passed through verbatim", got, "sha512")
 	}
 }
+
+// TestListRepos_UnsentRequiredReadFieldsDecode locks in the backward-compat
+// contract for spec/normalize.go's loosenReadModelRequired on RepoIndexEntry:
+// `org` and `provider` ship as "required" upstream, but the CLI reads neither,
+// so a core that predates them — or a mixed-version roll mid-deploy — must not
+// fail the response. ogen's decoder rejects a missing required field outright,
+// which would take out the whole index read rather than one field.
+//
+// RepoIndexEntry gets its own test because ListRepos is the widest consumer of
+// the loosening: the consolidated repos index is what resolveRepoCellTarget
+// routes repo-scoped requests with, and what `search`, `repo mirror` and the
+// dispatch wizard page through. A decode failure here is not one command
+// erroring, it is cell routing and search going dark at once — a materially
+// different blast radius from TestListProjectRepos_UnknownEnumValuesPassThrough,
+// which covers the sibling loosening on Repo.
+//
+// The unknown `permission` value pins the matching loosenReadModelEnums entry
+// in the same request: it was a closed enum upstream, and a value added later
+// must pass through rather than abort the read.
+func TestListRepos_UnsentRequiredReadFieldsDecode(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		// No "org", no "provider" — both required upstream, neither read here.
+		// "permission" carries a value the current spec's enum did NOT allow.
+		if _, err := w.Write([]byte(`{"repos":[{` +
+			`"id":"01H000000000000000000000R1","name":"web","full_name":"gh/acme/web",` +
+			`"jurisdiction":"us","cell":"aws-us-east-2","clusterSlug":"us","visibility":"private",` +
+			`"permission":"triage",` +
+			`"placements":[{"id":"01H000000000000000000000R1","jurisdiction":"us","cell":"aws-us-east-2","clusterSlug":"us","mirror":false,"status":"ready"}]` +
+			`}],"truncated":false,"candidatesIncomplete":false}`)); err != nil {
+			t.Errorf("writing test response: %v", err)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	c, err := NewClient(srv.URL, bearerOnlySource{})
+	if err != nil {
+		t.Fatalf("NewClient: %v", err)
+	}
+
+	out, err := c.ListRepos(context.Background(), ListReposParams{})
+	if err != nil {
+		t.Fatalf("ListRepos without org/provider must not fail (backward-compat), got: %v", err)
+	}
+	if len(out.Repos) != 1 {
+		t.Fatalf("Repos len = %d, want 1", len(out.Repos))
+	}
+	entry := out.Repos[0]
+	if entry.Org.IsSet() {
+		t.Errorf("Org.IsSet() = true, want false: an absent field must decode as unset, not fail the read")
+	}
+	if entry.Provider.IsSet() {
+		t.Errorf("Provider.IsSet() = true, want false: an absent field must decode as unset, not fail the read")
+	}
+	if got := entry.Permission.Or(""); got != "triage" {
+		t.Errorf("Permission = %q, want the unknown value %q passed through verbatim", got, "triage")
+	}
+	if got := entry.FullName; got != "gh/acme/web" {
+		t.Errorf("FullName = %q, want the entry to decode intact alongside the absent fields", got)
+	}
+}
+
+// TestListOrgsAndProjects_UnsentCapabilitiesDecode is the same contract for the
+// other two schemas that gained a required `capabilities` the CLI never reads.
+// Cheaper to lose than the repo index, but the loosening is only real if a
+// response without the field actually decodes.
+func TestListOrgsAndProjects_UnsentCapabilitiesDecode(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name string
+		body string
+		call func(*Client) (int, error)
+	}{
+		{
+			name: "orgs",
+			body: `{"orgs":[{"id":"01H000000000000000000000O1","name":"acme","region":"us","createdAt":"2026-01-01T00:00:00Z"}]}`,
+			call: func(c *Client) (int, error) {
+				out, err := c.ListOrgs(context.Background(), ListOrgsParams{})
+				if err != nil {
+					return 0, err
+				}
+				return len(out.Response.Orgs), nil
+			},
+		},
+		{
+			name: "projects",
+			body: `{"projects":[{"id":"01H000000000000000000000P1","name":"core","ownerType":"org","ownerId":"01H000000000000000000000O1","region":"us","createdAt":"2026-01-01T00:00:00Z"}]}`,
+			call: func(c *Client) (int, error) {
+				out, err := c.ListProjects(context.Background(), ListProjectsParams{})
+				if err != nil {
+					return 0, err
+				}
+				return len(out.Projects), nil
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusOK)
+				if _, err := w.Write([]byte(tc.body)); err != nil {
+					t.Errorf("writing test response: %v", err)
+				}
+			}))
+			t.Cleanup(srv.Close)
+
+			c, err := NewClient(srv.URL, bearerOnlySource{})
+			if err != nil {
+				t.Fatalf("NewClient: %v", err)
+			}
+			n, err := tc.call(c)
+			if err != nil {
+				t.Fatalf("list without capabilities must not fail (backward-compat), got: %v", err)
+			}
+			if n != 1 {
+				t.Fatalf("decoded %d item(s), want 1", n)
+			}
+		})
+	}
+}

From 05023e7b40b30d3e9e40039505af826bf6c685cf Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:03:13 +0200
Subject: [PATCH 26/59] repo protection: an empty list needs a positively
 native provider
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Nothing is protected yet." asserts that nothing protects this repository,
and it was printed for every provider that was not "github" — which made it
the else of the mirror test rather than a finding of its own.

`provider` is optional (an older core omits it) and open (normalize.go
strips its enum, so a forge added later decodes verbatim), and in --json
mode the lookup can fail outright and was swallowed. Each of those is "we
could not find out", and answering it with the native sentence is exactly
how an empty list would come to hide a mirror's upstream rules — an
unqualified [] for a script, and a flat contradiction of the note the
mirror branch exists to print.

All three outcomes are now identified positively: "entire" earns the native
sentence, "github" the mirror note, and everything else — absent,
unrecognized, or unread because the lookup failed — a third note saying the
provider could not be determined and that protection may be governed
elsewhere. --json puts whichever qualification applies on stderr, with the
lookup error when there was one, and still writes [] to stdout.

This is the invariant `.entire` validation and WorktreeRoot already state:
identify each condition positively, because "we could not find out" is not
evidence that there is nothing here.

add and remove keep the bare sentence. They share one PATCH that the server
refuses on a mirror, so reaching their empty rendering at all means the
write landed on a repo that accepts rules — noted at both call sites.

Also corrects the comments claiming these read-model enums are display-only
and never branched on, which Repo.provider has made false since it joined
the list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25T2DWR6K1GTFCJQ79X8NXY
---
 cmd/entire/cli/repo_protection.go      | 77 ++++++++++++++++++--------
 cmd/entire/cli/repo_protection_test.go | 75 +++++++++++++++++++++++--
 cmd/entire/cli/resolveref.go           | 18 ++++--
 internal/coreapi/UPSTREAM.md           | 12 ++--
 internal/coreapi/spec/normalize.go     | 26 +++++----
 5 files changed, 159 insertions(+), 49 deletions(-)

diff --git a/cmd/entire/cli/repo_protection.go b/cmd/entire/cli/repo_protection.go
index 1352a36b3b..cf676e949a 100644
--- a/cmd/entire/cli/repo_protection.go
+++ b/cmd/entire/cli/repo_protection.go
@@ -23,9 +23,19 @@ var protectionColumns = []string{"BRANCH", "LEVEL"}
 const (
 	protectionLevelProtected = "protected"
 	protectionLevelMergeOnly = "server-side merge only"
-	protectionEmpty          = "Nothing is protected yet."
-	protectionMirrorNote     = "GitHub mirror: branch protection is governed by the upstream repository. " +
+	// protectionEmpty asserts that nothing protects this repository, so it
+	// is printed only for a provider positively known to be Entire-native.
+	protectionEmpty      = "Nothing is protected yet."
+	protectionMirrorNote = "GitHub mirror: branch protection is governed by the upstream repository. " +
 		"Its default branch is always protected on Entire; no rules can be added here."
+	// protectionUnknownNote covers every empty list whose provider was not
+	// established: absent (an older core), a value this build does not know
+	// (a forge added later), or a lookup that failed. Each of those is
+	// "we could not find out", which is not the same as "nothing is
+	// protected" — see reportNoProtectionRules.
+	protectionUnknownNote = "No branch-protection rules are set here on Entire. This repository's " +
+		"provider could not be determined, so whether protection is governed elsewhere is unknown; " +
+		"a mirror's rules are its upstream's."
 	// headBranchPattern is the server's pattern for "whatever branch HEAD
 	// points at"; it follows a default-branch rename.
 	headBranchPattern = "HEAD"
@@ -119,38 +129,53 @@ func newRepoProtectionListCmd() *cobra.Command {
 	return cmd
 }
 
-// reportNoProtectionRules renders an empty rule list. A GitHub mirror always
-// reads as empty — its rules are the upstream's, and the data plane protects
-// its default branch regardless — so "nothing is protected" would misstate
-// both, and the caller is told which kind of empty this is.
+// reportNoProtectionRules renders an empty rule list, naming which kind of
+// empty it is. A GitHub mirror always reads as empty — its rules are the
+// upstream's, and the data plane protects its default branch regardless — so
+// "nothing is protected" would misstate it.
+//
+// All three outcomes are identified positively, and "native" is not the else
+// of "mirror". `provider` is optional (an older core omits it) and open
+// (`readModelEnumFields` drops its enum, so a forge added later decodes
+// verbatim), and in JSON mode the lookup may fail outright. Every one of
+// those is "we could not find out", which is not evidence that nothing is
+// protected — treating it as such is how an unqualified "Nothing is
+// protected yet." would come to hide a mirror's upstream rules. Only
+// repoProviderEntire earns that sentence; everything else gets
+// protectionUnknownNote.
 //
 // The caveat reaches --json callers too, on stderr: stdout stays the bare
 // array a script parses, but a script concluding "no rules ⇒ nothing is
-// protected" is wrong on a mirror, which is the misreading the note exists to
-// prevent. That makes the note advisory for --json and load-bearing for the
-// human rendering, so a failed provider lookup is fatal only to the latter —
-// the branch-protection answer is already in hand, and a script must not lose
-// its array because a secondary lookup flaked.
+// protected" is wrong on a mirror, which is the misreading the note exists
+// to prevent. That makes the note advisory for --json and load-bearing for
+// the human rendering, so a failed provider lookup is fatal only to the
+// latter — the branch-protection answer is already in hand, and a script
+// must not lose its array because a secondary lookup flaked. It is still
+// told, with the reason, rather than handed a silent [].
 func reportNoProtectionRules(ctx context.Context, cmd *cobra.Command, c *coreapi.Client, repoID string) error {
-	mirror := false
+	note := protectionUnknownNote
 	repo, err := c.GetRepo(ctx, coreapi.GetRepoParams{RepoId: repoID})
 	switch {
-	case err != nil && !jsonRequested(cmd):
-		return err
-	case err == nil:
-		mirror = repo.Provider.Or("") == repoProviderGitHub
+	case err != nil:
+		if !jsonRequested(cmd) {
+			return err
+		}
+		note = fmt.Sprintf("%s (looking it up failed: %v)", protectionUnknownNote, err)
+	case repo.Provider.Or("") == repoProviderGitHub:
+		note = protectionMirrorNote
+	case repo.Provider.Or("") == repoProviderEntire:
+		note = "" // the one case that positively establishes "native".
 	}
 	if jsonRequested(cmd) {
-		if mirror {
-			fmt.Fprintln(cmd.ErrOrStderr(), protectionMirrorNote)
+		if note != "" {
+			fmt.Fprintln(cmd.ErrOrStderr(), note)
 		}
 		return printJSON(cmd.OutOrStdout(), []branchRule{})
 	}
-	if mirror {
-		fmt.Fprintln(cmd.OutOrStdout(), protectionMirrorNote)
-		return nil
+	if note == "" {
+		note = protectionEmpty
 	}
-	fmt.Fprintln(cmd.OutOrStdout(), protectionEmpty)
+	fmt.Fprintln(cmd.OutOrStdout(), note)
 	return nil
 }
 
@@ -173,6 +198,10 @@ func newRepoProtectionAddCmd() *cobra.Command {
 				cmd.SilenceUsage = true
 				return err
 			}
+			// protectionEmpty asserts the repo is native, which list has to
+			// establish but this verb gets for free: add and remove share one
+			// PATCH, the server refuses it on a mirror, so reaching the render
+			// at all means the write landed on a repo that accepts rules.
 			return runCoreList(cmd, protectionEmpty, protectionColumns, protectionRow, func(ctx context.Context, c *coreapi.Client) ([]branchRule, error) {
 				repoID, err := resolveRepoRef(ctx, c, args[0], project)
 				if err != nil {
@@ -211,6 +240,10 @@ func newRepoProtectionRemoveCmd() *cobra.Command {
 				cmd.SilenceUsage = true
 				return err
 			}
+			// protectionEmpty asserts the repo is native, which list has to
+			// establish but this verb gets for free: add and remove share one
+			// PATCH, the server refuses it on a mirror, so reaching the render
+			// at all means the write landed on a repo that accepts rules.
 			return runCoreList(cmd, protectionEmpty, protectionColumns, protectionRow, func(ctx context.Context, c *coreapi.Client) ([]branchRule, error) {
 				repoID, err := resolveRepoRef(ctx, c, args[0], project)
 				if err != nil {
diff --git a/cmd/entire/cli/repo_protection_test.go b/cmd/entire/cli/repo_protection_test.go
index 91f1f5f2b1..73d0d31c43 100644
--- a/cmd/entire/cli/repo_protection_test.go
+++ b/cmd/entire/cli/repo_protection_test.go
@@ -56,6 +56,9 @@ type fakeProtectionServer struct {
 	// the provider, so every other path must leave this at zero — see
 	// TestRepoProtection_LooksUpTheRepoOnlyForAnEmptyList.
 	repoGets int
+	// repoGetFails makes GET /repos/{id} 500, so the empty rendering has to
+	// cope with never learning the provider at all.
+	repoGetFails bool
 }
 
 func (f *fakeProtectionServer) handler(t *testing.T) http.HandlerFunc {
@@ -63,13 +66,23 @@ func (f *fakeProtectionServer) handler(t *testing.T) http.HandlerFunc {
 		if r.Method == http.MethodGet && r.URL.Path == "/api/v1/repos/"+testProtectionRepoULID {
 			f.mu.Lock()
 			f.repoGets++
+			fails, provider := f.repoGetFails, f.provider
 			f.mu.Unlock()
+			if fails {
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			if err := printJSON(w, &coreapi.Repo{
+			repo := &coreapi.Repo{
 				ID: testProtectionRepoULID, Name: "web", OwningProjectId: testProjectULID,
-				Provider: coreapi.NewOptString(f.provider),
-			}); err != nil {
+			}
+			// An empty provider stands in for a core that predates the
+			// field: it must be absent from the body, not sent as "".
+			if provider != "" {
+				repo.Provider = coreapi.NewOptString(provider)
+			}
+			if err := printJSON(w, repo); err != nil {
 				t.Errorf("encode repo response: %v", err)
 			}
 			return
@@ -148,7 +161,7 @@ func (f *fakeProtectionServer) apply(body coreapi.UpdateBranchProtectionInputBod
 // Not parallel: swaps the package-level activeCoreClient seam.
 func newProtectionFixture(t *testing.T, rules ...coreapi.BranchRule) *fakeProtectionServer {
 	t.Helper()
-	fake := &fakeProtectionServer{provider: "entire", rules: rules}
+	fake := &fakeProtectionServer{provider: repoProviderEntire, rules: rules}
 	srv := httptest.NewServer(fake.handler(t))
 	t.Cleanup(srv.Close)
 	prev := activeCoreClient
@@ -299,3 +312,57 @@ func TestRepoProtection_NameNeedsProject(t *testing.T) {
 	assert.Contains(t, err.Error(), "--project")
 	assert.Empty(t, fake.patches)
 }
+
+// "Nothing is protected yet." asserts that nothing protects this repository,
+// so it needs the provider to be positively "entire". `provider` is optional
+// (an older core omits it) and open (its enum is stripped, so a forge added
+// later decodes verbatim), and the lookup can fail outright — each of those
+// is "we could not find out", and answering it with the native sentence is
+// how an empty list would come to hide a mirror's upstream rules.
+func TestRepoProtection_EmptyListNeedsAPositivelyNativeProvider(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		provider string
+		getFails bool
+		want     string
+	}{
+		{name: "native", provider: repoProviderEntire, want: protectionEmpty},
+		{name: "mirror", provider: repoProviderGitHub, want: protectionMirrorNote},
+		{name: "absent", provider: "", want: protectionUnknownNote},
+		{name: "unknown forge", provider: "gitlab", want: protectionUnknownNote},
+		{name: "lookup failed", provider: repoProviderEntire, getFails: true, want: ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fake := newProtectionFixture(t)
+			fake.provider = tc.provider
+			fake.repoGetFails = tc.getFails
+
+			out, err := execRepoProtection(t, "list", testProtectionRepoULID)
+			if tc.getFails {
+				// The note is load-bearing for the human rendering, so a
+				// provider we could not read is an error rather than a
+				// sentence that might be wrong.
+				require.Error(t, err, "a failed lookup must not be rendered as an answer")
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.want+"\n", out)
+			}
+
+			// --json keeps stdout a bare array either way, and puts whatever
+			// qualification applies on stderr — including the reason the
+			// provider is unknown, rather than a silent [].
+			out, errOut, err := execRepoProtectionBothStreams(t, "list", testProtectionRepoULID, "--json")
+			require.NoError(t, err, "a script must not lose its array to a secondary lookup")
+			assert.Equal(t, "[]", strings.TrimSpace(out))
+			switch {
+			case tc.getFails:
+				assert.Contains(t, errOut, protectionUnknownNote)
+				assert.Contains(t, errOut, "looking it up failed", "the reason is reported, not just the doubt")
+			case tc.want == protectionEmpty:
+				assert.Empty(t, errOut, "a positively native repo needs no qualification")
+			default:
+				assert.Equal(t, tc.want+"\n", errOut)
+			}
+		})
+	}
+}
diff --git a/cmd/entire/cli/resolveref.go b/cmd/entire/cli/resolveref.go
index b91d7fb70d..f8cb3e7205 100644
--- a/cmd/entire/cli/resolveref.go
+++ b/cmd/entire/cli/resolveref.go
@@ -32,12 +32,18 @@ import (
 // service hosts a repo's checkpoints).
 const providerGitHub = "github"
 
-// repoProviderGitHub is the value of a repository's `provider` field when the
-// repo is a GitHub mirror rather than Entire-native; the wire enum is
-// "github" | "entire". It answers "which forge backs this repo", which is a
-// different question from providerGitHub's "which provider backs this account"
-// — see the note there.
-const repoProviderGitHub = "github"
+// repoProviderGitHub and repoProviderEntire are the values of a repository's
+// `provider` field; the wire enum is "github" | "entire". They answer "which
+// forge backs this repo", which is a different question from providerGitHub's
+// "which provider backs this account" — see the note there.
+//
+// The field is optional and open on the client (normalize.go drops it from
+// `required` and strips its enum), so a caller must test for the value it
+// wants and treat everything else as unknown rather than as the other one.
+const (
+	repoProviderGitHub = "github"
+	repoProviderEntire = "entire"
+)
 
 // projectRefClient and repoRefClient are the narrow control-plane surfaces the
 // name resolvers need. Keeping the helpers on interfaces lets repo-scoped
diff --git a/internal/coreapi/UPSTREAM.md b/internal/coreapi/UPSTREAM.md
index afee429908..0fe17c1bd1 100644
--- a/internal/coreapi/UPSTREAM.md
+++ b/internal/coreapi/UPSTREAM.md
@@ -65,11 +65,13 @@ sends them, then tighten.
 **Workaround:** `spec/normalize.go` (`loosenReadModelRequired`, allowlist
 `readModelOptionalFields`) drops the listed fields from `required`. The new
 `provider` and `RepoIndexEntry.permission` enums are also in
-`readModelEnumFields`, since the CLI displays them or tests a single value
-and treats every other as "not that one" (`repo protection list` compares
-`Repo.provider` against `"github"`). Remove an entry when the CLI needs the
-field to be *present* to be correct — reading it through its `Opt` accessor
-with a safe default is not that.
+`readModelEnumFields`, since the CLI displays them or tests for the values it
+knows and treats everything else as unknown (`repo protection list` tests
+`Repo.provider` for `"github"` and `"entire"` separately, with a third
+rendering for anything else — an absent or unrecognized provider must not
+fall into either known value's branch). Remove an entry when the CLI needs
+the field to be *present* to be correct — reading it through its `Opt`
+accessor with a safe default is not that.
 
 Locked in by `TestListRepos_UnsentRequiredReadFieldsDecode` and
 `TestListOrgsAndProjects_UnsentCapabilitiesDecode` in `client_test.go`.
diff --git a/internal/coreapi/spec/normalize.go b/internal/coreapi/spec/normalize.go
index 9f4ab2884d..3cea3995be 100644
--- a/internal/coreapi/spec/normalize.go
+++ b/internal/coreapi/spec/normalize.go
@@ -28,11 +28,12 @@
 // readModelEnumFields). ogen turns an enum field into a named type with a
 // strict Validate() that the response decoder calls unconditionally, so a
 // single unknown value the server adds later (a new repo state, say) fails
-// the whole list/get request. These fields are display-only on the client —
-// nothing branches on them — so we model them as open strings: unknown
-// values decode and print verbatim instead of aborting the request. Only
-// response read models are loosened; request-body enums stay strict so we
-// still reject a bad value we are about to send.
+// the whole list/get request. The client treats these as open sets rather
+// than closed ones — it prints them, or tests for the values it knows and
+// treats everything else as unknown — so we model them as open strings:
+// unknown values decode and pass through instead of aborting the request.
+// Only response read models are loosened; request-body enums stay strict so
+// we still reject a bad value we are about to send.
 //
 // Transform 2b (forward- and backward-compat, non-load-bearing read-model
 // fields): drop selected fields from a read model's "required" list (see
@@ -223,13 +224,14 @@ func filterSecurityRequirements(reqs []any) ([]any, error) {
 // readModelEnumFields lists the response read-model schema fields whose
 // "enum" constraint is dropped by loosenReadModelEnums, keyed by component
 // schema name. The client treats these as open sets: it prints them, or
-// tests one value and treats every other as "not that one", so a value the
-// server adds later must pass through rather than fail the whole request in
-// ogen's Validate(). Repo.provider is the branching case — `repo protection
-// list` compares it against "github" and any other value, known or not,
-// simply is not a mirror. A field whose *unknown* values the CLI would have
-// to handle differently does not belong here; it belongs in a switch with an
-// explicit default.
+// tests for the specific values it knows and treats everything else as
+// unknown, so a value the server adds later must pass through rather than
+// fail the whole request in ogen's Validate(). Repo.provider is the
+// branching case — `repo protection list` tests for "github" and "entire"
+// separately and has a third rendering for anything else, because each of
+// its two known values licenses a different claim and neither is the else
+// of the other. A field whose unknown values would silently take a known
+// value's branch does not belong here.
 //
 // Only response read models belong here. Request-body schemas (e.g.
 // SetRepoVisibilityInputBody) keep their enums so we still reject a bad

From 135aac08e1402f748aa02c1f8ca9d0fa685768ed Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:04:06 +0200
Subject: [PATCH 27/59] fix: address review findings on on-demand plugin
 installation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two defects, each with a regression test verified red without its fix.

An `entire-graph` already in the managed directory but unreachable through
PATH — a local-dev symlink whose target moved, or a managed bin dir that
could not be prepended at startup — dead-ended: the user was prompted,
accepted, and after three network round-trips got "already installed; use
--force to replace", because the on-demand path passes no --force. The
managed entry is now found before the prompt and executed, which is what
installMissingPlugin's own return contract already promised.

A confirmation rendered to the supplied writer even when that writer was not
a terminal. `entire graph 2>log` therefore put zero bytes on the terminal
while holding it in raw mode waiting for a keypress, and with Yes as the
default an Enter authorized a download-and-exec nobody was shown. The opener
now keeps the TTY's output handle instead of closing it, and renders there
when the caller's writer is not itself a terminal.

Also narrows the plugin signal exit. It fired whenever any signal had reached
this process, which discarded the plugin's own exit code — Ctrl-C reaches the
whole foreground process group, so a TUI plugin that handles it and exits 0
was reported as killed. It is now gated on the plugin's outcome via
ExitPluginSignalled, which incidentally fixes os.Exit(-1) truncating to 255
for a signalled child.

Smaller: the announcement names the command rather than only its arguments
(a bare `entire graph` printed "Running plugin with command:" and stopped);
`plugin upgrade` opts into the install progress its own startPluginStep calls
were emitting nowhere; Browse cancellation follows its prompt to stderr; the
graph name gets a constant; the progress docs move out of the managed-install
-directory section; and the prompt-clearing assertion stops pinning the row
count of a huh form.

TestMaybeRunPlugin_MissingGraphNonInteractive gains plugin-dir isolation:
consulting the managed directory before the prompt made it read the
developer's real plugins, and pluginParentDir is not covered by the testdirs
fallback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25T41HTVXGY36EF3QXAF9YP
---
 cmd/entire/cli/plugin.go                      | 43 +++++++--
 cmd/entire/cli/plugin_confirm.go              | 48 ++++++++--
 cmd/entire/cli/plugin_confirm_test.go         | 69 ++++++++++++--
 cmd/entire/cli/plugin_group.go                | 10 +-
 cmd/entire/cli/plugin_on_demand.go            | 15 +++
 cmd/entire/cli/plugin_on_demand_test.go       | 95 ++++++++++++++++++-
 cmd/entire/cli/plugin_progress_test.go        | 39 ++++++++
 cmd/entire/cli/uiform/prompt_terminal_test.go | 18 +++-
 cmd/entire/main.go                            | 22 ++++-
 docs/architecture/external-commands.md        | 14 ++-
 10 files changed, 335 insertions(+), 38 deletions(-)

diff --git a/cmd/entire/cli/plugin.go b/cmd/entire/cli/plugin.go
index d84655b629..0e548b8578 100644
--- a/cmd/entire/cli/plugin.go
+++ b/cmd/entire/cli/plugin.go
@@ -36,6 +36,19 @@ const (
 // disk (`entire upgrade` → entire-upgrade).
 const selfUpdatePluginName = "upgrade"
 
+// onDemandInstallPluginName is the one missing plugin the dispatcher offers to
+// install rather than falling through to Cobra's unknown-command path. Kept as
+// a named constant beside the other plugin names the dispatcher special-cases,
+// so the set is readable in one place.
+const onDemandInstallPluginName = "graph"
+
+// ExitPluginSignalled reports that a plugin was terminated by a signal, or
+// that a signal interrupted an on-demand install before the plugin ran. It is
+// deliberately not a valid exit status — os.Exit(-1) truncates to 255 — so
+// main.go re-raises the signal instead of exiting with it. -1 is already what
+// exec.ExitError.ExitCode() reports for a signalled child.
+const ExitPluginSignalled = -1
+
 // postPluginVersionCheck is a test seam for the version-check notice that
 // fires after a successful plugin run.
 var postPluginVersionCheck = versioncheck.CheckAndNotify
@@ -43,7 +56,10 @@ var postPluginVersionCheck = versioncheck.CheckAndNotify
 // MaybeRunPlugin returns (true, exitCode) when an external command was
 // resolved and run. On launch failure (e.g. missing executable bit)
 // returns (true, 1) after printing to stderr. On no-match returns
-// (false, 0) so the caller can fall through to Cobra.
+// (false, 0) so the caller can fall through to Cobra. exitCode is
+// ExitPluginSignalled when the plugin was killed by a signal, or when a
+// signal interrupted an on-demand install before it ran; the caller turns
+// that into a re-raised signal rather than an exit status.
 //
 // Telemetry and the version-check notice mirror Cobra's PersistentPostRun
 // behavior for built-ins: both fire only on a successful (exit-0) run.
@@ -58,16 +74,25 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 		binPath, err = installMissingPlugin(ctx, rootCmd, pluginName)
 		if err != nil {
 			var silent *SilentError
-			if !errors.As(silencePluginCancel(ctx, err), &silent) {
-				fmt.Fprintln(rootCmd.ErrOrStderr(), RenderUserFacingError(err))
+			if errors.As(silencePluginCancel(ctx, err), &silent) {
+				// A signal interrupted the install. Report it as a signal
+				// rather than a plain failure so main.go re-raises it: a
+				// shell breaks an enclosing loop only on WIFSIGNALED.
+				return true, ExitPluginSignalled
 			}
+			fmt.Fprintln(rootCmd.ErrOrStderr(), RenderUserFacingError(err))
 			return true, 1
 		}
 		if binPath == "" {
 			// The command was not executed because installation was declined.
 			return true, 1
 		}
-		fmt.Fprintf(rootCmd.ErrOrStderr(), "Running plugin with command: %s\n", strings.Join(pluginArgs, " "))
+		// Name the command that is about to run: the install may have taken a
+		// while, and it is the reason the user is still waiting. The command
+		// itself is part of the line — printing only the arguments left a
+		// bare "Running plugin with command:" for `entire graph`.
+		fmt.Fprintf(rootCmd.ErrOrStderr(), "Running %s\n",
+			strings.Join(append([]string{rootCmd.Name(), pluginName}, pluginArgs...), " "))
 	}
 	exitCode = runPlugin(ctx, pluginName, binPath, pluginArgs)
 	if exitCode == 0 {
@@ -102,8 +127,9 @@ func maybeTrackPluginInvocation(ctx context.Context, pluginName string) {
 	telemetry.TrackPluginDetached(pluginName, s.Enabled, versioninfo.Version)
 }
 
-// resolvePlugin returns an empty binary path for a missing graph plugin so
-// the dispatcher can offer installation. Other missing names fall through.
+// resolvePlugin returns an empty binary path for a missing
+// onDemandInstallPluginName so the dispatcher can offer installation. Other
+// missing names fall through.
 func resolvePlugin(rootCmd *cobra.Command, args []string) (binPath string, pluginArgs []string, ok bool) {
 	if len(args) == 0 {
 		return "", nil, false
@@ -133,7 +159,7 @@ func resolvePlugin(rootCmd *cobra.Command, args []string) (binPath string, plugi
 		if p, found := findInaccessiblePlugin(binName); found {
 			return p, args[1:], true
 		}
-		if name == "graph" && errors.Is(err, exec.ErrNotFound) {
+		if name == onDemandInstallPluginName && errors.Is(err, exec.ErrNotFound) {
 			return "", args[1:], true
 		}
 		return "", nil, false
@@ -235,6 +261,9 @@ func runPlugin(ctx context.Context, pluginName, binPath string, args []string) i
 	if err := cmd.Run(); err != nil {
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
+			// A signalled child reports -1, i.e. ExitPluginSignalled: it is
+			// not an exit status, so main.go re-raises the signal rather than
+			// letting os.Exit truncate it to 255.
 			return exitErr.ExitCode()
 		}
 		// Prefix with the plugin name so users can tell parent vs child
diff --git a/cmd/entire/cli/plugin_confirm.go b/cmd/entire/cli/plugin_confirm.go
index 6b274c442c..34079fdc66 100644
--- a/cmd/entire/cli/plugin_confirm.go
+++ b/cmd/entire/cli/plugin_confirm.go
@@ -10,33 +10,67 @@ import (
 	tea "charm.land/bubbletea/v2"
 	"charm.land/huh/v2"
 	"github.com/muesli/cancelreader"
+
+	"github.com/entireio/cli/cmd/entire/cli/interactive"
 )
 
-// A separate terminal keeps confirmation from consuming the plugin's stdin.
+// pluginPromptTerminal is the controlling terminal a confirmation prompt uses.
+//
+// in is the terminal rather than os.Stdin, so a confirmation never consumes
+// bytes the plugin was piped. out is the terminal's own output handle, used
+// only when the writer the caller supplied is not itself a terminal — see
+// runPluginConfirm. It is nil when there is nothing to fall back to, which is
+// the case in tests that replace the opener.
+type pluginPromptTerminal struct {
+	in  io.ReadCloser
+	out io.Writer
+	// closeOut releases out when it is a handle of its own. Unix hands back
+	// one file for both directions, so closing in covers it there; Windows
+	// opens CONIN$ and CONOUT$ separately, and writing to CONIN$ renders
+	// nothing — which is why the pair cannot be collapsed to one handle.
+	closeOut func()
+}
+
 // Tests replace the opener rather than redirecting the command's data stream.
-var openPluginPromptInput = func() (io.ReadCloser, error) {
+var openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
 	in, out, err := tea.OpenTTY()
 	if err != nil {
-		return nil, fmt.Errorf("open confirmation terminal: %w", err)
+		return pluginPromptTerminal{}, fmt.Errorf("open confirmation terminal: %w", err)
 	}
+	t := pluginPromptTerminal{in: in, out: out}
 	if out != in {
-		_ = out.Close()
+		t.closeOut = func() { _ = out.Close() }
 	}
-	return in, nil
+	return t, nil
 }
 
 func runPluginConfirm(ctx context.Context, out io.Writer, prompt string, defaultYes bool) (bool, error) {
 	if err := ctx.Err(); err != nil {
 		return false, fmt.Errorf("confirmation cancelled: %w", err)
 	}
-	input, err := openPluginPromptInput()
+	term, err := openPluginPromptTerminal()
 	if err != nil {
 		return false, err
 	}
+	input := term.in
 	closeInput := sync.OnceFunc(func() { _ = input.Close() })
 	defer closeInput()
+	if term.closeOut != nil {
+		defer term.closeOut()
+	}
+	// The answer is read from the terminal, so the question has to be visible
+	// there. A supplied writer that is not a terminal — `entire graph 2>log`,
+	// or any wrapper capturing stderr — left the prompt invisible while the
+	// terminal sat in raw mode waiting for a keypress, and with Yes as the
+	// default an idle Enter authorized a download-and-exec nobody was shown.
+	// Render on the terminal the answer comes from instead; the escape
+	// sequences had no business in the redirect either way.
+	render := out
+	if term.out != nil && !interactive.IsTerminalWriter(out) {
+		render = term.out
+	}
 	answer := defaultYes
-	form := NewAccessibleForm(huh.NewGroup(huh.NewConfirm().Title(prompt).Value(&answer))).WithOutput(out).WithInput(input)
+	form := NewAccessibleForm(huh.NewGroup(huh.NewConfirm().Title(prompt).Value(&answer))).WithOutput(render).WithInput(input)
 	if IsAccessibleMode() {
 		// Huh's accessible scanner ignores context and treats EOF as the default.
 		// Make the read cancellable and retain EOF so it cannot authorize an install.
diff --git a/cmd/entire/cli/plugin_confirm_test.go b/cmd/entire/cli/plugin_confirm_test.go
index 2946f29981..d6799896c0 100644
--- a/cmd/entire/cli/plugin_confirm_test.go
+++ b/cmd/entire/cli/plugin_confirm_test.go
@@ -14,9 +14,11 @@ import (
 func TestPluginDependencyConfirmationUsesWriter(t *testing.T) { //nolint:paralleltest // isolates terminal opener and accessibility
 	t.Setenv("ACCESSIBLE", "1")
 	t.Setenv("ENTIRE_TEST_TTY", "1")
-	original := openPluginPromptInput
-	openPluginPromptInput = func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("y\n")), nil }
-	t.Cleanup(func() { openPluginPromptInput = original })
+	original := openPluginPromptTerminal
+	openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+		return pluginPromptTerminal{in: io.NopCloser(strings.NewReader("y\n"))}, nil
+	}
+	t.Cleanup(func() { openPluginPromptTerminal = original })
 	var stderr bytes.Buffer
 	ok, err := confirmPluginAction(t.Context(), &stderr, "Install them now?", false)
 	if err != nil || !ok {
@@ -41,14 +43,14 @@ func TestPluginAccessibleConfirmationCancellation(t *testing.T) { //nolint:paral
 			}
 			defer writer.Close()
 			tracked := &pluginPromptCloseTracker{ReadCloser: input}
-			original := openPluginPromptInput
-			openPluginPromptInput = func() (io.ReadCloser, error) {
+			original := openPluginPromptTerminal
+			openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
 				if fallback {
-					return tracked, nil
+					return pluginPromptTerminal{in: tracked}, nil
 				}
-				return input, nil
+				return pluginPromptTerminal{in: input}, nil
 			}
-			t.Cleanup(func() { openPluginPromptInput = original })
+			t.Cleanup(func() { openPluginPromptTerminal = original })
 			ctx, cancel := context.WithCancel(t.Context())
 			defer cancel()
 			ready := make(chan struct{}, 1)
@@ -102,3 +104,54 @@ func (r *pluginPromptCloseTracker) Close() error {
 	r.closes++
 	return r.ReadCloser.Close()
 }
+
+// The answer comes from the terminal, so the question has to appear there.
+// A writer that is not a terminal — `entire graph 2>log`, or a wrapper
+// capturing stderr — rendered the prompt into the redirect: nothing reached
+// the terminal, which sat in raw mode waiting for a keypress, and with Yes as
+// the default an idle Enter authorized a download-and-exec nobody was shown.
+func TestPluginConfirmationRendersOnTerminalWhenWriterIsRedirected(t *testing.T) { //nolint:paralleltest // isolates terminal opener and accessibility
+	t.Setenv("ACCESSIBLE", "1")
+	t.Setenv("ENTIRE_TEST_TTY", "1")
+	var terminal bytes.Buffer
+	original := openPluginPromptTerminal
+	openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+		return pluginPromptTerminal{in: io.NopCloser(strings.NewReader("y\n")), out: &terminal}, nil
+	}
+	t.Cleanup(func() { openPluginPromptTerminal = original })
+
+	var redirected bytes.Buffer // stands in for a redirected stderr
+	ok, err := runPluginConfirm(t.Context(), &redirected, "Install the entire-graph plugin?", true)
+	if err != nil || !ok {
+		t.Fatalf("answer=%v err=%v", ok, err)
+	}
+	if !strings.Contains(terminal.String(), "Install the entire-graph plugin?") {
+		t.Errorf("prompt did not reach the terminal: %q", terminal.String())
+	}
+	if redirected.Len() != 0 {
+		t.Errorf("prompt leaked into the redirected writer: %q", redirected.String())
+	}
+}
+
+// The other half of the same rule: a writer that IS a terminal is what the
+// prompt renders to, so the caller keeps deciding where its own output goes.
+// Covered for real terminals by TestPluginConfirmationRedirectedInput; here
+// the check is that a non-terminal writer with no terminal handle to fall
+// back to is still used rather than dropped.
+func TestPluginConfirmationUsesSuppliedWriterWithoutATerminalHandle(t *testing.T) { //nolint:paralleltest // isolates terminal opener and accessibility
+	t.Setenv("ACCESSIBLE", "1")
+	t.Setenv("ENTIRE_TEST_TTY", "1")
+	original := openPluginPromptTerminal
+	openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+		return pluginPromptTerminal{in: io.NopCloser(strings.NewReader("y\n"))}, nil
+	}
+	t.Cleanup(func() { openPluginPromptTerminal = original })
+
+	var supplied bytes.Buffer
+	if _, err := runPluginConfirm(t.Context(), &supplied, "Install?", true); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(supplied.String(), "Install?") {
+		t.Errorf("prompt did not reach the supplied writer: %q", supplied.String())
+	}
+}
diff --git a/cmd/entire/cli/plugin_group.go b/cmd/entire/cli/plugin_group.go
index 508541b5fa..b21130ccd6 100644
--- a/cmd/entire/cli/plugin_group.go
+++ b/cmd/entire/cli/plugin_group.go
@@ -541,7 +541,11 @@ manifest upgrades need; local-dev symlink installs are skipped. Plugins
 installed with --pin are skipped until reinstalled without the pin.`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			ctx := cmd.Context()
+			// Upgrading does the same network work as installing — list tags,
+			// fetch metadata, download, place the binary — so it reports the
+			// same stages. Without this the startPluginStep calls on that path
+			// are no-ops, because progress travels on the context.
+			ctx := withPluginProgress(cmd.Context(), cmd.ErrOrStderr())
 			out := cmd.OutOrStdout()
 			var names []string
 			switch {
@@ -739,7 +743,9 @@ in scripts and non-interactive runs.`,
 				huh.NewSelect[string]().Title("Install a plugin").Options(options...).Value(&choice),
 			))
 			if err := form.RunWithContext(ctx); err != nil {
-				return handleFormCancellation(cmd.OutOrStdout(), "Browse", err)
+				// Stderr, like the confirmation below it: stdout carries the
+				// install result and nothing else.
+				return handleFormCancellation(cmd.ErrOrStderr(), "Browse", err)
 			}
 			if choice == "" {
 				return nil
diff --git a/cmd/entire/cli/plugin_on_demand.go b/cmd/entire/cli/plugin_on_demand.go
index 3468373146..f066547f9f 100644
--- a/cmd/entire/cli/plugin_on_demand.go
+++ b/cmd/entire/cli/plugin_on_demand.go
@@ -14,6 +14,21 @@ import (
 var onDemandPluginInstall = runRemoteInstall
 
 func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name string) (string, error) {
+	// The plugin may already be in the managed directory and merely
+	// unreachable through PATH: a local-dev symlink whose target moved, or a
+	// managed bin dir that could not be prepended at startup. Offering to
+	// install over it is a dead end — installRepoAtTag refuses an existing
+	// install without --force, so the user answers Yes, waits for three
+	// network round-trips and gets "already installed; use --force to
+	// replace". Execute the managed entry instead, which is what this
+	// function's own return contract promises below.
+	//
+	// A listing error falls through to the install rather than failing here:
+	// the install path reads the same directory and reports the problem in
+	// terms of what it was trying to do.
+	if installed, err := FindInstalledPlugin(name); err == nil && installed != nil {
+		return installed.Path, nil
+	}
 	if !interactive.CanPromptInteractively() {
 		return "", fmt.Errorf("the entire-%s plugin is not installed; run 'entire plugin install %s' and retry", name, name)
 	}
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
index a12bc9387b..f76b1641c9 100644
--- a/cmd/entire/cli/plugin_on_demand_test.go
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -17,6 +18,12 @@ import (
 func TestMaybeRunPlugin_MissingGraphNonInteractive(t *testing.T) { //nolint:paralleltest // isolates PATH and terminal detection
 	t.Setenv("PATH", t.TempDir())
 	t.Setenv("ENTIRE_TEST_TTY", "0")
+	// The managed dir is consulted before the prompt (see installMissingPlugin),
+	// and it is NOT covered by the testdirs fallback — pluginParentDir reads
+	// $ENTIRE_PLUGIN_DIR/$XDG_DATA_HOME and the home dir itself. Without this
+	// the test reads the developer's real plugins and passes only on a machine
+	// that happens not to have graph installed.
+	withPluginDir(t)
 	root := newTestRoot()
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
@@ -42,8 +49,8 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 	}{
 		{name: "enter accepts default yes", answer: "\n", wantInstall: true, wantRun: true},
 		{name: "explicit yes preserves exit code", answer: "y\n", pluginCode: 42, wantCode: 42, wantInstall: true, wantRun: true},
-		{name: "cancelled install stays quiet", answer: "y\n", cancelInstall: true, installErr: context.Canceled, wantCode: 1, wantInstall: true},
-		{name: "cancelled dependency confirmation does not run", answer: "y\n", cancelInstall: true, wantCode: 1, wantInstall: true},
+		{name: "cancelled install stays quiet", answer: "y\n", cancelInstall: true, installErr: context.Canceled, wantCode: ExitPluginSignalled, wantInstall: true},
+		{name: "cancelled dependency confirmation does not run", answer: "y\n", cancelInstall: true, wantCode: ExitPluginSignalled, wantInstall: true},
 		{name: "EOF declines", answer: "", wantCode: 1},
 		{name: "no cancels", answer: "n\n", wantCode: 1},
 		{name: "failed install does not run", answer: "\n", installErr: errors.New("download failed"), wantCode: 1, wantInstall: true},
@@ -83,9 +90,11 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			var stdout, stderr bytes.Buffer
 			root.SetOut(&stdout)
 			root.SetErr(&stderr)
-			originalInput := openPluginPromptInput
-			openPluginPromptInput = func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader(tc.answer)), nil }
-			t.Cleanup(func() { openPluginPromptInput = originalInput })
+			originalInput := openPluginPromptTerminal
+			openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+				return pluginPromptTerminal{in: io.NopCloser(strings.NewReader(tc.answer))}, nil
+			}
+			t.Cleanup(func() { openPluginPromptTerminal = originalInput })
 			data := strings.NewReader("plugin data\n")
 			root.SetIn(data)
 			args := []string{"graph", "search", "two words", "--json", "--", "$(untouched)", ""}
@@ -151,3 +160,79 @@ func TestResolvePlugin_OnDemandEligibility(t *testing.T) { //nolint:paralleltest
 		t.Fatal("built-in graph must take precedence over on-demand installation")
 	}
 }
+
+// A managed entry PATH cannot reach is the case installMissingPlugin's return
+// contract already promised: run it. Offering to install over it dead-ended,
+// because an existing install needs --force and the on-demand path passes
+// none — so the user answered Yes, waited for the index and metadata fetches,
+// and got "already installed; use --force to replace".
+func TestMaybeRunPlugin_GraphInManagedDirIsRunNotReinstalled(t *testing.T) { //nolint:paralleltest // isolates PATH and managed plugins
+	withIsolatedPluginEnv(t)
+	interceptVersionCheck(t)
+	binDir, err := EnsurePluginBinDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	argFile := filepath.Join(t.TempDir(), "args.txt")
+	writePluginBinary(t, binDir, "entire-graph", argFile, 0)
+	// Deliberately NOT on PATH: this is the managed bin dir that could not be
+	// prepended at startup.
+	if _, lookErr := exec.LookPath("entire-graph"); lookErr == nil {
+		t.Fatal("precondition: entire-graph must not resolve through PATH")
+	}
+
+	t.Setenv("ENTIRE_TEST_TTY", "1")
+	t.Setenv("ACCESSIBLE", "1")
+	originalTerminal := openPluginPromptTerminal
+	openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+		t.Error("an already-installed plugin must not prompt for installation")
+		return pluginPromptTerminal{in: io.NopCloser(strings.NewReader("n\n"))}, nil
+	}
+	t.Cleanup(func() { openPluginPromptTerminal = originalTerminal })
+	originalInstall := onDemandPluginInstall
+	onDemandPluginInstall = func(context.Context, *cobra.Command, installSource, remoteInstallFlags) error {
+		t.Error("an already-installed plugin must not be reinstalled")
+		return nil
+	}
+	t.Cleanup(func() { onDemandPluginInstall = originalInstall })
+
+	root := newTestRoot()
+	var stderr bytes.Buffer
+	root.SetErr(&stderr)
+	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "search", "hello"})
+	if !handled || code != 0 {
+		t.Fatalf("handled=%v code=%d, want true, 0; stderr=%s", handled, code, &stderr)
+	}
+	got, err := os.ReadFile(argFile)
+	if err != nil || string(got) != "search\nhello\n" {
+		t.Fatalf("managed entry did not run with the forwarded args: %q %v", got, err)
+	}
+	// The announcement names the command, not just its arguments — a bare
+	// `entire graph` used to print "Running plugin with command:" and stop.
+	if !strings.Contains(stderr.String(), "Running entire graph search hello\n") {
+		t.Errorf("forwarded command was not announced: %q", stderr.String())
+	}
+}
+
+// A bare `entire graph` has no arguments to forward, which is the case the
+// announcement got wrong: joining only the arguments left a trailing colon
+// and nothing after it.
+func TestMaybeRunPlugin_BareGraphAnnouncesTheCommand(t *testing.T) { //nolint:paralleltest // isolates PATH and managed plugins
+	withIsolatedPluginEnv(t)
+	interceptVersionCheck(t)
+	binDir, err := EnsurePluginBinDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	writePluginBinary(t, binDir, "entire-graph", filepath.Join(t.TempDir(), "args.txt"), 0)
+
+	root := newTestRoot()
+	var stderr bytes.Buffer
+	root.SetErr(&stderr)
+	if handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph"}); !handled || code != 0 {
+		t.Fatalf("handled=%v code=%d; stderr=%s", handled, code, &stderr)
+	}
+	if !strings.Contains(stderr.String(), "Running entire graph\n") {
+		t.Errorf("bare command was not announced: %q", stderr.String())
+	}
+}
diff --git a/cmd/entire/cli/plugin_progress_test.go b/cmd/entire/cli/plugin_progress_test.go
index a8ab439484..c987605e0b 100644
--- a/cmd/entire/cli/plugin_progress_test.go
+++ b/cmd/entire/cli/plugin_progress_test.go
@@ -49,3 +49,42 @@ func TestPluginInstallReportsStagesOnStderr(t *testing.T) { //nolint:paralleltes
 		t.Fatalf("stdout should contain only the install result: %q", out.String())
 	}
 }
+
+// Progress travels on the context, so a command that does the network work
+// without opting in reports nothing. `plugin upgrade` list tags, fetches
+// metadata, downloads and places a binary exactly as `plugin install` does,
+// and the stages were silent there until the command opted in.
+func TestPluginUpgradeReportsStagesOnStderr(t *testing.T) { //nolint:paralleltest // isolates managed plugins and index cache
+	withIsolatedPluginEnv(t)
+	withIndexCache(t)
+	repoURL, _ := newDemoPluginRepo(t, []string{remoteTestTagOld}, "0.1.0")
+	if _, err := InstallPluginFromRepo(t.Context(), repoURL, "", RemoteInstallOptions{}); err != nil {
+		t.Fatalf("InstallPluginFromRepo: %v", err)
+	}
+	srv := pluginReleaseServer(t, "0.1.0", "0.2.0")
+	updateRepoMetadata(t, repoURL, fmt.Sprintf("name: demo\ndownload_url: \"%s/dl/{tag}/{asset}\"\n", srv.URL))
+	gitTag(t, repoURL, remoteTestTagMid)
+
+	cmd := newPluginUpgradeCmd()
+	var out, errOut bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&errOut)
+	cmd.SetContext(t.Context())
+	cmd.SetArgs([]string{"demo"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatal(err)
+	}
+	for _, stage := range []string{
+		"Finding latest plugin release...",
+		"Fetching plugin metadata for " + remoteTestTagMid + "...",
+		"Downloading plugin archive...",
+		"Installing entire-demo " + remoteTestTagMid + "...",
+	} {
+		if !strings.Contains(errOut.String(), stage) {
+			t.Errorf("missing %q in upgrade progress: %q", stage, errOut.String())
+		}
+	}
+	if !strings.Contains(out.String(), remoteTestTagOld+" → "+remoteTestTagMid) {
+		t.Errorf("stdout should carry the upgrade result: %q", out.String())
+	}
+}
diff --git a/cmd/entire/cli/uiform/prompt_terminal_test.go b/cmd/entire/cli/uiform/prompt_terminal_test.go
index 8b4e70bc3e..4ea0622f22 100644
--- a/cmd/entire/cli/uiform/prompt_terminal_test.go
+++ b/cmd/entire/cli/uiform/prompt_terminal_test.go
@@ -5,6 +5,7 @@ package uiform
 import (
 	"context"
 	"io"
+	"regexp"
 	"strings"
 	"testing"
 	"time"
@@ -14,6 +15,11 @@ import (
 	"github.com/creack/pty"
 )
 
+// clearedFromFirstRow matches a cursor-up over the rendered form followed by
+// an erase to the end of the display — CUU then ED0, the pair that removes an
+// answered prompt. The row count is left open on purpose; see the assertion.
+var clearedFromFirstRow = regexp.MustCompile(`\x1b\[[0-9]+A\x1b\[J`)
+
 // An empty Form.View is not enough: the renderer must move back over the
 // question before erasing it. Exercise the actual terminal output, because
 // accessible-mode tests bypass the renderer that left answered prompts behind.
@@ -61,9 +67,15 @@ func TestConfirmationClearsPromptAfterAnswer(t *testing.T) {
 		t.Fatal(err)
 	}
 	transcript := <-output
-	// This fixed-width, five-row form ends with the cursor on its help row.
-	// Clearing from that row alone leaves the question and choices visible.
-	if !strings.Contains(transcript, "\x1b[4A\x1b[J") {
+	// The form ends with the cursor on its help row, so erasing from there
+	// alone leaves the question and choices visible: the renderer has to move
+	// back up over the form first, then erase to the end of the display.
+	//
+	// The number of rows is deliberately not pinned. It is a property of the
+	// form's height, which a field, theme or terminal-width change moves, and
+	// a literal "\x1b[4A\x1b[J" fails such a change with a message about
+	// prompt clearing — which is not what broke.
+	if !clearedFromFirstRow.MatchString(transcript) {
 		t.Fatalf("completed prompt was not erased from its first row: %q", transcript)
 	}
 	if !answer {
diff --git a/cmd/entire/main.go b/cmd/entire/main.go
index cd53940eda..75f74d182c 100644
--- a/cmd/entire/main.go
+++ b/cmd/entire/main.go
@@ -81,10 +81,26 @@ func main() {
 	restorePATH := cli.PrependPluginBinDirToPATH(ctx)
 
 	if handled, code := cli.MaybeRunPlugin(ctx, rootCmd, os.Args[1:]); handled {
-		if ctx.Err() != nil && procsignal.Load() != nil {
-			dieFromSignal(terminatingSignal())
-		}
 		cancel()
+		if code == cli.ExitPluginSignalled {
+			// The plugin was terminated by a signal, or a signal interrupted
+			// the on-demand install before it ran. Re-raise so the shell sees
+			// WIFSIGNALED and an enclosing loop breaks on one Ctrl-C.
+			//
+			// Gated on the plugin's own outcome rather than on a signal
+			// having fired somewhere in this process: Ctrl-C reaches the whole
+			// foreground process group, so a plugin that handles it itself and
+			// exits with a meaningful code (a TUI quitting on Ctrl-C exits 0)
+			// must keep that code instead of being reported as killed.
+			if procsignal.Load() != nil {
+				dieFromSignal(terminatingSignal())
+			}
+			// Killed by a signal we never received ourselves — an external
+			// kill, or a crash. There is no signal to re-raise, and -1 is not
+			// an exit status (os.Exit would truncate it to 255), so report a
+			// plain failure. The child has already said what happened.
+			os.Exit(1)
+		}
 		os.Exit(code)
 	}
 	restorePATH()
diff --git a/docs/architecture/external-commands.md b/docs/architecture/external-commands.md
index ae11ddcbba..ff94c78769 100644
--- a/docs/architecture/external-commands.md
+++ b/docs/architecture/external-commands.md
@@ -16,11 +16,11 @@ Rules, in order:
 2. **Reserved names are skipped.** Names beginning with `agent-` are reserved for the [agent protocol](external-agent-protocol.md). The resolver refuses to invoke them as external commands.
 3. **Path-traversal candidates are rejected.** Names containing `/` or `\` never resolve.
 4. **Found-but-not-executable surfaces as a launch error.** If `entire-<name>` exists on `$PATH` but lacks the executable bit, the resolver reports `Failed to run plugin entire-<name>` with exit code 1, rather than falling through to Cobra's "unknown command" path.
-5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` asks `Install the entire-graph plugin?` with Yes selected by default. Accepting installs `graph` through the configured plugin index using the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr. Declining, cancelling, or failing installation exits nonzero without running the command. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
+5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` asks `Install the entire-graph plugin?` with Yes selected by default. Accepting installs `graph` through the configured plugin index using the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr. Declining or a failed installation exits nonzero without running the command; a cancelled one terminates by signal, so a single Ctrl-C escapes an enclosing shell loop. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
 
-### Managed install directory
+   A `graph` that is already in the [managed install directory](#managed-install-directory) but unreachable through `$PATH` — a local-dev symlink whose target moved, or a managed dir that could not be prepended at startup — is **executed**, not offered for installation. Installing over it cannot work: an existing install needs `--force`, which the on-demand path deliberately does not pass, so prompting would spend the user's Yes and several network round-trips on a guaranteed "already installed; use --force to replace".
 
-Remote installs report index lookup, release metadata, download (including checksum verification), and installation progress on stderr. Styled terminals show a spinner; non-terminal and accessibility output prints plain status lines as each step starts. Progress stops before confirmations and results, including when installation fails. The same reporting applies when `entire graph` offers to install its missing plugin and when installing dependencies. Asset-name probes share one download status per release. Confirmations read from the controlling terminal and render to the supplied output writer (stderr for on-demand installs and dependency prompts), preserving piped plugin input and output. EOF declines installation; cancellation stops the prompt and preserves signal termination.
+### Managed install directory
 
 Users can drop binaries anywhere on `$PATH`, but a per-user managed directory is also automatically discovered:
 
@@ -31,6 +31,14 @@ The CLI prepends this directory to `$PATH` at startup via `cli.PrependPluginBinD
 
 `entire plugin install/list/remove/upgrade` manage the contents of this directory. Authors who prefer the raw "drop a binary on `$PATH`" model don't need to use it.
 
+### Install progress and confirmations
+
+`entire plugin install`, `entire plugin upgrade`, dependency installs, and the on-demand `entire graph` install report their stages — index lookup, release metadata, download and checksum verification, placement — on **stderr**, so stdout carries only the result and stays pipeable. A styled terminal gets a spinner; a non-terminal writer and accessibility mode get one plain line per stage as it starts. Progress stops before any confirmation or result is printed, including on failure. Asset-name probing shares one download status per release rather than one per candidate.
+
+Progress travels on the context (`withPluginProgress`), so a caller that has not opted in prints nothing — a library caller never writes to the process's terminal on its own.
+
+Confirmations read from the **controlling terminal**, never stdin, so a plugin's piped input survives being prompted about. They render to the writer the caller supplies, except when that writer is not itself a terminal (`entire graph 2>log`): then the prompt renders on the terminal the answer is read from, because a prompt nobody can see still blocks on a keypress — and with Yes as the default, an unwitting Enter would authorize the install. EOF declines; cancellation stops the prompt and still terminates by signal.
+
 ### Remote install
 
 `entire plugin install` accepts three source forms:

From 94112949be8cfaba83ca6da9589990c9856cae8b Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:10:17 +0200
Subject: [PATCH 28/59] Update CodeQL workflow to remove unused languages

Removed JavaScript, TypeScript, and Python languages from CodeQL analysis configuration.
---
 .github/workflows/codeql.yml | 93 ++++++++++++++++++++++++++++++++++++
 1 file changed, 93 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..91cb2e6241
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,93 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '34 14 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: go
+          build-mode: autobuild
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - name: Run manual build steps
+      if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

From e75b832e4db589cb5c55edd12d3cc2c552ddc727 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:17:49 +0200
Subject: [PATCH 29/59] build: bump Go to 1.27.1 and golangci-lint to 2.13.2

Go 1.26.6 -> 1.27.1 in go.mod and mise.toml, kept aligned per the comment
there.

The golangci-lint bump is forced rather than optional: 2.11.3 refuses to lint a
module targeting a newer Go than it was built with ("the Go language version
(go1.26) used to build golangci-lint is lower than the targeted Go version
(1.27.1)"), and 2.13.0 is the first release built with go1.27, so 2.13.x is the
floor. It arrives with three linter behaviour changes, resolved here rather than
suppressed.

goconst (2.13 scans composite literals, 2457 new findings). Two settings
restore the prior scope for the 2328 that are test fixtures and map-literal
keys; a Go toolchain bump should not also adopt a stricter linter. The
remaining 129 become named constants: a new names.go for command/verb names,
shared control-plane table headers and count-dependent display nouns; a
token-report vocabulary block shared by `session tokens`, `checkpoint tokens`
and `tokens profile`; canonical activity agent IDs; explain row labels; hook
categories; recap footer hints; and per-package constants in review,
claudecode, copilotcli, benchutil, strategy and transcript/compact.

Every substitution preserves the string value, so the --json contracts and test
assertions are untouched.

goconst's "such constant already exists" hints are deliberately not followed
where they point at a same-valued constant in an unrelated domain
(agentFlagName for the `agent` command, trailReviewSeverityLow for a
token-pressure level, sourceCheckpoint for the `checkpoint` command). Two
literals stay literals for the same reason: `gh repo create` and `gh <kind>
list` argv are the GitHub CLI's tokens, not Entire's.

nolintlint (22): deleted. Newer gosec no longer reports G115 on int(f.Fd()), so
those directives were dead.

staticcheck SA1019 (8): targeted //nolint with reasons. These are deliberate
reads of our own deprecated-for-backward-compat fields, so dropping the usage
would break the compatibility they exist for.

govet (1): Go 1.27's new inline analyzer flags the deprecated reflect.Ptr
alias; now reflect.Pointer.

Verified on go1.27.1: build clean; go vet clean on darwin, linux and windows
and under the integration and e2e tags; all five lint tasks at 0 issues;
test:ci green (91 packages under -race with -tags=integration, plus both canary
legs, vogon 56/56 and roger-roger 4/4).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25TX5G5TZ9416EZ64JGSHDF
---
 .golangci.yaml                                |  7 ++
 cmd/entire/cli/activity_cmd.go                | 43 ++++++++----
 cmd/entire/cli/activity_render.go             | 32 ++++-----
 cmd/entire/cli/agent/agent_test.go            |  1 -
 cmd/entire/cli/agent/claudecode/generate.go   | 13 +++-
 .../agent/claudecode/generate_streaming.go    |  2 +-
 cmd/entire/cli/agent/claudecode/models.go     |  2 +-
 cmd/entire/cli/agent/claudecode/reviewer.go   |  2 +-
 cmd/entire/cli/agent/copilotcli/generate.go   | 10 ++-
 cmd/entire/cli/agent/event.go                 |  2 +-
 cmd/entire/cli/agent/session_test.go          |  1 -
 cmd/entire/cli/agent_group.go                 |  4 +-
 cmd/entire/cli/agent_help_cmd.go              |  4 +-
 cmd/entire/cli/auth.go                        |  2 +-
 cmd/entire/cli/benchutil/benchutil.go         | 18 +++--
 cmd/entire/cli/checkpoint/fsstore/fsstore.go  |  2 +-
 cmd/entire/cli/checkpoint/id/id.go            |  2 -
 cmd/entire/cli/checkpoint/persistent.go       |  2 +-
 cmd/entire/cli/checkpoint_group.go            |  6 +-
 cmd/entire/cli/checkpoint_tokens.go           | 18 ++---
 cmd/entire/cli/dispatch.go                    |  2 +-
 cmd/entire/cli/explain.go                     | 52 +++++++-------
 cmd/entire/cli/grant.go                       | 16 +++--
 cmd/entire/cli/hook_registry.go               | 13 +++-
 cmd/entire/cli/integration_test/hooks.go      | 36 +++++-----
 cmd/entire/cli/integration_test/testenv.go    | 52 +++++++++-----
 cmd/entire/cli/integration_test/transcript.go | 22 +++---
 cmd/entire/cli/interactive/interactive.go     |  4 +-
 cmd/entire/cli/interactive/rawmode_unix.go    |  2 +-
 cmd/entire/cli/internal/flock/flock_unix.go   |  4 +-
 cmd/entire/cli/labs.go                        |  6 +-
 cmd/entire/cli/lifecycle.go                   |  6 +-
 cmd/entire/cli/mcp.go                         | 13 ++--
 cmd/entire/cli/mdrender/mdrender.go           |  4 +-
 cmd/entire/cli/names.go                       | 42 ++++++++++++
 cmd/entire/cli/org.go                         |  8 +--
 cmd/entire/cli/plugin_group.go                |  2 +-
 cmd/entire/cli/project.go                     | 16 +++--
 cmd/entire/cli/recap.go                       |  2 +-
 cmd/entire/cli/recap_tui.go                   | 26 ++++---
 cmd/entire/cli/repo.go                        |  6 +-
 cmd/entire/cli/repo_mirror.go                 |  8 +--
 cmd/entire/cli/repo_mirror_collaborators.go   |  2 +-
 cmd/entire/cli/repo_mirror_create_wizard.go   |  2 +-
 cmd/entire/cli/review/configure_test.go       |  4 +-
 cmd/entire/cli/review/picker.go               |  4 +-
 cmd/entire/cli/review/profile.go              | 19 ++++--
 cmd/entire/cli/review/tui_sink.go             |  2 +-
 cmd/entire/cli/runner_gather.go               |  3 +-
 cmd/entire/cli/session_adopt_test.go          |  8 +--
 cmd/entire/cli/session_tokens.go              | 68 ++++++++++++-------
 cmd/entire/cli/sessions.go                    |  6 +-
 cmd/entire/cli/settings/settings_test.go      |  2 +-
 cmd/entire/cli/status.go                      |  6 +-
 cmd/entire/cli/status_style.go                | 14 +++-
 cmd/entire/cli/strategy/cleanup.go            | 10 ++-
 cmd/entire/cli/strategy/hook_managers_test.go |  2 +-
 cmd/entire/cli/strategy/hooks.go              | 10 ++-
 cmd/entire/cli/strategy/manual_commit_test.go |  2 +-
 cmd/entire/cli/tokens_profile.go              | 26 +++----
 cmd/entire/cli/trail_cmd.go                   |  4 +-
 cmd/entire/cli/trail_cmd_test.go              |  2 +-
 cmd/entire/cli/trail_comment_cmd.go           |  2 +-
 cmd/entire/cli/trail_resume_cmd.go            |  6 +-
 cmd/entire/cli/transcript/compact/codex.go    |  4 +-
 cmd/entire/cli/transcript/compact/compact.go  |  7 +-
 cmd/entire/cli/transcript/compact/gemini.go   |  4 +-
 cmd/entire/cli/transcript/compact/opencode.go |  2 +-
 cmd/entire/cli/transcript/compact/parse.go    | 10 +--
 cmd/entire/cli/transcript/compact/pi.go       |  9 +--
 go.mod                                        |  5 +-
 mise.toml                                     |  4 +-
 72 files changed, 468 insertions(+), 296 deletions(-)
 create mode 100644 cmd/entire/cli/names.go

diff --git a/.golangci.yaml b/.golangci.yaml
index 662d3bcba6..0af30d6d1b 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -74,6 +74,13 @@ linters:
     - whitespace
     - wrapcheck
   settings:
+    goconst:
+      # golangci-lint 2.13 (goconst upgrade) began scanning composite literals,
+      # which turned map-literal keys and test fixtures into ~2.3k findings that
+      # 2.11 never reported. Both knobs restore the prior scope rather than
+      # adopting a stricter linter as a side effect of a Go toolchain bump.
+      ignore-tests: true
+      ignore-map-keys: true
     gosec:
       excludes:
         - G204 # subprocess with variables is expected for git/opencode CLI wrappers
diff --git a/cmd/entire/cli/activity_cmd.go b/cmd/entire/cli/activity_cmd.go
index bd9861dcea..af07acc828 100644
--- a/cmd/entire/cli/activity_cmd.go
+++ b/cmd/entire/cli/activity_cmd.go
@@ -27,23 +27,40 @@ const (
 	sessionsOverviewLimit = 50
 )
 
+// Canonical agent IDs as /me/activity reports them: the keys of the display
+// map, the values knownAgents normalizes onto, and the render order all draw
+// from this one set.
+const (
+	activityAgentClaude   = "claude"
+	activityAgentGemini   = "gemini"
+	activityAgentAmp      = "amp"
+	activityAgentCodex    = "codex"
+	activityAgentOpencode = "opencode"
+	activityAgentCopilot  = "copilot"
+	activityAgentPi       = "pi"
+	activityAgentCursor   = "cursor"
+	activityAgentDroid    = "droid"
+	activityAgentKiro     = "kiro"
+	activityAgentUnknown  = "unknown"
+)
+
 // knownAgents maps normalized agent strings from the API to display IDs.
 // Used for the commit list, where per-checkpoint agent strings are free-form.
 // The /me/activity endpoint returns already-normalized canonical IDs.
 var knownAgents = map[string]string{
-	"claude":     "claude",
-	"claudecode": "claude",
-	"gemini":     "gemini",
-	"geminicli":  "gemini",
-	"amp":        "amp",
-	"codex":      "codex",
-	"opencode":   "opencode",
-	"copilot":    "copilot",
-	"copilotcli": "copilot",
-	"pi":         "pi",
-	"cursor":     "cursor",
-	"droid":      "droid",
-	"kiro":       "kiro",
+	"claude":     activityAgentClaude,
+	"claudecode": activityAgentClaude,
+	"gemini":     activityAgentGemini,
+	"geminicli":  activityAgentGemini,
+	"amp":        activityAgentAmp,
+	"codex":      activityAgentCodex,
+	"opencode":   activityAgentOpencode,
+	"copilot":    activityAgentCopilot,
+	"copilotcli": activityAgentCopilot,
+	"pi":         activityAgentPi,
+	"cursor":     activityAgentCursor,
+	"droid":      activityAgentDroid,
+	"kiro":       activityAgentKiro,
 }
 
 func newActivityCmd() *cobra.Command {
diff --git a/cmd/entire/cli/activity_render.go b/cmd/entire/cli/activity_render.go
index 46493d7618..6a29d7649c 100644
--- a/cmd/entire/cli/activity_render.go
+++ b/cmd/entire/cli/activity_render.go
@@ -37,7 +37,7 @@ type activityStyles struct {
 // used by other commands. Activity benefits from wide output for bar charts.
 func getFullTerminalWidth(w io.Writer) int {
 	if f, ok := w.(*os.File); ok {
-		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 { //nolint:gosec // G115: uintptr->int is safe for fd
+		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 {
 			return width
 		}
 	}
@@ -45,7 +45,7 @@ func getFullTerminalWidth(w io.Writer) int {
 		if f == nil {
 			continue
 		}
-		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 { //nolint:gosec // G115: uintptr->int is safe for fd
+		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 {
 			return width
 		}
 	}
@@ -108,22 +108,22 @@ type agentDisplay struct {
 // recognizable; lipgloss resolves them to the best representation for the
 // terminal's color profile. The non-brand "unknown" fallback uses muted gray.
 var agentDisplayMap = map[string]agentDisplay{
-	"claude":   {Label: "Claude Code", Color: "#fb923c", Char: '▓'}, // orange-400
-	"gemini":   {Label: "Gemini", Color: "#60a5fa", Char: '▓'},      // blue-400
-	"amp":      {Label: "Amp", Color: "#f87171", Char: '▓'},         // red-400
-	"codex":    {Label: "Codex", Color: "#818cf8", Char: '▓'},       // indigo-400
-	"opencode": {Label: "OpenCode", Color: "#22d3ee", Char: '▓'},    // cyan-400
-	"copilot":  {Label: "Copilot", Color: "#a78bfa", Char: '▓'},     // violet-400
-	"pi":       {Label: "Pi", Color: "#fbbf24", Char: '▓'},          // amber-400
-	"cursor":   {Label: "Cursor", Color: "#38bdf8", Char: '▓'},      // sky-400
-	"droid":    {Label: "Droid", Color: "#f472b6", Char: '▓'},       // pink-400
-	"kiro":     {Label: "Kiro", Color: "#c084fc", Char: '▓'},        // purple-400
-	"unknown":  {Label: "Unknown", Color: palette.Muted, Char: '░'},
+	activityAgentClaude:   {Label: "Claude Code", Color: "#fb923c", Char: '▓'}, // orange-400
+	activityAgentGemini:   {Label: "Gemini", Color: "#60a5fa", Char: '▓'},      // blue-400
+	activityAgentAmp:      {Label: "Amp", Color: "#f87171", Char: '▓'},         // red-400
+	activityAgentCodex:    {Label: "Codex", Color: "#818cf8", Char: '▓'},       // indigo-400
+	activityAgentOpencode: {Label: "OpenCode", Color: "#22d3ee", Char: '▓'},    // cyan-400
+	activityAgentCopilot:  {Label: "Copilot", Color: "#a78bfa", Char: '▓'},     // violet-400
+	activityAgentPi:       {Label: "Pi", Color: "#fbbf24", Char: '▓'},          // amber-400
+	activityAgentCursor:   {Label: "Cursor", Color: "#38bdf8", Char: '▓'},      // sky-400
+	activityAgentDroid:    {Label: "Droid", Color: "#f472b6", Char: '▓'},       // pink-400
+	activityAgentKiro:     {Label: "Kiro", Color: "#c084fc", Char: '▓'},        // purple-400
+	activityAgentUnknown:  {Label: "Unknown", Color: palette.Muted, Char: '░'},
 }
 
 var agentOrder = []string{
-	"claude", "codex", "gemini", "amp", "opencode",
-	"copilot", "pi", "cursor", "droid", "kiro", "unknown",
+	activityAgentClaude, activityAgentCodex, activityAgentGemini, activityAgentAmp, activityAgentOpencode,
+	activityAgentCopilot, activityAgentPi, activityAgentCursor, activityAgentDroid, activityAgentKiro, activityAgentUnknown,
 }
 
 // renderActivityHeader renders the stat cards, contribution heatmap, and repo
@@ -556,7 +556,7 @@ func renderSessionListN(w io.Writer, sty activityStyles, days []sessionDay, maxD
 
 	for _, day := range days[:maxDays] {
 		displayDate := formatCommitDate(day.Date)
-		sessionWord := "sessions"
+		sessionWord := nounSessions
 		if len(day.Sessions) == 1 {
 			sessionWord = strings.TrimSuffix(sessionWord, "s")
 		}
diff --git a/cmd/entire/cli/agent/agent_test.go b/cmd/entire/cli/agent/agent_test.go
index b9507a5293..73de9cecc4 100644
--- a/cmd/entire/cli/agent/agent_test.go
+++ b/cmd/entire/cli/agent/agent_test.go
@@ -135,7 +135,6 @@ func TestHookTypeConstants(t *testing.T) {
 	}
 }
 
-//nolint:govet // testing struct field assignment
 func TestHookInputStructure(t *testing.T) {
 	t.Parallel()
 
diff --git a/cmd/entire/cli/agent/claudecode/generate.go b/cmd/entire/cli/agent/claudecode/generate.go
index 2e7d51bf77..65f1e859e0 100644
--- a/cmd/entire/cli/agent/claudecode/generate.go
+++ b/cmd/entire/cli/agent/claudecode/generate.go
@@ -14,6 +14,13 @@ import (
 	"github.com/entireio/cli/cmd/entire/cli/agent"
 )
 
+// flagOutputFormat selects the CLI's response encoding; modelHaiku is the
+// default model for Entire's own generation calls (fast and cheap).
+const (
+	flagOutputFormat = "--output-format"
+	modelHaiku       = "haiku"
+)
+
 // buildGenerateArgs assembles the claude CLI argv for a --print text-generation
 // call.
 //
@@ -41,7 +48,7 @@ import (
 // without any injection (settingsPath == "").
 func buildGenerateArgs(model, settingsPath string) []string {
 	args := []string{
-		"--print", "--output-format", "json",
+		"--print", flagOutputFormat, "json",
 		"--model", model,
 		"--setting-sources", "",
 	}
@@ -59,7 +66,7 @@ func buildGenerateArgs(model, settingsPath string) []string {
 func buildStreamingGenerateArgs(model, settingsPath string) []string {
 	args := []string{
 		"--print",
-		"--output-format", "stream-json",
+		flagOutputFormat, "stream-json",
 		"--include-partial-messages",
 		"--verbose",
 		"--model", model,
@@ -151,7 +158,7 @@ func readUserAPIKeyHelper() string {
 func (c *ClaudeCodeAgent) GenerateText(ctx context.Context, prompt string, model string) (string, error) {
 	claudePath := "claude"
 	if model == "" {
-		model = "haiku"
+		model = modelHaiku
 	}
 
 	commandRunner := c.CommandRunner
diff --git a/cmd/entire/cli/agent/claudecode/generate_streaming.go b/cmd/entire/cli/agent/claudecode/generate_streaming.go
index 5e2878f082..91e6c4dbd4 100644
--- a/cmd/entire/cli/agent/claudecode/generate_streaming.go
+++ b/cmd/entire/cli/agent/claudecode/generate_streaming.go
@@ -29,7 +29,7 @@ func (c *ClaudeCodeAgent) GenerateTextStreaming(
 	progress agent.ProgressFn,
 ) (string, error) {
 	if model == "" {
-		model = "haiku"
+		model = modelHaiku
 	}
 
 	commandRunner := c.CommandRunner
diff --git a/cmd/entire/cli/agent/claudecode/models.go b/cmd/entire/cli/agent/claudecode/models.go
index 666900254d..71de832b3d 100644
--- a/cmd/entire/cli/agent/claudecode/models.go
+++ b/cmd/entire/cli/agent/claudecode/models.go
@@ -15,6 +15,6 @@ func (c *ClaudeCodeAgent) ListModels(_ context.Context) ([]agent.ModelInfo, erro
 	return []agent.ModelInfo{
 		{ID: "opus", Note: "alias — latest Claude Opus"},
 		{ID: "sonnet", Note: "alias — latest Claude Sonnet"},
-		{ID: "haiku", Note: "alias — latest Claude Haiku (fast)"},
+		{ID: modelHaiku, Note: "alias — latest Claude Haiku (fast)"},
 	}, nil
 }
diff --git a/cmd/entire/cli/agent/claudecode/reviewer.go b/cmd/entire/cli/agent/claudecode/reviewer.go
index 90708ba943..bc80457fd4 100644
--- a/cmd/entire/cli/agent/claudecode/reviewer.go
+++ b/cmd/entire/cli/agent/claudecode/reviewer.go
@@ -37,7 +37,7 @@ func NewReviewer() *reviewtypes.ReviewerTemplate {
 // Exposed at package level for test inspection of argv and env.
 func buildReviewCmd(ctx context.Context, cfg reviewtypes.RunConfig) *exec.Cmd {
 	prompt := review.ComposeReviewPrompt(cfg)
-	args := []string{"-p", prompt, "--output-format", "stream-json", "--verbose"}
+	args := []string{"-p", prompt, flagOutputFormat, "stream-json", "--verbose"}
 	args = review.AppendModelFlag(args, cfg.Model)
 	cmd := exec.CommandContext(ctx, "claude", args...)
 	cmd.Env = review.AppendReviewEnv(os.Environ(), "claude-code", cfg, prompt)
diff --git a/cmd/entire/cli/agent/copilotcli/generate.go b/cmd/entire/cli/agent/copilotcli/generate.go
index 375a9850f4..974924ca4c 100644
--- a/cmd/entire/cli/agent/copilotcli/generate.go
+++ b/cmd/entire/cli/agent/copilotcli/generate.go
@@ -7,6 +7,10 @@ import (
 	"github.com/entireio/cli/cmd/entire/cli/agent"
 )
 
+// flagDenyTool withholds one built-in tool from the generation run; Entire's
+// summaries need no tools at all, so every one it knows about is denied.
+const flagDenyTool = "--deny-tool"
+
 // generateTextArgs is the pinned tool policy for text generation.
 //
 // Summary generation is a text-in text-out call, and its prompt carries
@@ -48,9 +52,9 @@ import (
 // TestGenerateText_PinsMinimalToolSurface pins the argv so a future flag
 // change is a reviewed decision rather than a drive-by edit.
 var generateTextArgs = []string{
-	"--deny-tool", "shell",
-	"--deny-tool", "write",
-	"--deny-tool", "url",
+	flagDenyTool, "shell",
+	flagDenyTool, "write",
+	flagDenyTool, "url",
 	"--no-ask-user",
 	"--no-custom-instructions",
 	"--disable-builtin-mcps",
diff --git a/cmd/entire/cli/agent/event.go b/cmd/entire/cli/agent/event.go
index 95b7d172b9..537ae79bb6 100644
--- a/cmd/entire/cli/agent/event.go
+++ b/cmd/entire/cli/agent/event.go
@@ -248,5 +248,5 @@ func ReadHookInputRawLimited(stdin io.Reader, limit int64) (json.RawMessage, err
 // instead of blocking on a read that will never complete (issue #1398).
 func StdinLooksInteractive(r io.Reader) bool {
 	f, ok := r.(*os.File)
-	return ok && term.IsTerminal(int(f.Fd())) //nolint:gosec // G115: uintptr->int is safe for fd
+	return ok && term.IsTerminal(int(f.Fd()))
 }
diff --git a/cmd/entire/cli/agent/session_test.go b/cmd/entire/cli/agent/session_test.go
index cecb0c815f..497b74aef3 100644
--- a/cmd/entire/cli/agent/session_test.go
+++ b/cmd/entire/cli/agent/session_test.go
@@ -1,4 +1,3 @@
-//nolint:govet // Test file with struct field assignments for completeness
 package agent
 
 import (
diff --git a/cmd/entire/cli/agent_group.go b/cmd/entire/cli/agent_group.go
index 3201d599ec..274bfdee9d 100644
--- a/cmd/entire/cli/agent_group.go
+++ b/cmd/entire/cli/agent_group.go
@@ -16,7 +16,7 @@ import (
 // newAgentGroupCmd builds `entire agent`. Replaces `entire configure`.
 func newAgentGroupCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "agent",
+		Use:   cmdAgent,
 		Short: "Manage agent integrations (add, remove, list)",
 		Long: `Manage agent integrations in this repository.
 
@@ -57,7 +57,7 @@ func runAgentMenu(ctx context.Context, w io.Writer) error {
 
 func newAgentListCmd() *cobra.Command {
 	return &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List installed and available agents",
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return runAgentList(cmd.Context(), cmd.OutOrStdout())
diff --git a/cmd/entire/cli/agent_help_cmd.go b/cmd/entire/cli/agent_help_cmd.go
index 55858c3e34..13d6f6651a 100644
--- a/cmd/entire/cli/agent_help_cmd.go
+++ b/cmd/entire/cli/agent_help_cmd.go
@@ -692,9 +692,9 @@ func renderAgentHelpTop(rootCmd *cobra.Command, repoLine string, trailsEnabled b
 	}
 	// Use an example command that is actually advertised here (trail is gated on
 	// trails being enabled), so we never point at a command the agent can't use.
-	example := "checkpoint"
+	example := cmdCheckpoint
 	if trailsEnabled {
-		example = "trail"
+		example = cmdTrail
 	}
 	fmt.Fprintf(&b, "\nDrill in for exact, currently-installed flags:  entire agent-help <command>  (e.g. entire agent-help %s)\n", example)
 	b.WriteString("Add --json for structured output.\n")
diff --git a/cmd/entire/cli/auth.go b/cmd/entire/cli/auth.go
index 52bae07bac..d627d7682a 100644
--- a/cmd/entire/cli/auth.go
+++ b/cmd/entire/cli/auth.go
@@ -215,7 +215,7 @@ func newAuthTokenCmd() *cobra.Command {
 func newAuthStatusCmd() *cobra.Command {
 	var insecureHTTPAuth bool
 	cmd := &cobra.Command{
-		Use:   "status",
+		Use:   cmdStatus,
 		Short: "Show authentication status",
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			target, err := resolveAuthStatusTarget(cmd.Context(), auth.Contexts, auth.RefreshedLoginToken)
diff --git a/cmd/entire/cli/benchutil/benchutil.go b/cmd/entire/cli/benchutil/benchutil.go
index 4c4f50ea7f..e7c2f905d8 100644
--- a/cmd/entire/cli/benchutil/benchutil.go
+++ b/cmd/entire/cli/benchutil/benchutil.go
@@ -29,6 +29,12 @@ import (
 	"github.com/go-git/go-git/v6/plumbing/object"
 )
 
+// Fixture identity for every benchmark repo and commit this package builds.
+const (
+	benchAuthorName  = "Bench User"
+	benchAuthorEmail = "bench@example.com"
+)
+
 // BenchRepo is a fully initialized git repository with Entire configured,
 // ready for checkpoint benchmarks.
 type BenchRepo struct {
@@ -150,8 +156,8 @@ func NewBenchRepo(b *testing.B, opts RepoOpts) *BenchRepo {
 		}
 		headHash, err = wt.Commit(fmt.Sprintf("Commit %d", c+1), &git.CommitOptions{
 			Author: &object.Signature{
-				Name:  "Bench User",
-				Email: "bench@example.com",
+				Name:  benchAuthorName,
+				Email: benchAuthorEmail,
 				When:  time.Now(),
 			},
 		})
@@ -371,8 +377,8 @@ func (br *BenchRepo) SeedShadowBranch(b *testing.B, sessionID string, checkpoint
 			ModifiedFiles:     modified,
 			MetadataDir:       metadataDir,
 			CommitMessage:     fmt.Sprintf("Checkpoint %d", i+1),
-			AuthorName:        "Bench User",
-			AuthorEmail:       "bench@example.com",
+			AuthorName:        benchAuthorName,
+			AuthorEmail:       benchAuthorEmail,
 			IsFirstCheckpoint: i == 0,
 		})
 		if err != nil {
@@ -412,8 +418,8 @@ func (br *BenchRepo) SeedMetadataBranch(b *testing.B, checkpointCount int) {
 			Prompts:          []string{fmt.Sprintf("Implement feature %d", i)},
 			FilesTouched:     files,
 			CheckpointsCount: 3,
-			AuthorName:       "Bench User",
-			AuthorEmail:      "bench@example.com",
+			AuthorName:       benchAuthorName,
+			AuthorEmail:      benchAuthorEmail,
 			Agent:            agent.AgentTypeClaudeCode,
 		})
 		if err != nil {
diff --git a/cmd/entire/cli/checkpoint/fsstore/fsstore.go b/cmd/entire/cli/checkpoint/fsstore/fsstore.go
index 7fb341edb7..baa4c05084 100644
--- a/cmd/entire/cli/checkpoint/fsstore/fsstore.go
+++ b/cmd/entire/cli/checkpoint/fsstore/fsstore.go
@@ -326,7 +326,7 @@ func metadataFromWriteOptions(opts cp.WriteOptions) cp.Metadata {
 		TurnID:                      opts.TurnID,
 		TranscriptIdentifierAtStart: opts.TranscriptIdentifierAtStart,
 		CheckpointTranscriptStart:   opts.CheckpointTranscriptStart,
-		TranscriptLinesAtStart:      opts.CheckpointTranscriptStart, // git writes both for back-compat
+		TranscriptLinesAtStart:      opts.CheckpointTranscriptStart, //nolint:staticcheck // deliberate: git writes both so older CLIs can still read the metadata
 		TokenUsage:                  opts.TokenUsage,
 		SkillEvents:                 opts.SkillEvents,
 		PromptAttributions:          opts.PromptAttributionsJSON,
diff --git a/cmd/entire/cli/checkpoint/id/id.go b/cmd/entire/cli/checkpoint/id/id.go
index 7e23736f17..93fba1e53e 100644
--- a/cmd/entire/cli/checkpoint/id/id.go
+++ b/cmd/entire/cli/checkpoint/id/id.go
@@ -16,8 +16,6 @@ import (
 // CheckpointID identifies a checkpoint. It comes in two formats: a legacy
 // 12-character lowercase hex ID and a 26-character Crockford base32 ULID (see
 // Kind / CheckpointPattern). It links code commits to their checkpoint metadata.
-//
-//nolint:recvcheck // UnmarshalJSON requires pointer receiver, others use value receiver - standard pattern
 type CheckpointID string
 
 // EmptyCheckpointID represents an unset or invalid checkpoint ID.
diff --git a/cmd/entire/cli/checkpoint/persistent.go b/cmd/entire/cli/checkpoint/persistent.go
index bc185ac186..e095d091a7 100644
--- a/cmd/entire/cli/checkpoint/persistent.go
+++ b/cmd/entire/cli/checkpoint/persistent.go
@@ -727,7 +727,7 @@ func (s *treeWriter) writeSessionToSubdirectory(ctx context.Context, opts WriteO
 		TurnID:                      opts.TurnID,
 		TranscriptIdentifierAtStart: opts.TranscriptIdentifierAtStart,
 		CheckpointTranscriptStart:   opts.CheckpointTranscriptStart,
-		TranscriptLinesAtStart:      opts.CheckpointTranscriptStart, // Deprecated: kept for backward compat
+		TranscriptLinesAtStart:      opts.CheckpointTranscriptStart, //nolint:staticcheck // deliberate: written so older CLIs can still read the metadata
 		CompactTranscriptStart:      compactTranscriptStart,
 		TokenUsage:                  opts.TokenUsage,
 		SkillEventsVersion:          skillEventsVersion(opts.SkillEvents),
diff --git a/cmd/entire/cli/checkpoint_group.go b/cmd/entire/cli/checkpoint_group.go
index 8210aac97f..767f018336 100644
--- a/cmd/entire/cli/checkpoint_group.go
+++ b/cmd/entire/cli/checkpoint_group.go
@@ -12,8 +12,8 @@ import (
 // registers list/explain/tokens/search/resume as children.
 func newCheckpointGroupCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "checkpoint",
-		Aliases: []string{"cp", "checkpoints"},
+		Use:     cmdCheckpoint,
+		Aliases: []string{"cp", cmdCheckpointsAlias},
 		Short:   "Inspect and search checkpoints",
 		Long: `Operations on checkpoints — the persistent records of agent work tied to commits.
 
@@ -75,7 +75,7 @@ func newCheckpointListCmd() *cobra.Command {
 	var pendingFlag bool
 
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List checkpoints on the current branch",
 		Long: `List checkpoints on the current branch.
 
diff --git a/cmd/entire/cli/checkpoint_tokens.go b/cmd/entire/cli/checkpoint_tokens.go
index 6f5bb557f9..b9c37b9566 100644
--- a/cmd/entire/cli/checkpoint_tokens.go
+++ b/cmd/entire/cli/checkpoint_tokens.go
@@ -218,20 +218,20 @@ func buildCheckpointTokensReport(cpID id.CheckpointID, summary *checkpoint.Check
 		report.Tokens = tokens
 		if tokens.SubagentTotal > 0 {
 			report.Contributors = append(report.Contributors, sessionTokensContributor{
-				Kind:       "subagents",
+				Kind:       tokensKindSubagents,
 				Label:      "Subagents",
 				Tokens:     tokens.SubagentTotal,
-				Confidence: "reported",
-				Signals:    []string{"subagent_tokens"},
+				Confidence: tokensConfidenceReported,
+				Signals:    []string{tokensSignalSubagentTokens},
 			})
 		}
 	} else {
 		report.Limitations = append(report.Limitations, "No token usage recorded for this checkpoint.")
 		report.Recommendations = append(report.Recommendations, sessionTokensRecommendation{
 			ID:       "no-token-data",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "Token usage is unavailable for this checkpoint; the agent may not expose token data yet, or this checkpoint predates token tracking.",
-			Signals:  []string{"missing_token_usage"},
+			Signals:  []string{tokensSignalMissingUsage},
 		})
 	}
 	if metadataWarnings > 0 {
@@ -251,11 +251,11 @@ func buildCheckpointTokensReport(cpID id.CheckpointID, summary *checkpoint.Check
 			if contextInfo := buildSessionTokensContext(metrics.ContextTokens, metrics.ContextWindowSize); contextInfo != nil {
 				report.Context = contextInfo
 				report.Contributors = append(report.Contributors, sessionTokensContributor{
-					Kind:       "context_pressure",
+					Kind:       tokensKindContextPressure,
 					Label:      "Context pressure",
 					Percent:    contextInfo.Percent,
-					Confidence: "reported",
-					Signals:    []string{"context_tokens"},
+					Confidence: tokensConfidenceReported,
+					Signals:    []string{tokensSignalContextTokens},
 				})
 			}
 		}
@@ -275,7 +275,7 @@ func buildCheckpointTokensReport(cpID id.CheckpointID, summary *checkpoint.Check
 		report.Contributors = append(report.Contributors, sessionTokensContributor{
 			Kind:       "skills",
 			Label:      "Skills/slash commands: " + strings.Join(labels, ", "),
-			Confidence: "reported",
+			Confidence: tokensConfidenceReported,
 			Signals:    []string{"skill_events"},
 		})
 	}
diff --git a/cmd/entire/cli/dispatch.go b/cmd/entire/cli/dispatch.go
index f1fb64e5d8..92589423ee 100644
--- a/cmd/entire/cli/dispatch.go
+++ b/cmd/entire/cli/dispatch.go
@@ -147,7 +147,7 @@ func runDispatchCommand(ctx context.Context, outW io.Writer, opts dispatchpkg.Op
 }
 
 func isTerminalStdin(file *os.File) bool {
-	return term.IsTerminal(int(file.Fd())) //nolint:gosec // G115: uintptr->int is safe for fd
+	return term.IsTerminal(int(file.Fd()))
 }
 
 func shouldRunDispatchWizard(flagCount int, stdinIsTerminal bool, stdoutIsTerminal bool) bool {
diff --git a/cmd/entire/cli/explain.go b/cmd/entire/cli/explain.go
index 3bba24fd0b..d8727848fc 100644
--- a/cmd/entire/cli/explain.go
+++ b/cmd/entire/cli/explain.go
@@ -1037,7 +1037,7 @@ func generateCheckpointSummary(ctx context.Context, w, errW io.Writer, store che
 	if content.Metadata.Summary != nil && !force {
 		return renderExplainFailure(errW, "Summary already exists", []explainRow{
 			{Label: "id", Value: checkpointID.String()},
-			{Label: "try", Value: fmt.Sprintf("entire checkpoint explain --generate --force %s", checkpointID)},
+			{Label: explainLabelTry, Value: fmt.Sprintf("entire checkpoint explain --generate --force %s", checkpointID)},
 		}, fmt.Errorf("checkpoint %s already has a summary", checkpointID))
 	}
 
@@ -1257,28 +1257,28 @@ func formatCheckpointSummaryError(err error, attempt *summaryAttempt) (string, [
 		case claudecode.ClaudeErrorAuth:
 			label := "Claude authentication failed"
 			rows := []explainRow{
-				{Label: "try", Value: "run `claude login` and retry"},
+				{Label: explainLabelTry, Value: "run `claude login` and retry"},
 			}
 			if claudeErr.Message != "" {
-				rows = append([]explainRow{{Label: "message", Value: claudeErr.Message}}, rows...)
+				rows = append([]explainRow{{Label: explainLabelMessage, Value: claudeErr.Message}}, rows...)
 			}
 			return label, rows, fmt.Errorf("Claude authentication failed%s", formatMessageSuffix(claudeErr.Message)) //nolint:staticcheck // ST1005: Claude is a proper noun
 		case claudecode.ClaudeErrorRateLimit:
 			label := "Claude rejected the summary request due to rate limits or quota"
 			rows := []explainRow{
-				{Label: "try", Value: "wait and retry"},
+				{Label: explainLabelTry, Value: "wait and retry"},
 			}
 			if claudeErr.Message != "" {
-				rows = append([]explainRow{{Label: "message", Value: claudeErr.Message}}, rows...)
+				rows = append([]explainRow{{Label: explainLabelMessage, Value: claudeErr.Message}}, rows...)
 			}
 			return label, rows, fmt.Errorf("Claude rejected the summary request due to rate limits or quota%s", formatMessageSuffix(claudeErr.Message)) //nolint:staticcheck // ST1005
 		case claudecode.ClaudeErrorConfig:
 			label := "Claude rejected the summary request"
 			rows := []explainRow{
-				{Label: "try", Value: "check your Claude CLI config and selected model"},
+				{Label: explainLabelTry, Value: "check your Claude CLI config and selected model"},
 			}
 			if claudeErr.Message != "" {
-				rows = append([]explainRow{{Label: "message", Value: claudeErr.Message}}, rows...)
+				rows = append([]explainRow{{Label: explainLabelMessage, Value: claudeErr.Message}}, rows...)
 			}
 			return label, rows, fmt.Errorf("Claude rejected the summary request%s", formatMessageSuffix(claudeErr.Message)) //nolint:staticcheck // ST1005
 		case claudecode.ClaudeErrorCLIMissing:
@@ -1356,33 +1356,33 @@ func timeoutDiagnostic(_ error, attempt *summaryAttempt) (string, []explainRow)
 		case attempt.phasesReached[agent.PhaseDone]:
 			label = "model finished but the result was not delivered in time"
 			rows = []explainRow{
-				{Label: "cause", Value: "the deadline fired while the finished result was being read"},
-				{Label: "try", Value: "raise --summary-timeout-seconds and retry"},
+				{Label: explainLabelCause, Value: "the deadline fired while the finished result was being read"},
+				{Label: explainLabelTry, Value: "raise --summary-timeout-seconds and retry"},
 			}
 		case attempt.phasesReached[agent.PhaseGenerating], attempt.phasesReached[agent.PhaseFirstToken]:
 			label = "model responded but did not finish"
 			rows = []explainRow{
-				{Label: "cause", Value: "transcript may be too large for the chosen cap, or model is slow"},
-				{Label: "try", Value: "raise --summary-timeout-seconds or pick a faster model"},
+				{Label: explainLabelCause, Value: "transcript may be too large for the chosen cap, or model is slow"},
+				{Label: explainLabelTry, Value: "raise --summary-timeout-seconds or pick a faster model"},
 			}
 		case attempt.phasesReached[agent.PhaseConnecting]:
 			label = "provider sent request but received no response"
 			rows = []explainRow{
-				{Label: "cause", Value: "network/firewall, provider API degraded, or auth check stuck"},
-				{Label: "try", Value: "check connectivity to the provider, then retry"},
+				{Label: explainLabelCause, Value: "network/firewall, provider API degraded, or auth check stuck"},
+				{Label: explainLabelTry, Value: "check connectivity to the provider, then retry"},
 			}
 		default:
 			label = "provider never sent its request"
 			rows = []explainRow{
-				{Label: "cause", Value: "the provider CLI may be stalled before subprocess startup"},
-				{Label: "try", Value: tryRunCLI},
+				{Label: explainLabelCause, Value: "the provider CLI may be stalled before subprocess startup"},
+				{Label: explainLabelTry, Value: tryRunCLI},
 			}
 		}
 		// attempt.streaming is set eagerly when a streaming-capable provider
 		// is selected, so a provider that stalls before its first event lands
 		// here — surface the captured stderr rather than dropping it.
 		if stderr != "" {
-			rows = append(rows, explainRow{Label: "stderr", Value: stderr})
+			rows = append(rows, explainRow{Label: explainLabelStderr, Value: stderr})
 		}
 		return prefix + label, rows
 	}
@@ -1391,21 +1391,21 @@ func timeoutDiagnostic(_ error, attempt *summaryAttempt) (string, []explainRow)
 
 	if stdoutBytes == 0 {
 		rows := []explainRow{
-			{Label: "cause", Value: "provider CLI produced no output (likely network/auth/CLI path issue)"},
-			{Label: "try", Value: tryRunCLI},
+			{Label: explainLabelCause, Value: "provider CLI produced no output (likely network/auth/CLI path issue)"},
+			{Label: explainLabelTry, Value: tryRunCLI},
 		}
 		if stderr != "" {
-			rows = append(rows, explainRow{Label: "stderr", Value: stderr})
+			rows = append(rows, explainRow{Label: explainLabelStderr, Value: stderr})
 		}
 		return prefix + "provider produced no output", rows
 	}
 
 	rows := []explainRow{
-		{Label: "cause", Value: "provider was generating output but did not finish before cap"},
-		{Label: "try", Value: "raise --summary-timeout-seconds"},
+		{Label: explainLabelCause, Value: "provider was generating output but did not finish before cap"},
+		{Label: explainLabelTry, Value: "raise --summary-timeout-seconds"},
 	}
 	if stderr != "" {
-		rows = append(rows, explainRow{Label: "stderr", Value: stderr})
+		rows = append(rows, explainRow{Label: explainLabelStderr, Value: stderr})
 	}
 	return prefix + "provider was generating output when killed", rows
 }
@@ -1728,7 +1728,7 @@ func explainTemporaryCheckpoint(ctx context.Context, w, errW io.Writer, repo *gi
 
 	label := fmt.Sprintf("Checkpoint %s [temporary]", shortID)
 	rows := []explainRow{
-		{Label: "session", Value: tc.SessionID},
+		{Label: explainLabelSession, Value: tc.SessionID},
 		{Label: "created", Value: tc.Timestamp.Format("2006-01-02 15:04:05")},
 	}
 	sb.WriteString(styles.renderIdentity(label, "", rows))
@@ -3083,7 +3083,7 @@ func outputWithPager(w io.Writer, content string) {
 	// Check if we're writing to stdout and it's a terminal
 	if f, ok := w.(*os.File); ok && f == os.Stdout && interactive.IsTerminalWriter(w) {
 		// Get terminal height
-		_, height, err := term.GetSize(int(f.Fd())) //nolint:gosec // G115: same as above
+		_, height, err := term.GetSize(int(f.Fd()))
 		if err != nil {
 			height = 24 // Default fallback
 		}
@@ -3153,9 +3153,9 @@ func formatBranchCheckpoints(w io.Writer, branchName string, points []strategy.P
 		{Label: "branch", Value: branchName},
 	}
 	if sessionFilter != "" {
-		branchRows = append(branchRows, explainRow{Label: "session", Value: sessionFilter})
+		branchRows = append(branchRows, explainRow{Label: explainLabelSession, Value: sessionFilter})
 	}
-	branchRows = append(branchRows, explainRow{Label: "checkpoints", Value: strconv.Itoa(len(groups))})
+	branchRows = append(branchRows, explainRow{Label: explainLabelCheckpoints, Value: strconv.Itoa(len(groups))})
 
 	sb.WriteString(styles.metadataRows(branchRows))
 	sb.WriteString("\n")
diff --git a/cmd/entire/cli/grant.go b/cmd/entire/cli/grant.go
index 4d62946c47..f38efeb4f6 100644
--- a/cmd/entire/cli/grant.go
+++ b/cmd/entire/cli/grant.go
@@ -67,8 +67,8 @@ func newGrantCmd() *cobra.Command {
 // grants, so GRANTEE shows a friendly name (handle/org name) with SOURCE
 // saying where the grant comes from; ID keeps the ULID for revoke.
 var (
-	orgMemberColumns = []string{"ACCOUNT", "ROLE", "STATUS"}
-	grantColumns     = []string{"GRANTEE", "ROLE", "SOURCE", "TYPE", "ID"}
+	orgMemberColumns = []string{"ACCOUNT", colHeaderRole, colHeaderStatus}
+	grantColumns     = []string{"GRANTEE", colHeaderRole, "SOURCE", "TYPE", "ID"}
 )
 
 func orgMemberRow(m coreapi.Membership) []string {
@@ -98,7 +98,7 @@ func granteeName(name coreapi.OptString, granteeID string) string {
 
 func newGrantOrgCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "org",
+		Use:   cmdOrg,
 		Short: "Manage org membership",
 	}
 	cmd.AddCommand(newGrantOrgAddCmd())
@@ -313,6 +313,10 @@ func newGrantProjectRemoveCmd() *cobra.Command {
 	return cmd
 }
 
+// granteeTypeAccount is the only grantee kind the revoke-by-id calls take; the
+// provider-qualified variant has its own endpoint.
+const granteeTypeAccount = "account"
+
 // revokeProjectGrantee revokes a grantee (provider:handle or account ULID) from
 // a resolved project. projectRef is the user's original (pre-resolution) project
 // ref, used only for the success message.
@@ -321,7 +325,7 @@ func revokeProjectGrantee(ctx context.Context, cmd *cobra.Command, c *coreapi.Cl
 		func() error {
 			return c.RevokeProjectAccess(ctx, coreapi.RevokeProjectAccessParams{
 				ProjectId:   projID,
-				GranteeType: "account",
+				GranteeType: granteeTypeAccount,
 				GranteeId:   grantee,
 			})
 		},
@@ -363,7 +367,7 @@ func revokeGrantee(
 
 func newGrantRepoCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "repo",
+		Use:   cmdRepo,
 		Short: "Manage repo access",
 	}
 	cmd.AddCommand(newGrantRepoAddCmd())
@@ -476,7 +480,7 @@ func revokeRepoGrantee(ctx context.Context, cmd *cobra.Command, c *coreapi.Clien
 		func() error {
 			return c.RevokeRepoAccess(ctx, coreapi.RevokeRepoAccessParams{
 				RepoId:      repoID,
-				GranteeType: "account",
+				GranteeType: granteeTypeAccount,
 				GranteeId:   grantee,
 			})
 		},
diff --git a/cmd/entire/cli/hook_registry.go b/cmd/entire/cli/hook_registry.go
index 09972d10eb..a4ffc7636f 100644
--- a/cmd/entire/cli/hook_registry.go
+++ b/cmd/entire/cli/hook_registry.go
@@ -77,6 +77,13 @@ func newAgentHooksCmd(agentName types.AgentName, handler agent.HookSupport) *cob
 	return cmd
 }
 
+// Hook categories reported by getHookType.
+const (
+	hookTypeAgent    = "agent"
+	hookTypeTool     = "tool"
+	hookTypeSubagent = "subagent"
+)
+
 // getHookType returns the hook type based on the hook name.
 // Returns "subagent" for task-related hooks (pre-task, post-task, post-todo,
 // subagent-stop), "tool" for tool-related hooks (before-tool, after-tool),
@@ -85,11 +92,11 @@ func getHookType(hookName string) string {
 	switch hookName {
 	case claudecode.HookNamePreTask, claudecode.HookNamePostTask, claudecode.HookNamePostTodo,
 		claudecode.HookNameSubagentStop:
-		return "subagent"
+		return hookTypeSubagent
 	case geminicli.HookNameBeforeTool, geminicli.HookNameAfterTool:
-		return "tool"
+		return hookTypeTool
 	default:
-		return "agent"
+		return hookTypeAgent
 	}
 }
 
diff --git a/cmd/entire/cli/integration_test/hooks.go b/cmd/entire/cli/integration_test/hooks.go
index 23bee389d9..4dce5d63e3 100644
--- a/cmd/entire/cli/integration_test/hooks.go
+++ b/cmd/entire/cli/integration_test/hooks.go
@@ -807,33 +807,33 @@ func (s *FactoryDroidSession) CreateDroidTranscript(prompt string, changes []Fil
 
 	// User message with prompt
 	lines = append(lines, map[string]interface{}{
-		"type": "message",
+		"type": entryTypeMessage,
 		"id":   "m1",
 		"message": map[string]interface{}{
-			"role": "user",
+			"role": roleUser,
 			"content": []map[string]interface{}{
-				{"type": "text", "text": prompt},
+				{"type": blockTypeText, "text": prompt},
 			},
 		},
 	})
 
 	// Assistant message with tool uses
 	assistantContent := []interface{}{
-		map[string]interface{}{"type": "text", "text": "I'll help you with that."},
+		map[string]interface{}{"type": blockTypeText, "text": "I'll help you with that."},
 	}
 	for i, change := range changes {
 		assistantContent = append(assistantContent, map[string]interface{}{
-			"type":  "tool_use",
+			"type":  blockTypeToolUse,
 			"id":    fmt.Sprintf("toolu_%d", i+1),
 			"name":  "Write",
 			"input": map[string]string{"file_path": change.Path, "content": change.Content},
 		})
 	}
 	lines = append(lines, map[string]interface{}{
-		"type": "message",
+		"type": entryTypeMessage,
 		"id":   "m2",
 		"message": map[string]interface{}{
-			"role":    "assistant",
+			"role":    roleAssistant,
 			"content": assistantContent,
 		},
 	})
@@ -842,28 +842,28 @@ func (s *FactoryDroidSession) CreateDroidTranscript(prompt string, changes []Fil
 	toolResultContent := make([]map[string]interface{}, 0, len(changes))
 	for i := range changes {
 		toolResultContent = append(toolResultContent, map[string]interface{}{
-			"type":        "tool_result",
+			"type":        blockTypeToolResult,
 			"tool_use_id": fmt.Sprintf("toolu_%d", i+1),
 			"content":     "Success",
 		})
 	}
 	lines = append(lines, map[string]interface{}{
-		"type": "message",
+		"type": entryTypeMessage,
 		"id":   "m3",
 		"message": map[string]interface{}{
-			"role":    "user",
+			"role":    roleUser,
 			"content": toolResultContent,
 		},
 	})
 
 	// Final assistant message
 	lines = append(lines, map[string]interface{}{
-		"type": "message",
+		"type": entryTypeMessage,
 		"id":   "m4",
 		"message": map[string]interface{}{
-			"role": "assistant",
+			"role": roleAssistant,
 			"content": []map[string]interface{}{
-				{"type": "text", "text": "Done!"},
+				{"type": blockTypeText, "text": "Done!"},
 			},
 		},
 	})
@@ -1096,11 +1096,11 @@ func (s *OpenCodeSession) CreateOpenCodeTranscript(prompt string, changes []File
 	s.messages = append(s.messages, map[string]interface{}{
 		"info": map[string]interface{}{
 			"id":   fmt.Sprintf("msg-%d", s.msgCounter),
-			"role": "user",
+			"role": roleUser,
 			"time": map[string]interface{}{"created": 1708300000 + s.msgCounter},
 		},
 		"parts": []map[string]interface{}{
-			{"type": "text", "text": prompt},
+			{"type": blockTypeText, "text": prompt},
 		},
 	})
 
@@ -1108,7 +1108,7 @@ func (s *OpenCodeSession) CreateOpenCodeTranscript(prompt string, changes []File
 	s.msgCounter++
 	var parts []map[string]interface{}
 	parts = append(parts, map[string]interface{}{
-		"type": "text",
+		"type": blockTypeText,
 		"text": "I'll help you with that.",
 	})
 	for i, change := range changes {
@@ -1124,14 +1124,14 @@ func (s *OpenCodeSession) CreateOpenCodeTranscript(prompt string, changes []File
 		})
 	}
 	parts = append(parts, map[string]interface{}{
-		"type": "text",
+		"type": blockTypeText,
 		"text": "Done!",
 	})
 
 	s.messages = append(s.messages, map[string]interface{}{
 		"info": map[string]interface{}{
 			"id":   fmt.Sprintf("msg-%d", s.msgCounter),
-			"role": "assistant",
+			"role": roleAssistant,
 			"time": map[string]interface{}{
 				"created":   1708300000 + s.msgCounter,
 				"completed": 1708300000 + s.msgCounter + 5,
diff --git a/cmd/entire/cli/integration_test/testenv.go b/cmd/entire/cli/integration_test/testenv.go
index 7271beae64..9dfc2f5e1a 100644
--- a/cmd/entire/cli/integration_test/testenv.go
+++ b/cmd/entire/cli/integration_test/testenv.go
@@ -36,6 +36,22 @@ import (
 	"github.com/go-git/go-git/v6/plumbing/object"
 )
 
+// Fixture git identity used by every repo this harness initializes.
+const (
+	testAuthorName  = "Test User"
+	testAuthorEmail = "test@example.com"
+)
+
+// Values from the agent transcript JSONL wire formats the harness synthesizes.
+const (
+	entryTypeMessage    = "message"
+	roleUser            = "user"
+	roleAssistant       = "assistant"
+	blockTypeText       = "text"
+	blockTypeToolUse    = "tool_use"
+	blockTypeToolResult = "tool_result"
+)
+
 // testBinaryPath holds the path to the CLI binary built once in TestMain.
 // All tests share this binary to avoid repeated builds.
 var testBinaryPath string
@@ -227,8 +243,8 @@ func (env *TestEnv) InitRepo() {
 	if err != nil {
 		env.T.Fatalf("failed to get repo config: %v", err)
 	}
-	cfg.User.Name = "Test User"
-	cfg.User.Email = "test@example.com"
+	cfg.User.Name = testAuthorName
+	cfg.User.Email = testAuthorEmail
 
 	// Disable GPG signing for test commits (prevents failures if user has commit.gpgsign=true globally)
 	if cfg.Raw == nil {
@@ -484,8 +500,8 @@ func (env *TestEnv) GitCommit(message string) {
 
 	_, err = worktree.Commit(message, &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 	})
@@ -515,8 +531,8 @@ func (env *TestEnv) GitCommitWithCheckpointID(message, checkpointID string) {
 
 	_, err = worktree.Commit(fullMessage, &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 	})
@@ -552,8 +568,8 @@ func (env *TestEnv) GitCommitWithMultipleCheckpoints(message string, checkpointI
 
 	_, err = worktree.Commit(sb.String(), &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 	})
@@ -1034,8 +1050,8 @@ func (env *TestEnv) gitCommitWithShadowHooks(message string, simulateTTY bool, f
 
 	_, err = worktree.Commit(string(modifiedMsg), &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 	})
@@ -1112,8 +1128,8 @@ func (env *TestEnv) GitCommitAmendWithShadowHooks(message string, files ...strin
 
 	_, err = worktree.Commit(string(modifiedMsg), &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 		Amend: true,
@@ -1218,8 +1234,8 @@ func (env *TestEnv) GitCommitWithTrailerRemoved(message string, files ...string)
 
 	_, err = worktree.Commit(cleanedMsg, &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 	})
@@ -1293,8 +1309,8 @@ func (env *TestEnv) gitCommitStagedWithShadowHooks(message string, simulateTTY b
 
 	_, err = worktree.Commit(string(modifiedMsg), &git.CommitOptions{
 		Author: &object.Signature{
-			Name:  "Test User",
-			Email: "test@example.com",
+			Name:  testAuthorName,
+			Email: testAuthorEmail,
 			When:  time.Now(),
 		},
 	})
@@ -1823,8 +1839,8 @@ func (env *TestEnv) CloneFrom(bareDir string) *TestEnv {
 
 	// Configure git user (clone doesn't inherit local config from the bare repo)
 	for _, kv := range [][2]string{
-		{"user.name", "Test User"},
-		{"user.email", "test@example.com"},
+		{"user.name", testAuthorName},
+		{"user.email", testAuthorEmail},
 		{"commit.gpgsign", "false"},
 	} {
 		testutil.RunGit(env.T, cloneDir, "config", kv[0], kv[1])
diff --git a/cmd/entire/cli/integration_test/transcript.go b/cmd/entire/cli/integration_test/transcript.go
index 55038bef53..1120dc89be 100644
--- a/cmd/entire/cli/integration_test/transcript.go
+++ b/cmd/entire/cli/integration_test/transcript.go
@@ -28,7 +28,7 @@ func NewTranscriptBuilder() *TranscriptBuilder {
 func (b *TranscriptBuilder) AddUserMessage(content string) {
 	b.messages = append(b.messages, map[string]interface{}{
 		"uuid":      fmt.Sprintf("user-%d", len(b.messages)+1),
-		"type":      "user",
+		"type":      roleUser,
 		"message":   map[string]interface{}{"content": content},
 		"timestamp": time.Now().UTC().Format(time.RFC3339),
 	})
@@ -38,10 +38,10 @@ func (b *TranscriptBuilder) AddUserMessage(content string) {
 func (b *TranscriptBuilder) AddAssistantMessage(content string) {
 	b.messages = append(b.messages, map[string]interface{}{
 		"uuid": fmt.Sprintf("asst-%d", len(b.messages)+1),
-		"type": "assistant",
+		"type": roleAssistant,
 		"message": map[string]interface{}{
 			"content": []map[string]interface{}{
-				{"type": "text", "text": content},
+				{"type": blockTypeText, "text": content},
 			},
 		},
 		"timestamp": time.Now().UTC().Format(time.RFC3339),
@@ -55,7 +55,7 @@ func (b *TranscriptBuilder) AddToolUse(toolName, filePath, content string) strin
 	toolUseID := fmt.Sprintf("toolu_%d", b.toolUseCounter)
 
 	toolUse := map[string]interface{}{
-		"type": "tool_use",
+		"type": blockTypeToolUse,
 		"id":   toolUseID,
 		"name": toolName,
 		"input": map[string]interface{}{
@@ -66,7 +66,7 @@ func (b *TranscriptBuilder) AddToolUse(toolName, filePath, content string) strin
 
 	b.messages = append(b.messages, map[string]interface{}{
 		"uuid": fmt.Sprintf("asst-%d", len(b.messages)+1),
-		"type": "assistant",
+		"type": roleAssistant,
 		"message": map[string]interface{}{
 			"content": []interface{}{toolUse},
 		},
@@ -80,11 +80,11 @@ func (b *TranscriptBuilder) AddToolUse(toolName, filePath, content string) strin
 func (b *TranscriptBuilder) AddToolResult(toolUseID string) {
 	b.messages = append(b.messages, map[string]interface{}{
 		"uuid": fmt.Sprintf("user-%d", len(b.messages)+1),
-		"type": "user",
+		"type": roleUser,
 		"message": map[string]interface{}{
 			"content": []map[string]interface{}{
 				{
-					"type":        "tool_result",
+					"type":        blockTypeToolResult,
 					"tool_use_id": toolUseID,
 					"content":     "Success",
 				},
@@ -103,7 +103,7 @@ func (b *TranscriptBuilder) AddTaskToolUse(toolUseID, prompt string) string {
 	}
 
 	toolUse := map[string]interface{}{
-		"type": "tool_use",
+		"type": blockTypeToolUse,
 		"id":   toolUseID,
 		"name": "Task",
 		"input": map[string]interface{}{
@@ -114,7 +114,7 @@ func (b *TranscriptBuilder) AddTaskToolUse(toolUseID, prompt string) string {
 
 	b.messages = append(b.messages, map[string]interface{}{
 		"uuid": fmt.Sprintf("asst-%d", len(b.messages)+1),
-		"type": "assistant",
+		"type": roleAssistant,
 		"message": map[string]interface{}{
 			"content": []interface{}{toolUse},
 		},
@@ -131,11 +131,11 @@ func (b *TranscriptBuilder) AddTaskToolResult(toolUseID, agentID string) string
 
 	b.messages = append(b.messages, map[string]interface{}{
 		"uuid": uuid,
-		"type": "user",
+		"type": roleUser,
 		"message": map[string]interface{}{
 			"content": []map[string]interface{}{
 				{
-					"type":        "tool_result",
+					"type":        blockTypeToolResult,
 					"tool_use_id": toolUseID,
 					"content":     "agentId: " + agentID,
 				},
diff --git a/cmd/entire/cli/interactive/interactive.go b/cmd/entire/cli/interactive/interactive.go
index e6274bcc22..4b50064632 100644
--- a/cmd/entire/cli/interactive/interactive.go
+++ b/cmd/entire/cli/interactive/interactive.go
@@ -119,7 +119,7 @@ func IsTerminalReader(r io.Reader) bool {
 	if !ok {
 		return false
 	}
-	return term.IsTerminal(int(f.Fd())) //nolint:gosec // G115: uintptr->int is safe for fd
+	return term.IsTerminal(int(f.Fd()))
 }
 
 // IsTerminalWriter reports whether w is an *os.File backed by a terminal.
@@ -130,7 +130,7 @@ func IsTerminalWriter(w io.Writer) bool {
 	if !ok {
 		return false
 	}
-	return term.IsTerminal(int(f.Fd())) //nolint:gosec // G115: uintptr->int is safe for fd
+	return term.IsTerminal(int(f.Fd()))
 }
 
 // ShouldStyle reports whether ANSI-styled output (color, bold, rendered
diff --git a/cmd/entire/cli/interactive/rawmode_unix.go b/cmd/entire/cli/interactive/rawmode_unix.go
index a3d7d11380..90841aa490 100644
--- a/cmd/entire/cli/interactive/rawmode_unix.go
+++ b/cmd/entire/cli/interactive/rawmode_unix.go
@@ -40,7 +40,7 @@ import (
 // rawModeIoctl is the platform's termios read ioctl (rawmode_darwin.go,
 // rawmode_linux.go); rawmode_other.go covers platforms without termios.
 func ttyInRawMode(f *os.File) bool {
-	termios, err := unix.IoctlGetTermios(int(f.Fd()), rawModeIoctl) //nolint:gosec // G115: uintptr->int is safe for fd
+	termios, err := unix.IoctlGetTermios(int(f.Fd()), rawModeIoctl)
 	if err != nil {
 		// Can't tell — fail open so an unexpected ioctl failure never silently
 		// disables prompting. This check may only ever suppress prompts we
diff --git a/cmd/entire/cli/internal/flock/flock_unix.go b/cmd/entire/cli/internal/flock/flock_unix.go
index 80693b2d69..35250667fe 100644
--- a/cmd/entire/cli/internal/flock/flock_unix.go
+++ b/cmd/entire/cli/internal/flock/flock_unix.go
@@ -78,7 +78,7 @@ func lockFile(ctx context.Context, open func() (*os.File, error), holdsCurrent f
 			if err != nil {
 				return nil, fmt.Errorf("open flock: %w", err)
 			}
-			if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil { //nolint:gosec // file descriptors are non-negative; standard Go pattern for syscall.Flock
+			if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
 				_ = f.Close()
 				return nil, fmt.Errorf("flock: %w", err)
 			}
@@ -101,7 +101,7 @@ func lockFile(ctx context.Context, open func() (*os.File, error), holdsCurrent f
 		if err != nil {
 			return nil, fmt.Errorf("open flock: %w", err)
 		}
-		lockErr := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) //nolint:gosec // see above
+		lockErr := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
 		if lockErr == nil {
 			current, err := holdsCurrent(f)
 			if err != nil {
diff --git a/cmd/entire/cli/labs.go b/cmd/entire/cli/labs.go
index 606d382d36..8540a25b7d 100644
--- a/cmd/entire/cli/labs.go
+++ b/cmd/entire/cli/labs.go
@@ -16,7 +16,7 @@ type experimentalCommandInfo struct {
 
 var experimentalCommands = []experimentalCommandInfo{
 	{
-		CommandPath: []string{"review"},
+		CommandPath: []string{cmdReview},
 		Invocation:  "entire review",
 		Summary:     "Run a multi-agent review against the current branch",
 	},
@@ -31,7 +31,7 @@ var experimentalCommands = []experimentalCommandInfo{
 		Summary:     "Import existing Claude Code transcripts as local, read-only history",
 	},
 	{
-		CommandPath: []string{"tokens"},
+		CommandPath: []string{cmdTokens},
 		Invocation:  "entire tokens",
 		Summary:     "Analyze experimental token usage diagnostics",
 	},
@@ -41,7 +41,7 @@ var experimentalCommands = []experimentalCommandInfo{
 		Summary:     "Aggregate token usage across committed checkpoints",
 	},
 	{
-		CommandPath: []string{"session", "tokens"},
+		CommandPath: []string{cmdSession, cmdTokens},
 		Invocation:  "entire session tokens",
 		Summary:     "Show token usage and recommendations for a session",
 	},
diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index abc76e9627..4ec7bfac78 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -2196,11 +2196,15 @@ func tryAdoptEnv(ctx context.Context, state *session.State, expectedAgent string
 	spec.apply(ctx, state, envAgent)
 }
 
+// sessionKindLabelReview is the human label for a review session, shared by
+// env adoption and the trail resume summary.
+const sessionKindLabelReview = "review"
+
 // adoptReviewEnv tags the session as a review session when ENTIRE_REVIEW_*
 // env vars are present on the current process.
 func adoptReviewEnv(ctx context.Context, state *session.State, expectedAgent string) {
 	tryAdoptEnv(ctx, state, expectedAgent, envAdoptionSpec{
-		kindLabel:      "review",
+		kindLabel:      sessionKindLabelReview,
 		envSession:     review.EnvSession,
 		envAgent:       review.EnvAgent,
 		envStartingSHA: review.EnvStartingSHA,
diff --git a/cmd/entire/cli/mcp.go b/cmd/entire/cli/mcp.go
index 57cc60d549..39f164f4b9 100644
--- a/cmd/entire/cli/mcp.go
+++ b/cmd/entire/cli/mcp.go
@@ -61,6 +61,9 @@ type mcpRequest struct {
 	Params  json.RawMessage `json:"params,omitempty"`
 }
 
+// jsonRPCVersion is the only JSON-RPC version this server speaks.
+const jsonRPCVersion = "2.0"
+
 type mcpResponse struct {
 	JSONRPC string          `json:"jsonrpc"`
 	ID      json.RawMessage `json:"id"`
@@ -91,7 +94,7 @@ func runMCPServer(ctx context.Context, rootCmd *cobra.Command, in io.Reader, out
 
 		var req mcpRequest
 		if err := json.Unmarshal(line, &req); err != nil {
-			if encErr := enc.Encode(mcpResponse{JSONRPC: "2.0", ID: json.RawMessage("null"), Error: &mcpError{Code: -32700, Message: "parse error"}}); encErr != nil {
+			if encErr := enc.Encode(mcpResponse{JSONRPC: jsonRPCVersion, ID: json.RawMessage("null"), Error: &mcpError{Code: -32700, Message: "parse error"}}); encErr != nil {
 				return fmt.Errorf("write mcp parse-error response: %w", encErr)
 			}
 			continue
@@ -100,12 +103,12 @@ func runMCPServer(ctx context.Context, rootCmd *cobra.Command, in io.Reader, out
 		// Reject a parseable-but-invalid request (missing/incorrect jsonrpc version
 		// or empty method) with -32600 before dispatch, per JSON-RPC, rather than
 		// treating it as method-not-found.
-		if req.JSONRPC != "2.0" || req.Method == "" {
+		if req.JSONRPC != jsonRPCVersion || req.Method == "" {
 			id := req.ID
 			if len(id) == 0 {
 				id = json.RawMessage("null")
 			}
-			if encErr := enc.Encode(mcpResponse{JSONRPC: "2.0", ID: id, Error: &mcpError{Code: -32600, Message: "invalid request"}}); encErr != nil {
+			if encErr := enc.Encode(mcpResponse{JSONRPC: jsonRPCVersion, ID: id, Error: &mcpError{Code: -32600, Message: "invalid request"}}); encErr != nil {
 				return fmt.Errorf("write mcp invalid-request response: %w", encErr)
 			}
 			continue
@@ -124,7 +127,7 @@ func runMCPServer(ctx context.Context, rootCmd *cobra.Command, in io.Reader, out
 			continue
 		}
 
-		resp := mcpResponse{JSONRPC: "2.0", ID: req.ID}
+		resp := mcpResponse{JSONRPC: jsonRPCVersion, ID: req.ID}
 		if rpcErr != nil {
 			resp.Error = rpcErr
 		} else {
@@ -138,7 +141,7 @@ func runMCPServer(ctx context.Context, rootCmd *cobra.Command, in io.Reader, out
 		// A single line exceeded maxMCPMessageBytes (the scanner can't resynchronize
 		// past an over-long token) or the read failed; report once and stop.
 		if errors.Is(err, bufio.ErrTooLong) {
-			if encErr := enc.Encode(mcpResponse{JSONRPC: "2.0", ID: json.RawMessage("null"), Error: &mcpError{Code: -32600, Message: "request too large"}}); encErr != nil {
+			if encErr := enc.Encode(mcpResponse{JSONRPC: jsonRPCVersion, ID: json.RawMessage("null"), Error: &mcpError{Code: -32600, Message: "request too large"}}); encErr != nil {
 				return fmt.Errorf("write mcp oversize response: %w", encErr)
 			}
 			return nil
diff --git a/cmd/entire/cli/mdrender/mdrender.go b/cmd/entire/cli/mdrender/mdrender.go
index 079d724ec6..bf63ed876c 100644
--- a/cmd/entire/cli/mdrender/mdrender.go
+++ b/cmd/entire/cli/mdrender/mdrender.go
@@ -93,7 +93,7 @@ func shouldRender(w io.Writer) bool {
 // Falls back to stdout/stderr probing, then DefaultTerminalWidth.
 func terminalWidth(w io.Writer) int {
 	if f, ok := w.(*os.File); ok {
-		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 { //nolint:gosec // G115: uintptr->int is safe for fd
+		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 {
 			return min(width, DefaultTerminalWidth)
 		}
 	}
@@ -101,7 +101,7 @@ func terminalWidth(w io.Writer) int {
 		if f == nil {
 			continue
 		}
-		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 { //nolint:gosec // G115: uintptr->int is safe for fd
+		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 {
 			return min(width, DefaultTerminalWidth)
 		}
 	}
diff --git a/cmd/entire/cli/names.go b/cmd/entire/cli/names.go
new file mode 100644
index 0000000000..fdc7fdb994
--- /dev/null
+++ b/cmd/entire/cli/names.go
@@ -0,0 +1,42 @@
+package cli
+
+// Command and verb names that more than one file spells. Cobra takes these as
+// plain strings, so without a name here a rename means finding every `Use:`,
+// alias and hard-coded command path by hand.
+const (
+	cmdAgent      = "agent"
+	cmdCheckpoint = "checkpoint"
+	cmdCreateName = "create <name>"
+	cmdList       = "list"
+	cmdOrg        = "org"
+	cmdRepo       = "repo"
+	cmdReview     = "review"
+	cmdSession    = "session"
+	cmdStatus     = "status"
+	cmdTokens     = "tokens"
+	cmdTrail      = "trail"
+
+	// Plural aliases, kept beside the names they alias.
+	cmdCheckpointsAlias = "checkpoints"
+	cmdSessionsAlias    = "sessions"
+)
+
+// Column headers shared by the control-plane tables: org, project, repo, grant
+// and the mirror subtree each print several of the same columns.
+const (
+	colHeaderCloneURL = "CLONE URL"
+	colHeaderCluster  = "CLUSTER"
+	colHeaderName     = "NAME"
+	colHeaderRegion   = "REGION"
+	colHeaderRole     = "ROLE"
+	colHeaderStatus   = "STATUS"
+)
+
+// Display nouns selected by a count. Spelled here rather than inline because
+// several commands phrase the same "N thing(s)" line.
+const (
+	nounCheckpoint  = "checkpoint"
+	nounCheckpoints = "checkpoints"
+	nounSession     = "session"
+	nounSessions    = "sessions"
+)
diff --git a/cmd/entire/cli/org.go b/cmd/entire/cli/org.go
index 5fab505889..3357af2c41 100644
--- a/cmd/entire/cli/org.go
+++ b/cmd/entire/cli/org.go
@@ -13,7 +13,7 @@ import (
 // delete organizations on the Entire control plane.
 func newOrgCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "org",
+		Use:   cmdOrg,
 		Short: "Manage Entire organizations",
 	}
 	addControlPlaneFlags(cmd)
@@ -26,7 +26,7 @@ func newOrgCmd() *cobra.Command {
 
 // orgColumns is the human table/field view of an org, shared by list and
 // any future `org get`.
-var orgColumns = []string{"ID", "NAME", "REGION", "CREATED"}
+var orgColumns = []string{"ID", colHeaderName, colHeaderRegion, "CREATED"}
 
 func orgRow(o coreapi.Org) []string {
 	return []string{o.ID, o.Name, o.Region, o.CreatedAt.Format("2006-01-02")}
@@ -35,7 +35,7 @@ func orgRow(o coreapi.Org) []string {
 func newOrgCreateCmd() *cobra.Command {
 	var region string
 	cmd := &cobra.Command{
-		Use:   "create <name>",
+		Use:   cmdCreateName,
 		Short: "Create an organization",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -59,7 +59,7 @@ func newOrgCreateCmd() *cobra.Command {
 
 func newOrgListCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List organizations you can see",
 		Args:  cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
diff --git a/cmd/entire/cli/plugin_group.go b/cmd/entire/cli/plugin_group.go
index 9fdb29daa5..aa44f2c3fc 100644
--- a/cmd/entire/cli/plugin_group.go
+++ b/cmd/entire/cli/plugin_group.go
@@ -449,7 +449,7 @@ func warnIfShadowsBuiltin(cmd *cobra.Command, name string) {
 
 func newPluginListCmd() *cobra.Command {
 	return &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List plugins installed in the managed directory",
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return runPluginList(cmd.OutOrStdout())
diff --git a/cmd/entire/cli/project.go b/cmd/entire/cli/project.go
index 5743ce5b9d..b3bb5d95ce 100644
--- a/cmd/entire/cli/project.go
+++ b/cmd/entire/cli/project.go
@@ -25,7 +25,7 @@ func newProjectCmd() *cobra.Command {
 }
 
 // projectColumns is the human table/field view of a project.
-var projectColumns = []string{"ID", "NAME", "OWNER-TYPE", "OWNER", "REGION"}
+var projectColumns = []string{"ID", colHeaderName, "OWNER-TYPE", "OWNER", colHeaderRegion}
 
 func projectRow(p coreapi.Project) []string {
 	return []string{p.ID, p.Name, string(p.OwnerType), p.OwnerId, p.Region}
@@ -38,7 +38,7 @@ func newProjectCreateCmd() *cobra.Command {
 		region    string
 	)
 	cmd := &cobra.Command{
-		Use:   "create <name>",
+		Use:   cmdCreateName,
 		Short: "Create a project under an org or account",
 		Long: "Creates a project owned by an org or an account. --owner is the " +
 			"owning org (name or ULID) or account (github:handle or ULID), and " +
@@ -94,7 +94,7 @@ func newProjectCreateCmd() *cobra.Command {
 func newProjectListCmd() *cobra.Command {
 	var name, org string
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List projects you can see",
 		Args:  cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
@@ -198,14 +198,20 @@ func newProjectDeleteCmd() *cobra.Command {
 	return cmd
 }
 
+// The two owner kinds a project may have, as the --owner-type flag spells them.
+const (
+	ownerTypeOrg     = "org"
+	ownerTypeAccount = "account"
+)
+
 // parseProjectOwnerType maps the --owner-type flag to the generated enum,
 // rejecting anything but org/account at the CLI boundary so the user gets
 // a clear message instead of a server 422.
 func parseProjectOwnerType(s string) (coreapi.CreateProjectInputBodyOwnerType, error) {
 	switch s {
-	case "org":
+	case ownerTypeOrg:
 		return coreapi.CreateProjectInputBodyOwnerTypeOrg, nil
-	case "account":
+	case ownerTypeAccount:
 		return coreapi.CreateProjectInputBodyOwnerTypeAccount, nil
 	default:
 		// Plain error: the create RunE sets SilenceUsage, and main.go
diff --git a/cmd/entire/cli/recap.go b/cmd/entire/cli/recap.go
index 7b3d644c1f..9423f19bb0 100644
--- a/cmd/entire/cli/recap.go
+++ b/cmd/entire/cli/recap.go
@@ -258,7 +258,7 @@ func terminalWidth(w io.Writer) int {
 	if !isatty.IsTerminal(file.Fd()) {
 		return recap.DefaultWidth
 	}
-	width, _, err := term.GetSize(int(file.Fd())) //nolint:gosec // fd values fit in int on supported platforms
+	width, _, err := term.GetSize(int(file.Fd()))
 	if err != nil || width <= 0 {
 		return recap.DefaultWidth
 	}
diff --git a/cmd/entire/cli/recap_tui.go b/cmd/entire/cli/recap_tui.go
index 977b52434f..e8ad57bf9f 100644
--- a/cmd/entire/cli/recap_tui.go
+++ b/cmd/entire/cli/recap_tui.go
@@ -261,6 +261,14 @@ func (m recapTUIModel) withViewport() recapTUIModel {
 	return m
 }
 
+// Footer key-hint labels, repeated across the progressively shorter footer
+// variants renderFooter picks between.
+const (
+	recapHintView  = "view"
+	recapHintAgent = "agent"
+	recapHintQuit  = "quit"
+)
+
 func (m recapTUIModel) renderFooter() string {
 	choices := []string{
 		recapFooterLine(m.color, []recapHelpItem{
@@ -268,24 +276,24 @@ func (m recapTUIModel) renderFooter() string {
 			{"w", "week"},
 			{"m", "month"},
 			{"r", "90d"},
-			{"v", "view"},
-			{"a", "agent"},
+			{"v", recapHintView},
+			{"a", recapHintAgent},
 			{"R", "reload"},
-			{"q", "quit"},
+			{"q", recapHintQuit},
 		}),
 		recapFooterLine(m.color, []recapHelpItem{
 			{"d/w/m/r", "range"},
-			{"v", "view"},
-			{"a", "agent"},
-			{"q", "quit"},
+			{"v", recapHintView},
+			{"a", recapHintAgent},
+			{"q", recapHintQuit},
 		}),
 		recapFooterLine(m.color, []recapHelpItem{
 			{"d/w/m/r", "range"},
-			{"v", "view"},
-			{"q", "quit"},
+			{"v", recapHintView},
+			{"q", recapHintQuit},
 		}),
 		recapFooterLine(m.color, []recapHelpItem{
-			{"q", "quit"},
+			{"q", recapHintQuit},
 		}),
 	}
 	for _, choice := range choices {
diff --git a/cmd/entire/cli/repo.go b/cmd/entire/cli/repo.go
index 2ba5a46fb4..16ee259391 100644
--- a/cmd/entire/cli/repo.go
+++ b/cmd/entire/cli/repo.go
@@ -20,7 +20,7 @@ import (
 // operations (log, diff, …) remain intentionally out of scope here.
 func newRepoCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "repo",
+		Use:   cmdRepo,
 		Short: "Manage Entire repositories",
 	}
 	addControlPlaneFlags(cmd)
@@ -36,7 +36,7 @@ func newRepoCmd() *cobra.Command {
 
 // repoColumns is the human table/field view of a repo, shared by list and
 // get. CLUSTER/STATE come from optional fields, shown as "-" when unset.
-var repoColumns = []string{"ID", "NAME", "PROJECT", "CLUSTER", "STATE"}
+var repoColumns = []string{"ID", colHeaderName, "PROJECT", colHeaderCluster, "STATE"}
 
 func repoRow(r coreapi.Repo) []string {
 	return []string{r.ID, r.Name, r.OwningProjectId, r.ClusterHost.Or("-"), r.State.Or("-")}
@@ -128,7 +128,7 @@ func newRepoCreateCmd() *cobra.Command {
 		objectFormat string
 	)
 	cmd := &cobra.Command{
-		Use:   "create <name>",
+		Use:   cmdCreateName,
 		Short: "Create a repository in a project",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
diff --git a/cmd/entire/cli/repo_mirror.go b/cmd/entire/cli/repo_mirror.go
index 3d87acc185..373c88ea68 100644
--- a/cmd/entire/cli/repo_mirror.go
+++ b/cmd/entire/cli/repo_mirror.go
@@ -35,11 +35,11 @@ type column struct {
 // so a --sort value needs no quoting; headers stay upper-case display text.
 var (
 	colName       = column{key: "name", header: "NAME (owner/repo)"}
-	colCloneURL   = column{key: "clone-url", header: "CLONE URL"}
+	colCloneURL   = column{key: "clone-url", header: colHeaderCloneURL}
 	colClusters   = column{key: "clusters", header: "CLUSTERS"}
 	colVisibility = column{key: "visibility", header: "VISIBILITY"}
 	colAccess     = column{key: "access", header: "ACCESS"}
-	colStatus     = column{key: "status", header: "STATUS"}
+	colStatus     = column{key: "status", header: colHeaderStatus}
 )
 
 // columnHeaders is the display-header view of a column set, for the table/field
@@ -923,7 +923,7 @@ func newRepoMirrorListCmd() *cobra.Command {
 	var pageToken string
 	var noPager, all bool
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List repos you can see: existing mirrors and GitHub repos you could onboard",
 		Long: "List repos visible from your login in one table: existing mirrors " +
 			"(one row per repo, with the clusters it is mirrored on and the clone " +
@@ -1140,7 +1140,7 @@ func renderRepoDetail(w io.Writer, row repoDirRow) {
 		return
 	}
 
-	headers := styledHeaders(st, []string{"CLUSTER", "CLONE URL", "STATUS"})
+	headers := styledHeaders(st, []string{colHeaderCluster, colHeaderCloneURL, colHeaderStatus})
 	rows := make([][]string, len(row.Placements))
 	for i, p := range row.Placements {
 		cluster, status := p.Cluster, p.Status
diff --git a/cmd/entire/cli/repo_mirror_collaborators.go b/cmd/entire/cli/repo_mirror_collaborators.go
index 5f9b47a519..7eb7d409cf 100644
--- a/cmd/entire/cli/repo_mirror_collaborators.go
+++ b/cmd/entire/cli/repo_mirror_collaborators.go
@@ -13,7 +13,7 @@ import (
 // collaborator: the display handle, the reader/writer role, and the Entire
 // account ULID (the stable identifier, shown last as the fallback when no
 // handle resolves).
-var mirrorCollaboratorColumns = []string{"HANDLE", "ROLE", "ACCOUNT"}
+var mirrorCollaboratorColumns = []string{"HANDLE", colHeaderRole, "ACCOUNT"}
 
 func mirrorCollaboratorRow(c coreapi.MirrorCollaborator) []string {
 	handle := c.Handle.Or("")
diff --git a/cmd/entire/cli/repo_mirror_create_wizard.go b/cmd/entire/cli/repo_mirror_create_wizard.go
index 1a9061bb5f..6532e2e9e3 100644
--- a/cmd/entire/cli/repo_mirror_create_wizard.go
+++ b/cmd/entire/cli/repo_mirror_create_wizard.go
@@ -292,7 +292,7 @@ type mirrorResult struct {
 	err         error
 }
 
-var mirrorCreateResultColumns = []string{"REPO", "REGION", "STATUS", "CLONE URL"}
+var mirrorCreateResultColumns = []string{"REPO", colHeaderRegion, colHeaderStatus, colHeaderCloneURL}
 
 func mirrorCreateResultRow(r mirrorResult) []string {
 	url := r.cloneURL
diff --git a/cmd/entire/cli/review/configure_test.go b/cmd/entire/cli/review/configure_test.go
index 990ee5d714..630bd1b99d 100644
--- a/cmd/entire/cli/review/configure_test.go
+++ b/cmd/entire/cli/review/configure_test.go
@@ -325,7 +325,7 @@ func TestBuildConfiguredProfile_PreservesExistingTask(t *testing.T) {
 func TestSelectReviewProfile_LegacyReviewFallback(t *testing.T) {
 	t.Parallel()
 	s := &settings.EntireSettings{
-		Review: map[string]settings.ReviewConfig{
+		Review: map[string]settings.ReviewConfig{ //nolint:staticcheck // exercises the legacy pre-profile fallback on purpose
 			tAgentClaude: {Skills: []string{"/review"}, Model: tModelSonnet},
 		},
 	}
@@ -353,7 +353,7 @@ func TestSelectReviewProfile_ConfiguredProfilesOverrideLegacyReview(t *testing.T
 	t.Parallel()
 	const securityProfile = "security"
 	s := &settings.EntireSettings{
-		Review: map[string]settings.ReviewConfig{
+		Review: map[string]settings.ReviewConfig{ //nolint:staticcheck // exercises the legacy pre-profile fallback on purpose
 			tAgentClaude: {Skills: []string{"/legacy"}},
 		},
 		ReviewProfiles: map[string]settings.ReviewProfileConfig{
diff --git a/cmd/entire/cli/review/picker.go b/cmd/entire/cli/review/picker.go
index 1c4ee6dbfc..026ecca90b 100644
--- a/cmd/entire/cli/review/picker.go
+++ b/cmd/entire/cli/review/picker.go
@@ -204,8 +204,8 @@ func promptForReviewFocus(ctx context.Context, current string) (string, string,
 	picked := DefaultProfileName
 	presets := []struct{ label, value string }{
 		{"General - correctness, regressions, tests", DefaultProfileName},
-		{"Security - auth, injection, secrets", "security"},
-		{"Accessibility - keyboard, screen readers, contrast", "accessibility"},
+		{"Security - auth, injection, secrets", SecurityProfileName},
+		{"Accessibility - keyboard, screen readers, contrast", AccessibilityProfileName},
 	}
 	options := make([]huh.Option[string], 0, len(presets)+1)
 	for _, p := range presets {
diff --git a/cmd/entire/cli/review/profile.go b/cmd/entire/cli/review/profile.go
index 7728bf415c..aab75945d8 100644
--- a/cmd/entire/cli/review/profile.go
+++ b/cmd/entire/cli/review/profile.go
@@ -16,7 +16,14 @@ import (
 	"github.com/entireio/cli/cmd/entire/cli/tuiutil"
 )
 
-const DefaultProfileName = "general"
+// Built-in profile names. DefaultProfileName is the profile used when none is
+// named; the other two are the presets the picker offers and profileTask knows
+// a built-in task for.
+const (
+	DefaultProfileName       = "general"
+	SecurityProfileName      = "security"
+	AccessibilityProfileName = "accessibility"
+)
 
 // Review output destinations. ReviewOutputLocal prints the verdict and writes
 // the local review manifest; ReviewOutputTrail additionally posts the verdict
@@ -63,9 +70,9 @@ func profileTask(name string, cfg settings.ReviewProfileConfig) string {
 	switch strings.ToLower(name) {
 	case "", DefaultProfileName:
 		return defaultGeneralTask
-	case "security":
+	case SecurityProfileName:
 		return defaultSecurityTask
-	case "accessibility", "a11y":
+	case AccessibilityProfileName, "a11y":
 		return defaultAccessibilityTask
 	default:
 		return defaultGeneralTask
@@ -398,7 +405,7 @@ func defaultReviewAgentConfig(profileName, agentName string) settings.ReviewConf
 	focus := defaultProfileFocus(profileName)
 	switch agentName {
 	case string(agent.AgentNameClaudeCode):
-		if strings.EqualFold(profileName, "security") {
+		if strings.EqualFold(profileName, SecurityProfileName) {
 			return settings.ReviewConfig{Skills: []string{"/security-review"}}
 		}
 		return settings.ReviewConfig{Skills: []string{"/review"}, Prompt: focus}
@@ -415,9 +422,9 @@ func defaultReviewAgentConfig(profileName, agentName string) settings.ReviewConf
 
 func defaultProfileFocus(profileName string) string {
 	switch strings.ToLower(strings.TrimSpace(profileName)) {
-	case "security":
+	case SecurityProfileName:
 		return "Focus specifically on security issues."
-	case "accessibility", "a11y":
+	case AccessibilityProfileName, "a11y":
 		return "Focus specifically on accessibility issues."
 	default:
 		return ""
diff --git a/cmd/entire/cli/review/tui_sink.go b/cmd/entire/cli/review/tui_sink.go
index 16d19ce0c6..b6b62022cc 100644
--- a/cmd/entire/cli/review/tui_sink.go
+++ b/cmd/entire/cli/review/tui_sink.go
@@ -120,7 +120,7 @@ func terminalMeasurer(output io.Writer) func() (int, int, bool) {
 		return nil
 	}
 	return func() (int, int, bool) {
-		width, height, err := term.GetSize(int(f.Fd())) //nolint:gosec // fd values fit in int on supported platforms
+		width, height, err := term.GetSize(int(f.Fd()))
 		if err != nil || width <= 0 || height <= 0 {
 			return 0, 0, false
 		}
diff --git a/cmd/entire/cli/runner_gather.go b/cmd/entire/cli/runner_gather.go
index a822b009bb..bd1844f4e6 100644
--- a/cmd/entire/cli/runner_gather.go
+++ b/cmd/entire/cli/runner_gather.go
@@ -28,6 +28,7 @@ const (
 )
 
 const (
+	sourceRepo        = "repo"
 	sourceCheckpoint  = "checkpoint"
 	sourceCheckpoints = "checkpoints"
 	sourceTrail       = "trail"
@@ -57,7 +58,7 @@ func parseTuneSources(list []string) (tuneSources, error) {
 			continue
 		case "all":
 			return allTuneSources(), nil
-		case "repo":
+		case sourceRepo:
 			s.repo = true
 		case "pr", "prs", "issue", "issues":
 			s.prs = true
diff --git a/cmd/entire/cli/session_adopt_test.go b/cmd/entire/cli/session_adopt_test.go
index 281dc22dd4..7fd0a6b2ed 100644
--- a/cmd/entire/cli/session_adopt_test.go
+++ b/cmd/entire/cli/session_adopt_test.go
@@ -961,8 +961,8 @@ func TestSessionAdopt_ResetsSourceCheckpointWindow(t *testing.T) {
 		ContextWindowSize:           200_000,
 		CheckpointTranscriptStart:   2,
 		CheckpointTranscriptSize:    1234,
-		CondensedTranscriptLines:    2,
-		TranscriptLinesAtStart:      2,
+		CondensedTranscriptLines:    2, //nolint:staticcheck // legacy field, asserted so migration keeps working
+		TranscriptLinesAtStart:      2, //nolint:staticcheck // legacy field, asserted so migration keeps working
 		TranscriptIdentifierAtStart: "source-assistant",
 		TurnID:                      "source-turn",
 		TurnCheckpointIDs:           []string{"abc123def456"},
@@ -1086,8 +1086,8 @@ func TestSessionAdopt_ClearsLegacyTranscriptOffsets(t *testing.T) {
 		BaseCommit:                "source-head",
 		WorktreePath:              "/source/repo",
 		CheckpointTranscriptStart: 9,
-		CondensedTranscriptLines:  9,
-		TranscriptLinesAtStart:    9,
+		CondensedTranscriptLines:  9, //nolint:staticcheck // legacy field, asserted so migration keeps working
+		TranscriptLinesAtStart:    9, //nolint:staticcheck // legacy field, asserted so migration keeps working
 	})
 	if err != nil {
 		t.Fatalf("buildAdoptedSessionState failed: %v", err)
diff --git a/cmd/entire/cli/session_tokens.go b/cmd/entire/cli/session_tokens.go
index 97a68316c4..688a1d104f 100644
--- a/cmd/entire/cli/session_tokens.go
+++ b/cmd/entire/cli/session_tokens.go
@@ -13,6 +13,26 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// The token-report vocabulary, shared by `session tokens`, `checkpoint tokens`
+// and `tokens profile`: these strings are part of those commands' --json
+// contract, so they are named once rather than spelled per call site.
+const (
+	tokensKindSubagents       = "subagents"
+	tokensKindContextPressure = "context_pressure"
+
+	tokensConfidenceReported = "reported"
+
+	tokensSignalSubagentTokens  = "subagent_tokens"
+	tokensSignalMissingUsage    = "missing_token_usage"
+	tokensSignalContextTokens   = "context_tokens"
+	tokensSignalCacheReadTokens = "cache_read_tokens"
+	tokensSignalAPICallCount    = "api_call_count"
+
+	tokensSeverityLow    = "low"
+	tokensSeverityMedium = "medium"
+	tokensSeverityHigh   = "high"
+)
+
 type sessionTokensReport struct {
 	SessionID       string                        `json:"session_id"`
 	Agent           string                        `json:"agent"`
@@ -209,31 +229,31 @@ func buildSessionTokensReport(state *strategy.SessionState, status string) sessi
 		report.Tokens = tokens
 		if tokens.SubagentTotal > 0 {
 			report.Contributors = append(report.Contributors, sessionTokensContributor{
-				Kind:       "subagents",
+				Kind:       tokensKindSubagents,
 				Label:      "Subagents",
 				Tokens:     tokens.SubagentTotal,
-				Confidence: "reported",
-				Signals:    []string{"subagent_tokens"},
+				Confidence: tokensConfidenceReported,
+				Signals:    []string{tokensSignalSubagentTokens},
 			})
 		}
 	} else {
 		report.Limitations = append(report.Limitations, "No token usage recorded for this session.")
 		report.Recommendations = append(report.Recommendations, sessionTokensRecommendation{
 			ID:       "no-token-data",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "Token usage is unavailable for this session; the agent may not expose token data yet, or no checkpoint has captured it.",
-			Signals:  []string{"missing_token_usage"},
+			Signals:  []string{tokensSignalMissingUsage},
 		})
 	}
 
 	if contextInfo := buildSessionTokensContext(state.ContextTokens, state.ContextWindowSize); contextInfo != nil {
 		report.Context = contextInfo
 		report.Contributors = append(report.Contributors, sessionTokensContributor{
-			Kind:       "context_pressure",
+			Kind:       tokensKindContextPressure,
 			Label:      "Context pressure",
 			Percent:    contextInfo.Percent,
-			Confidence: "reported",
-			Signals:    []string{"context_tokens"},
+			Confidence: tokensConfidenceReported,
+			Signals:    []string{tokensSignalContextTokens},
 		})
 	}
 
@@ -241,7 +261,7 @@ func buildSessionTokensReport(state *strategy.SessionState, status string) sessi
 		report.Contributors = append(report.Contributors, sessionTokensContributor{
 			Kind:       "skills",
 			Label:      "Skills/slash commands: " + strings.Join(labels, ", "),
-			Confidence: "reported",
+			Confidence: tokensConfidenceReported,
 			Signals:    []string{"skill_events"},
 		})
 	}
@@ -328,12 +348,12 @@ func recommendationRules(signals tokenRecommendationSignals) []sessionTokensReco
 			cacheReadHotspot = true
 			recs = append(recs, sessionTokensRecommendation{
 				ID:       "context-replay-hotspot",
-				Severity: "high",
+				Severity: tokensSeverityHigh,
 				Message: fmt.Sprintf(
 					"Cache/context replay is %s of token volume; reduce unnecessary follow-up calls in this large-context session.",
 					formatPercent(cacheReadPercent),
 				),
-				Signals: []string{"cache_read_tokens"},
+				Signals: []string{tokensSignalCacheReadTokens},
 			})
 		}
 	}
@@ -344,24 +364,24 @@ func recommendationRules(signals tokenRecommendationSignals) []sessionTokensReco
 		}
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "api-call-amplification",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  message,
-			Signals:  []string{"api_call_count"},
+			Signals:  []string{tokensSignalAPICallCount},
 		})
 	}
 	if signals.Tokens != nil && tokenShareAtLeastOneTenth(signals.Tokens.SubagentTotal, signals.Tokens.Total) {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "subagent-heavy",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  "Scope subagent tasks tightly; give each subagent a narrow objective and expected output.",
-			Signals:  []string{"subagent_tokens"},
+			Signals:  []string{tokensSignalSubagentTokens},
 		})
 	}
 	if signals.Tokens != nil && signals.Tokens.Total > 0 &&
 		tokenClassPressure(signals.Tokens.CacheWrite, signals.Tokens.Total, 5000, 10, 50_000) {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "cache-write-pressure",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  "Cache write is elevated; avoid broad new context and narrow the next read before continuing.",
 			Signals:  []string{"cache_write_tokens"},
 		})
@@ -370,7 +390,7 @@ func recommendationRules(signals tokenRecommendationSignals) []sessionTokensReco
 		tokenClassPressure(signals.Tokens.Output, signals.Tokens.Total, 3000, 2, 10_000) {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "output-pressure",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  "Output tokens are elevated; keep the next answer tight and avoid restating evidence.",
 			Signals:  []string{"output_tokens"},
 		})
@@ -378,23 +398,23 @@ func recommendationRules(signals tokenRecommendationSignals) []sessionTokensReco
 	if signals.Context != nil && signals.Context.Percent >= recommendationHighContextPercent {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "high-context-pressure",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  fmt.Sprintf("Context pressure is %d%% of the window; preserve only relevant context before continuing.", signals.Context.Percent),
-			Signals:  []string{"context_tokens"},
+			Signals:  []string{tokensSignalContextTokens},
 		})
 	}
 	if cacheReadHotspot && signals.Tokens != nil && signals.Tokens.APICalls >= recommendationHighAPICalls {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "summarize-before-boundary",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "Compact or restart after summarizing this investigation; do not discard useful findings just because cache read is high.",
-			Signals:  []string{"cache_read_tokens", "api_call_count"},
+			Signals:  []string{tokensSignalCacheReadTokens, tokensSignalAPICallCount},
 		})
 	}
 	if signals.TurnCount >= recommendationLongSessionTurns || signals.CheckpointCount >= recommendationLongSessionCheckpoints {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "long-session",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "Compact or restart after summarizing the useful findings if older context is no longer needed.",
 			Signals:  []string{"turn_count", "checkpoint_count"},
 		})
@@ -637,9 +657,9 @@ func writeTokenContributors(w io.Writer, contributors []sessionTokensContributor
 		fmt.Fprintln(w, "Likely contributors")
 		for _, contributor := range contributors {
 			switch contributor.Kind {
-			case "subagents":
+			case tokensKindSubagents:
 				fmt.Fprintf(w, "- %s: %s tokens\n", contributor.Label, formatTokenCount(contributor.Tokens))
-			case "context_pressure":
+			case tokensKindContextPressure:
 				if contextInfo != nil {
 					fmt.Fprintf(w, "- %s: %d%% of %s tokens\n", contributor.Label, contextInfo.Percent, formatTokenCount(contextInfo.WindowSize))
 				}
diff --git a/cmd/entire/cli/sessions.go b/cmd/entire/cli/sessions.go
index f773476f70..84305de73d 100644
--- a/cmd/entire/cli/sessions.go
+++ b/cmd/entire/cli/sessions.go
@@ -156,8 +156,8 @@ func writeWholeDocumentJSONTranscript(ctx context.Context, w io.Writer, r io.Rea
 
 func newSessionsCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "session",
-		Aliases: []string{"sessions"},
+		Use:     cmdSession,
+		Aliases: []string{cmdSessionsAlias},
 		Short:   "Manage agent sessions tracked by Entire",
 		Long: `View and manage agent sessions tracked by Entire.
 
@@ -325,7 +325,7 @@ func newListCmd() *cobra.Command {
 	var jsonFlag bool
 
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List all sessions",
 		Long: `List all sessions tracked by Entire, including ended sessions.
 
diff --git a/cmd/entire/cli/settings/settings_test.go b/cmd/entire/cli/settings/settings_test.go
index 499e2573f2..f2a8792247 100644
--- a/cmd/entire/cli/settings/settings_test.go
+++ b/cmd/entire/cli/settings/settings_test.go
@@ -167,7 +167,7 @@ func TestLoad_AcceptsValidKeys(t *testing.T) {
 	if settings.SummaryGeneration.Provider != "claude-code" {
 		t.Errorf("expected summary_generation.provider 'claude-code', got %q", settings.SummaryGeneration.Provider)
 	}
-	if settings.SummaryGeneration.Model != "sonnet" { //nolint:goconst // test literal
+	if settings.SummaryGeneration.Model != "sonnet" {
 		t.Errorf("expected summary_generation.model 'sonnet', got %q", settings.SummaryGeneration.Model)
 	}
 	if settings.Redaction == nil {
diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index 5150d2bee0..fec24cf19e 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -38,7 +38,7 @@ func newStatusCmd() *cobra.Command {
 	var jsonFlag bool
 
 	cmd := &cobra.Command{
-		Use:   "status",
+		Use:   cmdStatus,
 		Short: "Show Entire status",
 		Long:  "Show whether Entire is currently enabled or disabled",
 		RunE: func(cmd *cobra.Command, _ []string) error {
@@ -467,10 +467,10 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 // mode has no git remote to name (and only reaches here on the git-refs
 // backend), so it drops the remote-name phrasing.
 func formatUnpushedCheckpointsLine(info checkpointSyncInfo) string {
-	noun := "checkpoints"
+	noun := nounCheckpoints
 	pronoun := "they sync"
 	if info.Unpushed == 1 {
-		noun = "checkpoint"
+		noun = nounCheckpoint
 		pronoun = "it syncs"
 	}
 	if info.Source == checkpointSyncSourceDedicated {
diff --git a/cmd/entire/cli/status_style.go b/cmd/entire/cli/status_style.go
index 732f87d989..795a637f68 100644
--- a/cmd/entire/cli/status_style.go
+++ b/cmd/entire/cli/status_style.go
@@ -76,7 +76,7 @@ func shouldUseColor(w io.Writer) bool {
 func getTerminalWidth(w io.Writer) int {
 	// Try the output writer first
 	if f, ok := w.(*os.File); ok {
-		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 { //nolint:gosec // G115: uintptr->int is safe for fd
+		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 {
 			return min(width, 80)
 		}
 	}
@@ -86,7 +86,7 @@ func getTerminalWidth(w io.Writer) int {
 		if f == nil {
 			continue
 		}
-		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 { //nolint:gosec // G115: uintptr->int is safe for fd
+		if width, _, err := term.GetSize(int(f.Fd())); err == nil && width > 0 {
 			return min(width, 80)
 		}
 	}
@@ -119,6 +119,16 @@ func totalTokens(tu *agent.TokenUsage) int {
 	return total
 }
 
+// Row labels reused across the explain output's diagnostic tables.
+const (
+	explainLabelCause       = "cause"
+	explainLabelCheckpoints = "checkpoints"
+	explainLabelMessage     = "message"
+	explainLabelSession     = "session"
+	explainLabelStderr      = "stderr"
+	explainLabelTry         = "try"
+)
+
 // explainRow is one entry in a metadata block: dim label + plain value.
 type explainRow struct {
 	Label string
diff --git a/cmd/entire/cli/strategy/cleanup.go b/cmd/entire/cli/strategy/cleanup.go
index 47cace09c8..8ebeef8abc 100644
--- a/cmd/entire/cli/strategy/cleanup.go
+++ b/cmd/entire/cli/strategy/cleanup.go
@@ -35,6 +35,10 @@ const (
 	CleanupTypeRedactCache CleanupType = "redact-cache"
 )
 
+// cleanAllReason marks an item discovered by the unfiltered sweep, as opposed
+// to one selected by an orphan or staleness rule.
+const cleanAllReason = "clean all"
+
 // CleanupItem represents an item that can be cleaned up.
 type CleanupItem struct {
 	Type   CleanupType
@@ -501,7 +505,7 @@ func ListAllItems(ctx context.Context) ([]CleanupItem, error) {
 		cleanupItems = append(cleanupItems, CleanupItem{
 			Type:   CleanupTypeShadowBranch,
 			ID:     branch,
-			Reason: "clean all",
+			Reason: cleanAllReason,
 		})
 	}
 
@@ -520,7 +524,7 @@ func ListAllItems(ctx context.Context) ([]CleanupItem, error) {
 		cleanupItems = append(cleanupItems, CleanupItem{
 			Type:   CleanupTypeSessionState,
 			ID:     state.SessionID,
-			Reason: "clean all",
+			Reason: cleanAllReason,
 		})
 	}
 
@@ -531,7 +535,7 @@ func ListAllItems(ctx context.Context) ([]CleanupItem, error) {
 			cleanupItems = append(cleanupItems, CleanupItem{
 				Type:   CleanupTypeRedactCache,
 				ID:     checkpoint.RedactCacheDirName,
-				Reason: "clean all",
+				Reason: cleanAllReason,
 			})
 		}
 	}
diff --git a/cmd/entire/cli/strategy/hook_managers_test.go b/cmd/entire/cli/strategy/hook_managers_test.go
index e92e448355..d359eb8ded 100644
--- a/cmd/entire/cli/strategy/hook_managers_test.go
+++ b/cmd/entire/cli/strategy/hook_managers_test.go
@@ -55,7 +55,7 @@ func TestDetectHookManagers_Lefthook(t *testing.T) {
 	if len(managers) != 1 {
 		t.Fatalf("expected 1 manager, got %d", len(managers))
 	}
-	if managers[0].Name != "Lefthook" { //nolint:goconst // test assertion, not a magic string
+	if managers[0].Name != "Lefthook" {
 		t.Errorf("expected Lefthook, got %s", managers[0].Name)
 	}
 	if managers[0].ConfigPath != "lefthook.yml" {
diff --git a/cmd/entire/cli/strategy/hooks.go b/cmd/entire/cli/strategy/hooks.go
index c5b5dd6def..2c6ba7acba 100644
--- a/cmd/entire/cli/strategy/hooks.go
+++ b/cmd/entire/cli/strategy/hooks.go
@@ -34,8 +34,12 @@ const goosWindows = "windows"
 const chainComment = "# Chain: run pre-existing hook"
 const missingEntireGitHookWarning = "[entire] Entire CLI is enabled but not installed or not on PATH. Skipping Entire Git hook; continuing. Installation guide: https://docs.entire.io/cli/installation#installation-methods"
 
+// postRewriteHook is named on its own because the rewrite hook is the one
+// Entire branches on by name (see below).
+const postRewriteHook = "post-rewrite"
+
 // gitHookNames are the git hooks managed by Entire CLI
-var gitHookNames = []string{"prepare-commit-msg", "commit-msg", "post-commit", "post-rewrite", "pre-push"}
+var gitHookNames = []string{"prepare-commit-msg", "commit-msg", "post-commit", postRewriteHook, "pre-push"}
 
 // ManagedGitHookNames returns the list of git hooks managed by Entire CLI.
 // This is useful for tests that need to manipulate hooks.
@@ -595,7 +599,7 @@ func buildHookSpecs(cmdPrefix string) []hookSpec {
 `, entireHookMarker, postCommitCmd),
 		},
 		{
-			name: "post-rewrite",
+			name: postRewriteHook,
 			content: fmt.Sprintf(`#!/bin/sh
 # %s
 # Post-rewrite hook: remap session linkage after amend/rebase rewrites
@@ -858,7 +862,7 @@ func RemoveGitHook(ctx context.Context) (int, error) {
 // generateChainedContent appends a chain call to the base hook content,
 // so the pre-existing hook (backed up to .pre-entire) is called after our hook.
 func generateChainedContent(baseContent, hookName string) string {
-	if hookName == "post-rewrite" {
+	if hookName == postRewriteHook {
 		return generatePostRewriteChainedContent(baseContent)
 	}
 
diff --git a/cmd/entire/cli/strategy/manual_commit_test.go b/cmd/entire/cli/strategy/manual_commit_test.go
index 744e7b63bb..73d5dda2a6 100644
--- a/cmd/entire/cli/strategy/manual_commit_test.go
+++ b/cmd/entire/cli/strategy/manual_commit_test.go
@@ -871,7 +871,7 @@ func TestShadowStrategy_PrepareCommitMsg_SkipsSessionWhenContentCheckFails(t *te
 
 func TestAddCheckpointTrailer_NoComment(t *testing.T) {
 	// Test that addCheckpointTrailer adds trailer without any comment lines
-	message := "Test commit message\n" //nolint:goconst // already present in codebase
+	message := "Test commit message\n"
 
 	result := addCheckpointTrailer(message, testTrailerCheckpointID)
 
diff --git a/cmd/entire/cli/tokens_profile.go b/cmd/entire/cli/tokens_profile.go
index b2aea714e5..e22b6bb8eb 100644
--- a/cmd/entire/cli/tokens_profile.go
+++ b/cmd/entire/cli/tokens_profile.go
@@ -51,7 +51,7 @@ const tokensProfileUsageScopeCheckpointObserved = "checkpoint_observed"
 
 func newTokensGroupCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:    "tokens",
+		Use:    cmdTokens,
 		Short:  "Analyze token usage across sessions and checkpoints",
 		Hidden: true,
 		Long: `Analyze token usage across sessions and checkpoints.
@@ -276,7 +276,7 @@ func tokensProfileRecommendations(report tokensProfileReport) []sessionTokensRec
 	if report.CheckpointsAnalyzed == 0 {
 		return []sessionTokensRecommendation{{
 			ID:       "no-checkpoints",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "Create checkpoints first; token profiling needs committed checkpoint metadata to identify patterns.",
 			Signals:  []string{"empty_checkpoint_history"},
 		}}
@@ -286,48 +286,48 @@ func tokensProfileRecommendations(report tokensProfileReport) []sessionTokensRec
 		tokensProfileSignalCount(report.Signals, "api-call-amplification") > 0 {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "search-before-reinvestigation",
-			Severity: "high",
+			Severity: tokensSeverityHigh,
 			Message:  "Use `entire search` for prior decisions/checkpoints before broad re-investigation.",
-			Signals:  []string{"cache_read_tokens", "api_call_count"},
+			Signals:  []string{tokensSignalCacheReadTokens, tokensSignalAPICallCount},
 		})
 	}
 	if tokensProfileSignalCount(report.Signals, "api-call-amplification") > 0 {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "batch-diagnostics",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  "Batch diagnostic reads around one narrowed hypothesis when API call amplification repeats.",
-			Signals:  []string{"api_call_count"},
+			Signals:  []string{tokensSignalAPICallCount},
 		})
 	}
 	if tokensProfileSignalCount(report.Signals, "context-replay-hotspot") > 0 {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "preserve-then-compact",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  "Summarize useful findings before continuing large-context work; compact or restart only after preserving relevant context.",
-			Signals:  []string{"cache_read_tokens"},
+			Signals:  []string{tokensSignalCacheReadTokens},
 		})
 	}
 	if tokensProfileSignalCount(report.Signals, "subagent-heavy") > 0 {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "scope-subagents",
-			Severity: "medium",
+			Severity: tokensSeverityMedium,
 			Message:  "Scope subagent tasks tightly with a narrow objective and expected output.",
-			Signals:  []string{"subagent_tokens"},
+			Signals:  []string{tokensSignalSubagentTokens},
 		})
 	}
 	if report.MissingTokenData > 0 {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "improve-token-coverage",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "Increase token coverage by using agents and checkpoints that report token usage.",
-			Signals:  []string{"missing_token_usage"},
+			Signals:  []string{tokensSignalMissingUsage},
 		})
 	}
 
 	if len(recs) == 0 {
 		recs = append(recs, sessionTokensRecommendation{
 			ID:       "no-repeated-hotspots",
-			Severity: "low",
+			Severity: tokensSeverityLow,
 			Message:  "No repeated token hotspots were visible in committed checkpoint metadata.",
 			Signals:  []string{"checkpoint_token_metadata"},
 		})
diff --git a/cmd/entire/cli/trail_cmd.go b/cmd/entire/cli/trail_cmd.go
index eea9d6f9d8..5358f61bc3 100644
--- a/cmd/entire/cli/trail_cmd.go
+++ b/cmd/entire/cli/trail_cmd.go
@@ -49,7 +49,7 @@ func newTrailCmd() *cobra.Command {
 	var repoOverride string
 
 	cmd := &cobra.Command{
-		Use:    "trail",
+		Use:    cmdTrail,
 		Short:  "Manage trails for your branches",
 		Hidden: true,
 		// Hidden from root help while the surface matures, but advertised to
@@ -470,7 +470,7 @@ func newTrailListCmd() *cobra.Command {
 	var opts trailListOptions
 
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List recent trails",
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			opts.InsecureHTTP = trailInsecureHTTP(cmd)
diff --git a/cmd/entire/cli/trail_cmd_test.go b/cmd/entire/cli/trail_cmd_test.go
index 3fb7f180ed..4431479b61 100644
--- a/cmd/entire/cli/trail_cmd_test.go
+++ b/cmd/entire/cli/trail_cmd_test.go
@@ -2297,7 +2297,7 @@ func TestTrailUpdateRequestCountsEveryFieldAsMetadata(t *testing.T) {
 			// Fail rather than skip: a skipped subtest passes quietly, so a
 			// non-pointer field would silently retire the guarantee this test
 			// exists to provide, exactly when it starts mattering.
-			require.Equalf(t, reflect.Ptr, field.Type.Kind(),
+			require.Equalf(t, reflect.Pointer, field.Type.Kind(),
 				"field %s is not a pointer; decide its zero/set semantics and extend this test before adding it", field.Name)
 			var req api.TrailUpdateRequest
 			// A pointer to the zero value is still "provided" — that is how a
diff --git a/cmd/entire/cli/trail_comment_cmd.go b/cmd/entire/cli/trail_comment_cmd.go
index 9000786bfe..9d7a31b208 100644
--- a/cmd/entire/cli/trail_comment_cmd.go
+++ b/cmd/entire/cli/trail_comment_cmd.go
@@ -99,7 +99,7 @@ replies. Code-review comments are managed separately under 'entire trail finding
 func newTrailCommentListCmd() *cobra.Command {
 	var jsonOut, all bool
 	cmd := &cobra.Command{
-		Use:   "list",
+		Use:   cmdList,
 		Short: "List discussion threads on a trail",
 		Args:  cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
diff --git a/cmd/entire/cli/trail_resume_cmd.go b/cmd/entire/cli/trail_resume_cmd.go
index f39bd7a216..d89a7e032e 100644
--- a/cmd/entire/cli/trail_resume_cmd.go
+++ b/cmd/entire/cli/trail_resume_cmd.go
@@ -831,9 +831,9 @@ func printTrailResumeSkippedSessions(w io.Writer, skipped int) {
 	if skipped == 0 {
 		return
 	}
-	label := "session"
+	label := nounSession
 	if skipped != 1 {
-		label = "sessions"
+		label = nounSessions
 	}
 	fmt.Fprintf(w, "    skipped %d checkpoint %s due to read errors\n", skipped, label)
 }
@@ -1000,7 +1000,7 @@ func trailRestoredSessionChoiceLabel(session strategy.RestoredSession, isDefault
 func trailRestoredSessionKindLabel(kind string) string {
 	switch sessionpkg.Kind(kind) {
 	case sessionpkg.KindAgentReview:
-		return "review"
+		return sessionKindLabelReview
 	case sessionpkg.KindAgentInvestigate:
 		return "investigation"
 	case sessionpkg.KindImported:
diff --git a/cmd/entire/cli/transcript/compact/codex.go b/cmd/entire/cli/transcript/compact/codex.go
index 2d7e66be0d..3fe1539539 100644
--- a/cmd/entire/cli/transcript/compact/codex.go
+++ b/cmd/entire/cli/transcript/compact/codex.go
@@ -107,7 +107,7 @@ func compactCodex(content []byte, opts MetadataFields) ([]byte, error) {
 		}
 
 		switch {
-		case p.Type == transcriptTypeMessage && p.Role == "user":
+		case p.Type == transcriptTypeMessage && p.Role == transcript.TypeUser:
 			text := codexUserText(p.Content)
 			if text == "" {
 				continue
@@ -122,7 +122,7 @@ func compactCodex(content []byte, opts MetadataFields) ([]byte, error) {
 			line.Content = contentJSON
 			appendLine(&result, line)
 
-		case p.Type == transcriptTypeMessage && p.Role == "assistant":
+		case p.Type == transcriptTypeMessage && p.Role == transcript.TypeAssistant:
 			text := codexAssistantText(p.Content)
 			if text == "" {
 				continue
diff --git a/cmd/entire/cli/transcript/compact/compact.go b/cmd/entire/cli/transcript/compact/compact.go
index 782884d0d0..9316b23c85 100644
--- a/cmd/entire/cli/transcript/compact/compact.go
+++ b/cmd/entire/cli/transcript/compact/compact.go
@@ -46,7 +46,10 @@ func newTranscriptLine(opts MetadataFields) transcriptLine {
 	}
 }
 
-const toolResultStatusError = "error"
+const (
+	toolResultStatusSuccess = "success"
+	toolResultStatusError   = "error"
+)
 
 // toolResultJSON is the compact result object inlined into tool_use blocks.
 type toolResultJSON struct {
@@ -488,7 +491,7 @@ func inlineToolResults(assistant, user parsedEntry) parsedEntry {
 func buildToolResult(tr toolResultEntry) json.RawMessage {
 	r := toolResultJSON{
 		Output:     tr.output,
-		Status:     "success",
+		Status:     toolResultStatusSuccess,
 		MatchCount: tr.matchCount,
 	}
 	if tr.isError {
diff --git a/cmd/entire/cli/transcript/compact/gemini.go b/cmd/entire/cli/transcript/compact/gemini.go
index 8f2dcb5a73..8647b22899 100644
--- a/cmd/entire/cli/transcript/compact/gemini.go
+++ b/cmd/entire/cli/transcript/compact/gemini.go
@@ -250,9 +250,9 @@ func geminiToolResultCompact(tc geminiToolCall) json.RawMessage {
 
 	r := toolResultJSON{
 		Output: output,
-		Status: "success",
+		Status: toolResultStatusSuccess,
 	}
-	if tc.Status != "" && tc.Status != "success" {
+	if tc.Status != "" && tc.Status != toolResultStatusSuccess {
 		r.Status = toolResultStatusError
 	}
 	b, err := json.Marshal(r)
diff --git a/cmd/entire/cli/transcript/compact/opencode.go b/cmd/entire/cli/transcript/compact/opencode.go
index d8dd3efb88..cccee8fbbb 100644
--- a/cmd/entire/cli/transcript/compact/opencode.go
+++ b/cmd/entire/cli/transcript/compact/opencode.go
@@ -194,7 +194,7 @@ func emitOpenCodeAssistant(result *[]byte, base transcriptLine, msg openCodeMess
 func openCodeToolResult(state map[string]json.RawMessage) json.RawMessage {
 	r := toolResultJSON{
 		Output: unquote(state["output"]),
-		Status: "success",
+		Status: toolResultStatusSuccess,
 	}
 	if s := unquote(state["status"]); s != "" && s != "completed" {
 		r.Status = toolResultStatusError
diff --git a/cmd/entire/cli/transcript/compact/parse.go b/cmd/entire/cli/transcript/compact/parse.go
index 383b83b9b0..660455a2a0 100644
--- a/cmd/entire/cli/transcript/compact/parse.go
+++ b/cmd/entire/cli/transcript/compact/parse.go
@@ -5,6 +5,8 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+
+	"github.com/entireio/cli/cmd/entire/cli/transcript"
 )
 
 type CondensedEntry struct {
@@ -59,7 +61,7 @@ func BuildCondensedEntries(content []byte) ([]CondensedEntry, error) {
 		}
 
 		switch line.Type {
-		case "user":
+		case transcript.TypeUser:
 			var parts []string
 			for _, block := range blocks {
 				var text string
@@ -68,10 +70,10 @@ func BuildCondensedEntries(content []byte) ([]CondensedEntry, error) {
 				}
 			}
 			if len(parts) > 0 {
-				entries = append(entries, CondensedEntry{Type: "user", Content: strings.Join(parts, "\n")})
+				entries = append(entries, CondensedEntry{Type: transcript.TypeUser, Content: strings.Join(parts, "\n")})
 			}
 
-		case "assistant":
+		case transcript.TypeAssistant:
 			for _, block := range blocks {
 				var blockType string
 				if err := json.Unmarshal(block["type"], &blockType); err != nil {
@@ -82,7 +84,7 @@ func BuildCondensedEntries(content []byte) ([]CondensedEntry, error) {
 				case "text":
 					var text string
 					if err := json.Unmarshal(block["text"], &text); err == nil && text != "" {
-						entries = append(entries, CondensedEntry{Type: "assistant", Content: text})
+						entries = append(entries, CondensedEntry{Type: transcript.TypeAssistant, Content: text})
 					}
 				case "tool_use":
 					var toolName string
diff --git a/cmd/entire/cli/transcript/compact/pi.go b/cmd/entire/cli/transcript/compact/pi.go
index c64e53d27d..4aad44e830 100644
--- a/cmd/entire/cli/transcript/compact/pi.go
+++ b/cmd/entire/cli/transcript/compact/pi.go
@@ -25,11 +25,6 @@ import (
 // SkipLines, NewScanner) are shared with the pi agent package via
 // cmd/entire/cli/agent/pi/pijsonl so a fix applied here also lands there.
 
-const (
-	piToolResultStatusOK  = "success"
-	piToolResultStatusErr = "error"
-)
-
 // piToolNameMap normalises Pi's lowercase tool names to the title-cased names
 // used elsewhere in Entire's compact format (matching Claude's "Read"/"Write"/"Edit").
 var piToolNameMap = map[string]string{
@@ -299,9 +294,9 @@ func piDecodeResultOutput(raw json.RawMessage) string {
 
 func piResultStatus(isError bool) string {
 	if isError {
-		return piToolResultStatusErr
+		return toolResultStatusError
 	}
-	return piToolResultStatusOK
+	return toolResultStatusSuccess
 }
 
 func piTimestampJSON(ts string) json.RawMessage {
diff --git a/go.mod b/go.mod
index 31b5ed4856..df1da68eee 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/entireio/cli
 
-go 1.26.6
+go 1.27.1
 
 require (
 	charm.land/bubbles/v2 v2.2.1
@@ -30,6 +30,7 @@ require (
 	github.com/go-git/x/plugin/objectsigner/program v0.0.0-20260624122410-382b2905c041
 	github.com/gofrs/flock v0.13.1
 	github.com/google/uuid v1.6.0
+	github.com/lastpersonlabs/goredact v0.1.0
 	github.com/mattn/go-isatty v0.0.24
 	github.com/mattn/go-runewidth v0.0.29
 	github.com/muesli/termenv v0.16.0
@@ -50,8 +51,6 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 )
 
-require github.com/lastpersonlabs/goredact v0.1.0
-
 require (
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
diff --git a/mise.toml b/mise.toml
index 2e7574ce99..e078797a0a 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,7 +1,7 @@
 [tools]
 # Please also keep the version aligned in the go.mod file
-go = { version = '1.26.6', postinstall = "go install github.com/go-delve/delve/cmd/dlv@latest && go install gotest.tools/gotestsum@latest" }
-golangci-lint = '2.11.3'
+go = { version = '1.27.1', postinstall = "go install github.com/go-delve/delve/cmd/dlv@latest && go install gotest.tools/gotestsum@latest" }
+golangci-lint = '2.13.2'
 shellcheck = 'latest'
 tmux = 'latest'
 "go:github.com/entireio/roger-roger/cmd/roger-roger" = 'latest'

From c11a79faff1ab8276ae827eba68ff32fd4a0e802 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:32:41 +0200
Subject: [PATCH 30/59] docs: state the Go 1.27.1 requirement, and be honest
 about ignore-tests

Two review findings from the Go 1.27 bump.

The documented prerequisite still said Go 1.26 in five places (README,
WINDOWS, CONTRIBUTING, CLAUDE.md/AGENTS.md, docs/first-time-contributors),
so anyone building with GOTOOLCHAIN=local or without toolchain-download
access would fail while satisfying the docs. They now say 1.27.1 rather than
1.27: the go directive carries a patch level, so 1.27.0 is not enough either,
and CONTRIBUTING names the GOTOOLCHAIN=local case since that is the setup
where the failure is not self-explanatory. AGENTS.md is a symlink to
CLAUDE.md and follows automatically.

The goconst comment claimed both settings "restore the prior scope". That is
true of ignore-map-keys and false of ignore-tests: goconst did lint test
logic under 2.11, and the proof is in the same commit -- the three
//nolint:goconst directives it deleted as unused were suppressing real
comparison and assignment findings in _test.go files. The comment now
separates the two, says plainly which shapes are no longer checked in tests,
and records why the narrower alternatives were rejected: goconst settings
have no per-path variant, the remainder is 2016 findings across 62 packages
so a path-scoped rule would name nearly all of them, and exclude-types
replaces the default exclusion set instead of adding to it -- asking it to
exclude CompositeLit re-enables Call findings and takes the count from 2457
to 6255.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25VRC179S521B9MFR27TF71
---
 .golangci.yaml                  | 26 ++++++++++++++++++++++----
 CLAUDE.md                       |  2 +-
 CONTRIBUTING.md                 |  2 +-
 README.md                       |  2 +-
 WINDOWS.md                      |  2 +-
 docs/first-time-contributors.md |  2 +-
 6 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/.golangci.yaml b/.golangci.yaml
index 0af30d6d1b..96dea2473f 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -75,10 +75,28 @@ linters:
     - wrapcheck
   settings:
     goconst:
-      # golangci-lint 2.13 (goconst upgrade) began scanning composite literals,
-      # which turned map-literal keys and test fixtures into ~2.3k findings that
-      # 2.11 never reported. Both knobs restore the prior scope rather than
-      # adopting a stricter linter as a side effect of a Go toolchain bump.
+      # golangci-lint 2.13's goconst upgrade began scanning composite literals,
+      # which turned ~2.3k previously-unreported strings into findings. The two
+      # knobs below are NOT equivalent in what they give up:
+      #
+      #   ignore-map-keys restores the prior scope exactly: a map-literal key
+      #   was never reported before 2.13, so nothing is lost.
+      #
+      #   ignore-tests is broader than the 2.13 change and DOES give up
+      #   coverage this repo had. goconst used to lint test logic -- the proof
+      #   is the three //nolint:goconst directives in _test.go files that the
+      #   Go 1.27 bump deleted as unused; they were suppressing real
+      #   comparison/assignment findings under 2.11. Those shapes are no longer
+      #   checked in tests.
+      #
+      # It is accepted anyway because no narrower exclusion exists. goconst
+      # settings are global (there is no per-path variant), the remainder is
+      # 2016 findings across 62 packages so a path-scoped rule would have to
+      # name nearly every one, and the field that looks like the right tool --
+      # exclude-types: [CompositeLit] -- REPLACES the default exclusion set
+      # rather than adding to it, so it re-enables Call findings and takes the
+      # count up to 6255. Revisit if goconst gains per-path settings or fixes
+      # exclude-types.
       ignore-tests: true
       ignore-map-keys: true
     gosec:
diff --git a/CLAUDE.md b/CLAUDE.md
index 0b762c458d..80d6884cd7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -234,7 +234,7 @@ named `<noun>_group.go` and `<noun>_<verb>.go` respectively.
 
 ## Tech Stack
 
-- Language: Go 1.26.x
+- Language: Go 1.27.x (`go.mod` pins the 1.27.1 minimum)
 - Build tool: mise, go modules
 - Linting: golangci-lint
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 965da96636..aec7e5b6c3 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -93,7 +93,7 @@ Please answer these questions in your bug report:
 
 ### Prerequisites
 
-- **Go 1.26.x** - Check with `go version`
+- **Go 1.27.1+** - Check with `go version`. `go.mod` pins the minimum, so an older toolchain fails unless it can download the pinned one (`GOTOOLCHAIN=local` cannot).
 - **mise** - Task runner and version manager. Install with `curl https://mise.run | sh`
 
 ### Clone and Install
diff --git a/README.md b/README.md
index 5d07e53d7a..12e1bb6d74 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ With Entire, you can:
 - Git
 - macOS, Linux or Windows
 - [Supported agent](#agent-hook-configuration) installed and authenticated
-- Go 1.26+ only if you install with `go install` (the packaged installs bundle their own runtime)
+- Go 1.27.1+ only if you install with `go install` (the packaged installs bundle their own runtime)
 
 ## Quick Start
 
diff --git a/WINDOWS.md b/WINDOWS.md
index 5c3e18de13..68697fdba5 100644
--- a/WINDOWS.md
+++ b/WINDOWS.md
@@ -4,7 +4,7 @@
 
 - **Windows 10 1809+** (required for ConPTY support in E2E tests)
 - **Git for Windows** — provides `git.exe` and bundled bash for git hooks
-- **Go 1.26+** — for building from source
+- **Go 1.27.1+** — for building from source
 
 ## Building
 
diff --git a/docs/first-time-contributors.md b/docs/first-time-contributors.md
index 2ee28b7541..540903d3ca 100644
--- a/docs/first-time-contributors.md
+++ b/docs/first-time-contributors.md
@@ -78,7 +78,7 @@ Entire is a Go project managed by `mise`. Three commands and you're set up:
 # Install mise (skip if you already have it)
 curl https://mise.run | sh
 
-# Trust this repo's mise config and install Go 1.26
+# Trust this repo's mise config and install Go 1.27
 mise trust
 mise install
 

From 4ce53ca318633c444fe856f255e75c585107988f Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:47:57 +0200
Subject: [PATCH 31/59] fix: report an unrunnable managed plugin, and stop
 echoing plugin arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings on the on-demand install path.

FindInstalledPlugin reports what Lstat finds, so a local-dev symlink whose
target moved is listed like any other install. Short-circuiting to it
exec'd the missing target and failed with a fork/exec ENOENT naming a path
the user never chose — and the comment and docs claimed such an entry was
executed, which was true only when the target still existed. The entry is
now checked with os.Stat first; a missing target or a directory in its place
is reported with the entry's path and an 'entire plugin install <name>
--force' remedy. Reinstalling automatically is deliberately not done:
replacing a developer's symlink with a released binary is their call.

The remedy is offered only for the two conditions identified positively. A
stat failure that is not ENOENT gets the error and no advice — reinstalling
into the managed directory does not fix a permission failure on it, and a
remedy hung off an unmatched error is how advice comes to name the wrong
cause, as writeEntireDirRemedy documents for `.entire`.

The post-install announcement echoed every argument verbatim to stderr. They
are the user's own command line, already on screen, so they add nothing —
and they carry whatever they hold into stderr and anything capturing it. The
regression test drives a token, an ESC sequence and an embedded newline
through it; before the fix stderr read:

    Running entire graph --token s3cr3t \x1b[1A\x1b[2Kforged line
    break

The announcement is now the binary's name alone: "Running entire-graph".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25WMATX7WCBP326ZXSRZGSY
---
 cmd/entire/cli/plugin.go                |  17 ++-
 cmd/entire/cli/plugin_on_demand.go      |  63 +++++++++--
 cmd/entire/cli/plugin_on_demand_test.go | 139 ++++++++++++++++++++++--
 docs/architecture/external-commands.md  |   6 +-
 4 files changed, 199 insertions(+), 26 deletions(-)

diff --git a/cmd/entire/cli/plugin.go b/cmd/entire/cli/plugin.go
index 0e548b8578..e719ca6ee3 100644
--- a/cmd/entire/cli/plugin.go
+++ b/cmd/entire/cli/plugin.go
@@ -87,12 +87,17 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 			// The command was not executed because installation was declined.
 			return true, 1
 		}
-		// Name the command that is about to run: the install may have taken a
-		// while, and it is the reason the user is still waiting. The command
-		// itself is part of the line — printing only the arguments left a
-		// bare "Running plugin with command:" for `entire graph`.
-		fmt.Fprintf(rootCmd.ErrOrStderr(), "Running %s\n",
-			strings.Join(append([]string{rootCmd.Name(), pluginName}, pluginArgs...), " "))
+		// Say what is happening now: the install may have taken a while, and
+		// it is the reason the user is still waiting.
+		//
+		// The binary's name, never the arguments. They are the user's own
+		// command line, already on their screen, so echoing them back adds
+		// nothing — and it would put whatever they contain into stderr and
+		// into anything capturing it: a token passed as a flag, a newline
+		// that forges a second line of output, a terminal escape that
+		// repositions the cursor or repaints what is above it. That last one
+		// is the same hazard hasTerminalControlChars exists for.
+		fmt.Fprintf(rootCmd.ErrOrStderr(), "Running %s%s\n", pluginBinaryPrefix, pluginName)
 	}
 	exitCode = runPlugin(ctx, pluginName, binPath, pluginArgs)
 	if exitCode == 0 {
diff --git a/cmd/entire/cli/plugin_on_demand.go b/cmd/entire/cli/plugin_on_demand.go
index f066547f9f..fa5fa5c976 100644
--- a/cmd/entire/cli/plugin_on_demand.go
+++ b/cmd/entire/cli/plugin_on_demand.go
@@ -2,7 +2,9 @@ package cli
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"os"
 
 	"github.com/entireio/cli/cmd/entire/cli/interactive"
 	"github.com/spf13/cobra"
@@ -15,18 +17,34 @@ var onDemandPluginInstall = runRemoteInstall
 
 func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name string) (string, error) {
 	// The plugin may already be in the managed directory and merely
-	// unreachable through PATH: a local-dev symlink whose target moved, or a
-	// managed bin dir that could not be prepended at startup. Offering to
-	// install over it is a dead end — installRepoAtTag refuses an existing
-	// install without --force, so the user answers Yes, waits for three
-	// network round-trips and gets "already installed; use --force to
-	// replace". Execute the managed entry instead, which is what this
-	// function's own return contract promises below.
+	// unreachable through PATH — a managed bin dir that could not be
+	// prepended at startup. Offering to install over it is a dead end:
+	// installRepoAtTag refuses an existing install without --force, which the
+	// on-demand path deliberately does not pass, so the user answers Yes,
+	// waits for three network round-trips and gets "already installed; use
+	// --force to replace". Execute the managed entry instead, which is what
+	// this function's own return contract promises below.
 	//
 	// A listing error falls through to the install rather than failing here:
 	// the install path reads the same directory and reports the problem in
 	// terms of what it was trying to do.
 	if installed, err := FindInstalledPlugin(name); err == nil && installed != nil {
+		// The entry is not necessarily runnable. ListInstalledPlugins reports
+		// what it finds with Lstat, so a local-dev symlink whose target moved
+		// is listed like any other install — exec'ing it fails with a
+		// fork/exec ENOENT that names a path the user never chose and offers
+		// no way forward. Say what is wrong and how to fix it instead.
+		//
+		// Reinstalling automatically would be the other option, and it is
+		// deliberately not taken: replacing a developer's deliberate symlink
+		// with a released binary is their call to make, not ours.
+		if reinstallFixes, cerr := checkManagedPluginRunnable(installed.Path); cerr != nil {
+			broken := fmt.Errorf("the entire-%s plugin is installed at %s but cannot be run: %w", name, installed.Path, cerr)
+			if !reinstallFixes {
+				return "", broken
+			}
+			return "", fmt.Errorf("%w; reinstall it with 'entire plugin install %s --force'", broken, name)
+		}
 		return installed.Path, nil
 	}
 	if !interactive.CanPromptInteractively() {
@@ -72,3 +90,34 @@ func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name stri
 	// not be prepended to PATH at startup.
 	return installed.Path, nil
 }
+
+// checkManagedPluginRunnable reports why a managed plugin entry cannot be
+// executed, or a nil error when it can. reinstallFixes is true only for a
+// condition a reinstall actually repairs, so the caller does not attach that
+// remedy to an error it would not resolve — a permission failure on the
+// managed directory is not fixed by installing into it, and a remedy hung off
+// an unmatched error is how advice comes to name the wrong cause (the mistake
+// writeEntireDirRemedy documents for `.entire`). It is meaningless when the
+// error is nil.
+//
+// os.Stat rather than Lstat, deliberately: the question is whether the thing
+// at the end of the entry exists, and a dangling symlink is the case that
+// brought this function into being. The executable bit is left to the exec —
+// findInaccessiblePlugin draws the same line for PATH entries, and the mode
+// does not mean the same thing on Windows.
+func checkManagedPluginRunnable(path string) (reinstallFixes bool, err error) {
+	info, statErr := os.Stat(path)
+	if statErr != nil {
+		if errors.Is(statErr, os.ErrNotExist) {
+			// Worded rather than passed through because the errno itself ("no
+			// such file or directory") describes the entry, which plainly
+			// exists; what is missing is whatever it points at.
+			return true, errors.New("it points at a file that no longer exists")
+		}
+		return false, statErr //nolint:wrapcheck // the caller adds the plugin name and path
+	}
+	if info.IsDir() {
+		return true, errors.New("it is a directory")
+	}
+	return false, nil
+}
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
index f76b1641c9..60749ebab0 100644
--- a/cmd/entire/cli/plugin_on_demand_test.go
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -207,17 +207,22 @@ func TestMaybeRunPlugin_GraphInManagedDirIsRunNotReinstalled(t *testing.T) { //n
 	if err != nil || string(got) != "search\nhello\n" {
 		t.Fatalf("managed entry did not run with the forwarded args: %q %v", got, err)
 	}
-	// The announcement names the command, not just its arguments — a bare
-	// `entire graph` used to print "Running plugin with command:" and stop.
-	if !strings.Contains(stderr.String(), "Running entire graph search hello\n") {
-		t.Errorf("forwarded command was not announced: %q", stderr.String())
+	// The announcement names the binary and nothing else: the arguments are
+	// the user's own command line, and echoing them back would carry whatever
+	// they hold (a token, a newline, a terminal escape) into stderr.
+	if !strings.Contains(stderr.String(), "Running entire-graph\n") {
+		t.Errorf("plugin was not announced: %q", stderr.String())
+	}
+	if strings.Contains(stderr.String(), "hello") {
+		t.Errorf("arguments were echoed back: %q", stderr.String())
 	}
 }
 
-// A bare `entire graph` has no arguments to forward, which is the case the
-// announcement got wrong: joining only the arguments left a trailing colon
-// and nothing after it.
-func TestMaybeRunPlugin_BareGraphAnnouncesTheCommand(t *testing.T) { //nolint:paralleltest // isolates PATH and managed plugins
+// Arguments never reach stderr, whatever they contain. A terminal escape in
+// one could reposition the cursor or repaint the lines above it — the hazard
+// hasTerminalControlChars guards for index entries — and a flag value could be
+// a token that then lands in any log capturing stderr.
+func TestMaybeRunPlugin_AnnouncementNeverEchoesArguments(t *testing.T) { //nolint:paralleltest // isolates PATH and managed plugins
 	withIsolatedPluginEnv(t)
 	interceptVersionCheck(t)
 	binDir, err := EnsurePluginBinDir()
@@ -229,10 +234,122 @@ func TestMaybeRunPlugin_BareGraphAnnouncesTheCommand(t *testing.T) { //nolint:pa
 	root := newTestRoot()
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
-	if handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph"}); !handled || code != 0 {
+	args := []string{"graph", "--token", "s3cr3t", "\x1b[1A\x1b[2Kforged", "line\nbreak"}
+	if handled, code := MaybeRunPlugin(t.Context(), root, args); !handled || code != 0 {
 		t.Fatalf("handled=%v code=%d; stderr=%s", handled, code, &stderr)
 	}
-	if !strings.Contains(stderr.String(), "Running entire graph\n") {
-		t.Errorf("bare command was not announced: %q", stderr.String())
+	if !strings.Contains(stderr.String(), "Running entire-graph\n") {
+		t.Errorf("plugin was not announced: %q", stderr.String())
+	}
+	for _, leaked := range []string{"s3cr3t", "\x1b", "forged", "line\nbreak"} {
+		if strings.Contains(stderr.String(), leaked) {
+			t.Errorf("argument content %q reached stderr: %q", leaked, stderr.String())
+		}
+	}
+}
+
+// A managed entry Lstat reports but exec cannot use — the local-dev symlink
+// whose target moved — is neither run nor offered for installation: exec'ing
+// it fails with a fork/exec ENOENT naming a path the user never chose, and
+// prompting dead-ends on the already-installed guard. Both are replaced by a
+// message that says what is broken and how to repair it.
+func TestMaybeRunPlugin_BrokenManagedEntryReportsARemedy(t *testing.T) { //nolint:paralleltest // isolates PATH and managed plugins
+	withIsolatedPluginEnv(t)
+	interceptVersionCheck(t)
+	binDir, err := EnsurePluginBinDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	entry := filepath.Join(binDir, "entire-graph")
+	if err := os.Symlink(filepath.Join(t.TempDir(), "gone", "entire-graph"), entry); err != nil {
+		t.Fatal(err)
+	}
+	if found, ferr := FindInstalledPlugin("graph"); ferr != nil || found == nil {
+		t.Fatalf("precondition: a dangling entry must still be listed: %v %v", found, ferr)
+	}
+
+	t.Setenv("ENTIRE_TEST_TTY", "1")
+	t.Setenv("ACCESSIBLE", "1")
+	originalTerminal := openPluginPromptTerminal
+	openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+		t.Error("a broken entry must not be answered with an install prompt")
+		return pluginPromptTerminal{in: io.NopCloser(strings.NewReader("n\n"))}, nil
+	}
+	t.Cleanup(func() { openPluginPromptTerminal = originalTerminal })
+	originalInstall := onDemandPluginInstall
+	onDemandPluginInstall = func(context.Context, *cobra.Command, installSource, remoteInstallFlags) error {
+		t.Error("a broken entry must not be silently reinstalled over")
+		return nil
+	}
+	t.Cleanup(func() { onDemandPluginInstall = originalInstall })
+
+	root := newTestRoot()
+	var stderr bytes.Buffer
+	root.SetErr(&stderr)
+	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "search"})
+	if !handled || code != 1 {
+		t.Fatalf("handled=%v code=%d, want true, 1; stderr=%s", handled, code, &stderr)
+	}
+	for _, want := range []string{
+		entry,
+		"cannot be run",
+		"points at a file that no longer exists",
+		"entire plugin install graph --force",
+	} {
+		if !strings.Contains(stderr.String(), want) {
+			t.Errorf("missing %q in the diagnosis: %q", want, stderr.String())
+		}
+	}
+	if strings.Contains(stderr.String(), "use --force to replace") {
+		t.Errorf("fell through to the already-installed dead end: %q", stderr.String())
+	}
+}
+
+// The remedy is offered only for conditions a reinstall repairs, so it cannot
+// be hung off an error it would not resolve. Both identified conditions are
+// repairable; the unidentified branch (a stat failure that is not ENOENT) is
+// left to review, since staging one means breaking permissions on the managed
+// directory, which breaks its discovery first and exercises the wrong path.
+func TestCheckManagedPluginRunnable(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	runnable := filepath.Join(dir, "entire-ok")
+	if err := os.WriteFile(runnable, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	dangling := filepath.Join(dir, "entire-dangling")
+	if err := os.Symlink(filepath.Join(dir, "gone"), dangling); err != nil {
+		t.Fatal(err)
+	}
+	asDir := filepath.Join(dir, "entire-dir")
+	if err := os.Mkdir(asDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name             string
+		path             string
+		wantErr          string
+		wantReinstallFix bool
+	}{
+		{name: "regular file", path: runnable},
+		{name: "dangling symlink", path: dangling, wantErr: "points at a file that no longer exists", wantReinstallFix: true},
+		{name: "directory", path: asDir, wantErr: "it is a directory", wantReinstallFix: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			reinstallFixes, err := checkManagedPluginRunnable(tc.path)
+			if tc.wantErr == "" {
+				if err != nil {
+					t.Fatalf("err=%v, want nil", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
+				t.Fatalf("err=%v, want %q", err, tc.wantErr)
+			}
+			if reinstallFixes != tc.wantReinstallFix {
+				t.Errorf("reinstallFixes=%v, want %v", reinstallFixes, tc.wantReinstallFix)
+			}
+		})
 	}
 }
diff --git a/docs/architecture/external-commands.md b/docs/architecture/external-commands.md
index ff94c78769..a0ac418612 100644
--- a/docs/architecture/external-commands.md
+++ b/docs/architecture/external-commands.md
@@ -16,9 +16,11 @@ Rules, in order:
 2. **Reserved names are skipped.** Names beginning with `agent-` are reserved for the [agent protocol](external-agent-protocol.md). The resolver refuses to invoke them as external commands.
 3. **Path-traversal candidates are rejected.** Names containing `/` or `\` never resolve.
 4. **Found-but-not-executable surfaces as a launch error.** If `entire-<name>` exists on `$PATH` but lacks the executable bit, the resolver reports `Failed to run plugin entire-<name>` with exit code 1, rather than falling through to Cobra's "unknown command" path.
-5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` asks `Install the entire-graph plugin?` with Yes selected by default. Accepting installs `graph` through the configured plugin index using the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr. Declining or a failed installation exits nonzero without running the command; a cancelled one terminates by signal, so a single Ctrl-C escapes an enclosing shell loop. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
+5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` asks `Install the entire-graph plugin?` with Yes selected by default. Accepting installs `graph` through the configured plugin index using the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr, and the run that follows is announced as `Running entire-graph` — the binary's name only, never the arguments, which are the user's own command line and could carry a token, a newline or a terminal escape into stderr and anything capturing it. Declining or a failed installation exits nonzero without running the command; a cancelled one terminates by signal, so a single Ctrl-C escapes an enclosing shell loop. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
 
-   A `graph` that is already in the [managed install directory](#managed-install-directory) but unreachable through `$PATH` — a local-dev symlink whose target moved, or a managed dir that could not be prepended at startup — is **executed**, not offered for installation. Installing over it cannot work: an existing install needs `--force`, which the on-demand path deliberately does not pass, so prompting would spend the user's Yes and several network round-trips on a guaranteed "already installed; use --force to replace".
+   A `graph` that is already in the [managed install directory](#managed-install-directory) but unreachable through `$PATH` — a managed dir that could not be prepended at startup — is **executed**, not offered for installation. Installing over it cannot work: an existing install needs `--force`, which the on-demand path deliberately does not pass, so prompting would spend the user's Yes and several network round-trips on a guaranteed "already installed; use --force to replace".
+
+   A managed entry that exists but **cannot be run** — a local-dev symlink whose target moved, or a directory in its place — is reported with its path and a `entire plugin install <name> --force` remedy. It is neither executed (a `fork/exec` ENOENT names a path the user never chose) nor reinstalled over: replacing a developer's deliberate symlink with a released binary is their call.
 
 ### Managed install directory
 

From d4f783da96d45a2df9634f22ecd46a49a4cc61ce Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 16:51:40 +0200
Subject: [PATCH 32/59] ci: read the golangci-lint version from mise.toml

The lint workflow pinned golangci-lint v2.11.3 in a second place, so the Go
1.27 bump raised the linter in mise.toml and left this copy behind. The job
failed on exactly the incompatibility the bump was working around -- "the Go
language version (go1.26) used to build golangci-lint is lower than the
targeted Go version (1.27.1)" -- and failed *after* `mise run lint` in the
same job had already passed with 2.13.2, so the two steps disagreed about
which linter the repo uses.

Rather than hardcode 2.13.2 and leave the same trap for the next bump, the
version is now derived from mise.toml, which is the reason the setup-go step
above reads go.mod ("so future Go bumps don't need a parallel workflow
edit"). An unreadable or missing pin fails the step loudly instead of
resolving to a bare "v".

Caught by Copilot's review on #2356; every other check on that run passed,
including test-windows and all three integration shards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25WV49B2MDCQRDEE1BFPCM8
---
 .github/workflows/lint.yml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0d3177aee8..ba2fef1341 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -31,8 +31,26 @@ jobs:
       # So this golangci-lint uses the same config as `mise run lint:go`, but using special sauce to
       # create inline feedback on GitHub's UI.  On local dev, the same issues should be surfaced by
       # mise-tasks/lint/go
+      #
+      # The version is read from mise.toml for the same reason setup-go reads
+      # go.mod above: the two pins must name the same version, and the hardcoded
+      # copy that used to live here is what drifted on the Go 1.27 bump. A 2.11
+      # binary refuses to lint a 1.27 module outright ("the Go language version
+      # (go1.26) used to build golangci-lint is lower than the targeted Go
+      # version"), so this step failed after `mise run lint` had already passed
+      # with the correct version.
+      - name: Resolve golangci-lint version
+        id: golangci
+        run: |
+          version=$(sed -n "s/^golangci-lint = '\(.*\)'$/\1/p" mise.toml)
+          if [ -z "$version" ]; then
+            echo "could not read the golangci-lint version from mise.toml" >&2
+            exit 1
+          fi
+          echo "version=v$version" >> "$GITHUB_OUTPUT"
+
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
         with:
-          version: 'v2.11.3'
+          version: ${{ steps.golangci.outputs.version }}
           debug: 'clean'

From 99eda5cf8ecd11d8b93dd4a0ee3bf836903b29d6 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 17:11:50 +0200
Subject: [PATCH 33/59] ci: make the CodeQL advanced setup correct and
 self-consistent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The stock template this started from had four problems, three of which would
have left the setup quietly worse than the default setup it replaces.

Remove codeql-actions.yml. It and codeql.yml both analyzed `actions` and both
uploaded under category `/language:actions`, so the two would overwrite each
other's results for the same ref. codeql.yml supersedes it: it covers `go` as
well, and — the reason any of this matters — it triggers on `push` to main.
codeql-actions.yml never did, so of the 39 analyses it ever recorded, every one
was on a `refs/pull/*/head` ref and none on `refs/heads/main`. Since the open
alert list IS the default branch's alert set, and PR analyses report only alerts
new relative to the base, a long-standing condition in a file no PR touched was
invisible to it. That is why 13 missing-workflow-permissions alerts sat
undetected until default setup scanned main for the first time.

Enable security-extended and security-and-quality on both languages. The suite
was measured rather than guessed, because the intuition here is wrong in both
directions — the extra queries look expensive and are not, and the quality
suite sounds like style checks and is not:

| leg     | queries | CI time |
| ------- | ------- | ------- |
| actions | 18 → 28 | 50s → 42s |
| go      | 36 → 59 | 192s → 140s |

The spread is runner noise; `go`'s autobuild compile dominates its leg, and
`actions` has nothing to compile. So the suites are free on this repo.

What they add is worth having. For actions: `unpinned-tag`,
`if-expression-always-true`, and the `/medium` precision variants of
code-injection, envvar-injection, envpath-injection, artifact-poisoning and
untrusted-checkout — the default suite ships only high and critical. e2e.yml
already guards that exact class by hand, in a comment about REST-API dispatch
injecting shell metacharacters. For go, the 23 additions are bug-finding
queries, not formatting: the InconsistentCode family (MissingErrorCheck,
WrappedErrorAlwaysNil, LengthComparisonOffByOne, UnhandledCloseWritableHandle)
and the RedundantCode family (ImpossibleInterfaceNilCheck, DuplicateSwitchCase,
ShiftOutOfRange, UnreachableStatement).

Run against a local database of this repo, the go suites take it from 2 alerts
to 4. The two new ones are `go/unhandled-writable-file-close` (CWE-252,
precision high) at cmd/entire/cli/setup.go:2305 and e2e/vogon/main.go:708, both
a `defer f.Close()` on a writable handle that discards the close error, so a
failed flush loses the write while the function returns nil. golangci-lint
reports neither, so this is incremental coverage rather than overlap. They are
left for a separate change; this commit only turns on the analysis.

Pin the three action refs to the SHAs this repo already trusts elsewhere
(checkout v7.0.1, codeql-action v4.37.4), replacing floating `@v7`/`@v4` tags.
Every other workflow here pins a full SHA with a version comment, dependabot
manages github_actions, and `actions/unpinned-tag` — newly enabled above —
flags the floating form.

Add `permissions: {}` at the workflow level so the analyze job's grants are the
only ones in effect, matching the convention across the other workflows.

Drop the template's dead weight: the `swift`/macos-latest runner expression
(no swift in the matrix), and the "Run manual build steps" step, an `exit 1`
placeholder unreachable for both `none` and `autobuild` build modes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25Y02WZTTPFTFCG4QAPNG50
---
 .github/workflows/codeql-actions.yml |  39 ---------
 .github/workflows/codeql.yml         | 123 ++++++++++++---------------
 2 files changed, 53 insertions(+), 109 deletions(-)
 delete mode 100644 .github/workflows/codeql-actions.yml

diff --git a/.github/workflows/codeql-actions.yml b/.github/workflows/codeql-actions.yml
deleted file mode 100644
index 63189fcec2..0000000000
--- a/.github/workflows/codeql-actions.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: CodeQL (GitHub Actions)
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - '.github/workflows/**'
-      - '.github/actions/**'
-
-permissions: {}
-
-jobs:
-  analyze:
-    name: Analyze workflows
-    runs-on: ubuntu-latest
-
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
-        with:
-          languages: actions
-          queries: security-extended,security-and-quality
-
-      - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
-        with:
-          category: /language:actions
-          # Fork PRs receive a read-only GITHUB_TOKEN, so SARIF upload to the
-          # code-scanning API would fail. Analyze still runs and surfaces
-          # findings in the job log; same-repo PRs upload as normal.
-          upload: ${{ github.event.pull_request.head.repo.full_name == github.repository && 'always' || 'never' }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 91cb2e6241..8fa5bd0f97 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,41 +1,28 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL Advanced"
+name: CodeQL
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [main]
   pull_request:
-    branches: [ "main" ]
+    branches: [main]
   schedule:
+    # Weekly, so a new query release is picked up even on a quiet week.
     - cron: '34 14 * * 0'
 
+# Deny by default; the analyze job declares exactly what it needs.
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
-      # required for all workflows
+      # Upload the SARIF result to the code-scanning API.
       security-events: write
-
-      # required to fetch internal or private CodeQL packs
+      # Fetch the CodeQL query packs.
       packages: read
-
-      # only required for workflows in private repositories
+      # Read workflow metadata (required for private repositories).
       actions: read
       contents: read
 
@@ -43,51 +30,47 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - language: actions
-          build-mode: none
-        - language: go
-          build-mode: autobuild
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
+          # The query suite is set per language, not once for the workflow,
+          # because the two languages have very different cost profiles.
+          #
+          # actions: measured at 49s with the extended+quality suites versus
+          # 50s with the default suite, so the extra 10 queries are free. They
+          # are also the ones this repo wants: `unpinned-tag`, the
+          # `*-injection/medium` and `untrusted-checkout/medium` variants (the
+          # default suite ships only the high/critical precision ones), and
+          # `if-expression-always-true`.
+          - language: actions
+            build-mode: none
+            queries: security-extended,security-and-quality
+          # go: autobuild compiles the module, which dominates this leg, so the
+          # query suite is close to free here too. Measured on this repo:
+          # 36 queries (default) 192s, 37 (extended) 150s, 59
+          # (extended+quality) 140s — the spread is runner noise, not suites.
+          #
+          # security-and-quality is enabled because its 23 Go additions are
+          # bug-finding queries, not style: the InconsistentCode family
+          # (MissingErrorCheck, WrappedErrorAlwaysNil, LengthComparisonOffByOne,
+          # UnhandledCloseWritableHandle) and the RedundantCode family
+          # (ImpossibleInterfaceNilCheck, DuplicateSwitchCase, ShiftOutOfRange,
+          # UnreachableStatement). Run against a local database they add two
+          # high-precision findings that golangci-lint does not report, so this
+          # is incremental coverage rather than overlap.
+          - language: go
+            build-mode: autobuild
+            queries: security-extended,security-and-quality
 
-    # Add any setup steps before running the `github/codeql-action/init` action.
-    # This includes steps like installing compilers or runtimes (`actions/setup-node`
-    # or others). This is typically only required for manual builds.
-    # - name: Setup runtime (example)
-    #   uses: actions/setup-example@v1
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    # If the analyze step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - name: Run manual build steps
-      if: matrix.build-mode == 'manual'
-      shell: bash
-      run: |
-        echo 'If you are using a "manual" build mode for one or more of the' \
-          'languages you are analyzing, replace this with the commands to build' \
-          'your code, for example:'
-        echo '  make bootstrap'
-        echo '  make release'
-        exit 1
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: ${{ matrix.queries }}
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:${{matrix.language}}"
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        with:
+          category: /language:${{ matrix.language }}

From 190b656d6c3ce1d7022f9abb4ecbdbd1c6d63bc4 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 17:23:58 +0200
Subject: [PATCH 34/59] fix: handle Close on the two writable handles that
 discarded it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`go/unhandled-writable-file-close` (CWE-252, precision high), surfaced by the
CodeQL `security-and-quality` suite being enabled for Go. Both sites did
`defer f.Close()` on a handle opened for writing, which throws away the error
that reports a failed flush — so the write is lost and the code carries on as
if it succeeded. golangci-lint reports neither.

`appendShellCompletion` already returns an error, so it now reports the close
through it via a named return. The consequence of not doing so was specific
rather than theoretical: the caller prints that shell completion is installed,
while the rc file never received the line.

vogon's `appendTranscriptEntry` writes the transcript the E2E canary asserts
on, so a truncated one invalidates the run instead of degrading it — every
downstream assertion then fails with a message about the wrong thing. It calls
the existing `fatal` helper, which is the difference between one accurate error
and 56 misleading ones. Its `Write` error was being dropped too and is now
checked on the same reasoning; the pre-existing silent return on a failed
*open* is left alone as a separate judgement call.

Verified with the CodeQL CLI against a local database of this repo rather than
by reading the diff: the go security-and-quality suite goes from 4 alerts to 2,
with zero `unhandled-writable-file-close` remaining. The 2 left are the
`allocation-size-overflow` false positives already dismissed upstream.

`mise run lint` clean, `GOOS=windows go vet ./...` clean, 91 packages pass under
`-race`, and the canary passes both legs (56 and 4 tests) with no vogon error
output, so the new fatal paths do not fire in a healthy run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25YP98Y5HARJXXKPNWDGPFH
---
 cmd/entire/cli/setup.go | 15 +++++++++++----
 e2e/vogon/main.go       | 13 +++++++++++--
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/cmd/entire/cli/setup.go b/cmd/entire/cli/setup.go
index f354f9693e..8d41dd9af2 100644
--- a/cmd/entire/cli/setup.go
+++ b/cmd/entire/cli/setup.go
@@ -2293,7 +2293,7 @@ func isCompletionConfigured(rcFile string) bool {
 }
 
 // appendShellCompletion adds the completion line to the rc file.
-func appendShellCompletion(rcFile, completionLine string) error {
+func appendShellCompletion(rcFile, completionLine string) (err error) {
 	if err := os.MkdirAll(filepath.Dir(rcFile), 0o700); err != nil {
 		return fmt.Errorf("creating directory: %w", err)
 	}
@@ -2302,10 +2302,17 @@ func appendShellCompletion(rcFile, completionLine string) error {
 	if err != nil {
 		return fmt.Errorf("opening file: %w", err)
 	}
-	defer f.Close()
+	// Close reports a failed flush on a writable handle, so discarding it would
+	// drop the append while this function returned nil — the caller then tells
+	// the user completion is installed when the rc file never received the line.
+	// A write error already in flight is the more specific one, so it wins.
+	defer func() {
+		if cerr := f.Close(); cerr != nil && err == nil {
+			err = fmt.Errorf("closing file: %w", cerr)
+		}
+	}()
 
-	_, err = f.WriteString("\n" + shellCompletionComment + "\n" + completionLine + "\n")
-	if err != nil {
+	if _, err := f.WriteString("\n" + shellCompletionComment + "\n" + completionLine + "\n"); err != nil {
 		return fmt.Errorf("writing completion: %w", err)
 	}
 	return nil
diff --git a/e2e/vogon/main.go b/e2e/vogon/main.go
index f5c987a615..00018c2e36 100644
--- a/e2e/vogon/main.go
+++ b/e2e/vogon/main.go
@@ -705,8 +705,17 @@ func appendTranscriptEntry(path string, entry transcriptEntry) {
 	if err != nil {
 		return
 	}
-	defer f.Close()
-	f.Write(data)
+	// The canary asserts on this transcript, so a partial one invalidates the
+	// run rather than degrading it: every downstream assertion fails with a
+	// message about the wrong thing. Report the real cause instead. Close is
+	// checked because it is where a failed flush surfaces.
+	if _, err := f.Write(data); err != nil {
+		_ = f.Close()
+		fatal("writing transcript %s: %v", path, err)
+	}
+	if err := f.Close(); err != nil {
+		fatal("closing transcript %s: %v", path, err)
+	}
 }
 
 func fatal(format string, args ...any) {

From c8278555270d2ffcc11a1c3d6fe46ffeacd0e57d Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 17:25:58 +0200
Subject: [PATCH 35/59] fix: propagate a signal that reached only the plugin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A signalled child reports ExitPluginSignalled either way, so the previous
commit re-raised only when this process had also received a signal and exited
1 otherwise — losing the signal exactly when the plugin was the only one to
get it. Ctrl-C reaches the whole foreground process group, but `kill -TERM`
aimed at the plugin does not, and neither does a SIGPIPE from `entire graph |
head -1`. Both are outcomes kubectl-style dispatch has to pass through.

runPlugin now reads the signal off the child's wait status and MaybeRunPlugin
returns it, so main.go re-raises the child's own signal, preferring it over
one we received. `kill -TERM` inside a plugin, measured end to end:

    PR head          exit=255   (os.Exit(-1), truncated)
    previous commit  exit=1     (signal lost)
    now              exit=143   and bash reports "Terminated: 15"

pluginTerminatingSignal is a build-tagged pair rather than a runtime.GOOS
branch: syscall.WaitStatus on Windows is a bare struct with an ExitCode field
and no Signaled/Signal methods, so a GOOS branch would not compile. Windows
reports a killed child as an ordinary exit code, so it never reaches this path
at all; the remaining "-1 with no signal on either side" case exits 1 rather
than inventing a signal to raise.

MaybeRunPlugin's third result is what unparam flagged as unused, correctly:
nothing in the package checked that the signal survived the trip out of the
dispatcher, which is the half main.go depends on. Both levels are covered now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25YSY75V465CHD9DXK30WG5
---
 cmd/entire/cli/plugin.go                | 44 ++++++++++-----
 cmd/entire/cli/plugin_on_demand_test.go | 12 ++--
 cmd/entire/cli/plugin_signal_unix.go    | 33 +++++++++++
 cmd/entire/cli/plugin_signal_windows.go | 14 +++++
 cmd/entire/cli/plugin_test.go           | 75 +++++++++++++++++++++++--
 cmd/entire/main.go                      | 30 +++++++---
 6 files changed, 175 insertions(+), 33 deletions(-)
 create mode 100644 cmd/entire/cli/plugin_signal_unix.go
 create mode 100644 cmd/entire/cli/plugin_signal_windows.go

diff --git a/cmd/entire/cli/plugin.go b/cmd/entire/cli/plugin.go
index e719ca6ee3..823f9badfd 100644
--- a/cmd/entire/cli/plugin.go
+++ b/cmd/entire/cli/plugin.go
@@ -47,6 +47,13 @@ const onDemandInstallPluginName = "graph"
 // deliberately not a valid exit status — os.Exit(-1) truncates to 255 — so
 // main.go re-raises the signal instead of exiting with it. -1 is already what
 // exec.ExitError.ExitCode() reports for a signalled child.
+//
+// MaybeRunPlugin's killedBy return says WHICH signal, when it is knowable.
+// The two are separate because they have different sources: the exit code
+// comes from the child's wait status, while the signal may have reached only
+// the child (`kill -TERM` at the plugin, SIGPIPE from a closed pipe) or only
+// this process (a Ctrl-C during the on-demand install, where there is no
+// child yet).
 const ExitPluginSignalled = -1
 
 // postPluginVersionCheck is a test seam for the version-check notice that
@@ -61,12 +68,17 @@ var postPluginVersionCheck = versioncheck.CheckAndNotify
 // signal interrupted an on-demand install before it ran; the caller turns
 // that into a re-raised signal rather than an exit status.
 //
+// killedBy is the signal the plugin was killed by, when the platform reports
+// one. It is nil for an ordinary exit, on Windows, and for an install
+// interrupted before any child existed — in that last case the signal is the
+// one this process received, which the caller already has.
+//
 // Telemetry and the version-check notice mirror Cobra's PersistentPostRun
 // behavior for built-ins: both fire only on a successful (exit-0) run.
-func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string) (handled bool, exitCode int) {
+func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string) (handled bool, exitCode int, killedBy os.Signal) {
 	binPath, pluginArgs, ok := resolvePlugin(rootCmd, args)
 	if !ok {
-		return false, 0
+		return false, 0, nil
 	}
 	pluginName := args[0]
 	if binPath == "" {
@@ -77,15 +89,17 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 			if errors.As(silencePluginCancel(ctx, err), &silent) {
 				// A signal interrupted the install. Report it as a signal
 				// rather than a plain failure so main.go re-raises it: a
-				// shell breaks an enclosing loop only on WIFSIGNALED.
-				return true, ExitPluginSignalled
+				// shell breaks an enclosing loop only on WIFSIGNALED. No
+				// child ran, so there is no child signal to name — the
+				// caller falls back to the one it received.
+				return true, ExitPluginSignalled, nil
 			}
 			fmt.Fprintln(rootCmd.ErrOrStderr(), RenderUserFacingError(err))
-			return true, 1
+			return true, 1, nil
 		}
 		if binPath == "" {
 			// The command was not executed because installation was declined.
-			return true, 1
+			return true, 1, nil
 		}
 		// Say what is happening now: the install may have taken a while, and
 		// it is the reason the user is still waiting.
@@ -99,7 +113,7 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 		// is the same hazard hasTerminalControlChars exists for.
 		fmt.Fprintf(rootCmd.ErrOrStderr(), "Running %s%s\n", pluginBinaryPrefix, pluginName)
 	}
-	exitCode = runPlugin(ctx, pluginName, binPath, pluginArgs)
+	exitCode, killedBy = runPlugin(ctx, pluginName, binPath, pluginArgs)
 	if exitCode == 0 {
 		maybeTrackPluginInvocation(ctx, pluginName)
 		// Stderr, matching the built-in PersistentPostRun: the plugin's own
@@ -112,7 +126,7 @@ func MaybeRunPlugin(ctx context.Context, rootCmd *cobra.Command, args []string)
 			postPluginVersionCheck(ctx, os.Stderr, versioninfo.Version)
 		}
 	}
-	return true, exitCode
+	return true, exitCode, killedBy
 }
 
 // maybeTrackPluginInvocation fires telemetry only for plugins on the
@@ -223,7 +237,7 @@ func isAgentProtocolBinary(binPath string) bool {
 // On context cancellation the child gets SIGINT (with a 5s grace before the
 // runtime falls back to SIGKILL) so plugins can clean up. Terminal signals
 // reach the child directly via the shared process group.
-func runPlugin(ctx context.Context, pluginName, binPath string, args []string) int {
+func runPlugin(ctx context.Context, pluginName, binPath string, args []string) (exitCode int, killedBy os.Signal) {
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	cmd.Cancel = func() error { return cmd.Process.Signal(os.Interrupt) }
 	cmd.WaitDelay = 5 * time.Second
@@ -267,14 +281,16 @@ func runPlugin(ctx context.Context, pluginName, binPath string, args []string) i
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
 			// A signalled child reports -1, i.e. ExitPluginSignalled: it is
-			// not an exit status, so main.go re-raises the signal rather than
-			// letting os.Exit truncate it to 255.
-			return exitErr.ExitCode()
+			// not an exit status, so the caller re-raises the signal rather
+			// than letting os.Exit truncate it to 255. Which signal comes
+			// from the wait status, because it need not be one this process
+			// received — see pluginTerminatingSignal.
+			return exitErr.ExitCode(), pluginTerminatingSignal(exitErr.ProcessState)
 		}
 		// Prefix with the plugin name so users can tell parent vs child
 		// errors apart in mixed stderr.
 		fmt.Fprintf(os.Stderr, "Failed to run plugin %s: %v\n", filepath.Base(binPath), err)
-		return 1
+		return 1, nil
 	}
-	return 0
+	return 0, nil
 }
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
index 60749ebab0..d49ec11b5b 100644
--- a/cmd/entire/cli/plugin_on_demand_test.go
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -27,7 +27,7 @@ func TestMaybeRunPlugin_MissingGraphNonInteractive(t *testing.T) { //nolint:para
 	root := newTestRoot()
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
-	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "search", "hello"})
+	handled, code, _ := MaybeRunPlugin(t.Context(), root, []string{"graph", "search", "hello"})
 	if !handled || code != 1 {
 		t.Fatalf("handled=%v code=%d, want true, 1", handled, code)
 	}
@@ -98,7 +98,7 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			data := strings.NewReader("plugin data\n")
 			root.SetIn(data)
 			args := []string{"graph", "search", "two words", "--json", "--", "$(untouched)", ""}
-			handled, code := MaybeRunPlugin(ctx, root, args)
+			handled, code, _ := MaybeRunPlugin(ctx, root, args)
 			if !handled || code != tc.wantCode {
 				t.Fatalf("handled=%v code=%d, want true, %d; stderr=%s", handled, code, tc.wantCode, &stderr)
 			}
@@ -141,7 +141,7 @@ func TestMaybeRunPlugin_GraphInstalledSkipsPrompt(t *testing.T) { //nolint:paral
 	root := newTestRoot()
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
-	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "--help"})
+	handled, code, _ := MaybeRunPlugin(t.Context(), root, []string{"graph", "--help"})
 	if !handled || code != 0 || stderr.Len() != 0 {
 		t.Fatalf("handled=%v code=%d stderr=%q", handled, code, stderr.String())
 	}
@@ -199,7 +199,7 @@ func TestMaybeRunPlugin_GraphInManagedDirIsRunNotReinstalled(t *testing.T) { //n
 	root := newTestRoot()
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
-	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "search", "hello"})
+	handled, code, _ := MaybeRunPlugin(t.Context(), root, []string{"graph", "search", "hello"})
 	if !handled || code != 0 {
 		t.Fatalf("handled=%v code=%d, want true, 0; stderr=%s", handled, code, &stderr)
 	}
@@ -235,7 +235,7 @@ func TestMaybeRunPlugin_AnnouncementNeverEchoesArguments(t *testing.T) { //nolin
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
 	args := []string{"graph", "--token", "s3cr3t", "\x1b[1A\x1b[2Kforged", "line\nbreak"}
-	if handled, code := MaybeRunPlugin(t.Context(), root, args); !handled || code != 0 {
+	if handled, code, _ := MaybeRunPlugin(t.Context(), root, args); !handled || code != 0 {
 		t.Fatalf("handled=%v code=%d; stderr=%s", handled, code, &stderr)
 	}
 	if !strings.Contains(stderr.String(), "Running entire-graph\n") {
@@ -286,7 +286,7 @@ func TestMaybeRunPlugin_BrokenManagedEntryReportsARemedy(t *testing.T) { //nolin
 	root := newTestRoot()
 	var stderr bytes.Buffer
 	root.SetErr(&stderr)
-	handled, code := MaybeRunPlugin(t.Context(), root, []string{"graph", "search"})
+	handled, code, _ := MaybeRunPlugin(t.Context(), root, []string{"graph", "search"})
 	if !handled || code != 1 {
 		t.Fatalf("handled=%v code=%d, want true, 1; stderr=%s", handled, code, &stderr)
 	}
diff --git a/cmd/entire/cli/plugin_signal_unix.go b/cmd/entire/cli/plugin_signal_unix.go
new file mode 100644
index 0000000000..3b36ff3cad
--- /dev/null
+++ b/cmd/entire/cli/plugin_signal_unix.go
@@ -0,0 +1,33 @@
+//go:build !windows
+
+package cli
+
+import (
+	"os"
+	"syscall"
+)
+
+// pluginTerminatingSignal reports the signal a plugin was killed by, or nil
+// when it exited normally.
+//
+// Build-tagged rather than switched on runtime.GOOS because the API is absent
+// on Windows, not merely inapplicable: syscall.WaitStatus there is a bare
+// struct with an ExitCode field and no Signaled/Signal methods, so a
+// runtime.GOOS branch would not compile.
+//
+// A signal is not something the parent necessarily saw. Ctrl-C reaches the
+// whole foreground process group, but `kill -TERM` aimed at the plugin, and a
+// SIGPIPE from `entire graph | head -1`, reach the child alone — and
+// kubectl-style dispatch has to propagate the external command's outcome
+// either way, so the signal has to come off the child's wait status rather
+// than out of what this process was told.
+func pluginTerminatingSignal(state *os.ProcessState) os.Signal {
+	if state == nil {
+		return nil
+	}
+	ws, ok := state.Sys().(syscall.WaitStatus)
+	if !ok || !ws.Signaled() {
+		return nil
+	}
+	return ws.Signal()
+}
diff --git a/cmd/entire/cli/plugin_signal_windows.go b/cmd/entire/cli/plugin_signal_windows.go
new file mode 100644
index 0000000000..c0a2936490
--- /dev/null
+++ b/cmd/entire/cli/plugin_signal_windows.go
@@ -0,0 +1,14 @@
+//go:build windows
+
+package cli
+
+import "os"
+
+// pluginTerminatingSignal always reports nil on Windows: there are no signals
+// to propagate. A process ended by TerminateProcess reports an ordinary exit
+// code, which ProcessState.ExitCode returns as-is, so a killed child never
+// reaches the ExitPluginSignalled path here in the first place.
+//
+// See plugin_signal_unix.go for why this is a build-tagged pair rather than a
+// runtime.GOOS branch.
+func pluginTerminatingSignal(*os.ProcessState) os.Signal { return nil }
diff --git a/cmd/entire/cli/plugin_test.go b/cmd/entire/cli/plugin_test.go
index 05bae3b165..95c218c341 100644
--- a/cmd/entire/cli/plugin_test.go
+++ b/cmd/entire/cli/plugin_test.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/spf13/cobra"
@@ -210,7 +211,7 @@ func TestMaybeRunPlugin_RelativePathEntry_ErrDotNotBypassed(t *testing.T) { //no
 	// exec.LookPath call inside resolvePlugin will observe.
 	t.Setenv("PATH", "bin"+string(os.PathListSeparator)+origPath)
 
-	handled, _ := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"errdotcheck"})
+	handled, _, _ := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"errdotcheck"})
 	if handled {
 		t.Fatal("a plugin reachable only via a RELATIVE PATH entry must not resolve/execute " +
 			"(this is the exec.ErrDot bypass / RCE the fix prevents)")
@@ -225,10 +226,13 @@ func TestRunPlugin_ExitCodePropagation(t *testing.T) {
 	dir := t.TempDir()
 	binPath := writePluginBinary(t, dir, "entire-exit42", filepath.Join(dir, "args.txt"), 42)
 
-	code := runPlugin(context.Background(), "exit42", binPath, []string{"a", "b"})
+	code, killedBy := runPlugin(context.Background(), "exit42", binPath, []string{"a", "b"})
 	if code != 42 {
 		t.Errorf("exit code: got %d, want 42", code)
 	}
+	if killedBy != nil {
+		t.Errorf("ordinary exit reported signal %v", killedBy)
+	}
 	contents, err := os.ReadFile(filepath.Join(dir, "args.txt"))
 	if err != nil {
 		t.Fatalf("read argfile: %v", err)
@@ -255,7 +259,7 @@ func TestMaybeRunPlugin_VersionCheckAfterSuccess(t *testing.T) { //nolint:parall
 	withPathDir(t, dir)
 	calls := interceptVersionCheck(t)
 
-	handled, code := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"pgr"})
+	handled, code, _ := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"pgr"})
 	if !handled || code != 0 {
 		t.Fatalf("handled=%v code=%d, want handled=true code=0", handled, code)
 	}
@@ -273,7 +277,7 @@ func TestMaybeRunPlugin_NoVersionCheckAfterSelfUpdate(t *testing.T) { //nolint:p
 	withPathDir(t, dir)
 	calls := interceptVersionCheck(t)
 
-	handled, code := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"upgrade", "--nightly"})
+	handled, code, _ := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"upgrade", "--nightly"})
 	if !handled || code != 0 {
 		t.Fatalf("handled=%v code=%d, want handled=true code=0", handled, code)
 	}
@@ -288,7 +292,7 @@ func TestMaybeRunPlugin_NoVersionCheckAfterFailure(t *testing.T) { //nolint:para
 	withPathDir(t, dir)
 	calls := interceptVersionCheck(t)
 
-	handled, code := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"pgr"})
+	handled, code, _ := MaybeRunPlugin(context.Background(), newTestRoot(), []string{"pgr"})
 	if !handled || code != 3 {
 		t.Fatalf("handled=%v code=%d, want handled=true code=3", handled, code)
 	}
@@ -328,3 +332,64 @@ func TestFindInaccessiblePlugin_SkipsRelativePATHEntry(t *testing.T) {
 		t.Errorf("findInaccessiblePlugin found %q via a relative $PATH entry, want no match", got)
 	}
 }
+
+// A signal that reaches only the plugin still has to propagate. Ctrl-C hits
+// the whole foreground process group, so the parent sees it too — but a
+// `kill -TERM` aimed at the plugin and a SIGPIPE from a closed pipe do not,
+// and reporting those as a plain exit-1 loses the signal that kubectl-style
+// dispatch exists to pass through.
+func TestRunPlugin_ReportsTheChildsOwnSignal(t *testing.T) {
+	t.Parallel()
+	if runtime.GOOS == windowsGOOS {
+		t.Skip("no signals to propagate on Windows")
+	}
+	for _, tc := range []struct {
+		name   string
+		script string
+		want   syscall.Signal
+	}{
+		{name: "self-terminated", script: "kill -TERM $$", want: syscall.SIGTERM},
+		{name: "self-interrupted", script: "kill -INT $$", want: syscall.SIGINT},
+		{name: "broken pipe", script: "kill -PIPE $$", want: syscall.SIGPIPE},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			dir := t.TempDir()
+			binPath := filepath.Join(dir, "entire-signaller")
+			script := "#!/bin/sh\ntrap - TERM INT PIPE\n" + tc.script + "\n"
+			if err := os.WriteFile(binPath, []byte(script), 0o755); err != nil {
+				t.Fatal(err)
+			}
+			code, killedBy := runPlugin(t.Context(), "signaller", binPath, nil)
+			if code != ExitPluginSignalled {
+				t.Fatalf("exit code=%d, want ExitPluginSignalled", code)
+			}
+			if killedBy != tc.want {
+				t.Errorf("killedBy=%v, want %v — the signal reached only the child, so it has to come off the wait status", killedBy, tc.want)
+			}
+		})
+	}
+}
+
+// The signal has to survive the trip out of the dispatcher too: MaybeRunPlugin
+// is what main.go sees, and it is main.go that re-raises.
+func TestMaybeRunPlugin_PropagatesTheChildsSignal(t *testing.T) { //nolint:paralleltest // mutates PATH
+	if runtime.GOOS == windowsGOOS {
+		t.Skip("no signals to propagate on Windows")
+	}
+	dir := t.TempDir()
+	binPath := filepath.Join(dir, "entire-signaller")
+	if err := os.WriteFile(binPath, []byte("#!/bin/sh\ntrap - TERM\nkill -TERM $$\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", dir)
+	interceptVersionCheck(t)
+
+	handled, code, killedBy := MaybeRunPlugin(t.Context(), newTestRoot(), []string{"signaller"})
+	if !handled || code != ExitPluginSignalled {
+		t.Fatalf("handled=%v code=%d, want true, ExitPluginSignalled", handled, code)
+	}
+	if killedBy != syscall.SIGTERM {
+		t.Errorf("killedBy=%v, want SIGTERM; main.go re-raises this, so losing it here exits 1 instead of 143", killedBy)
+	}
+}
diff --git a/cmd/entire/main.go b/cmd/entire/main.go
index 75f74d182c..385d87bbdd 100644
--- a/cmd/entire/main.go
+++ b/cmd/entire/main.go
@@ -80,26 +80,40 @@ func main() {
 	// inherits the prepended PATH so it can spawn sibling managed plugins.
 	restorePATH := cli.PrependPluginBinDirToPATH(ctx)
 
-	if handled, code := cli.MaybeRunPlugin(ctx, rootCmd, os.Args[1:]); handled {
+	if handled, code, killedBy := cli.MaybeRunPlugin(ctx, rootCmd, os.Args[1:]); handled {
 		cancel()
 		if code == cli.ExitPluginSignalled {
 			// The plugin was terminated by a signal, or a signal interrupted
 			// the on-demand install before it ran. Re-raise so the shell sees
-			// WIFSIGNALED and an enclosing loop breaks on one Ctrl-C.
+			// WIFSIGNALED: an enclosing loop breaks on one Ctrl-C, and the
+			// conventional 128+signum reaches whoever ran us.
 			//
 			// Gated on the plugin's own outcome rather than on a signal
 			// having fired somewhere in this process: Ctrl-C reaches the whole
 			// foreground process group, so a plugin that handles it itself and
 			// exits with a meaningful code (a TUI quitting on Ctrl-C exits 0)
 			// must keep that code instead of being reported as killed.
-			if procsignal.Load() != nil {
+			switch {
+			case killedBy != nil:
+				// The child's own signal, which is not necessarily one we
+				// received: `kill -TERM` aimed at the plugin must still exit
+				// 143, and a SIGPIPE from `entire graph | head -1` must still
+				// exit 141. Preferred over ours so the external command's
+				// outcome is what propagates.
+				dieFromSignal(killedBy)
+			case procsignal.Load() != nil:
+				// No child signal to name — the on-demand install was
+				// interrupted before any child existed — so die from what we
+				// were sent.
 				dieFromSignal(terminatingSignal())
+			default:
+				// -1 with no signal on either side. Windows reports a killed
+				// child as an ordinary exit code, so it never lands here;
+				// anything that does is unaccounted for, and -1 is not an
+				// exit status (os.Exit would truncate it to 255), so report a
+				// plain failure rather than inventing a signal.
+				os.Exit(1)
 			}
-			// Killed by a signal we never received ourselves — an external
-			// kill, or a crash. There is no signal to re-raise, and -1 is not
-			// an exit status (os.Exit would truncate it to 255), so report a
-			// plain failure. The child has already said what happened.
-			os.Exit(1)
 		}
 		os.Exit(code)
 	}

From 7efb51f5413c85a435d26c980f9506689640f6e1 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 17:38:50 +0200
Subject: [PATCH 36/59] fix: name the on-demand prompt's source, and correct
 the EOF claim
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The prompt is the only human checkpoint before a remote binary is downloaded
and executed — an index-listed install never prompts inside runRemoteInstall,
because the catalog is the trust decision — and it named neither its catalog
nor its repository while defaulting to Yes. confirmInstallOrCancel names
redactURL(repoURL) for an unlisted repo and defaults to No, so the one
unprompted-command-to-exec path described itself least. It now resolves the
index entry first and asks:

    Install the entire-graph plugin from https://github.com/entireio/entire-graph?

Resolving first also removes a prompt-then-fail: a name the index does not
carry cannot be installed at all, so it is now reported instead of offered,
the same shape as the already-installed dead end. Not an extra round-trip —
SyncPluginIndex touches a freshness marker and runRemoteInstall's own call
moments later reads the clone without fetching (pluginIndexTTL) — and the
progress step stops before the prompt.

The docs claimed "EOF declines" for both prompt modes. Measured, with an
input that EOFs immediately:

    accessible        returns at once, ok=false err=nil        (declines)
    default (tea)     blocks to the deadline, "cancelled"      (never answers)

Both fail closed, so this was doc accuracy rather than a hole, but only one
of them declines. The sentence now says which does what and why.

The on-demand tests gain a local file:// index, since the prompt text now
depends on a resolved entry: without it they would consult the real published
catalog over the network.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M25ZHG577Q1PD3S30XEV1P5Q
---
 cmd/entire/cli/plugin_on_demand.go      | 35 +++++++++++++++++-
 cmd/entire/cli/plugin_on_demand_test.go | 49 +++++++++++++++++++++++--
 docs/architecture/external-commands.md  |  4 +-
 3 files changed, 82 insertions(+), 6 deletions(-)

diff --git a/cmd/entire/cli/plugin_on_demand.go b/cmd/entire/cli/plugin_on_demand.go
index fa5fa5c976..fadc6d43ee 100644
--- a/cmd/entire/cli/plugin_on_demand.go
+++ b/cmd/entire/cli/plugin_on_demand.go
@@ -53,7 +53,40 @@ func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name stri
 	if err := ctx.Err(); err != nil {
 		return "", fmt.Errorf("install plugin: %w", err)
 	}
-	confirmed, err := runPluginConfirm(ctx, rootCmd.ErrOrStderr(), fmt.Sprintf("Install the entire-%s plugin?", name), true)
+
+	// Resolve the source before asking, for two reasons.
+	//
+	// The prompt is the only human checkpoint on this path — an index-listed
+	// install never prompts inside runRemoteInstall, because the catalog is
+	// the trust decision — so it has to say where the binary comes from.
+	// confirmInstallOrCancel names redactURL(repoURL) for an unlisted
+	// repository; a prompt that defaults to Yes and names nothing tells the
+	// user less about a download-and-exec than the one that defaults to No.
+	//
+	// And a name the index does not carry cannot be installed at all, so
+	// asking first and failing afterwards spends the user's Yes on a question
+	// that never had an answer — the same prompt-then-dead-end shape as the
+	// already-installed case above.
+	//
+	// This is not an extra round-trip: SyncPluginIndex touches a freshness
+	// marker, and runRemoteInstall's own call moments later reads the clone
+	// without fetching (pluginIndexTTL). Progress is reported and stopped
+	// before the prompt, per the rule that a spinner never overlaps a
+	// confirmation.
+	indexURL := resolvePluginIndexURL("")
+	stopIndex := startPluginStep(withPluginProgress(ctx, rootCmd.ErrOrStderr()), "Checking plugin index...")
+	idx, err := SyncPluginIndex(ctx, indexURL, false)
+	stopIndex()
+	if err != nil {
+		return "", fmt.Errorf("look up the entire-%s plugin in the plugin index %s: %w", name, redactURL(indexURL), err)
+	}
+	entry := idx.Find(name)
+	if entry == nil {
+		return "", fmt.Errorf("the entire-%s plugin is not listed in the plugin index %s, so it cannot be installed on demand; install it from its repository URL with 'entire plugin install <url>'", name, redactURL(indexURL))
+	}
+
+	confirmed, err := runPluginConfirm(ctx, rootCmd.ErrOrStderr(),
+		fmt.Sprintf("Install the entire-%s plugin from %s?", name, redactURL(entry.RepoURL)), true)
 	if err != nil {
 		if ctx.Err() != nil {
 			return "", err
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
index d49ec11b5b..ff4fd7bd28 100644
--- a/cmd/entire/cli/plugin_on_demand_test.go
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -57,11 +57,21 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			dir := t.TempDir()
-			t.Setenv("PATH", dir)
+			// dir first so entire-graph is unresolvable, but git still
+			// reachable: the index clone shells out to it.
+			withIsolatedPath(t)
+			withPathDir(t, dir)
 			t.Setenv("ENTIRE_PLUGIN_DIR", filepath.Join(dir, "managed"))
 			t.Setenv("ENTIRE_TEST_TTY", "1")
 			t.Setenv("ACCESSIBLE", "1")
 			t.Setenv("ENTIRE_TELEMETRY_OPTOUT", "1")
+			// The prompt names the repository the binary comes from, so the
+			// entry has to resolve before it is shown. A local index keeps
+			// that off the network — without it these tests would consult the
+			// real published catalog.
+			withIndexCache(t)
+			indexURL, _ := newIndexRepo(t, `{"version":1,"plugins":[{"name":"graph","repo_url":"https://github.com/entireio/entire-graph"}]}`)
+			t.Setenv(pluginIndexEnvVar, indexURL)
 			interceptVersionCheck(t)
 			argFile := filepath.Join(dir, "args.txt")
 			sourceDir := t.TempDir()
@@ -105,8 +115,12 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 			if (installCalls == 1) != tc.wantInstall {
 				t.Errorf("install calls=%d, want install=%v", installCalls, tc.wantInstall)
 			}
-			if !strings.Contains(stderr.String(), "Install the entire-graph plugin?") || !strings.Contains(stderr.String(), "[Y/n]") {
-				t.Errorf("missing Yes-default prompt: %q", stderr.String())
+			// The prompt names its source: this is the only human checkpoint
+			// before a remote binary is downloaded and executed, and an
+			// index-listed install never prompts inside runRemoteInstall.
+			if !strings.Contains(stderr.String(), "Install the entire-graph plugin from https://github.com/entireio/entire-graph?") ||
+				!strings.Contains(stderr.String(), "[Y/n]") {
+				t.Errorf("prompt must name the repository and default to Yes: %q", stderr.String())
 			}
 			if data.Len() != len("plugin data\n") {
 				t.Error("confirmation consumed plugin stdin")
@@ -353,3 +367,32 @@ func TestCheckManagedPluginRunnable(t *testing.T) {
 		})
 	}
 }
+
+// A name the index does not carry cannot be installed, so it must not be
+// offered. Asking first and failing afterwards spends the user's Yes on a
+// question that never had an answer.
+func TestMaybeRunPlugin_UnlistedNameIsNotOffered(t *testing.T) { //nolint:paralleltest // isolates PATH, index cache and terminal detection
+	withIsolatedPluginEnv(t)
+	withIndexCache(t)
+	indexURL, _ := newIndexRepo(t, `{"version":1,"plugins":[{"name":"other","repo_url":"https://example.invalid/entire-other"}]}`)
+	t.Setenv(pluginIndexEnvVar, indexURL)
+	t.Setenv("ENTIRE_TEST_TTY", "1")
+	t.Setenv("ACCESSIBLE", "1")
+	originalTerminal := openPluginPromptTerminal
+	openPluginPromptTerminal = func() (pluginPromptTerminal, error) {
+		t.Error("an unlisted plugin must not be offered for installation")
+		return pluginPromptTerminal{in: io.NopCloser(strings.NewReader("y\n"))}, nil
+	}
+	t.Cleanup(func() { openPluginPromptTerminal = originalTerminal })
+
+	root := newTestRoot()
+	var stderr bytes.Buffer
+	root.SetErr(&stderr)
+	handled, code, _ := MaybeRunPlugin(t.Context(), root, []string{"graph"})
+	if !handled || code != 1 {
+		t.Fatalf("handled=%v code=%d, want true, 1; stderr=%s", handled, code, &stderr)
+	}
+	if !strings.Contains(stderr.String(), "not listed in the plugin index") {
+		t.Errorf("missing diagnosis: %q", stderr.String())
+	}
+}
diff --git a/docs/architecture/external-commands.md b/docs/architecture/external-commands.md
index a0ac418612..a2745da42a 100644
--- a/docs/architecture/external-commands.md
+++ b/docs/architecture/external-commands.md
@@ -16,7 +16,7 @@ Rules, in order:
 2. **Reserved names are skipped.** Names beginning with `agent-` are reserved for the [agent protocol](external-agent-protocol.md). The resolver refuses to invoke them as external commands.
 3. **Path-traversal candidates are rejected.** Names containing `/` or `\` never resolve.
 4. **Found-but-not-executable surfaces as a launch error.** If `entire-<name>` exists on `$PATH` but lacks the executable bit, the resolver reports `Failed to run plugin entire-<name>` with exit code 1, rather than falling through to Cobra's "unknown command" path.
-5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` asks `Install the entire-graph plugin?` with Yes selected by default. Accepting installs `graph` through the configured plugin index using the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr, and the run that follows is announced as `Running entire-graph` — the binary's name only, never the arguments, which are the user's own command line and could carry a token, a newline or a terminal escape into stderr and anything capturing it. Declining or a failed installation exits nonzero without running the command; a cancelled one terminates by signal, so a single Ctrl-C escapes an enclosing shell loop. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
+5. **Missing Graph offers installation.** When `entire-graph` is absent, `entire graph <command>` resolves `graph` in the configured plugin index and asks `Install the entire-graph plugin from <repo url>?` with Yes selected by default. The repository is named because this prompt is the only human checkpoint on the path — an index-listed install never prompts inside `runRemoteInstall`, since the catalog is the trust decision. A name the index does not carry is reported instead of offered, rather than prompting and then failing on a request that could never be honored. Accepting installs `graph` through the normal managed installer, then executes the installed binary with all remaining arguments unchanged. This also works for bare `entire graph` and `entire graph --help`. Installation output goes to stderr, and the run that follows is announced as `Running entire-graph` — the binary's name only, never the arguments, which are the user's own command line and could carry a token, a newline or a terminal escape into stderr and anything capturing it. Declining or a failed installation exits nonzero without running the command; a cancelled one terminates by signal, so a single Ctrl-C escapes an enclosing shell loop. Non-interactive sessions receive an `entire plugin install graph` hint instead of a prompt. Other missing plugin names still fall through to Cobra.
 
    A `graph` that is already in the [managed install directory](#managed-install-directory) but unreachable through `$PATH` — a managed dir that could not be prepended at startup — is **executed**, not offered for installation. Installing over it cannot work: an existing install needs `--force`, which the on-demand path deliberately does not pass, so prompting would spend the user's Yes and several network round-trips on a guaranteed "already installed; use --force to replace".
 
@@ -39,7 +39,7 @@ The CLI prepends this directory to `$PATH` at startup via `cli.PrependPluginBinD
 
 Progress travels on the context (`withPluginProgress`), so a caller that has not opted in prints nothing — a library caller never writes to the process's terminal on its own.
 
-Confirmations read from the **controlling terminal**, never stdin, so a plugin's piped input survives being prompted about. They render to the writer the caller supplies, except when that writer is not itself a terminal (`entire graph 2>log`): then the prompt renders on the terminal the answer is read from, because a prompt nobody can see still blocks on a keypress — and with Yes as the default, an unwitting Enter would authorize the install. EOF declines; cancellation stops the prompt and still terminates by signal.
+Confirmations read from the **controlling terminal**, never stdin, so a plugin's piped input survives being prompted about. They render to the writer the caller supplies, except when that writer is not itself a terminal (`entire graph 2>log`): then the prompt renders on the terminal the answer is read from, because a prompt nobody can see still blocks on a keypress — and with Yes as the default, an unwitting Enter would authorize the install. An input that reaches EOF never becomes a Yes, but the two modes get there differently: accessibility mode declines outright — huh's scanner would otherwise read EOF as the field's default, which is Yes here — while the default full-screen prompt keeps waiting until the context is cancelled. Both fail closed; only one of them answers. Cancellation stops the prompt either way, and still terminates by signal.
 
 ### Remote install
 

From 325483e9a157c17fe37f1e2635f75d0a660bff72 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 10 Sep 2026 18:20:03 +0200
Subject: [PATCH 37/59] fix: prefer Entire's own signal, and bind the install
 to the prompted repo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings, both on commits earlier in this branch.

The signal precedence was backwards. runPlugin's cmd.Cancel sends the child
SIGINT whatever Entire was sent, so when Entire is signalled the child's
signal is Entire's own signal laundered — and laundered lossily. Preferring
the child's therefore reported the wrong thing for exactly the case
dieFromSignal's doc comment calls out: "a SIGTERM (from a supervisor /
container stop) must exit 143, not masquerade as a SIGINT 130". Measured with
a plugin that ignores SIGINT and so outlives WaitDelay:

    before   supervisor SIGTERM -> parent dies of SIGKILL (137)
    after    supervisor SIGTERM -> parent dies of SIGTERM (143)

The child's signal is now used only when Entire received none, which is
precisely when nothing laundered it: `kill -TERM` at the plugin still exits
143, SIGPIPE from a closed pipe still exits 141.

Naming the repository in the prompt introduced a TOCTOU on the trust
decision it exists to make. runRemoteInstall re-resolved the name through a
second SyncPluginIndex, and the two reads can disagree: a refresh that fails
leaves the freshness marker untouched, so the next call retries the fetch and
may succeed with different content, and a concurrent `plugin index update
--force` rewrites the clone under the lock either way. The prompt could name
repository A while repository B was downloaded and executed. installSource
gains a Resolved entry that travels with the request, so nothing is
re-resolved after the user has agreed. An idxErr stops being fatal on that
path, since the caller has already done the lookup and the index is needed
afterwards only for dependency planning, which already degrades to a warning.

TestExternalCommand_ParentsSignalOutranksTheChilds covers the precedence
against the real binary — main.go had no automated coverage for this at all —
and fails with "parent died of killed, want SIGTERM" against the old order.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M261WZ3GJH3BBPSSY3TJ0TNX
---
 .../external_command_signal_unix_test.go      | 70 +++++++++++++++++++
 cmd/entire/cli/plugin_group.go                | 26 ++++++-
 cmd/entire/cli/plugin_on_demand.go            |  6 +-
 cmd/entire/cli/plugin_on_demand_test.go       |  6 ++
 cmd/entire/cli/plugin_progress_test.go        | 37 ++++++++++
 cmd/entire/main.go                            | 25 ++++---
 6 files changed, 156 insertions(+), 14 deletions(-)

diff --git a/cmd/entire/cli/integration_test/external_command_signal_unix_test.go b/cmd/entire/cli/integration_test/external_command_signal_unix_test.go
index c5c519d18a..fd0a8511f2 100644
--- a/cmd/entire/cli/integration_test/external_command_signal_unix_test.go
+++ b/cmd/entire/cli/integration_test/external_command_signal_unix_test.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
@@ -92,3 +93,72 @@ func waitForFile(path string, timeout time.Duration) bool {
 	}
 	return false
 }
+
+// A signal Entire received outranks the one its child died of.
+//
+// Cancelling the context makes runPlugin send the plugin SIGINT whatever
+// Entire itself was sent, so the child's signal is often Entire's own signal
+// laundered — and laundered lossily. A supervisor's SIGTERM must still leave
+// Entire dying of SIGTERM (143), not of whatever the child ended up with:
+// this plugin ignores SIGINT, so it outlives WaitDelay and os/exec SIGKILLs
+// it, which reported 137 before the precedence was fixed.
+func TestExternalCommand_ParentsSignalOutranksTheChilds(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	readyFile := filepath.Join(dir, "ready.txt")
+	// Longer than the parent's WaitDelay (5s) plus grace, so the child is
+	// still alive when the delay expires and is killed rather than exiting.
+	const pluginLoopSeconds = 20
+	body := fmt.Sprintf(
+		"#!/bin/sh\ntrap '' INT\n"+
+			"echo ready > %q\n"+
+			"i=0\nwhile [ $i -lt %d ]; do sleep 0.1; i=$((i+1)); done\nexit 0\n",
+		readyFile, pluginLoopSeconds*10,
+	)
+	if err := os.WriteFile(filepath.Join(dir, "entire-ignoreint"), []byte(body), 0o755); err != nil {
+		t.Fatalf("write plugin: %v", err)
+	}
+
+	cmd := execx.NonInteractive(context.Background(), getTestBinary(), "ignoreint")
+	cmd.Env = pathWith(dir)
+	var pStderr bytes.Buffer
+	cmd.Stdout = &bytes.Buffer{}
+	cmd.Stderr = &pStderr
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start: %v", err)
+	}
+	if !waitForFile(readyFile, 5*time.Second) {
+		if killErr := cmd.Process.Kill(); killErr != nil {
+			t.Logf("kill process: %v", killErr)
+		}
+		if waitErr := cmd.Wait(); waitErr != nil {
+			t.Logf("wait after kill: %v", waitErr)
+		}
+		t.Fatalf("plugin never reached ready state\nparent stderr:\n%s", pStderr.String())
+	}
+
+	// A supervisor or container stop, not a terminal Ctrl-C: only the parent
+	// is signalled, and with SIGTERM rather than SIGINT.
+	if err := cmd.Process.Signal(syscall.SIGTERM); err != nil {
+		t.Fatalf("signal parent: %v", err)
+	}
+	waitErr := cmd.Wait()
+	if waitErr == nil {
+		t.Fatalf("parent exited 0 after SIGTERM\nparent stderr:\n%s", pStderr.String())
+	}
+
+	// Re-raised, so the parent is genuinely WIFSIGNALED: an os.Exit(143) would
+	// not break an enclosing shell loop.
+	ws, ok := cmd.ProcessState.Sys().(syscall.WaitStatus)
+	if !ok {
+		t.Fatalf("no wait status: %v", waitErr)
+	}
+	if !ws.Signaled() {
+		t.Fatalf("parent exited %d rather than dying from a signal\nparent stderr:\n%s",
+			cmd.ProcessState.ExitCode(), pStderr.String())
+	}
+	if ws.Signal() != syscall.SIGTERM {
+		t.Errorf("parent died of %v, want SIGTERM — the child's signal (SIGKILL here) must not outrank ours\nparent stderr:\n%s",
+			ws.Signal(), pStderr.String())
+	}
+}
diff --git a/cmd/entire/cli/plugin_group.go b/cmd/entire/cli/plugin_group.go
index b21130ccd6..aac97d892f 100644
--- a/cmd/entire/cli/plugin_group.go
+++ b/cmd/entire/cli/plugin_group.go
@@ -74,6 +74,18 @@ type installSource struct {
 	// Ref is the repository URL, the filesystem path, or the catalog name,
 	// according to Kind.
 	Ref string
+	// Resolved is the catalog entry a caller already looked up for Ref.
+	//
+	// Set it whenever the caller has SHOWN the user which repository will be
+	// installed. runRemoteInstall reads the index for its own reasons, and
+	// that second read can disagree with the first: a refresh that failed
+	// leaves the freshness marker untouched, so the next call retries the
+	// fetch and may succeed with different content, and a concurrent
+	// `plugin index update --force` rewrites the clone under the lock either
+	// way. Re-resolving after a confirmation therefore lets the prompt name
+	// repository A while repository B is downloaded and executed — which
+	// makes naming the repository worse than useless.
+	Resolved *PluginIndexEntry
 }
 
 // parseInstallSource classifies an install argument and validates it in one
@@ -216,10 +228,18 @@ func runRemoteInstall(ctx context.Context, cmd *cobra.Command, src installSource
 	stopIndex()
 
 	if src.Kind == installFromIndex {
-		if idxErr != nil {
-			return fmt.Errorf("resolve %q via plugin index: %w", src.Ref, idxErr)
+		entry := src.Resolved
+		// Only consult the index when the caller did not already resolve the
+		// name. An idxErr is fatal only in that case: a caller that arrives
+		// with an entry has done the lookup, and the index is needed after
+		// this only for dependency planning, which already degrades to a
+		// warning when it is unavailable.
+		if entry == nil {
+			if idxErr != nil {
+				return fmt.Errorf("resolve %q via plugin index: %w", src.Ref, idxErr)
+			}
+			entry = idx.Find(src.Ref)
 		}
-		entry := idx.Find(src.Ref)
 		if entry == nil {
 			// Bare names never resolve to local files (see
 			// parseInstallSource), but a user who typed one expecting a
diff --git a/cmd/entire/cli/plugin_on_demand.go b/cmd/entire/cli/plugin_on_demand.go
index fadc6d43ee..2b0bf80d9b 100644
--- a/cmd/entire/cli/plugin_on_demand.go
+++ b/cmd/entire/cli/plugin_on_demand.go
@@ -106,7 +106,11 @@ func installMissingPlugin(ctx context.Context, rootCmd *cobra.Command, name stri
 	cmd := newPluginInstallCmd()
 	cmd.SetOut(rootCmd.ErrOrStderr())
 	cmd.SetErr(rootCmd.ErrOrStderr())
-	if err := onDemandPluginInstall(ctx, cmd, installSource{Kind: installFromIndex, Ref: name}, remoteInstallFlags{}); err != nil {
+	// Resolved carries the entry the prompt named, so the install cannot
+	// re-resolve into a different repository after the user has agreed to
+	// this one — see installSource.Resolved.
+	src := installSource{Kind: installFromIndex, Ref: name, Resolved: entry}
+	if err := onDemandPluginInstall(ctx, cmd, src, remoteInstallFlags{}); err != nil {
 		return "", err
 	}
 	if err := ctx.Err(); err != nil {
diff --git a/cmd/entire/cli/plugin_on_demand_test.go b/cmd/entire/cli/plugin_on_demand_test.go
index ff4fd7bd28..1d07b30582 100644
--- a/cmd/entire/cli/plugin_on_demand_test.go
+++ b/cmd/entire/cli/plugin_on_demand_test.go
@@ -88,6 +88,12 @@ func TestMaybeRunPlugin_InstallGraphAndRun(t *testing.T) { //nolint:paralleltest
 				if src.Kind != installFromIndex || src.Ref != "graph" || flags != (remoteInstallFlags{}) {
 					t.Fatalf("unexpected install request: %+v %+v", src, flags)
 				}
+				// The entry the prompt named travels with the request, so the
+				// install cannot re-resolve into a different repository after
+				// the user agreed to this one.
+				if src.Resolved == nil || src.Resolved.RepoURL != "https://github.com/entireio/entire-graph" {
+					t.Fatalf("install was not bound to the repository shown: %+v", src.Resolved)
+				}
 				if tc.installErr != nil {
 					return tc.installErr
 				}
diff --git a/cmd/entire/cli/plugin_progress_test.go b/cmd/entire/cli/plugin_progress_test.go
index c987605e0b..55d63498b6 100644
--- a/cmd/entire/cli/plugin_progress_test.go
+++ b/cmd/entire/cli/plugin_progress_test.go
@@ -88,3 +88,40 @@ func TestPluginUpgradeReportsStagesOnStderr(t *testing.T) { //nolint:paralleltes
 		t.Errorf("stdout should carry the upgrade result: %q", out.String())
 	}
 }
+
+// installSource.Resolved binds an install to the entry its caller already
+// showed the user. Without it runRemoteInstall reads the index a second time,
+// and the two reads can disagree — a failed refresh leaves the freshness
+// marker untouched so the next call retries and may succeed with different
+// content, and a concurrent forced update rewrites the clone either way —
+// letting the prompt name repository A while repository B is installed.
+//
+// The index here does not list "demo" at all, so a re-resolution cannot
+// silently substitute: it fails outright, which is what makes the assertion
+// unambiguous.
+func TestRunRemoteInstall_ResolvedEntryIsNotReResolved(t *testing.T) { //nolint:paralleltest // isolates managed plugins and index cache
+	withIsolatedPluginEnv(t)
+	withIndexCache(t)
+	repoURL, _ := newDemoPluginRepo(t, []string{remoteTestTagOld}, "0.1.0")
+	indexURL, _ := newIndexRepo(t, `{"version":1,"plugins":[{"name":"somethingelse","repo_url":"https://example.invalid/entire-somethingelse"}]}`)
+
+	cmd := newPluginInstallCmd()
+	var out, errOut bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SetErr(&errOut)
+	src := installSource{
+		Kind:     installFromIndex,
+		Ref:      "demo",
+		Resolved: &PluginIndexEntry{Name: "demo", RepoURL: repoURL},
+	}
+	if err := runRemoteInstall(t.Context(), cmd, src, remoteInstallFlags{index: indexURL}); err != nil {
+		t.Fatalf("runRemoteInstall: %v", err)
+	}
+	if !strings.Contains(out.String(), `Installed plugin "demo" `+remoteTestTagOld+" from "+repoURL) {
+		t.Errorf("installed something other than the resolved repository: %q", out.String())
+	}
+	installed, err := FindInstalledPlugin("demo")
+	if err != nil || installed == nil {
+		t.Fatalf("FindInstalledPlugin: %v %v", installed, err)
+	}
+}
diff --git a/cmd/entire/main.go b/cmd/entire/main.go
index 385d87bbdd..b3bcdd53f0 100644
--- a/cmd/entire/main.go
+++ b/cmd/entire/main.go
@@ -94,18 +94,23 @@ func main() {
 			// exits with a meaningful code (a TUI quitting on Ctrl-C exits 0)
 			// must keep that code instead of being reported as killed.
 			switch {
-			case killedBy != nil:
-				// The child's own signal, which is not necessarily one we
-				// received: `kill -TERM` aimed at the plugin must still exit
-				// 143, and a SIGPIPE from `entire graph | head -1` must still
-				// exit 141. Preferred over ours so the external command's
-				// outcome is what propagates.
-				dieFromSignal(killedBy)
 			case procsignal.Load() != nil:
-				// No child signal to name — the on-demand install was
-				// interrupted before any child existed — so die from what we
-				// were sent.
+				// A signal we received outranks the child's, because when we
+				// were signalled the child's signal is usually OUR signal
+				// laundered — and laundered lossily. Cancelling the context
+				// makes runPlugin's cmd.Cancel send the child SIGINT whatever
+				// we got, so a supervisor's SIGTERM comes back as a SIGINT
+				// child and would report 130 for a shutdown that must report
+				// 143. That is the exact confusion dieFromSignal exists to
+				// prevent.
 				dieFromSignal(terminatingSignal())
+			case killedBy != nil:
+				// We were not signalled, so the child's signal is genuinely
+				// its own: `kill -TERM` aimed at the plugin still exits 143,
+				// and a SIGPIPE from `entire graph | head -1` still exits
+				// 141. Nothing laundered it, so it is the outcome to
+				// propagate.
+				dieFromSignal(killedBy)
 			default:
 				// -1 with no signal on either side. Windows reports a killed
 				// child as an ordinary exit code, so it never lands here;

From a529dc2330795ea8363c1219f0b5c3cdbb430fa5 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 11:23:17 -0700
Subject: [PATCH 38/59] fix(status): retain remote diagnostics when pushing is
 disabled

Entire-Checkpoint: 01M268YMCEBRSY75YFERDKYF5N
---
 cmd/entire/cli/status.go      | 33 ++++++++------
 cmd/entire/cli/status_test.go | 81 +++++++++++++++++++++++++++++++++--
 2 files changed, 99 insertions(+), 15 deletions(-)

diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index 76ec9a8dec..76e09c25e5 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -357,9 +357,9 @@ type checkpointSyncInfo struct {
 }
 
 func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpointSyncInfo {
-	if s.IsPushSessionsDisabled() {
-		return checkpointSyncInfo{PushDisabled: true}
-	}
+	info := checkpointSyncInfo{PushDisabled: s.IsPushSessionsDisabled()}
+	// Remote configuration diagnostics also explain checkpoint read behavior.
+	// Disabling uploads suppresses push promises and counts, not these warnings.
 
 	elected, err := strategy.ResolveCheckpointSyncRemote(ctx)
 	if err != nil {
@@ -370,10 +370,11 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		// configured, the gate's dedicated exemption may still sync checkpoint
 		// data even while this fail-closed warning is shown, since there is no
 		// elected remote left to probe PushURL against here.
-		return checkpointSyncInfo{Err: err.Error()}
+		info.Err = err.Error()
+		return info
 	}
 	if elected.Name == "" {
-		return checkpointSyncInfo{} // no remotes configured: show nothing
+		return info // no remotes configured: only report disabled pushing, if set
 	}
 
 	// Dedicated checkpoint_remote mode is reported only when PushURL derives
@@ -386,7 +387,11 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 	// PushURL differently than this elected-remote probe does.
 	if cr := s.GetCheckpointRemote(); cr != nil {
 		if _, enabled, purlErr := checkpointremote.PushURL(ctx, elected.Name); purlErr == nil && enabled {
-			info := checkpointSyncInfo{Remote: cr.Repo, Source: checkpointSyncSourceDedicated}
+			if info.PushDisabled {
+				return info
+			}
+			info.Remote = cr.Repo
+			info.Source = checkpointSyncSourceDedicated
 			// The unpushed counter is meaningful here only on the git-refs
 			// backend (push-queue length is local and accurate). The
 			// git-branch comparison is omitted: pushes to a raw URL update
@@ -399,10 +404,10 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		}
 	}
 
-	info := checkpointSyncInfo{
-		Remote:   elected.Name,
-		Source:   string(elected.Source),
-		Unpushed: countUnpushedCheckpointsForStatus(ctx, elected.Name),
+	if !info.PushDisabled {
+		info.Remote = elected.Name
+		info.Source = string(elected.Source)
+		info.Unpushed = countUnpushedCheckpointsForStatus(ctx, elected.Name)
 	}
 	// A configured checkpoint_remote that did not enable above is being
 	// ignored. When the ownership check is what rejected it, say so: this is
@@ -440,8 +445,12 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 	info := computeCheckpointSyncInfo(ctx, s)
 	switch {
 	case info.PushDisabled:
-		b.WriteString("\n  Automatic checkpoint pushing: disabled (push_sessions=false)")
-		return
+		b.WriteString("\n  Automatic checkpoint pushing: disabled")
+		b.WriteString(sty.render(sty.dim, " (push_sessions=false)"))
+		if info.Err != "" {
+			b.WriteString("\n")
+			b.WriteString(sty.render(sty.yellow, "  ! Checkpoint remote configuration: "+info.Err))
+		}
 	case info.Err != "":
 		b.WriteString("\n")
 		b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index b38a6eec1e..bc43558e39 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"slices"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -2333,7 +2334,7 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool)
 				t.Errorf("%s = %s, want true (decode error: %v)", key, raw, err)
 			}
 		}
-		for _, key := range []string{"checkpoint_sync_remote", "checkpoint_sync_remote_source", "checkpoint_sync_error", "unpushed_checkpoints", "checkpoint_remote_ignored", "checkpoint_remote_ignored_reason"} {
+		for _, key := range []string{"checkpoint_sync_remote", "checkpoint_sync_remote_source", "unpushed_checkpoints"} {
 			if value, exists := result[key]; exists {
 				t.Errorf("disabled pushing must omit %s, got %s", key, value)
 			}
@@ -2343,7 +2344,7 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool)
 	if !strings.Contains(stdout.String(), "Automatic checkpoint pushing: disabled (push_sessions=false)") {
 		t.Error("missing automatic checkpoint pushing disabled message")
 	}
-	for _, unwanted := range []string{"Checkpoints sync to:", "Checkpoints NOT syncing:", "not yet", "next 'git push", "is not in use:"} {
+	for _, unwanted := range []string{"Checkpoints sync to:", "Checkpoints NOT syncing:", "not yet", "next 'git push"} {
 		if strings.Contains(stdout.String(), unwanted) {
 			t.Errorf("disabled pushing must not show %q", unwanted)
 		}
@@ -2393,6 +2394,17 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				if err != nil {
 					t.Fatal(err)
 				}
+				s, err := LoadEntireSettings(t.Context())
+				if err != nil {
+					t.Fatal(err)
+				}
+				info := computeCheckpointSyncInfo(t.Context(), s)
+				if (info.Err != "") != (tc.name == "missing_configured_remote") || (info.IgnoredRemote != "") != (tc.name == "inherited_dedicated_rejected") {
+					t.Errorf("unexpected remote diagnostics: %+v", info)
+				}
+				if !info.PushDisabled || info.Remote != "" || info.Source != "" || info.Unpushed != 0 {
+					t.Errorf("disabled pushing must preserve diagnostics without push destination/count: %+v", info)
+				}
 				for _, jsonOutput := range []bool{false, true} {
 					assertCheckpointPushDisabledStatus(t, jsonOutput, false)
 					after, err := queue.Peek()
@@ -2408,6 +2420,67 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 	}
 }
 
+// Not parallel: setupTestRepo changes CWD and isolates process environment.
+func TestRunStatus_CheckpointDiagnosticsWithPushDisabled(t *testing.T) {
+	for _, disabled := range []bool{false, true} {
+		for _, tc := range []struct {
+			name, options, key, text string
+		}{
+			{"inherited", `"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "checkpoint_remote_ignored", "org/checkpoints"},
+			{"missing", `"checkpoint_push_remote":"gone"`, "checkpoint_sync_error", `checkpoint_push_remote "gone"`},
+		} {
+			label := "pushing_enabled/" + tc.name
+			pushSetting := strconv.FormatBool(!disabled)
+			if disabled {
+				label = "pushing_disabled/" + tc.name
+			}
+			t.Run(label, func(t *testing.T) {
+				testutil.IsolateGitConfigEnv(t)
+				setupTestRepo(t)
+				writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":`+pushSetting+`,`+tc.options+`}}`)
+				testutil.AddRemote(t, ".", "origin", "https://github.com/other/repo.git")
+				for _, mode := range []struct {
+					name           string
+					detailed, json bool
+				}{{"text", false, false}, {"detailed", true, false}, {"json", false, true}} {
+					t.Run(mode.name, func(t *testing.T) {
+						var out bytes.Buffer
+						if err := runStatus(t.Context(), &out, mode.detailed, mode.json); err != nil {
+							t.Fatal(err)
+						}
+						if mode.json {
+							var result map[string]json.RawMessage
+							if err := json.Unmarshal(out.Bytes(), &result); err != nil {
+								t.Fatal(err)
+							}
+							var diagnostic string
+							if err := json.Unmarshal(result[tc.key], &diagnostic); err != nil || !strings.Contains(diagnostic, tc.text) {
+								t.Errorf("missing %s diagnostic: %s", tc.key, out.String())
+							}
+							if tc.name == "inherited" && !strings.Contains(string(result["checkpoint_remote_ignored_reason"]), "differs from checkpoint owner") {
+								t.Errorf("missing rejection reason: %s", out.String())
+							}
+							if disabled {
+								var pushDisabled bool
+								if err := json.Unmarshal(result["checkpoint_push_disabled"], &pushDisabled); err != nil || !pushDisabled {
+									t.Errorf("missing disabled flag: %s", out.String())
+								}
+							}
+							return
+						}
+						if !strings.Contains(out.String(), tc.text) || (tc.name == "inherited" && !strings.Contains(out.String(), "is not in use:")) {
+							t.Errorf("missing remote diagnostic: %s", out.String())
+						}
+						if disabled && (!strings.Contains(out.String(), "Automatic checkpoint pushing: disabled") || strings.Contains(out.String(), "Checkpoints NOT syncing:")) {
+							t.Errorf("diagnostic must coexist with disabled pushing, not claim a push failure: %s", out.String())
+						}
+					})
+				}
+			})
+		}
+	}
+}
+
 func TestRunStatus_CheckpointPushDisabledSettingsPrecedence(t *testing.T) {
 	for _, tc := range []struct {
 		name     string
@@ -2432,7 +2505,9 @@ func TestRunStatus_CheckpointPushDisabledSettingsPrecedence(t *testing.T) {
 			testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
 			for _, jsonOutput := range []bool{false, true} {
 				if tc.disabled {
-					assertCheckpointPushDisabledStatus(t, jsonOutput, true)
+					// --detailed and --json are mutually exclusive: only text
+					// exercises the detailed settings view.
+					assertCheckpointPushDisabledStatus(t, jsonOutput, !jsonOutput)
 					continue
 				}
 				var stdout bytes.Buffer

From 14295ee8d0da40e1c05f80a60317ad100808636e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 18:23:53 +0000
Subject: [PATCH 39/59] build(deps): bump the go-dependencies group across 1
 directory with 3 updates

Bumps the go-dependencies group with 3 updates in the / directory: [golang.org/x/mod](https://github.com/golang/mod), [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/sys](https://github.com/golang/sys).


Updates `golang.org/x/mod` from 0.40.0 to 0.41.0
- [Commits](https://github.com/golang/mod/compare/v0.40.0...v0.41.0)

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0)

Updates `golang.org/x/sys` from 0.47.0 to 0.48.0
- [Commits](https://github.com/golang/sys/compare/v0.47.0...v0.48.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod |  6 +++---
 go.sum | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/go.mod b/go.mod
index 31b5ed4856..32cb15ad76 100644
--- a/go.mod
+++ b/go.mod
@@ -42,10 +42,10 @@ require (
 	github.com/stretchr/testify v1.12.1
 	github.com/zalando/go-keyring v0.2.8
 	golang.org/x/crypto v0.56.0
-	golang.org/x/mod v0.40.0
+	golang.org/x/mod v0.41.0
 	golang.org/x/net v0.58.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/go.sum b/go.sum
index 29f725e194..c563c17849 100644
--- a/go.sum
+++ b/go.sum
@@ -312,19 +312,19 @@ golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
 golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa h1:t2QcU6V556bFjYgu4L6C+6VrCPyJZ+eyRsABUPs1mz4=
 golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa/go.mod h1:BHOTPb3L19zxehTsLoJXVaTktb06DFgmdW6Wb9s8jqk=
-golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
-golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=

From 44ce97501600987d3f8f62022821685b8aef58a1 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 13:03:42 -0700
Subject: [PATCH 40/59] fix(codex): preserve child evidence and constrain
 rollout reads

Entire-Checkpoint: 01M26EPFY82S7RNY5Z8RV5J003
---
 cmd/entire/cli/agent/agent.go                 |   7 +-
 cmd/entire/cli/agent/codex/AGENT.md           |   5 +-
 cmd/entire/cli/agent/codex/codex.go           |  89 ++++++------
 cmd/entire/cli/agent/codex/lifecycle.go       |  10 +-
 cmd/entire/cli/agent/codex/lifecycle_test.go  |   7 +-
 .../cli/agent/codex/rollout_open_unix.go      |   8 ++
 .../cli/agent/codex/rollout_open_windows.go   |   3 +
 .../cli/agent/codex/rollout_read_test.go      |  33 +++++
 .../cli/agent/codex/rollout_read_unix_test.go |  18 +++
 cmd/entire/cli/agent/codex/subagent_test.go   |  57 +++++---
 cmd/entire/cli/agent/codex/transcript.go      | 132 +++++++++---------
 cmd/entire/cli/agent/codex/transcript_test.go |   4 +-
 .../integration_test/codex_subagent_test.go   |  11 +-
 cmd/entire/cli/integration_test/hooks.go      |   2 +-
 cmd/entire/cli/lifecycle.go                   |  43 ++++--
 cmd/entire/cli/lifecycle_test.go              |  53 ++++++-
 cmd/entire/cli/session/state.go               |   4 +
 cmd/entire/cli/session/state_test.go          |  14 ++
 redact/betterleaks_env_test.go                |   3 +-
 19 files changed, 342 insertions(+), 161 deletions(-)
 create mode 100644 cmd/entire/cli/agent/codex/rollout_open_unix.go
 create mode 100644 cmd/entire/cli/agent/codex/rollout_open_windows.go
 create mode 100644 cmd/entire/cli/agent/codex/rollout_read_test.go
 create mode 100644 cmd/entire/cli/agent/codex/rollout_read_unix_test.go

diff --git a/cmd/entire/cli/agent/agent.go b/cmd/entire/cli/agent/agent.go
index 1f128bda53..61e1badfb7 100644
--- a/cmd/entire/cli/agent/agent.go
+++ b/cmd/entire/cli/agent/agent.go
@@ -308,6 +308,8 @@ type TokenCalculator interface {
 // by the session ledger. Transcript paths are hints only: implementations must
 // verify that a path's native metadata identifies this exact AgentID.
 type SubagentReference struct {
+	// ObservedTurnIDs are child turn identities recorded by native hooks.
+	ObservedTurnIDs        []string
 	AgentID                string
 	DeclaredTranscriptPath string
 	ResolvedTranscriptPath string
@@ -327,9 +329,8 @@ type SubagentAnalysis struct {
 // authoritative child inventory. TokenUsage records parent usage and, when
 // complete, its exact cumulative child aggregate in SubagentTokens.
 type InventoryExtraction struct {
-	ModifiedFiles []string
-	TokenUsage    *TokenUsage
-	Children      []SubagentAnalysis
+	TokenUsage *TokenUsage
+	Children   []SubagentAnalysis
 }
 
 // InventoryAwareExtractor analyzes only an already-authoritative inventory of
diff --git a/cmd/entire/cli/agent/codex/AGENT.md b/cmd/entire/cli/agent/codex/AGENT.md
index 5bd8f4cc23..1941403b5f 100644
--- a/cmd/entire/cli/agent/codex/AGENT.md
+++ b/cmd/entire/cli/agent/codex/AGENT.md
@@ -344,7 +344,7 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - **A pre-SessionEnd install still counts as installed:** `AreHooksInstalled` gates on the core events only, so adding an event does not retroactively drop Codex out of `entire status` and the agent pickers for everyone who enabled it earlier. The stale install is reported as drift through `InspectHookConfig(...).Missing` instead, with `entire enable` as the fix.
 - **`reason` carries no information:** always `"other"`, so a session ended by `/clear` is indistinguishable from one ended by quitting.
 - **Transcript may be null:** In `--ephemeral` mode, `transcript_path` is null.
-  Entire emits a categorized diagnostic and preserves TurnStart / TurnEnd state
+  Entire emits a categorized debug diagnostic and preserves TurnStart / TurnEnd state
   mutation; only a rollout positively identified as a child is skipped.
 - **Unreadable, malformed, or future rollout metadata is treated as unknown:**
   the turn hook emits a diagnostic categorized as `unreadable_transcript`,
@@ -354,6 +354,9 @@ The `systemMessage` field can be used to display messages to the user via the ag
 - **Subagent identity fields are inverted from their names:** `SubagentStart` / `SubagentStop` (schemas at `codex-rs/hooks/schema/generated/subagent-{start,stop}.command.input.schema.json`) send `session_id` = the identity shared by the root thread *and every descendant*, i.e. the user's session, which maps straight to Entire's SessionID; `agent_id` = the subagent thread's own id. Codex sends no `tool_use_id`, so `agent_id` doubles as Entire's ToolUseID — it is the only value correlating a start with its stop, and Entire keys pre-task state and the task metadata directory on it. Getting this backwards attributes subagent work to a session Entire has never seen.
 - **`SubagentStop` is provisional, not authoritative completion.** It carries two transcripts: `transcript_path` is the *parent* rollout and `agent_transcript_path` the child rollout. Entire retains the child identity and declared path, then accepts a rollout only after its first `session_meta.id` exactly matches `agent_id`, it is a regular file, and the same verified bytes are analyzed. A hook-supplied filename is never trusted by itself.
 - **Completion is reconciled from the child rollout.** Only explicit matching `task_complete.turn_id` records (or the narrowly correlated legacy boundary) finalize a pending child turn. The root hook reads the authoritative inventory, batches exact-ID rollout lookup across active and archived trees, and fails closed on an ambiguous, unreadable, malformed, or non-regular candidate.
+- **Fork history is not child usage.** A rollout with `forked_from_id` but no exact ordinal boundary may contain parent counters and an unfinished parent turn. Only hook-observed child turns contribute files; independently balanced turns remain reconcilable. Its cumulative token total is unavailable rather than guessed.
+- **Rollout reads are confined.** Declared and cached paths must stay under configured active or archived rollout roots. Metadata reads are bounded and reject special files. Fallback scan failures remain conservative and emit a debug diagnostic; a large archive may exceed the fixed scan budget.
+- **Session end persists ENDED first.** Child reconciliation and condensation then share the remaining hook deadline. Force-closing an unresolved turn preserves evidence already captured for prior turns.
 - **Child accounting is exact-only.** Each child retains independently readable file and terminal evidence, but the aggregate is present only when every inventory child resolves and has a valid final cumulative token snapshot. A missing or malformed child makes aggregate coverage incomplete and leaves its aggregate nil; no timestamps, filenames, text length, or tool/API-call counts are estimated.
 - **Only thread-spawned subagents fire these hooks:** internal/synthetic ones expose no user-configured lifecycle hooks, so they are invisible to Entire.
 - **Hook response protocol differs from Claude Code:** Codex uses `systemMessage` (same field name) but also supports `hookSpecificOutput` with `additionalContext` for injecting context into the model. For Entire's purposes, `systemMessage` is sufficient.
diff --git a/cmd/entire/cli/agent/codex/codex.go b/cmd/entire/cli/agent/codex/codex.go
index 40aa189322..a187aa4b98 100644
--- a/cmd/entire/cli/agent/codex/codex.go
+++ b/cmd/entire/cli/agent/codex/codex.go
@@ -2,6 +2,7 @@
 package codex
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -132,15 +133,8 @@ func (b *rolloutScanBudget) observeBytes(count int64) error {
 	return nil
 }
 
-func readRegularRolloutContext(ctx context.Context, path string, byteLimit int64, observe func(string, int)) (loadedRollout, error) {
-	info, err := os.Lstat(path)
-	if err != nil {
-		return loadedRollout{}, fmt.Errorf("lstat rollout: %w", err)
-	}
-	if !info.Mode().IsRegular() {
-		return loadedRollout{}, errors.New("rollout is not a regular file")
-	}
-	file, opened, err := openRolloutFile(path, info)
+func readRegularRolloutContext(ctx context.Context, roots []string, path string, byteLimit int64, observe func(string, int)) (loadedRollout, error) {
+	file, opened, err := openScopedRollout(roots, path)
 	if err != nil {
 		return loadedRollout{}, err
 	}
@@ -158,17 +152,39 @@ func readRegularRolloutContext(ctx context.Context, path string, byteLimit int64
 	return loadedRollout{Path: path, Data: data}, nil
 }
 
-func openRolloutFile(path string, before fs.FileInfo) (*os.File, fs.FileInfo, error) {
-	file, err := os.Open(path) //nolint:gosec // Caller rejects special entries; descriptor Stat verifies the opened file.
+// openScopedRollout accepts files only inside configured rollout roots. Root
+// operations retain containment across directory/symlink replacement races.
+func openScopedRollout(roots []string, path string) (*os.File, fs.FileInfo, error) {
+	for _, base := range roots {
+		rel, err := filepath.Rel(base, path)
+		if err != nil || !filepath.IsLocal(rel) {
+			continue
+		}
+		root, err := os.OpenRoot(base)
+		if err != nil {
+			return nil, nil, fmt.Errorf("open rollout root: %w", err)
+		}
+		file, info, err := openRolloutFile(root, rel)
+		_ = root.Close()
+		return file, info, err
+	}
+	return nil, nil, errors.New("rollout is outside configured roots")
+}
+
+func openRolloutFile(root *os.Root, name string) (*os.File, fs.FileInfo, error) {
+	before, err := root.Lstat(name)
 	if err != nil {
-		return nil, nil, fmt.Errorf("open rollout: %w", err)
+		return nil, nil, fmt.Errorf("lstat rollout: %w", err)
 	}
-	opened, err := file.Stat()
+	if !before.Mode().IsRegular() {
+		return nil, nil, errors.New("rollout is not a regular file")
+	}
+	file, err := root.OpenFile(name, os.O_RDONLY|rolloutNonblock, 0)
 	if err != nil {
-		_ = file.Close()
-		return nil, nil, fmt.Errorf("stat opened rollout: %w", err)
+		return nil, nil, fmt.Errorf("open rollout: %w", err)
 	}
-	if !opened.Mode().IsRegular() || !os.SameFile(before, opened) {
+	opened, err := file.Stat()
+	if err != nil || !opened.Mode().IsRegular() || !os.SameFile(before, opened) {
 		_ = file.Close()
 		return nil, nil, errors.New("rollout changed or is not a regular file")
 	}
@@ -219,7 +235,7 @@ func (c *CodexAgent) loadCandidateRollout(ctx context.Context, path string) (loa
 	if c.loadRollout != nil {
 		return c.loadRollout(path)
 	}
-	return readRegularRolloutContext(ctx, path, rolloutBodyByteLimit, c.observeRolloutRead)
+	return readRegularRolloutContext(ctx, c.rolloutRoots(), path, rolloutBodyByteLimit, c.observeRolloutRead)
 }
 
 func (c *CodexAgent) loadVerifiedRollout(ctx context.Context, path, agentID string) (loadedRollout, bool) {
@@ -292,21 +308,19 @@ func walkRolloutsIncremental(ctx context.Context, root string, budget *rolloutSc
 	if err := budget.check(); err != nil {
 		return err
 	}
-	rootInfo, err := os.Lstat(root)
+	scoped, err := os.OpenRoot(root)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			return nil
 		}
-		return fmt.Errorf("lstat rollout root: %w", err)
+		return fmt.Errorf("open rollout root: %w", err)
 	}
-	if !rootInfo.IsDir() {
-		return nil
-	}
-	return walkRolloutDirectory(ctx, root, budget, visit)
+	defer scoped.Close()
+	return walkRolloutDirectory(ctx, scoped, root, ".", budget, visit)
 }
 
-func walkRolloutDirectory(ctx context.Context, dirPath string, budget *rolloutScanBudget, visit func(string, fs.DirEntry) error) error {
-	dir, err := os.Open(dirPath) //nolint:gosec // rollout root is user configuration or Codex's own directory
+func walkRolloutDirectory(ctx context.Context, root *os.Root, base, dirPath string, budget *rolloutScanBudget, visit func(string, fs.DirEntry) error) error {
+	dir, err := root.Open(dirPath)
 	if err != nil {
 		return fmt.Errorf("open rollout directory: %w", err)
 	}
@@ -323,12 +337,12 @@ func walkRolloutDirectory(ctx context.Context, dirPath string, budget *rolloutSc
 			}
 			path := filepath.Join(dirPath, entry.Name())
 			if entry.IsDir() {
-				if err := walkRolloutDirectory(ctx, path, budget, visit); err != nil {
+				if err := walkRolloutDirectory(ctx, root, base, path, budget, visit); err != nil {
 					return err
 				}
 				continue
 			}
-			if err := visit(path, entry); err != nil {
+			if err := visit(filepath.Join(base, path), entry); err != nil {
 				return err
 			}
 		}
@@ -349,14 +363,6 @@ func (c *CodexAgent) inspectFallbackCandidate(
 	agentIDs map[string]struct{},
 	budget *rolloutScanBudget,
 ) (string, loadedRollout, error) {
-	info, err := os.Lstat(path)
-	if err != nil {
-		return "", loadedRollout{}, fmt.Errorf("lstat rollout candidate: %w", err)
-	}
-	if !info.Mode().IsRegular() {
-		return "", loadedRollout{}, nil
-	}
-
 	if c.loadRollout != nil {
 		loaded, loadErr := c.loadRollout(path)
 		if loadErr != nil {
@@ -384,7 +390,7 @@ func (c *CodexAgent) inspectFallbackCandidate(
 		return id, loaded, nil
 	}
 
-	file, opened, err := openRolloutFile(path, info)
+	file, opened, err := openScopedRollout(c.rolloutRoots(), path)
 	if err != nil {
 		return "", loadedRollout{}, err
 	}
@@ -444,7 +450,7 @@ func (c *CodexAgent) readFallbackMetadata(file *os.File, path string, budget *ro
 				c.observeRolloutRead(path, n)
 			}
 			chunk := buffer[:n]
-			if newline := indexByte(chunk, '\n'); newline >= 0 {
+			if newline := bytes.IndexByte(chunk, '\n'); newline >= 0 {
 				data = append(data, chunk[:newline+1]...)
 				if int64(len(data)) > budget.limits.metadataByteLimit {
 					return nil, fmt.Errorf("rollout metadata exceeds limit %d: %w", budget.limits.metadataByteLimit, errRolloutScanBudget)
@@ -468,15 +474,6 @@ func (c *CodexAgent) readFallbackMetadata(file *os.File, path string, budget *ro
 	}
 }
 
-func indexByte(data []byte, target byte) int {
-	for index, value := range data {
-		if value == target {
-			return index
-		}
-	}
-	return -1
-}
-
 // scanFallbackRollouts scans every configured root once. Any traversal or
 // regular-candidate metadata failure discards all results: partial results
 // cannot prove a child ID is unique.
diff --git a/cmd/entire/cli/agent/codex/lifecycle.go b/cmd/entire/cli/agent/codex/lifecycle.go
index b765d782ee..0064a7cba3 100644
--- a/cmd/entire/cli/agent/codex/lifecycle.go
+++ b/cmd/entire/cli/agent/codex/lifecycle.go
@@ -207,7 +207,7 @@ func (c *CodexAgent) parseTurnStart(ctx context.Context, stdin io.Reader) (*agen
 	if err != nil {
 		return nil, err
 	}
-	if !isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
+	if !c.isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
 		return nil, nil //nolint:nilnil // only confirmed child rollouts are skipped
 	}
 	return &agent.Event{
@@ -281,7 +281,7 @@ func (c *CodexAgent) parseTurnEnd(ctx context.Context, stdin io.Reader) (*agent.
 	if err != nil {
 		return nil, err
 	}
-	if !isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
+	if !c.isRootTurnRollout(ctx, derefString(raw.TranscriptPath)) {
 		return nil, nil //nolint:nilnil // only confirmed child rollouts are skipped
 	}
 	return &agent.Event{
@@ -293,8 +293,8 @@ func (c *CodexAgent) parseTurnEnd(ctx context.Context, stdin io.Reader) (*agent.
 	}, nil
 }
 
-func isRootTurnRollout(ctx context.Context, path string) bool {
-	classification := classifyRolloutDetailed(path)
+func (c *CodexAgent) isRootTurnRollout(ctx context.Context, path string) bool {
+	classification := classifyRolloutDetailed(path, c.rolloutRoots())
 	switch classification.Classification {
 	case rolloutRoot:
 		return true
@@ -302,7 +302,7 @@ func isRootTurnRollout(ctx context.Context, path string) bool {
 		logging.Debug(ctx, "codex: skipped root lifecycle mutation for child rollout", slog.String("path", path))
 		return false
 	case rolloutUnknown:
-		logging.Warn(ctx, "codex: preserved root lifecycle event because rollout ownership is unverified",
+		logging.Debug(ctx, "codex: preserved root lifecycle event because rollout ownership is unverified",
 			slog.String("category", string(classification.Issue)),
 			slog.String("detail", classification.Detail),
 			slog.String("path", path))
diff --git a/cmd/entire/cli/agent/codex/lifecycle_test.go b/cmd/entire/cli/agent/codex/lifecycle_test.go
index a91b25d863..c0bfcfd2ac 100644
--- a/cmd/entire/cli/agent/codex/lifecycle_test.go
+++ b/cmd/entire/cli/agent/codex/lifecycle_test.go
@@ -2,6 +2,7 @@ package codex
 
 import (
 	"context"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"strings"
@@ -186,7 +187,7 @@ func TestParseHookEvent_TurnHooksIgnoreChildRollout(t *testing.T) {
 	input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":"` + path + `","model":"gpt-5","prompt":"do work","stop_hook_active":true}`
 
 	for _, hookName := range []string{HookNameUserPromptSubmit, HookNameStop} {
-		event, err := (&CodexAgent{}).ParseHookEvent(context.Background(), hookName, strings.NewReader(input))
+		event, err := (&CodexAgent{RolloutRoots: []string{filepath.Dir(path)}}).ParseHookEvent(context.Background(), hookName, strings.NewReader(input))
 		require.NoError(t, err)
 		require.Nil(t, event)
 	}
@@ -245,7 +246,7 @@ func TestParseHookEvent_UnknownTurnRolloutPreservesRootLifecycle(t *testing.T) {
 				pathJSON = `"` + rolloutPath + `"`
 			}
 			logDir := t.TempDir()
-			logger, err := logging.New(logging.Config{Dir: logDir})
+			logger, err := logging.New(logging.Config{Dir: logDir, Level: slog.LevelDebug})
 			require.NoError(t, err)
 			ctx := logging.WithLogger(context.Background(), logger)
 			input := `{"session_id":"root-session-1","turn_id":"turn-1","transcript_path":` + pathJSON + `,"model":"gpt-5","prompt":"do work"}`
@@ -257,7 +258,7 @@ func TestParseHookEvent_UnknownTurnRolloutPreservesRootLifecycle(t *testing.T) {
 				{HookNameUserPromptSubmit, agent.TurnStart},
 				{HookNameStop, agent.TurnEnd},
 			} {
-				event, err := (&CodexAgent{}).ParseHookEvent(ctx, hook.name, strings.NewReader(input))
+				event, err := (&CodexAgent{RolloutRoots: []string{filepath.Dir(rolloutPath)}}).ParseHookEvent(ctx, hook.name, strings.NewReader(input))
 				require.NoError(t, err)
 				require.NotNil(t, event)
 				require.Equal(t, hook.want, event.Type)
diff --git a/cmd/entire/cli/agent/codex/rollout_open_unix.go b/cmd/entire/cli/agent/codex/rollout_open_unix.go
new file mode 100644
index 0000000000..5ca38be17a
--- /dev/null
+++ b/cmd/entire/cli/agent/codex/rollout_open_unix.go
@@ -0,0 +1,8 @@
+//go:build !windows
+
+package codex
+
+import "syscall"
+
+// A regular-file replacement by a FIFO must not block before fstat can reject it.
+const rolloutNonblock = syscall.O_NONBLOCK
diff --git a/cmd/entire/cli/agent/codex/rollout_open_windows.go b/cmd/entire/cli/agent/codex/rollout_open_windows.go
new file mode 100644
index 0000000000..a5fdc4d426
--- /dev/null
+++ b/cmd/entire/cli/agent/codex/rollout_open_windows.go
@@ -0,0 +1,3 @@
+package codex
+
+const rolloutNonblock = 0
diff --git a/cmd/entire/cli/agent/codex/rollout_read_test.go b/cmd/entire/cli/agent/codex/rollout_read_test.go
new file mode 100644
index 0000000000..c13482efa5
--- /dev/null
+++ b/cmd/entire/cli/agent/codex/rollout_read_test.go
@@ -0,0 +1,33 @@
+package codex
+
+import (
+	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/stretchr/testify/require"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRolloutReadRejectsOutsideRootAndSymlinkedParent(t *testing.T) {
+	t.Parallel()
+	root, outside := t.TempDir(), t.TempDir()
+	path := writeRollout(t, outside, "child.jsonl", "child", nil)
+	ag := &CodexAgent{RolloutRoots: []string{root}}
+	_, ok := ag.loadDirectRollout(t.Context(), agent.SubagentReference{AgentID: "child", DeclaredTranscriptPath: path})
+	require.False(t, ok)
+	require.NoError(t, os.Symlink(outside, filepath.Join(root, "escape")))
+	_, ok = ag.loadDirectRollout(t.Context(), agent.SubagentReference{AgentID: "child", DeclaredTranscriptPath: filepath.Join(root, "escape", "child.jsonl")})
+	require.False(t, ok)
+}
+
+func TestRolloutClassificationBoundsFirstRecord(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	path := filepath.Join(root, "huge.jsonl")
+	data := `{"type":"session_meta","payload":{"thread_source":"user","padding":"` + strings.Repeat("x", int(rolloutMetadataByteLimit)) + `"}}`
+	require.NoError(t, os.WriteFile(path, []byte(data), 0o600))
+	result := classifyRolloutDetailed(path, []string{root})
+	require.Equal(t, rolloutUnknown, result.Classification)
+	require.Equal(t, rolloutIssueUnreadable, result.Issue)
+}
diff --git a/cmd/entire/cli/agent/codex/rollout_read_unix_test.go b/cmd/entire/cli/agent/codex/rollout_read_unix_test.go
new file mode 100644
index 0000000000..834a5e7979
--- /dev/null
+++ b/cmd/entire/cli/agent/codex/rollout_read_unix_test.go
@@ -0,0 +1,18 @@
+//go:build !windows
+
+package codex
+
+import (
+	"github.com/stretchr/testify/require"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestRolloutClassificationRejectsFIFO(t *testing.T) {
+	t.Parallel()
+	root := t.TempDir()
+	path := filepath.Join(root, "pipe.jsonl")
+	require.NoError(t, syscall.Mkfifo(path, 0o600))
+	require.Equal(t, rolloutUnknown, classifyRolloutDetailed(path, []string{root}).Classification)
+}
diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
index c4c7e4c0b0..2cf48a9b9e 100644
--- a/cmd/entire/cli/agent/codex/subagent_test.go
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -91,9 +91,9 @@ func TestTerminalTurnIDs_OnlyAcceptsUnambiguousBoundaries(t *testing.T) {
 		taskEvent("task_started", stringPointer("one")), taskEvent("task_complete", stringPointer("one")),
 		taskEvent("task_started", stringPointer("two")), taskEvent("task_complete", nil),
 	}
-	require.Equal(t, []string{"one", "two"}, analyzeRollout(rolloutData(t, "child", valid), 0).TerminalTurnIDs)
+	require.Equal(t, []string{"one", "two"}, analyzeRollout(rolloutData(t, "child", valid)).TerminalTurnIDs)
 	withUnknownEvent := append(append([]json.RawMessage(nil), valid...), json.RawMessage(`{"type":"event_msg","payload":{"type":"future_event","turn_id":7}}`))
-	require.Equal(t, []string{"one", "two"}, analyzeRollout(rolloutData(t, "child", withUnknownEvent), 0).TerminalTurnIDs)
+	require.Equal(t, []string{"one", "two"}, analyzeRollout(rolloutData(t, "child", withUnknownEvent)).TerminalTurnIDs)
 
 	tests := []struct {
 		name   string
@@ -112,7 +112,7 @@ func TestTerminalTurnIDs_OnlyAcceptsUnambiguousBoundaries(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			require.Empty(t, analyzeRollout(rolloutData(t, "child", tt.events), 0).TerminalTurnIDs)
+			require.Empty(t, analyzeRollout(rolloutData(t, "child", tt.events)).TerminalTurnIDs)
 		})
 	}
 }
@@ -145,9 +145,9 @@ func TestAnalyzeRollout_PaginatedSubagentIgnoresInheritedParentHistory(t *testin
 		encoded = append(encoded, data)
 	}
 
-	result := analyzeRollout(append([]byte(joinLines(encoded)), '\n'), 0)
-	require.Equal(t, []string{"/repo/child.txt"}, result.ModifiedFiles)
+	result := analyzeRollout(append([]byte(joinLines(encoded)), '\n'))
 	require.Equal(t, []string{"child-turn"}, result.TerminalTurnIDs)
+	require.Equal(t, []string{"/repo/child.txt"}, result.ModifiedFiles)
 	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1}, result.ExactTokenUsage)
 }
 
@@ -158,18 +158,18 @@ func TestExactTokenUsage_UsesOnlyLastRecognizableSnapshot(t *testing.T) {
 		"input_tokens": 15, "cached_input_tokens": 12, "output_tokens": 3,
 		"reasoning_output_tokens": 2, "total_tokens": 18,
 	}})
-	usage := analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid}), 0).ExactTokenUsage
+	usage := analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid})).ExactTokenUsage
 	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 12, OutputTokens: 3}, usage)
 
 	malformedLast := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
 		"input_tokens": 10, "cached_input_tokens": 11, "output_tokens": 3,
 	}})
-	require.Nil(t, analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid, malformedLast}), 0).ExactTokenUsage)
+	require.Nil(t, analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid, malformedLast})).ExactTokenUsage)
 
 	missingRequired := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
 		"input_tokens": 10, "output_tokens": 3,
 	}})
-	require.Nil(t, analyzeRollout(rolloutData(t, "child", []json.RawMessage{missingRequired}), 0).ExactTokenUsage)
+	require.Nil(t, analyzeRollout(rolloutData(t, "child", []json.RawMessage{missingRequired})).ExactTokenUsage)
 }
 
 func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testing.T) {
@@ -178,7 +178,7 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 	valid := func(values map[string]any) []byte {
 		return rolloutData(t, "child", []json.RawMessage{tokenCountEvent(map[string]any{"total_token_usage": values})})
 	}
-	require.Nil(t, analyzeRollout(rolloutData(t, "child", nil), 0).ExactTokenUsage)
+	require.Nil(t, analyzeRollout(rolloutData(t, "child", nil)).ExactTokenUsage)
 
 	for _, values := range []map[string]any{
 		{"cached_input_tokens": 0, "output_tokens": 1},
@@ -193,17 +193,17 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "reasoning_output_tokens": -1},
 		{"input_tokens": 1, "cached_input_tokens": 0, "output_tokens": 1, "reasoning_output_tokens": 2},
 	} {
-		require.Nil(t, analyzeRollout(valid(values), 0).ExactTokenUsage)
+		require.Nil(t, analyzeRollout(valid(values)).ExactTokenUsage)
 	}
 
-	zeros := analyzeRollout(valid(map[string]any{"input_tokens": 0, "cached_input_tokens": 0, "output_tokens": 0}), 0).ExactTokenUsage
+	zeros := analyzeRollout(valid(map[string]any{"input_tokens": 0, "cached_input_tokens": 0, "output_tokens": 0})).ExactTokenUsage
 	require.Equal(t, &agent.TokenUsage{}, zeros)
 
 	multiple := rolloutData(t, "child", []json.RawMessage{
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 9, "cached_input_tokens": 1, "output_tokens": 2}}),
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
 	})
-	usage := analyzeRollout(multiple, 0).ExactTokenUsage
+	usage := analyzeRollout(multiple).ExactTokenUsage
 	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 1, OutputTokens: 2}, usage)
 	require.Zero(t, usage.APICallCount, "snapshot record count is not an API-call count")
 
@@ -211,7 +211,7 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
 		tokenCountEvent(map[string]any{"total_token_usage": "not-an-object"}),
 	})
-	require.Nil(t, analyzeRollout(malformedFinal, 0).ExactTokenUsage, "must not fall back to the earlier valid snapshot")
+	require.Nil(t, analyzeRollout(malformedFinal).ExactTokenUsage, "must not fall back to the earlier valid snapshot")
 }
 
 func TestSubagentInventory_CollectsExactEvidenceAndDoesNotPartialAggregate(t *testing.T) {
@@ -237,7 +237,6 @@ func TestSubagentInventory_CollectsExactEvidenceAndDoesNotPartialAggregate(t *te
 		{AgentID: "two", ResolvedTranscriptPath: childTwo},
 	})
 	require.NoError(t, err)
-	require.Equal(t, []string{"parent.txt", "child.txt", "two.txt"}, result.ModifiedFiles)
 	require.Len(t, result.Children, 2)
 	require.Equal(t, childOne, result.Children[0].ResolvedPath)
 	require.Equal(t, []string{"child.txt"}, result.Children[0].ModifiedFiles)
@@ -275,7 +274,6 @@ func TestSubagentInventory_AggregatesOnlyCompleteExactChildren(t *testing.T) {
 		{AgentID: "second", ResolvedTranscriptPath: second},
 	})
 	require.NoError(t, err)
-	require.Equal(t, []string{"first.txt", "second.txt"}, result.ModifiedFiles)
 	require.Len(t, result.Children, 2, "one analysis is retained for each supplied reference")
 	require.Equal(t, "first", result.Children[0].AgentID)
 	require.Equal(t, first, result.Children[0].ResolvedPath)
@@ -333,7 +331,6 @@ func TestSubagentInventory_UnresolvedChildPreventsPartialAggregate(t *testing.T)
 	})
 	require.NoError(t, err)
 	require.Len(t, result.Children, 2)
-	require.Equal(t, []string{"available.txt"}, result.ModifiedFiles)
 	require.Equal(t, []string{"available-turn"}, result.Children[0].TerminalTurnIDs)
 	require.NotNil(t, result.Children[0].TokenUsage)
 	require.Empty(t, result.Children[1].ResolvedPath)
@@ -648,3 +645,31 @@ func joinLines(lines [][]byte) string {
 	}
 	return result.String()
 }
+
+func TestAnalyzeRollout_ForkWithoutOrdinalDoesNotAttributeParentUsage(t *testing.T) {
+	t.Parallel()
+	data := []byte(`{"type":"session_meta","payload":{"id":"child","forked_from_id":"parent"}}` + "\n" +
+		`{"type":"event_msg","payload":{"type":"task_started","turn_id":"parent-turn"}}` + "\n" +
+		string(patchEvent("parent.txt")) + "\n" +
+		string(tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 1000, "cached_input_tokens": 900, "output_tokens": 50}})) + "\n" +
+		string(taskEvent("task_started", stringPointer("child-turn"))) + "\n" +
+		string(patchEvent("child.txt")) + "\n" +
+		string(taskEvent("task_complete", stringPointer("child-turn"))) + "\n")
+	result := analyzeRollout(data)
+	require.Nil(t, result.ExactTokenUsage, "inherited cumulative counters cannot prove child-only usage")
+	require.Empty(t, result.ModifiedFiles, "without a boundary or observed child turns, files are unscoped")
+	require.Contains(t, result.TerminalTurnIDs, "child-turn", "the inherited open parent turn must not invalidate a balanced child turn")
+	scoped := analyzeRolloutForTurns(t.Context(), data, []string{"child-turn"})
+	require.Equal(t, []string{"child.txt"}, scoped.ModifiedFiles)
+	require.Contains(t, scoped.TerminalTurnIDs, "child-turn")
+	require.Nil(t, scoped.ExactTokenUsage)
+}
+
+func TestExactTokenUsage_MalformedTokenEnvelopeClearsSnapshot(t *testing.T) {
+	t.Parallel()
+	data := rolloutData(t, "child", []json.RawMessage{
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 10, "cached_input_tokens": 2, "output_tokens": 3}}),
+		json.RawMessage(`{"type":"event_msg","payload":{"type":"token_count","turn_id":7}}`),
+	})
+	require.Nil(t, analyzeRollout(data).ExactTokenUsage)
+}
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index 2d146eeccd..72ade50e4a 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"os"
 	"regexp"
 	"sort"
@@ -15,6 +16,8 @@ import (
 	"time"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/agent/types"
+	"github.com/entireio/cli/cmd/entire/cli/logging"
 )
 
 // Compile-time interface assertions.
@@ -93,6 +96,7 @@ type rolloutClassificationResult struct {
 // sessionMetaPayload is the payload for type="session_meta" lines.
 type sessionMetaPayload struct {
 	ID                          string          `json:"id"`
+	ForkedFromID                string          `json:"forked_from_id,omitempty"`
 	Timestamp                   string          `json:"timestamp"`
 	ThreadSource                string          `json:"thread_source"`
 	Source                      json.RawMessage `json:"source"`
@@ -101,19 +105,19 @@ type sessionMetaPayload struct {
 
 // classifyRolloutDetailed reads only the rollout's session_meta record. Newer
 // Codex rollouts use thread_source; older rollouts use source.
-func classifyRolloutDetailed(path string) rolloutClassificationResult {
+func classifyRolloutDetailed(path string, roots []string) rolloutClassificationResult {
 	if path == "" {
 		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueNullPath}
 	}
 
-	file, err := os.Open(path) //nolint:gosec // Path comes from agent hook input
+	file, _, err := openScopedRollout(roots, path)
 	if err != nil {
 		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueUnreadable, Detail: "open"}
 	}
 	defer file.Close()
-
-	lineData, err := bufio.NewReader(file).ReadBytes('\n')
-	if err != nil && !errors.Is(err, io.EOF) {
+	reader := &CodexAgent{}
+	lineData, err := reader.readFallbackMetadata(file, path, newRolloutScanBudget(context.Background(), defaultRolloutScanLimits))
+	if err != nil {
 		return rolloutClassificationResult{Classification: rolloutUnknown, Issue: rolloutIssueUnreadable, Detail: "read"}
 	}
 
@@ -484,7 +488,11 @@ type rolloutAnalysis struct {
 // Each evidence channel keeps its own validity: malformed task boundaries
 // invalidate terminal turns without discarding file paths already observed,
 // while a malformed final token snapshot makes exact usage unavailable.
-func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
+func analyzeRollout(data []byte) rolloutAnalysis {
+	return analyzeRolloutForTurns(context.Background(), data, nil)
+}
+
+func analyzeRolloutForTurns(ctx context.Context, data []byte, observedTurns []string) rolloutAnalysis {
 	var result rolloutAnalysis
 	terminalValid := true
 	scopeValid := true
@@ -495,17 +503,28 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 	foundToken := false
 	lines := splitJSONL(data)
 	var localStartOrdinal *int
+	inherited := false
+	knownTurns := make(map[string]bool, len(observedTurns))
+	for _, turnID := range observedTurns {
+		knownTurns[turnID] = true
+	}
 	if len(lines) > 0 {
 		var first rolloutLine
 		if json.Unmarshal(lines[0], &first) == nil && first.Type == rolloutLineTypeSessionMeta {
 			var meta sessionMetaPayload
-			if json.Unmarshal(first.Payload, &meta) == nil && meta.SubagentHistoryStartOrdinal != nil && *meta.SubagentHistoryStartOrdinal >= 0 {
-				localStartOrdinal = meta.SubagentHistoryStartOrdinal
+			if json.Unmarshal(first.Payload, &meta) == nil {
+				inherited = meta.ForkedFromID != ""
+				if meta.SubagentHistoryStartOrdinal != nil && *meta.SubagentHistoryStartOrdinal >= 0 {
+					localStartOrdinal = meta.SubagentHistoryStartOrdinal
+				}
 			}
 		}
 	}
 
-	for index, lineData := range lines {
+	for _, lineData := range lines {
+		if ctx.Err() != nil {
+			return rolloutAnalysis{}
+		}
 		var line rolloutLine
 		if json.Unmarshal(lineData, &line) != nil {
 			terminalValid = false
@@ -523,7 +542,7 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 				continue
 			}
 		}
-		if index+1 > fromOffset {
+		if !inherited || localStartOrdinal != nil || knownTurns[openTurn] {
 			for _, file := range extractFilesFromParsedLine(line) {
 				if _, seen := seenFiles[file]; !seen {
 					seenFiles[file] = struct{}{}
@@ -549,6 +568,9 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 		if json.Unmarshal(line.Payload, &event) != nil {
 			if header.Type != eventMsgTypeTokenCount {
 				terminalValid = false
+			} else {
+				foundToken = true
+				lastTokenInfo = nil
 			}
 			continue
 		}
@@ -557,6 +579,11 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 			foundToken = true
 			lastTokenInfo = event.Info
 		case "task_started":
+			// Forks copy an unfinished parent turn. A later explicit turn start
+			// replaces that orphan; only balanced pairs can yield terminal IDs.
+			if inherited && localStartOrdinal == nil && event.TurnID != nil && *event.TurnID != openTurn {
+				openTurn = ""
+			}
 			if openTurn != "" || event.TurnID == nil || *event.TurnID == "" {
 				terminalValid = false
 				continue
@@ -582,7 +609,7 @@ func analyzeRollout(data []byte, fromOffset int) rolloutAnalysis {
 	if !terminalValid || openTurn != "" {
 		result.TerminalTurnIDs = nil
 	}
-	if foundToken {
+	if foundToken && (!inherited || localStartOrdinal != nil) {
 		result.ExactTokenUsage = exactUsageFromInfo(lastTokenInfo)
 	}
 	return result
@@ -649,92 +676,59 @@ func exactUsageFromInfo(lastInfo json.RawMessage) *agent.TokenUsage {
 // caller's authoritative ledger. It never discovers children from transcript
 // text, filenames, timestamps, or token-count events.
 func (c *CodexAgent) ExtractWithSubagentInventory(ctx context.Context, parent []byte, fromOffset int, refs []agent.SubagentReference) (agent.InventoryExtraction, error) {
-	result := agent.InventoryExtraction{ModifiedFiles: analyzeRollout(parent, fromOffset).ModifiedFiles}
+	var result agent.InventoryExtraction
 	parentUsage, err := c.CalculateTokenUsage(parent, fromOffset)
 	if err != nil {
 		return result, err
 	}
 	complete := true
 	var childTotal *agent.TokenUsage
-	resolved := make([]loadedRollout, len(refs))
+	result.Children = make([]agent.SubagentAnalysis, len(refs))
 	unresolvedIDs := make(map[string]struct{})
 	for index, ref := range refs {
 		if loaded, ok := c.loadDirectRollout(ctx, ref); ok {
-			resolved[index] = loaded
-		} else if ref.AgentID != "" {
-			unresolvedIDs[ref.AgentID] = struct{}{}
+			// Analyze and release each direct body before reading the next child.
+			result.Children[index] = analyzeLoadedChild(ctx, ref, loaded)
+		} else {
+			result.Children[index].AgentID = ref.AgentID
+			if ref.AgentID != "" {
+				unresolvedIDs[ref.AgentID] = struct{}{}
+			}
 		}
 	}
 	fallback, fallbackErr := c.scanFallbackRollouts(ctx, unresolvedIDs)
 	if fallbackErr != nil {
 		fallback = nil
+		logging.Debug(ctx, "codex: fallback rollout scan incomplete", slog.String("error", fallbackErr.Error()))
 	}
 	for index, ref := range refs {
-		if resolved[index].Path == "" {
-			resolved[index] = fallback[ref.AgentID]
+		if result.Children[index].ResolvedPath == "" {
+			result.Children[index] = analyzeLoadedChild(ctx, ref, fallback[ref.AgentID])
 		}
-	}
-	for index, ref := range refs {
-		analysis := agent.SubagentAnalysis{AgentID: ref.AgentID}
-		loaded := resolved[index]
-		analysis.ResolvedPath = loaded.Path
-		if loaded.Path == "" {
-			complete = false
-			result.Children = append(result.Children, analysis)
-			continue
-		}
-		rollout := analyzeRollout(loaded.Data, 0)
-		analysis.ModifiedFiles = rollout.ModifiedFiles
-		analysis.TerminalTurnIDs = rollout.TerminalTurnIDs
-		analysis.TokenUsage = rollout.ExactTokenUsage
-		if analysis.TokenUsage == nil {
+		child := result.Children[index]
+		if child.TokenUsage == nil {
 			complete = false
 		} else {
-			childTotal = addExactUsage(childTotal, analysis.TokenUsage)
+			childTotal = types.AddTokenUsage(childTotal, child.TokenUsage)
 		}
-		result.ModifiedFiles = appendUniqueFiles(result.ModifiedFiles, analysis.ModifiedFiles)
-		result.Children = append(result.Children, analysis)
 	}
-	result.TokenUsage = withChildCoverage(parentUsage, complete)
+	result.TokenUsage = types.WithClearedSubagentTokens(parentUsage, complete)
 	if complete && len(refs) > 0 {
 		result.TokenUsage.SubagentTokens = childTotal
 	}
 	return result, nil
 }
 
-func withChildCoverage(usage *agent.TokenUsage, complete bool) *agent.TokenUsage {
-	if usage == nil {
-		return &agent.TokenUsage{SubagentTokensComplete: &complete}
-	}
-	result := *usage
-	result.SubagentTokens = nil
-	result.SubagentTokensComplete = &complete
-	return &result
-}
-
-func appendUniqueFiles(files, additions []string) []string {
-	seen := make(map[string]struct{}, len(files)+len(additions))
-	for _, file := range files {
-		seen[file] = struct{}{}
-	}
-	for _, file := range additions {
-		if _, exists := seen[file]; !exists {
-			seen[file] = struct{}{}
-			files = append(files, file)
-		}
-	}
-	return files
-}
-
-func addExactUsage(total, addition *agent.TokenUsage) *agent.TokenUsage {
-	if total == nil {
-		cloned := *addition
-		return &cloned
+func analyzeLoadedChild(ctx context.Context, ref agent.SubagentReference, loaded loadedRollout) agent.SubagentAnalysis {
+	analysis := agent.SubagentAnalysis{AgentID: ref.AgentID, ResolvedPath: loaded.Path}
+	if loaded.Path == "" {
+		return analysis
 	}
-	total.InputTokens += addition.InputTokens
-	total.CacheReadTokens += addition.CacheReadTokens
-	total.OutputTokens += addition.OutputTokens
-	return total
+	rollout := analyzeRolloutForTurns(ctx, loaded.Data, ref.ObservedTurnIDs)
+	analysis.ModifiedFiles = rollout.ModifiedFiles
+	analysis.TerminalTurnIDs = rollout.TerminalTurnIDs
+	analysis.TokenUsage = rollout.ExactTokenUsage
+	return analysis
 }
 
 // ExtractPrompts returns user prompts from the transcript starting at the given offset.
diff --git a/cmd/entire/cli/agent/codex/transcript_test.go b/cmd/entire/cli/agent/codex/transcript_test.go
index 9be16e24d5..cd70d8345c 100644
--- a/cmd/entire/cli/agent/codex/transcript_test.go
+++ b/cmd/entire/cli/agent/codex/transcript_test.go
@@ -86,7 +86,7 @@ func TestClassifyRollout(t *testing.T) {
 			t.Parallel()
 			path := filepath.Join(t.TempDir(), "rollout.jsonl")
 			require.NoError(t, os.WriteFile(path, []byte(tt.data), 0o600))
-			got := classifyRolloutDetailed(path)
+			got := classifyRolloutDetailed(path, []string{filepath.Dir(path)})
 			require.Equal(t, tt.want, got.Classification)
 			require.Equal(t, tt.wantIssue, got.Issue)
 		})
@@ -94,7 +94,7 @@ func TestClassifyRollout(t *testing.T) {
 
 	t.Run("missing path", func(t *testing.T) {
 		t.Parallel()
-		got := classifyRolloutDetailed(filepath.Join(t.TempDir(), "missing.jsonl"))
+		got := classifyRolloutDetailed(filepath.Join(t.TempDir(), "missing.jsonl"), nil)
 		require.Equal(t, rolloutUnknown, got.Classification)
 		require.Equal(t, rolloutIssueUnreadable, got.Issue)
 	})
diff --git a/cmd/entire/cli/integration_test/codex_subagent_test.go b/cmd/entire/cli/integration_test/codex_subagent_test.go
index 618e8e3282..ac381211d3 100644
--- a/cmd/entire/cli/integration_test/codex_subagent_test.go
+++ b/cmd/entire/cli/integration_test/codex_subagent_test.go
@@ -45,7 +45,9 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 	require.NoError(t, os.WriteFile(parentRollout, []byte(`{"type":"session_meta","payload":{"id":"`+sessionID+`","thread_source":"user"}}`+"\n"), 0o600))
 	subagentRollout := filepath.Join(rolloutDir, "rollout-"+agentID+".jsonl")
 	require.NoError(t, os.WriteFile(subagentRollout, []byte(
-		`{"type":"session_meta","payload":{"id":"`+agentID+`"}}`+"\n"+
+		`{"type":"session_meta","payload":{"id":"`+agentID+`","forked_from_id":"`+sessionID+`"}}`+"\n"+
+			`{"type":"event_msg","payload":{"type":"task_started","turn_id":"inherited-parent-turn"}}`+"\n"+
+			`{"type":"response_item","payload":{"type":"custom_tool_call","name":"apply_patch","input":"*** Begin Patch\n*** Add File: parent-only.txt\n+x\n*** End Patch"}}`+"\n"+
 			`{"type":"event_msg","payload":{"type":"task_started","turn_id":"turn-1"}}`+"\n"+
 			`{"type":"response_item","payload":{"type":"custom_tool_call","status":"completed","name":"apply_patch","input":"*** Begin Patch\n*** Add File: `+editedFile+`\n+red\n*** End Patch"}}`+"\n"+
 			`{"type":"event_msg","payload":{"type":"token_count","info":{"total_token_usage":{"input_tokens":10,"cached_input_tokens":2,"output_tokens":3}}}}`+"\n"+
@@ -77,7 +79,8 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 	require.NotNil(t, rec, "expected a task record keyed by agent_id")
 	require.True(t, rec.CompletedAt.IsZero(), "provisional subagent-stop must not complete the record")
 
-	// Root Stop observes terminal evidence in the same verified child rollout.
+	// The fixture includes the real fork shape: inherited parent history with
+	// an open parent turn and no ordinal boundary. Root Stop observes terminal evidence in the same verified child rollout.
 	hook("stop", map[string]any{"hook_event_name": "Stop", "last_assistant_message": "done"})
 	state, err = env.GetSessionState(sessionID)
 	require.NoError(t, err)
@@ -87,7 +90,9 @@ func TestCodexSubagent_StoresDeclaredSubagentTranscript(t *testing.T) {
 	rec = state.FindTaskRecord(agentID)
 	require.NotNil(t, rec)
 	require.False(t, rec.CompletedAt.IsZero(), "terminal child rollout must reconcile the record")
-	require.True(t, containsFile(rec.Files, editedFile), "the record must carry the child edit, got %v", rec.Files)
+	require.Equal(t, []string{editedFile}, rec.Files, "only hook-observed child turns contribute files")
+	require.Nil(t, rec.TokenUsage, "unscoped fork counters are not exact child usage")
+	require.False(t, *state.TokenUsage.SubagentTokensComplete)
 
 	// Committing condenses the session, and the materializer must store the rollout
 	// itself — the storage guarantee this test is named for.
diff --git a/cmd/entire/cli/integration_test/hooks.go b/cmd/entire/cli/integration_test/hooks.go
index 23bee389d9..fccd92e93e 100644
--- a/cmd/entire/cli/integration_test/hooks.go
+++ b/cmd/entire/cli/integration_test/hooks.go
@@ -661,7 +661,7 @@ func (r *CodexHookRunner) runCodexHook(hookName string, inputJSON []byte) error
 	cmd := exec.CommandContext(context.Background(), getTestBinary(), "hooks", "codex", hookName)
 	cmd.Dir = r.RepoDir
 	cmd.Stdin = bytes.NewReader(inputJSON)
-	cmd.Env = testutil.GitIsolatedEnv()
+	cmd.Env = append(testutil.GitIsolatedEnv(), "ENTIRE_TEST_CODEX_SESSION_DIR="+filepath.Join(r.RepoDir, ".entire", "tmp"))
 
 	output, err := cmd.CombinedOutput()
 	if err != nil {
diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 0af68db726..3119d7fefb 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1135,11 +1135,29 @@ func handleLifecycleSessionEnd(ctx context.Context, ag agent.Agent, event *agent
 	// sets no budget, and for agents that do, bounding the final captures
 	// against the same deadline is a known follow-up.
 	if ag.Type() == agent.AgentTypeCodex {
-		if transcript, readErr := ag.ReadTranscript(event.SessionRef); readErr == nil {
-			_, _ = refreshCodexInventory(ctx, ag, event.SessionID, transcript, 0)
+		// Persist the cheap end transition before any potentially large rollout
+		// reads. If the host kills this hook, the session must not remain ACTIVE.
+		ended, err := markSessionEnded(ctx, event, event.SessionID, nil, endedNow)
+		if err != nil {
+			return fmt.Errorf("mark codex session ended: %w", err)
+		}
+		if !ended {
+			return nil
+		}
+		deadline := sessionEndCondenseDeadline(ag)
+		if !deadline.IsZero() {
+			var cancel context.CancelFunc
+			ctx, cancel = context.WithDeadline(ctx, deadline)
+			defer cancel()
 		}
+		// Only child evidence is persisted here; rereading the parent is unused.
+		_, _ = refreshCodexInventory(ctx, ag, event.SessionID, nil, 0)
 		finalizeCodexObservedAtSessionEnd(ctx, event.SessionID)
+		completeLiveTaskRecords(ctx, ag, event.SessionID, event.SessionRef)
+		condenseEndedSession(ctx, event.SessionID, deadline)
+		return nil
 	}
+
 	completeLiveTaskRecords(ctx, ag, event.SessionID, event.SessionRef)
 
 	if _, err := endSessionNow(ctx, event, event.SessionID, nil, sessionEndCondenseDeadline(ag), endedNow); err != nil {
@@ -1176,8 +1194,7 @@ func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
 					if entry.ResolvedTranscriptPath != "" {
 						record.DeclaredTranscriptPath = entry.ResolvedTranscriptPath
 					}
-					record.Files = nil
-					record.TokenUsage = nil
+					// No new snapshot exists here. Preserve evidence captured for earlier turns.
 					break
 				}
 			}
@@ -1199,7 +1216,7 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 	}
 	refs := make([]agent.SubagentReference, 0, len(state.SubagentInventory))
 	for _, entry := range state.SubagentInventory {
-		refs = append(refs, agent.SubagentReference{AgentID: entry.AgentID, DeclaredTranscriptPath: entry.DeclaredTranscriptPath, ResolvedTranscriptPath: entry.ResolvedTranscriptPath})
+		refs = append(refs, agent.SubagentReference{ObservedTurnIDs: entry.ObservedTurnIDs, AgentID: entry.AgentID, DeclaredTranscriptPath: entry.DeclaredTranscriptPath, ResolvedTranscriptPath: entry.ResolvedTranscriptPath})
 	}
 	version := state.SubagentLedgerVersion
 	extraction, ok := agent.ExtractWithSubagentInventory(ctx, ag, parent, fromOffset, refs)
@@ -1207,7 +1224,7 @@ func refreshCodexInventory(ctx context.Context, ag agent.Agent, sessionID string
 		return nil, &version
 	}
 
-	usage := extraction.TokenUsage
+	usage := types.WithClearedSubagentTokens(extraction.TokenUsage, false)
 	if err := strategy.MutateSessionState(ctx, sessionID, func(current *strategy.SessionState) error {
 		if current.SubagentLedgerVersion != version {
 			return strategy.ErrMutationSkip
@@ -1325,12 +1342,17 @@ func endSessionNow(ctx context.Context, event *agent.Event, sessionID string, gu
 	if err != nil || !ended {
 		return ended, err
 	}
+	condenseEndedSession(ctx, sessionID, condenseDeadline)
+	return true, nil
+}
+
+func condenseEndedSession(ctx context.Context, sessionID string, condenseDeadline time.Time) {
 	logCtx := logging.WithComponent(ctx, "lifecycle")
 	if !condenseDeadline.IsZero() {
 		if remaining := time.Until(condenseDeadline); remaining <= 0 {
 			logging.Info(logCtx, "skipping eager condense: session-end budget already spent",
 				slog.String("session_id", sessionID))
-			return true, nil
+			return
 		}
 		var cancel context.CancelFunc
 		ctx, cancel = context.WithDeadline(ctx, condenseDeadline)
@@ -1341,7 +1363,6 @@ func endSessionNow(ctx context.Context, event *agent.Event, sessionID string, gu
 			slog.String("session_id", sessionID),
 			slog.String("error", condErr.Error()))
 	}
-	return true, nil
 }
 
 // handleLifecycleSubagentStart handles subagent start: captures pre-task state.
@@ -1431,10 +1452,16 @@ func handleLifecycleSubagentEnd(ctx context.Context, ag agent.Agent, event *agen
 		if event.SubagentID == "" || event.TurnID == "" {
 			return errors.New("invalid codex provisional subagent stop: agent and turn IDs are required")
 		}
+		if err := GetStrategy(ctx).EnsureSessionExists(ctx, event.SessionID, ag.Type()); err != nil {
+			return fmt.Errorf("ensure codex subagent session: %w", err)
+		}
 		// Codex's stop hook is deliberately not completion: its rollout can
 		// still be changing. Record only the observation for later transcript
 		// reconciliation; do not capture the parent worktree or mark a task done.
 		err := strategy.MutateSessionState(logCtx, event.SessionID, func(state *strategy.SessionState) error {
+			if state.Phase == session.PhaseEnded || state.EndedAt != nil {
+				return strategy.ErrMutationSkip
+			}
 			state.RecordSubagentStop(event.SubagentID, event.TurnID)
 			state.UpdateSubagentTranscriptPaths(event.SubagentID, event.SubagentTranscriptPath, "")
 			return nil
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index 06c5b2b69f..464aea62fb 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -213,7 +213,7 @@ func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *tes
 	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
 }
 
-func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildClearsStaleEvidence(t *testing.T) {
+func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildPreservesCapturedEvidence(t *testing.T) {
 	// NOT parallel: setupStopTestRepo changes the process working directory.
 	setupStopTestRepo(t)
 	ctx := context.Background()
@@ -249,8 +249,8 @@ func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildClearsStaleEvidence(t *
 	record := state.FindTaskRecord(agentID)
 	require.NotNil(t, record)
 	assert.Equal(t, completedAt, record.CompletedAt, "force-closing a later turn must not complete the task twice")
-	assert.Empty(t, record.Files, "files from an earlier turn are not exact evidence for an unresolved later turn")
-	assert.Nil(t, record.TokenUsage, "tokens from an earlier turn are not exact evidence for an unresolved later turn")
+	assert.Equal(t, []string{"first.go"}, record.Files, "closing an unresolved turn must preserve previously captured files")
+	assert.Equal(t, &agent.TokenUsage{InputTokens: 10}, record.TokenUsage, "without a new snapshot, preserve captured tokens")
 	assert.Equal(t, "/tmp/verified-child-1.jsonl", record.DeclaredTranscriptPath,
 		"force-closing must retain the inventory's exact-ID-verified rollout path for condensation")
 	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
@@ -4101,3 +4101,50 @@ func TestAppendEventSkillEventsToState_ReturnsOnlyNewlyAppended(t *testing.T) {
 	// Full re-delivery is a no-op.
 	require.Nil(t, appendEventSkillEventsToState(&agent.Event{SkillEvents: []agent.SkillEvent{first, second}}, state))
 }
+
+func TestRefreshCodexInventory_RejectsStaleReturnedCoverage(t *testing.T) {
+	// NOT parallel: setupStopTestRepo changes CWD.
+	setupStopTestRepo(t)
+	ctx := t.Context()
+	const id = "stale-inventory-return"
+	complete := true
+	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{SessionID: id, StartedAt: time.Now(), SubagentInventoryComplete: &complete}))
+	ag := &mockInventoryAgent{mockLifecycleAgent: newMockAgent(), extraction: agent.InventoryExtraction{TokenUsage: &agent.TokenUsage{SubagentTokensComplete: &complete, SubagentTokens: &agent.TokenUsage{InputTokens: 99}}}, beforeReturn: func() {
+		require.NoError(t, strategy.MutateSessionState(ctx, id, func(s *strategy.SessionState) error { s.RegisterSubagent("new-child", "new-turn"); return nil }))
+	}}
+	usage, _ := refreshCodexInventory(ctx, ag, id, nil, 0)
+	require.NotNil(t, usage)
+	require.False(t, *usage.SubagentTokensComplete)
+	require.Nil(t, usage.SubagentTokens)
+}
+
+func TestCodexProvisionalStopBeforeStartRetainsObservation(t *testing.T) {
+	// NOT parallel: setupStopTestRepo changes CWD.
+	setupStopTestRepo(t)
+	ag := newMockAgent()
+	ag.agentType = agent.AgentTypeCodex
+	event := &agent.Event{SessionID: "stop-first", SubagentID: "child", TurnID: "turn", ProvisionalSubagentStop: true}
+	require.NoError(t, handleLifecycleSubagentEnd(t.Context(), ag, event))
+	state, err := strategy.LoadSessionState(t.Context(), event.SessionID)
+	require.NoError(t, err)
+	require.NotNil(t, state)
+	require.NotNil(t, state.FindSubagentInventory("child"))
+	require.NotNil(t, state.FindTaskRecord("child"))
+}
+
+func TestCodexSessionEndPersistsEndedBeforeInventoryRead(t *testing.T) {
+	// NOT parallel: setupStopTestRepo changes CWD.
+	setupStopTestRepo(t)
+	ctx := t.Context()
+	const id = "end-before-child-read"
+	complete := true
+	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{SessionID: id, StartedAt: time.Now(), Phase: session.PhaseActive, SubagentInventoryComplete: &complete}))
+	ag := &mockInventoryAgent{mockLifecycleAgent: newMockAgent(), beforeReturn: func() {
+		state, err := strategy.LoadSessionState(ctx, id)
+		require.NoError(t, err)
+		require.NotNil(t, state.EndedAt, "the host may kill the process during child reads")
+		require.Equal(t, session.PhaseEnded, state.Phase)
+	}}
+	ag.agentType = agent.AgentTypeCodex
+	require.NoError(t, handleLifecycleSessionEnd(ctx, ag, &agent.Event{SessionID: id}))
+}
diff --git a/cmd/entire/cli/session/state.go b/cmd/entire/cli/session/state.go
index e112ea96c2..3555f1110e 100644
--- a/cmd/entire/cli/session/state.go
+++ b/cmd/entire/cli/session/state.go
@@ -872,6 +872,10 @@ func (s *State) ClearCondensationAttempt() {
 // helper (resetCheckpointWindow) and cross-repo session adoption, which likewise
 // opens a fresh target-local window. Sharing this here keeps the two in step.
 func (s *State) RebaselineSubagentTokens() {
+	// Legacy agents without a snapshot retain their existing window baseline.
+	if s.TokenUsage == nil && s.AgentType != agent.AgentTypeCodex {
+		return
+	}
 	if s.TokenUsage == nil || (s.TokenUsage.SubagentTokensComplete != nil && !*s.TokenUsage.SubagentTokensComplete) {
 		incomplete := false
 		s.SubagentTokensBaseline = nil
diff --git a/cmd/entire/cli/session/state_test.go b/cmd/entire/cli/session/state_test.go
index 905cc5e035..af830f37de 100644
--- a/cmd/entire/cli/session/state_test.go
+++ b/cmd/entire/cli/session/state_test.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/entireio/cli/cmd/entire/cli/agent"
+	"github.com/entireio/cli/cmd/entire/cli/agent/types"
 	"github.com/entireio/cli/cmd/entire/cli/checkpoint/id"
 	"github.com/entireio/cli/cmd/entire/cli/testutil"
 	"github.com/stretchr/testify/assert"
@@ -1211,3 +1212,16 @@ func TestState_RebaselineSubagentTokensPreservesTriState(t *testing.T) {
 	assert.False(t, *unknown.SubagentTokensBaselineComplete)
 	assert.Nil(t, unknown.SubagentTokensBaseline)
 }
+
+func TestState_RebaselineSubagentTokensPreservesLegacyNilUsage(t *testing.T) {
+	t.Parallel()
+	for _, agentType := range []types.AgentType{agent.AgentTypeClaudeCode, agent.AgentTypeFactoryAIDroid} {
+		t.Run(string(agentType), func(t *testing.T) {
+			t.Parallel()
+			state := &State{AgentType: agentType, SubagentTokensBaseline: &agent.TokenUsage{InputTokens: 7}}
+			state.RebaselineSubagentTokens()
+			require.Equal(t, &agent.TokenUsage{InputTokens: 7}, state.SubagentTokensBaseline)
+			require.Nil(t, state.SubagentTokensBaselineComplete)
+		})
+	}
+}
diff --git a/redact/betterleaks_env_test.go b/redact/betterleaks_env_test.go
index 193a8004ed..6c8bfb6042 100644
--- a/redact/betterleaks_env_test.go
+++ b/redact/betterleaks_env_test.go
@@ -5,6 +5,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -28,7 +29,7 @@ go 1.26.2
 
 require github.com/entireio/cli v0.0.0
 
-replace github.com/entireio/cli => ` + filepath.ToSlash(repoRoot) + `
+replace github.com/entireio/cli => ` + strconv.Quote(filepath.ToSlash(repoRoot)) + `
 `
 	if err := os.WriteFile(filepath.Join(tmpDir, "go.mod"), []byte(goMod), 0o644); err != nil {
 		t.Fatalf("write go.mod: %v", err)

From a09a214c6b81701b486fc7745755ea3a5a0f3bb3 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 15:56:58 -0700
Subject: [PATCH 41/59] fix(status): keep read source and local-only count when
 pushing is off

Addresses all five review findings on the trail. Commit 1 suppressed the
destination, source and count fields whenever push_sessions=false, on the
reasoning that they were push promises. Only their phrasing was.

- The elected remote is still the checkpoint READ source:
  CheckpointReadRemotesWithElection never consults push_sessions, and
  neither does resume's fetch path. Suppressing it left status as the only
  surface that names the read source, naming nothing. It is kept and
  reworded "Checkpoints read from:".
- The unpushed count is the only signal that local-only checkpoint data is
  accumulating, which it keeps doing because push_sessions gates pushing
  and not checkpoint creation. Kept, phrased "N checkpoints stored locally
  only".
- The remote-topology note told the user to run `entire status` for the
  elected destination and how many checkpoints wait for it, and described
  where a push delivers them. Both now carry a disabled-pushing caveat
  instead of dead-ending.
- The CheckpointPushDisabled JSON doc claimed destination, error and count
  were all omitted; commit 2 kept the error and the ignored-remote fields
  were never mentioned. Rewritten to say the flag requalifies the fields
  rather than removing them.
- The two rationale lines added after the info literal described neither
  the statement above nor the block below them; they are now the
  PushDisabled field's own contract.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M26RKRK1SC7YWAXVTZKVPTMG
---
 .../integration_test/multi_pushurl_test.go    |  21 ++++
 cmd/entire/cli/remote_topology.go             |  24 ++++-
 cmd/entire/cli/status.go                      |  82 +++++++++-----
 cmd/entire/cli/status_test.go                 | 102 +++++++++++++++---
 4 files changed, 185 insertions(+), 44 deletions(-)

diff --git a/cmd/entire/cli/integration_test/multi_pushurl_test.go b/cmd/entire/cli/integration_test/multi_pushurl_test.go
index 5f1b04fe06..5c61aed292 100644
--- a/cmd/entire/cli/integration_test/multi_pushurl_test.go
+++ b/cmd/entire/cli/integration_test/multi_pushurl_test.go
@@ -406,6 +406,27 @@ func TestMultiPushURL_DestinationNoteSurfaces(t *testing.T) {
 			want:   []string{"2 remotes", "single elected remote", "entire status"},
 			absent: []string{"follow whichever remote", "always looks at origin"},
 		},
+		{
+			// The note tells the user to run `entire status` for the elected
+			// destination, and describes where a push delivers checkpoints —
+			// both of which read as promises when push_sessions is false and
+			// nothing is pushed at all. The note still applies (the
+			// destination decides where checkpoints are READ from), so it is
+			// qualified rather than suppressed.
+			name: "several remotes, pushing disabled",
+			setup: func(env *TestEnv) {
+				env.SetupNamedBareRemote("backup")
+				env.PatchSettings(map[string]any{
+					"strategy_options": map[string]any{"push_sessions": false},
+				})
+			},
+			want: []string{
+				"2 remotes", "single elected remote", "entire status",
+				"Automatic checkpoint pushing is disabled (push_sessions=false)",
+				"where they are read from today",
+			},
+			absent: []string{"checkpoints are waiting for it"},
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/cmd/entire/cli/remote_topology.go b/cmd/entire/cli/remote_topology.go
index 59f729c6e3..4237b4b2a4 100644
--- a/cmd/entire/cli/remote_topology.go
+++ b/cmd/entire/cli/remote_topology.go
@@ -51,6 +51,12 @@ type remoteTopology struct {
 	// primaryIsRefs reports whether the git-refs backend is active, which
 	// decides what a fanning-out remote means for checkpoints.
 	primaryIsRefs bool
+	// pushDisabled reports that push_sessions is off, which makes every claim
+	// below about where a push delivers checkpoints conditional: nothing is
+	// pushed at all. Read as a caveat on the note, not a reason to suppress
+	// it — the destination still decides where checkpoints are read from, and
+	// it is still what a user pins with checkpoint_remote.
+	pushDisabled bool
 }
 
 // inspectRemoteTopology reads the repo's remotes and checkpoint configuration.
@@ -92,6 +98,11 @@ func inspectRemoteTopology(ctx context.Context) remoteTopology {
 	if cpCfg, err := settings.LoadCheckpointsConfig(ctx); err == nil {
 		t.primaryIsRefs = checkpoint.PrimaryIsRefs(cpCfg)
 	}
+	// Best-effort like everything else here: an unreadable settings file reads
+	// as "pushing enabled", which is the note this code has always printed.
+	if s, err := settings.Load(ctx); err == nil {
+		t.pushDisabled = s.IsPushSessionsDisabled()
+	}
 
 	return t
 }
@@ -144,6 +155,15 @@ func (t remoteTopology) describeCheckpointDestination(w io.Writer, header string
 
 	fmt.Fprintln(w, header)
 
+	// Said first, because it qualifies every "pushes to" below. The note is
+	// still worth printing: the destination decides where checkpoints are read
+	// from, and re-enabling pushing is one setting away.
+	if t.pushDisabled {
+		fmt.Fprintln(w, "  Automatic checkpoint pushing is disabled (push_sessions=false), so no")
+		fmt.Fprintln(w, "  checkpoints are pushed anywhere right now. The destination below is where")
+		fmt.Fprintln(w, "  they would go, and where they are read from today.")
+	}
+
 	for _, d := range t.destinations {
 		if !d.fansOut() {
 			continue
@@ -170,8 +190,8 @@ func (t remoteTopology) describeCheckpointDestination(w io.Writer, header string
 		fmt.Fprintf(w, "  This repo has %d remotes (%s).\n", len(names), strings.Join(names, ", "))
 		fmt.Fprintln(w, "    Checkpoints sync to a single elected remote — not to whichever one you")
 		fmt.Fprintln(w, "    push to. A push to any other remote carries your code but no session")
-		fmt.Fprintln(w, "    history. Run `entire status` to see the elected destination and how many")
-		fmt.Fprintln(w, "    checkpoints are waiting for it.")
+		fmt.Fprintln(w, "    history. Run `entire status` to see the elected destination and how much")
+		fmt.Fprintln(w, "    checkpoint data has not reached it.")
 	}
 
 	fmt.Fprintln(w, "  To pin one repository for checkpoints, set checkpoint_remote in")
diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index 76e09c25e5..2c6fadf95a 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -334,10 +334,19 @@ const checkpointSyncSourceDedicated = "dedicated"
 type checkpointSyncInfo struct {
 	// PushDisabled reflects the explicit automatic-push setting, not every
 	// possible reason checkpoint sync might fail.
+	//
+	// It suppresses nothing else in this struct, because nothing else is a
+	// push promise. The elected remote stays the checkpoint READ source
+	// (strategy.CheckpointReadRemotesWithElection never consults
+	// push_sessions), the unpushed count is the only signal that local-only
+	// checkpoint data is accumulating, and the remote-configuration
+	// diagnostics explain read behavior too. Disabling uploads therefore
+	// changes how the renderers PHRASE these fields, not whether they are
+	// populated — see writeCheckpointSyncLines.
 	PushDisabled bool
 	// Remote is the elected git remote name, or the org/repo slug in
-	// dedicated checkpoint_remote mode. Empty when pushing is disabled or
-	// nothing resolved (no remotes configured, or the fail-closed case).
+	// dedicated checkpoint_remote mode. Empty when nothing resolved (no
+	// remotes configured, or the fail-closed case).
 	Remote string
 	// Source is config|observed|default|sole|first (resolver values) or
 	// "dedicated".
@@ -358,8 +367,6 @@ type checkpointSyncInfo struct {
 
 func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpointSyncInfo {
 	info := checkpointSyncInfo{PushDisabled: s.IsPushSessionsDisabled()}
-	// Remote configuration diagnostics also explain checkpoint read behavior.
-	// Disabling uploads suppresses push promises and counts, not these warnings.
 
 	elected, err := strategy.ResolveCheckpointSyncRemote(ctx)
 	if err != nil {
@@ -387,9 +394,6 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 	// PushURL differently than this elected-remote probe does.
 	if cr := s.GetCheckpointRemote(); cr != nil {
 		if _, enabled, purlErr := checkpointremote.PushURL(ctx, elected.Name); purlErr == nil && enabled {
-			if info.PushDisabled {
-				return info
-			}
 			info.Remote = cr.Repo
 			info.Source = checkpointSyncSourceDedicated
 			// The unpushed counter is meaningful here only on the git-refs
@@ -404,11 +408,9 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		}
 	}
 
-	if !info.PushDisabled {
-		info.Remote = elected.Name
-		info.Source = string(elected.Source)
-		info.Unpushed = countUnpushedCheckpointsForStatus(ctx, elected.Name)
-	}
+	info.Remote = elected.Name
+	info.Source = string(elected.Source)
+	info.Unpushed = countUnpushedCheckpointsForStatus(ctx, elected.Name)
 	// A configured checkpoint_remote that did not enable above is being
 	// ignored. When the ownership check is what rejected it, say so: this is
 	// the one trust-gate rejection a user otherwise experiences only as
@@ -438,30 +440,44 @@ func countUnpushedCheckpointsForStatus(ctx context.Context, remoteName string) i
 	return n
 }
 
-// writeCheckpointSyncLines reports disabled automatic pushing or the checkpoint
-// sync destination (and the unpushed counter, when non-zero) in the enabled status
-// block. With pushing enabled, no remotes configured means no lines.
+// writeCheckpointSyncLines reports the checkpoint sync destination (and the
+// unpushed counter, when non-zero) in the enabled status block, prefixed by the
+// disabled-pushing line when automatic pushing is off. No remotes configured
+// means no destination line either way.
+//
+// Every phrase that promises a push is conditioned on info.PushDisabled: with
+// pushing off the elected remote is still the read source and the counter still
+// reports local-only data, so the lines are reworded rather than dropped —
+// status is the only surface that names either.
 func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *EntireSettings, sty statusStyles) {
 	info := computeCheckpointSyncInfo(ctx, s)
-	switch {
-	case info.PushDisabled:
+	destination := "\n  Checkpoints sync to: "
+	if info.PushDisabled {
 		b.WriteString("\n  Automatic checkpoint pushing: disabled")
 		b.WriteString(sty.render(sty.dim, " (push_sessions=false)"))
-		if info.Err != "" {
-			b.WriteString("\n")
-			b.WriteString(sty.render(sty.yellow, "  ! Checkpoint remote configuration: "+info.Err))
-		}
+		destination = "\n  Checkpoints read from: "
+	}
+	switch {
 	case info.Err != "":
 		b.WriteString("\n")
-		b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
+		// A fail-closed election is not a push failure when nothing is being
+		// pushed: name the misconfiguration without claiming a lost sync.
+		if info.PushDisabled {
+			b.WriteString(sty.render(sty.yellow, "  ! Checkpoint remote configuration: "+info.Err))
+		} else {
+			b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
+		}
 	case info.Remote == "":
-		return
+		// No remotes configured: nothing resolved, and the diagnostics and
+		// counter below are empty by construction on this path.
 	case info.Source == checkpointSyncSourceDedicated:
-		b.WriteString("\n  Checkpoints sync to: ")
+		b.WriteString(destination)
 		b.WriteString(sty.render(sty.cyan, "dedicated checkpoint remote ("+info.Remote+")"))
 	default:
-		b.WriteString("\n  Checkpoints sync to: ")
+		b.WriteString(destination)
 		b.WriteString(sty.render(sty.cyan, info.Remote))
+		// Both suffixes describe how the remote was ELECTED, which is what
+		// picks the read source too, so they hold with pushing disabled.
 		switch info.Source {
 		case string(strategy.SyncRemoteSourceConfig):
 			b.WriteString(sty.render(sty.dim, " (set by checkpoint_push_remote)"))
@@ -484,6 +500,10 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 // formatUnpushedCheckpointsLine phrases the unpushed counter. Dedicated URL
 // mode has no git remote to name (and only reaches here on the git-refs
 // backend), so it drops the remote-name phrasing.
+//
+// With pushing disabled the count is not pending anything, so it says what the
+// number actually is — local-only checkpoint data, which keeps growing because
+// push_sessions gates pushing and not checkpoint creation.
 func formatUnpushedCheckpointsLine(info checkpointSyncInfo) string {
 	noun := "checkpoints"
 	pronoun := "they sync"
@@ -491,6 +511,9 @@ func formatUnpushedCheckpointsLine(info checkpointSyncInfo) string {
 		noun = "checkpoint"
 		pronoun = "it syncs"
 	}
+	if info.PushDisabled {
+		return fmt.Sprintf("%d %s stored locally only", info.Unpushed, noun)
+	}
 	if info.Source == checkpointSyncSourceDedicated {
 		return fmt.Sprintf("%d %s not yet pushed", info.Unpushed, noun)
 	}
@@ -871,8 +894,13 @@ type statusJSON struct {
 	CodexHooks *codexHooksStatusJSON `json:"codex_hooks,omitempty"`
 	// CheckpointPushDisabled is emitted only when Entire is enabled and the
 	// effective push_sessions setting is false. Its absence does not guarantee
-	// that a push can succeed. Sync destination, error, and count fields are
-	// omitted while pushing is disabled.
+	// that a push can succeed.
+	//
+	// No other field is omitted or suppressed when it is set: read it as
+	// requalifying the fields below rather than removing them.
+	// CheckpointSyncRemote is then the remote checkpoints are READ from,
+	// UnpushedCheckpoints counts checkpoint data held only locally, and the
+	// error and ignored-remote diagnostics apply to reads as well.
 	CheckpointPushDisabled bool `json:"checkpoint_push_disabled,omitempty"`
 	// CheckpointSyncRemote is the elected checkpoint sync remote name, or the
 	// org/repo slug in dedicated checkpoint_remote mode. Deliberately not named
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index bc43558e39..06318f505b 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -2308,10 +2308,13 @@ func testCheckpointPushDisabledFork(t *testing.T, jsonOutput bool) {
 	testutil.AddRemote(t, ".", "fork", "https://github.com/user/repo.git")
 	head := checkpointSyncTestCommit(t, "a.txt", "one")
 	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
-	assertCheckpointPushDisabledStatus(t, jsonOutput, false)
+	assertCheckpointPushDisabledStatus(t, jsonOutput, false, "fork")
 }
 
-func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool) {
+// assertCheckpointPushDisabledStatus asserts the disabled-pushing report:
+// wantRemote is the checkpoint read destination status must still name ("" when
+// nothing resolved), and no phrasing may survive that promises a push.
+func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool, wantRemote string) {
 	t.Helper()
 	var stdout bytes.Buffer
 	if err := runStatus(context.Background(), &stdout, detailed, jsonOutput); err != nil {
@@ -2334,11 +2337,20 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool)
 				t.Errorf("%s = %s, want true (decode error: %v)", key, raw, err)
 			}
 		}
-		for _, key := range []string{"checkpoint_sync_remote", "checkpoint_sync_remote_source", "unpushed_checkpoints"} {
-			if value, exists := result[key]; exists {
-				t.Errorf("disabled pushing must omit %s, got %s", key, value)
+		// The elected remote is still the read source, so the destination
+		// fields stay populated; only the phrasing around them changes.
+		gotRemote := ""
+		if raw, exists := result["checkpoint_sync_remote"]; exists {
+			if err := json.Unmarshal(raw, &gotRemote); err != nil {
+				t.Fatalf("checkpoint_sync_remote decode error = %v", err)
 			}
 		}
+		if gotRemote != wantRemote {
+			t.Errorf("checkpoint_sync_remote = %q, want %q: %s", gotRemote, wantRemote, stdout.String())
+		}
+		if _, exists := result["checkpoint_sync_remote_source"]; exists != (wantRemote != "") {
+			t.Errorf("checkpoint_sync_remote_source presence = %v, want %v: %s", exists, wantRemote != "", stdout.String())
+		}
 		return
 	}
 	if !strings.Contains(stdout.String(), "Automatic checkpoint pushing: disabled (push_sessions=false)") {
@@ -2349,6 +2361,50 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool)
 			t.Errorf("disabled pushing must not show %q", unwanted)
 		}
 	}
+	if wantRemote != "" && !strings.Contains(stdout.String(), "Checkpoints read from: ") {
+		t.Errorf("disabled pushing must still name the read destination %q: %s", wantRemote, stdout.String())
+	}
+	if wantRemote == "" && strings.Contains(stdout.String(), "Checkpoints read from: ") {
+		t.Errorf("nothing resolved, so no read destination may be named: %s", stdout.String())
+	}
+}
+
+// Not parallel: setupTestRepo changes CWD and isolates process environment.
+func TestRunStatus_CheckpointPushDisabledNamesReadSourceAndLocalCount(t *testing.T) {
+	testutil.IsolateGitConfigEnv(t)
+	setupTestRepo(t)
+	writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false}}`)
+	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+	head := checkpointSyncTestCommit(t, "a.txt", "one")
+	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
+
+	// With pushing off, status is the only surface naming where checkpoint
+	// reads resolve (CheckpointReadRemotesWithElection never consults
+	// push_sessions) and the only one reporting that checkpoint data is
+	// piling up locally — push_sessions gates pushing, not checkpoint
+	// creation. Both must be phrased without promising a push.
+	var text bytes.Buffer
+	if err := runStatus(t.Context(), &text, false, false); err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("status output:\n%s", text.String())
+	for _, want := range []string{"Checkpoints read from: origin", "1 checkpoint stored locally only"} {
+		if !strings.Contains(text.String(), want) {
+			t.Errorf("missing %q: %s", want, text.String())
+		}
+	}
+
+	var jsonOut bytes.Buffer
+	if err := runStatus(t.Context(), &jsonOut, false, true); err != nil {
+		t.Fatal(err)
+	}
+	var result map[string]json.RawMessage
+	if err := json.Unmarshal(jsonOut.Bytes(), &result); err != nil {
+		t.Fatal(err)
+	}
+	if string(result["checkpoint_sync_remote"]) != `"origin"` || string(result["unpushed_checkpoints"]) != "1" {
+		t.Errorf("disabled pushing dropped read destination or local-only count: %s", jsonOut.String())
+	}
 }
 
 func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
@@ -2358,13 +2414,19 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 			name    string
 			options string
 			origin  string
+			// wantRemote is the read destination status must still report with
+			// pushing disabled; wantSource is its provenance ("" when nothing
+			// resolved). Populating them is the point: the elected remote stays
+			// the checkpoint read source when push_sessions is false.
+			wantRemote string
+			wantSource string
 		}{
-			{"origin", "", "https://github.com/org/repo.git"},
-			{"explicit_fork", `,"checkpoint_push_remote":"fork"`, "https://github.com/org/repo.git"},
-			{"dedicated", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/org/repo.git"},
-			{"inherited_dedicated_rejected", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/other/repo.git"},
-			{"no_remotes", "", ""},
-			{"missing_configured_remote", `,"checkpoint_push_remote":"gone"`, "https://github.com/org/repo.git"},
+			{"origin", "", "https://github.com/org/repo.git", "origin", "default"},
+			{"explicit_fork", `,"checkpoint_push_remote":"fork"`, "https://github.com/org/repo.git", "fork", "config"},
+			{"dedicated", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/org/repo.git", "org/checkpoints", checkpointSyncSourceDedicated},
+			{"inherited_dedicated_rejected", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/other/repo.git", "origin", "default"},
+			{"no_remotes", "", "", "", ""},
+			{"missing_configured_remote", `,"checkpoint_push_remote":"gone"`, "https://github.com/org/repo.git", "", ""},
 		} {
 			t.Run(backend+"/"+tc.name, func(t *testing.T) {
 				testutil.IsolateGitConfigEnv(t)
@@ -2402,11 +2464,21 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				if (info.Err != "") != (tc.name == "missing_configured_remote") || (info.IgnoredRemote != "") != (tc.name == "inherited_dedicated_rejected") {
 					t.Errorf("unexpected remote diagnostics: %+v", info)
 				}
-				if !info.PushDisabled || info.Remote != "" || info.Source != "" || info.Unpushed != 0 {
-					t.Errorf("disabled pushing must preserve diagnostics without push destination/count: %+v", info)
+				if !info.PushDisabled || info.Remote != tc.wantRemote || info.Source != tc.wantSource {
+					t.Errorf("disabled pushing must still resolve the read destination %q/%q: %+v", tc.wantRemote, tc.wantSource, info)
+				}
+				// The counter is the only signal that local-only checkpoint
+				// data is accumulating, so it survives disabled pushing
+				// wherever it is meaningful at all. Dedicated URL mode on
+				// git-branch has no tracking ref to compare against and stays
+				// uncounted, as it does with pushing enabled.
+				wantCount := tc.wantRemote != "" &&
+					(tc.wantSource != checkpointSyncSourceDedicated || backend != "git-branch")
+				if (info.Unpushed > 0) != wantCount {
+					t.Errorf("unpushed count = %d, want counted: %v (%+v)", info.Unpushed, wantCount, info)
 				}
 				for _, jsonOutput := range []bool{false, true} {
-					assertCheckpointPushDisabledStatus(t, jsonOutput, false)
+					assertCheckpointPushDisabledStatus(t, jsonOutput, false, tc.wantRemote)
 					after, err := queue.Peek()
 					if err != nil {
 						t.Fatal(err)
@@ -2507,7 +2579,7 @@ func TestRunStatus_CheckpointPushDisabledSettingsPrecedence(t *testing.T) {
 				if tc.disabled {
 					// --detailed and --json are mutually exclusive: only text
 					// exercises the detailed settings view.
-					assertCheckpointPushDisabledStatus(t, jsonOutput, !jsonOutput)
+					assertCheckpointPushDisabledStatus(t, jsonOutput, !jsonOutput, "origin")
 					continue
 				}
 				var stdout bytes.Buffer

From 0eedf94750e035e0697bf45e933a47f0c326d32b Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 16:27:52 -0700
Subject: [PATCH 42/59] fix(status): do not call push URLs the checkpoint read
 source
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The disabled-pushing caveat added to the remote-topology note claimed the
destination below it was "where they are read from today". That note lists
PUSH URLs, and a fan-out remote's reads use its fetch URL instead — as the
git-branch branch a few lines down already says ("only the fetch URL is ever
reconciled"). The caveat now says only where a push would go and points at
`entire status` for the read source, which names an elected remote rather
than a URL and so is accurate there.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M26TCAWXDEXNZM1X624SDFV9
---
 .../cli/integration_test/multi_pushurl_test.go | 17 +++++++++++++----
 cmd/entire/cli/remote_topology.go              | 18 +++++++++++++-----
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/cmd/entire/cli/integration_test/multi_pushurl_test.go b/cmd/entire/cli/integration_test/multi_pushurl_test.go
index 5c61aed292..0cf0c16f5f 100644
--- a/cmd/entire/cli/integration_test/multi_pushurl_test.go
+++ b/cmd/entire/cli/integration_test/multi_pushurl_test.go
@@ -410,9 +410,11 @@ func TestMultiPushURL_DestinationNoteSurfaces(t *testing.T) {
 			// The note tells the user to run `entire status` for the elected
 			// destination, and describes where a push delivers checkpoints —
 			// both of which read as promises when push_sessions is false and
-			// nothing is pushed at all. The note still applies (the
-			// destination decides where checkpoints are READ from), so it is
-			// qualified rather than suppressed.
+			// nothing is pushed at all. The ambiguity is still real (it is
+			// what re-enabling pushing runs into), so the note is qualified
+			// rather than suppressed — and the caveat points at status for
+			// the read source instead of claiming the URLs listed here are
+			// it, since those are push URLs and reads use the fetch URL.
 			name: "several remotes, pushing disabled",
 			setup: func(env *TestEnv) {
 				env.SetupNamedBareRemote("backup")
@@ -423,9 +425,16 @@ func TestMultiPushURL_DestinationNoteSurfaces(t *testing.T) {
 			want: []string{
 				"2 remotes", "single elected remote", "entire status",
 				"Automatic checkpoint pushing is disabled (push_sessions=false)",
+				// Substrings must not straddle the note's line wrapping.
+				"they would go if you re-enabled it",
+				"checkpoints are read from meanwhile",
+			},
+			absent: []string{
+				"checkpoints are waiting for it",
+				// The URLs listed here are push URLs; reads use the fetch
+				// URL, so this note must not present them as the read source.
 				"where they are read from today",
 			},
-			absent: []string{"checkpoints are waiting for it"},
 		},
 	}
 
diff --git a/cmd/entire/cli/remote_topology.go b/cmd/entire/cli/remote_topology.go
index 4237b4b2a4..74cbd55565 100644
--- a/cmd/entire/cli/remote_topology.go
+++ b/cmd/entire/cli/remote_topology.go
@@ -54,8 +54,8 @@ type remoteTopology struct {
 	// pushDisabled reports that push_sessions is off, which makes every claim
 	// below about where a push delivers checkpoints conditional: nothing is
 	// pushed at all. Read as a caveat on the note, not a reason to suppress
-	// it — the destination still decides where checkpoints are read from, and
-	// it is still what a user pins with checkpoint_remote.
+	// it — the ambiguity is still what re-enabling pushing would run into,
+	// and still what a user pins with checkpoint_remote.
 	pushDisabled bool
 }
 
@@ -156,12 +156,20 @@ func (t remoteTopology) describeCheckpointDestination(w io.Writer, header string
 	fmt.Fprintln(w, header)
 
 	// Said first, because it qualifies every "pushes to" below. The note is
-	// still worth printing: the destination decides where checkpoints are read
-	// from, and re-enabling pushing is one setting away.
+	// still worth printing: the ambiguity it describes is what re-enabling
+	// pushing would run into, and it is what checkpoint_remote pins.
+	//
+	// Deliberately silent about where checkpoints are READ from, even though
+	// that is the live question when nothing is pushed: what this note lists
+	// is PUSH URLs, and a fan-out remote's reads use its fetch URL instead
+	// (the git-branch branch below says as much — "only the fetch URL is ever
+	// reconciled"). `entire status` names the read source correctly, as an
+	// elected remote rather than a URL.
 	if t.pushDisabled {
 		fmt.Fprintln(w, "  Automatic checkpoint pushing is disabled (push_sessions=false), so no")
 		fmt.Fprintln(w, "  checkpoints are pushed anywhere right now. The destination below is where")
-		fmt.Fprintln(w, "  they would go, and where they are read from today.")
+		fmt.Fprintln(w, "  they would go if you re-enabled it; `entire status` reports where")
+		fmt.Fprintln(w, "  checkpoints are read from meanwhile.")
 	}
 
 	for _, d := range t.destinations {

From afd541747384f5809bd4dcb14e538c6a75f43996 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 16:45:01 -0700
Subject: [PATCH 43/59] fix(status): scope the unpushed count to the elected
 destination
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"N checkpoints stored locally only" claimed more than the number supports.
Unpushed is measured against the ELECTED destination alone — a tracking-ref
comparison on git-branch, the push queue on git-refs — so it says nothing
about whether those checkpoints already reached another remote. The read
chain's legacy origin tier is exactly that case, and stale tracking state
over-reports as well.

That is the wrong direction to be wrong in: it reassures someone asking
whether checkpoint data has left their machine. The line now says what the
count establishes and no more — "N checkpoints not on <remote>", or "not
pushed to the checkpoint remote" in dedicated mode — keeping the scoping the
enabled path already had and dropping only the push promise. The same
overclaim is corrected in the PushDisabled and unpushed_checkpoints field
docs, and a regression assertion rejects the local-only phrasings.

Also documents why the read-source line names the elected remote rather than
the whole read chain: rendering the chain would restate the resolver's rule
here (and drift from it) or need a second election call.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M26VBQZATYM0WHY2PTKRCXW8
---
 cmd/entire/cli/status.go      | 42 +++++++++++++++++++++++++----------
 cmd/entire/cli/status_test.go | 22 ++++++++++++------
 2 files changed, 45 insertions(+), 19 deletions(-)

diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index 2c6fadf95a..f3775a5565 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -338,11 +338,11 @@ type checkpointSyncInfo struct {
 	// It suppresses nothing else in this struct, because nothing else is a
 	// push promise. The elected remote stays the checkpoint READ source
 	// (strategy.CheckpointReadRemotesWithElection never consults
-	// push_sessions), the unpushed count is the only signal that local-only
-	// checkpoint data is accumulating, and the remote-configuration
-	// diagnostics explain read behavior too. Disabling uploads therefore
-	// changes how the renderers PHRASE these fields, not whether they are
-	// populated — see writeCheckpointSyncLines.
+	// push_sessions), the unpushed count is the only signal that checkpoint
+	// data is not reaching the elected destination, and the
+	// remote-configuration diagnostics explain read behavior too. Disabling
+	// uploads therefore changes how the renderers PHRASE these fields, not
+	// whether they are populated — see writeCheckpointSyncLines.
 	PushDisabled bool
 	// Remote is the elected git remote name, or the org/repo slug in
 	// dedicated checkpoint_remote mode. Empty when nothing resolved (no
@@ -455,6 +455,12 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 	if info.PushDisabled {
 		b.WriteString("\n  Automatic checkpoint pushing: disabled")
 		b.WriteString(sty.render(sty.dim, " (push_sessions=false)"))
+		// Names the remote reads resolve to FIRST, not the whole chain:
+		// CheckpointReadRemotes also appends origin as a legacy tier when it
+		// is configured and is not already the elected remote. Rendering the
+		// chain would mean either restating its rule here (which then drifts
+		// from the resolver) or a second election call, and the label does
+		// not claim exclusivity — "read from", never "only".
 		destination = "\n  Checkpoints read from: "
 	}
 	switch {
@@ -501,9 +507,16 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 // mode has no git remote to name (and only reaches here on the git-refs
 // backend), so it drops the remote-name phrasing.
 //
-// With pushing disabled the count is not pending anything, so it says what the
-// number actually is — local-only checkpoint data, which keeps growing because
-// push_sessions gates pushing and not checkpoint creation.
+// With pushing disabled the count is not pending anything, so the future tense
+// goes — but the phrasing must not overclaim in the other direction either.
+// Unpushed is measured against the ELECTED destination only (a tracking-ref
+// comparison on git-branch, the push queue on git-refs), which says nothing
+// about whether these checkpoints reached some other remote earlier; the read
+// chain's legacy origin tier is exactly that case, and stale tracking state
+// over-reports too. So it says what the number supports — not on that one
+// destination — and never that the data exists nowhere else. Getting this
+// backwards would falsely reassure someone asking whether checkpoint data has
+// left the machine.
 func formatUnpushedCheckpointsLine(info checkpointSyncInfo) string {
 	noun := "checkpoints"
 	pronoun := "they sync"
@@ -512,7 +525,10 @@ func formatUnpushedCheckpointsLine(info checkpointSyncInfo) string {
 		pronoun = "it syncs"
 	}
 	if info.PushDisabled {
-		return fmt.Sprintf("%d %s stored locally only", info.Unpushed, noun)
+		if info.Source == checkpointSyncSourceDedicated {
+			return fmt.Sprintf("%d %s not pushed to the checkpoint remote", info.Unpushed, noun)
+		}
+		return fmt.Sprintf("%d %s not on %s", info.Unpushed, noun, info.Remote)
 	}
 	if info.Source == checkpointSyncSourceDedicated {
 		return fmt.Sprintf("%d %s not yet pushed", info.Unpushed, noun)
@@ -898,9 +914,11 @@ type statusJSON struct {
 	//
 	// No other field is omitted or suppressed when it is set: read it as
 	// requalifying the fields below rather than removing them.
-	// CheckpointSyncRemote is then the remote checkpoints are READ from,
-	// UnpushedCheckpoints counts checkpoint data held only locally, and the
-	// error and ignored-remote diagnostics apply to reads as well.
+	// CheckpointSyncRemote is then the remote checkpoints are READ from, and
+	// the error and ignored-remote diagnostics apply to reads as well.
+	// UnpushedCheckpoints keeps its own meaning either way: checkpoints not
+	// present on THAT destination, which is not a claim that they exist
+	// nowhere else.
 	CheckpointPushDisabled bool `json:"checkpoint_push_disabled,omitempty"`
 	// CheckpointSyncRemote is the elected checkpoint sync remote name, or the
 	// org/repo slug in dedicated checkpoint_remote mode. Deliberately not named
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index 06318f505b..35446105de 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -2370,7 +2370,7 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool,
 }
 
 // Not parallel: setupTestRepo changes CWD and isolates process environment.
-func TestRunStatus_CheckpointPushDisabledNamesReadSourceAndLocalCount(t *testing.T) {
+func TestRunStatus_CheckpointPushDisabledNamesReadSourceAndCount(t *testing.T) {
 	testutil.IsolateGitConfigEnv(t)
 	setupTestRepo(t)
 	writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false}}`)
@@ -2380,19 +2380,27 @@ func TestRunStatus_CheckpointPushDisabledNamesReadSourceAndLocalCount(t *testing
 
 	// With pushing off, status is the only surface naming where checkpoint
 	// reads resolve (CheckpointReadRemotesWithElection never consults
-	// push_sessions) and the only one reporting that checkpoint data is
-	// piling up locally — push_sessions gates pushing, not checkpoint
+	// push_sessions) and the only one reporting that checkpoint data is not
+	// reaching the destination — push_sessions gates pushing, not checkpoint
 	// creation. Both must be phrased without promising a push.
 	var text bytes.Buffer
 	if err := runStatus(t.Context(), &text, false, false); err != nil {
 		t.Fatal(err)
 	}
 	t.Logf("status output:\n%s", text.String())
-	for _, want := range []string{"Checkpoints read from: origin", "1 checkpoint stored locally only"} {
+	for _, want := range []string{"Checkpoints read from: origin", "1 checkpoint not on origin"} {
 		if !strings.Contains(text.String(), want) {
 			t.Errorf("missing %q: %s", want, text.String())
 		}
 	}
+	// The count compares against the elected destination only, so it must not
+	// be phrased as proof the data exists nowhere else — a false reassurance
+	// about checkpoint data having left the machine.
+	for _, unwanted := range []string{"stored locally only", "local only", "only locally"} {
+		if strings.Contains(text.String(), unwanted) {
+			t.Errorf("count must not claim local-only storage (%q): %s", unwanted, text.String())
+		}
+	}
 
 	var jsonOut bytes.Buffer
 	if err := runStatus(t.Context(), &jsonOut, false, true); err != nil {
@@ -2403,7 +2411,7 @@ func TestRunStatus_CheckpointPushDisabledNamesReadSourceAndLocalCount(t *testing
 		t.Fatal(err)
 	}
 	if string(result["checkpoint_sync_remote"]) != `"origin"` || string(result["unpushed_checkpoints"]) != "1" {
-		t.Errorf("disabled pushing dropped read destination or local-only count: %s", jsonOut.String())
+		t.Errorf("disabled pushing dropped read destination or unpushed count: %s", jsonOut.String())
 	}
 }
 
@@ -2467,8 +2475,8 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				if !info.PushDisabled || info.Remote != tc.wantRemote || info.Source != tc.wantSource {
 					t.Errorf("disabled pushing must still resolve the read destination %q/%q: %+v", tc.wantRemote, tc.wantSource, info)
 				}
-				// The counter is the only signal that local-only checkpoint
-				// data is accumulating, so it survives disabled pushing
+				// The counter is the only signal that checkpoint data is not
+				// reaching the destination, so it survives disabled pushing
 				// wherever it is meaningful at all. Dedicated URL mode on
 				// git-branch has no tracking ref to compare against and stays
 				// uncounted, as it does with pushing enabled.

From e4cfdaed26fe624f3f15bfadff499e4415ab2843 Mon Sep 17 00:00:00 2001
From: Kai Ramuenke <kai@entire.io>
Date: Fri, 11 Sep 2026 09:56:15 +1000
Subject: [PATCH 44/59] repo protection: add sends a level only when the flag
 was given

Re-adding a branch without --server-side-merge-only used to send false and,
because the server upserts by ref, lowered a merge-only rule. The level now
travels only when the flag was given; the server (entiredb #3135) keeps an
existing rule's level when it is absent and protects a new branch, so an add
that only names a branch can never lower it. --server-side-merge-only=false
is the explicit way down.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 CLAUDE.md                              |  9 ++++---
 cmd/entire/cli/repo_protection.go      | 24 ++++++++++++-------
 cmd/entire/cli/repo_protection_test.go | 33 +++++++++++++++++++-------
 3 files changed, 47 insertions(+), 19 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 3460a5de37..cbaf6e3a2c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -85,9 +85,12 @@ the commands are always runnable in every build.
   `protection` (`list`, `add [--server-side-merge-only]`, `remove`) edits a
   native repo's branch-protection rules through core's
   `/repos/{repoId}/branch-protection` resource: `add` and `remove` are one
-  PATCH each (`addRules` upserts by ref, so re-adding a branch changes its
-  level), never a read-modify-write of the list; a short branch name expands
-  to `refs/heads/`, `HEAD` and `refs/...` pass through. The `mirror` subtree is
+  PATCH each (`addRules` upserts by ref), never a read-modify-write of the
+  list. `add` sends `serverSideMergeOnly` only when the flag was given: the
+  server keeps an existing rule's level when it is absent, so re-adding a
+  branch without the flag never lowers it and `--server-side-merge-only=false`
+  is the explicit way down. A short branch name expands to `refs/heads/`,
+  `HEAD` and `refs/...` pass through. The `mirror` subtree is
   server-side (`create`, `list`, `get`, `remove`, `collaborators`) with one
   exception: `mirror use` repoints the *current clone's* git remote at a mirror
   (local git config only — it creates nothing server-side). Interactively it
diff --git a/cmd/entire/cli/repo_protection.go b/cmd/entire/cli/repo_protection.go
index cf676e949a..814f7c96f6 100644
--- a/cmd/entire/cli/repo_protection.go
+++ b/cmd/entire/cli/repo_protection.go
@@ -38,7 +38,8 @@ const (
 		"a mirror's rules are its upstream's."
 	// headBranchPattern is the server's pattern for "whatever branch HEAD
 	// points at"; it follows a default-branch rename.
-	headBranchPattern = "HEAD"
+	headBranchPattern       = "HEAD"
+	serverSideMergeOnlyFlag = "server-side-merge-only"
 )
 
 func protectionRow(r branchRule) []string {
@@ -187,10 +188,11 @@ func newRepoProtectionAddCmd() *cobra.Command {
 		Short: "Protect a branch, or change the level of an existing rule",
 		Long: "Protect a branch, or change the level of an existing rule.\n\n" +
 			"<branch> is \"HEAD\", a branch name such as main, or a pattern such as release/*. " +
-			"Without --server-side-merge-only the branch is protected from force pushes and " +
-			"deletion. With it, every direct push is refused and the branch moves only through " +
-			"a merge Entire performs. Adding a branch that already has a rule replaces that " +
-			"rule's level. Prints the resulting rules. Requires manage permission on the repo.",
+			"A new rule protects the branch from force pushes and deletion. With " +
+			"--server-side-merge-only, every direct push is refused and the branch moves only " +
+			"through a merge Entire performs. Re-adding a branch without the flag keeps its " +
+			"current level; pass --server-side-merge-only=false to lower it. Prints the " +
+			"resulting rules. Requires manage permission on the repo.",
 		Args: cobra.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ref, err := expandBranchRef(args[1])
@@ -207,9 +209,15 @@ func newRepoProtectionAddCmd() *cobra.Command {
 				if err != nil {
 					return nil, err
 				}
-				body := &coreapi.UpdateBranchProtectionInputBody{
-					AddRules: []coreapi.BranchRule{{Ref: ref, ServerSideMergeOnly: coreapi.NewOptBool(mergeOnly)}},
+				// The level travels only when the flag was given. Absent, the
+				// server keeps an existing rule's level and protects a new
+				// branch, so an add that only names a branch can never lower
+				// it; --server-side-merge-only=false is the explicit way down.
+				rule := coreapi.BranchRule{Ref: ref}
+				if cmd.Flags().Changed(serverSideMergeOnlyFlag) {
+					rule.ServerSideMergeOnly = coreapi.NewOptBool(mergeOnly)
 				}
+				body := &coreapi.UpdateBranchProtectionInputBody{AddRules: []coreapi.BranchRule{rule}}
 				out, err := c.UpdateBranchProtection(ctx, body, coreapi.UpdateBranchProtectionParams{RepoId: repoID})
 				if err != nil {
 					return nil, err
@@ -219,7 +227,7 @@ func newRepoProtectionAddCmd() *cobra.Command {
 		},
 	}
 	bindRepoProjectFlag(cmd, &project)
-	cmd.Flags().BoolVar(&mergeOnly, "server-side-merge-only", false, "Refuse every direct push; the branch moves only through a merge Entire performs")
+	cmd.Flags().BoolVar(&mergeOnly, serverSideMergeOnlyFlag, false, "Refuse every direct push; the branch moves only through a merge Entire performs. Omit to keep an existing rule's level; =false lowers it")
 	addJSONFlag(cmd)
 	return cmd
 }
diff --git a/cmd/entire/cli/repo_protection_test.go b/cmd/entire/cli/repo_protection_test.go
index 73d0d31c43..454004ac70 100644
--- a/cmd/entire/cli/repo_protection_test.go
+++ b/cmd/entire/cli/repo_protection_test.go
@@ -136,8 +136,9 @@ func (f *fakeProtectionServer) apply(body coreapi.UpdateBranchProtectionInputBod
 		if removed {
 			continue
 		}
+		// Like the server: an entry without a level keeps the rule's.
 		for _, a := range body.AddRules {
-			if a.Ref == r.Ref {
+			if a.Ref == r.Ref && a.ServerSideMergeOnly.IsSet() {
 				r.ServerSideMergeOnly = a.ServerSideMergeOnly
 			}
 		}
@@ -268,9 +269,9 @@ func TestRepoProtection_ListShowsLevels(t *testing.T) {
 	assert.Equal(t, []branchRule{{Ref: "HEAD", ServerSideMergeOnly: true}, {Ref: "refs/heads/release/*"}}, got)
 }
 
-// add expands a short branch name, sends the level as given, and re-adding a
-// branch changes its level in place; remove sends only removeRefs. Each verb
-// prints the resulting rules.
+// add expands a short branch name and sends a level only when the flag was
+// given, so re-adding a branch without it can never lower the rule; remove
+// sends only removeRefs. Each verb prints the resulting rules.
 func TestRepoProtection_AddAndRemove(t *testing.T) {
 	fake := newProtectionFixture(t, coreapi.BranchRule{Ref: "HEAD"})
 
@@ -278,7 +279,7 @@ func TestRepoProtection_AddAndRemove(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, fake.patches, 1)
 	assert.Equal(t, []branchRule{{Ref: "refs/heads/release/*"}}, rulesView(fake.patches[0].AddRules))
-	assert.True(t, fake.patches[0].AddRules[0].ServerSideMergeOnly.IsSet(), "the level is always sent explicitly")
+	assert.False(t, fake.patches[0].AddRules[0].ServerSideMergeOnly.IsSet(), "no flag, no level on the wire")
 	assert.Empty(t, fake.patches[0].RemoveRefs)
 	assert.Contains(t, out, "refs/heads/release/*")
 
@@ -286,17 +287,33 @@ func TestRepoProtection_AddAndRemove(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, fake.patches, 2)
 	assert.Equal(t, []branchRule{{Ref: "HEAD", ServerSideMergeOnly: true}}, rulesView(fake.patches[1].AddRules))
+	assert.True(t, fake.patches[1].AddRules[0].ServerSideMergeOnly.IsSet())
 	assert.Contains(t, out, protectionLevelMergeOnly)
 	assert.Equal(t, []branchRule{
 		{Ref: "HEAD", ServerSideMergeOnly: true},
 		{Ref: "refs/heads/release/*"},
 	}, rulesView(fake.rules), "re-adding HEAD raised its level in place")
 
-	out, err = execRepoProtection(t, "remove", testProtectionRepoULID, "HEAD")
+	// The regression the CLI review caught: an add that only names the branch
+	// must not lower it. Lowering takes the flag set to false.
+	_, err = execRepoProtection(t, "add", testProtectionRepoULID, "HEAD")
 	require.NoError(t, err)
 	require.Len(t, fake.patches, 3)
-	assert.Equal(t, []string{"HEAD"}, fake.patches[2].RemoveRefs)
-	assert.Empty(t, fake.patches[2].AddRules)
+	assert.False(t, fake.patches[2].AddRules[0].ServerSideMergeOnly.IsSet())
+	assert.True(t, rulesView(fake.rules)[0].ServerSideMergeOnly, "HEAD stays merge-only")
+
+	out, err = execRepoProtection(t, "add", testProtectionRepoULID, "HEAD", "--server-side-merge-only=false")
+	require.NoError(t, err)
+	require.Len(t, fake.patches, 4)
+	assert.Equal(t, coreapi.NewOptBool(false), fake.patches[3].AddRules[0].ServerSideMergeOnly, "an explicit false is sent")
+	assert.False(t, rulesView(fake.rules)[0].ServerSideMergeOnly, "and lowers HEAD")
+	assert.NotContains(t, out, protectionLevelMergeOnly)
+
+	out, err = execRepoProtection(t, "remove", testProtectionRepoULID, "HEAD")
+	require.NoError(t, err)
+	require.Len(t, fake.patches, 5)
+	assert.Equal(t, []string{"HEAD"}, fake.patches[4].RemoveRefs)
+	assert.Empty(t, fake.patches[4].AddRules)
 	assert.NotContains(t, out, "HEAD")
 	assert.Contains(t, out, "refs/heads/release/*")
 

From 2e495c283a420c41754be0335409dbcda769932f Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 16:57:10 -0700
Subject: [PATCH 45/59] fix(status): name the read source when the election
 fails open
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reads fail OPEN where the election fails closed: strategy.CheckpointReadRemotes
falls back to origin on a misconfigured checkpoint_push_remote, because failing
reads closed would only prevent FINDING data. The fail-closed early return left
Remote empty, so with pushing disabled status named no read source at all — in
the one configuration where status is the only surface that could.

Reported as ReadFallback / checkpoint_read_fallback rather than through Remote.
Remote means "the elected remote" and nothing was elected here, so putting a
fallback in it would misstate checkpoint_sync_remote to JSON consumers. The
value comes from strategy.LeadCheckpointReadRemote rather than from reproducing
the resolver's fallback rule here; it re-runs the election, which is why it is
on the error path only, and it stays local-only like the rest of status.

Tests: the six-topology table gains the expectation, and the phrasing of
formatUnpushedCheckpointsLine moves to a pure-function table — the previous
fixture-based test rebuilt a repo and mutated CWD to assert a string that
depends on nothing else, while covering fewer of its branches.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M26W1Z8MJHMECYXYV14BQKVF
---
 .../integration_test/multi_pushurl_test.go    |   5 +-
 cmd/entire/cli/status.go                      |  35 ++++-
 cmd/entire/cli/status_test.go                 | 140 +++++++++---------
 3 files changed, 107 insertions(+), 73 deletions(-)

diff --git a/cmd/entire/cli/integration_test/multi_pushurl_test.go b/cmd/entire/cli/integration_test/multi_pushurl_test.go
index 0cf0c16f5f..138019c0b2 100644
--- a/cmd/entire/cli/integration_test/multi_pushurl_test.go
+++ b/cmd/entire/cli/integration_test/multi_pushurl_test.go
@@ -423,11 +423,12 @@ func TestMultiPushURL_DestinationNoteSurfaces(t *testing.T) {
 				})
 			},
 			want: []string{
-				"2 remotes", "single elected remote", "entire status",
+				// One string proving the note still renders its body; the
+				// case above already covers that body in full.
+				"single elected remote",
 				"Automatic checkpoint pushing is disabled (push_sessions=false)",
 				// Substrings must not straddle the note's line wrapping.
 				"they would go if you re-enabled it",
-				"checkpoints are read from meanwhile",
 			},
 			absent: []string{
 				"checkpoints are waiting for it",
diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index f3775a5565..27e2ae6aae 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -353,6 +353,17 @@ type checkpointSyncInfo struct {
 	Source string
 	// Err is the fail-closed misconfiguration message from the resolver.
 	Err string
+	// ReadFallback is the remote checkpoint READS fall open to when the
+	// election failed, so Err is set and nothing was elected. Deliberately
+	// not folded into Remote: that field means "the elected remote", and on
+	// this path there is none — reporting a fallback there would misstate
+	// checkpoint_sync_remote to JSON consumers.
+	//
+	// Populated only while pushing is disabled, where status is the sole
+	// surface naming the read source. With pushing enabled the headline is
+	// the broken setting and the user's next move is to fix it, so that
+	// output is left as it was.
+	ReadFallback string
 	// Unpushed approximates checkpoints not yet on the sync destination; 0
 	// when none, when counting failed, or when the count would be a lie
 	// (dedicated URL mode on the git-branch backend).
@@ -378,6 +389,14 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		// data even while this fail-closed warning is shown, since there is no
 		// elected remote left to probe PushURL against here.
 		info.Err = err.Error()
+		// Reads fail OPEN where the election failed closed (see
+		// strategy.CheckpointReadRemotes), so something may still be serving
+		// them. Asked of the resolver rather than reproducing its fallback
+		// rule here; it re-runs the election, which is why this is on the
+		// error path only, and it stays local-only like the rest of status.
+		if info.PushDisabled {
+			info.ReadFallback = strategy.LeadCheckpointReadRemote(ctx)
+		}
 		return info
 	}
 	if elected.Name == "" {
@@ -470,6 +489,14 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 		// pushed: name the misconfiguration without claiming a lost sync.
 		if info.PushDisabled {
 			b.WriteString(sty.render(sty.yellow, "  ! Checkpoint remote configuration: "+info.Err))
+			// Same label as the resolved case — to the reader it is one
+			// question, "where do checkpoints come from" — with the suffix
+			// saying this one was not chosen, it was fallen back to.
+			if info.ReadFallback != "" {
+				b.WriteString(destination)
+				b.WriteString(sty.render(sty.cyan, info.ReadFallback))
+				b.WriteString(sty.render(sty.dim, " (fallback; nothing was elected)"))
+			}
 		} else {
 			b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
 		}
@@ -926,7 +953,12 @@ type statusJSON struct {
 	CheckpointSyncRemote       string `json:"checkpoint_sync_remote,omitempty"`
 	CheckpointSyncRemoteSource string `json:"checkpoint_sync_remote_source,omitempty"` // config|observed|default|sole|first|dedicated
 	CheckpointSyncError        string `json:"checkpoint_sync_error,omitempty"`         // fail-closed message
-	UnpushedCheckpoints        int    `json:"unpushed_checkpoints,omitempty"`
+	// CheckpointReadFallback is the remote reads fall open to when the
+	// election failed (checkpoint_sync_error is then set and
+	// checkpoint_sync_remote is absent, because nothing was elected). Emitted
+	// only alongside checkpoint_push_disabled.
+	CheckpointReadFallback string `json:"checkpoint_read_fallback,omitempty"`
+	UnpushedCheckpoints    int    `json:"unpushed_checkpoints,omitempty"`
 	// CheckpointRemoteIgnored/-Reason report a configured checkpoint_remote the
 	// ownership check rejected as inherited with the clone (reads and pushes
 	// fall back to the elected remote). Mirrors the text path's warning line.
@@ -1020,6 +1052,7 @@ func runStatusJSON(ctx context.Context, w io.Writer) error {
 		result.CheckpointSyncRemote = syncInfo.Remote
 		result.CheckpointSyncRemoteSource = syncInfo.Source
 		result.CheckpointSyncError = syncInfo.Err
+		result.CheckpointReadFallback = syncInfo.ReadFallback
 		result.UnpushedCheckpoints = syncInfo.Unpushed
 		result.CheckpointRemoteIgnored = syncInfo.IgnoredRemote
 		result.CheckpointRemoteIgnoredReason = syncInfo.IgnoredReason
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index 35446105de..83951538ae 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -2308,13 +2308,15 @@ func testCheckpointPushDisabledFork(t *testing.T, jsonOutput bool) {
 	testutil.AddRemote(t, ".", "fork", "https://github.com/user/repo.git")
 	head := checkpointSyncTestCommit(t, "a.txt", "one")
 	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
-	assertCheckpointPushDisabledStatus(t, jsonOutput, false, "fork")
+	assertCheckpointPushDisabledStatus(t, jsonOutput, false, "fork", "")
 }
 
 // assertCheckpointPushDisabledStatus asserts the disabled-pushing report:
-// wantRemote is the checkpoint read destination status must still name ("" when
-// nothing resolved), and no phrasing may survive that promises a push.
-func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool, wantRemote string) {
+// wantRemote is the elected read destination status must still name, wantFallback
+// the remote reads fall open to when the election failed instead (at most one is
+// set; both "" means nothing resolved), and no phrasing may survive that
+// promises a push.
+func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool, wantRemote, wantFallback string) {
 	t.Helper()
 	var stdout bytes.Buffer
 	if err := runStatus(context.Background(), &stdout, detailed, jsonOutput); err != nil {
@@ -2338,19 +2340,19 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool,
 			}
 		}
 		// The elected remote is still the read source, so the destination
-		// fields stay populated; only the phrasing around them changes.
-		gotRemote := ""
-		if raw, exists := result["checkpoint_sync_remote"]; exists {
-			if err := json.Unmarshal(raw, &gotRemote); err != nil {
-				t.Fatalf("checkpoint_sync_remote decode error = %v", err)
+		// field stays populated; only the phrasing around it changes. A
+		// fail-open read source is reported separately, because nothing was
+		// elected — checkpoint_sync_remote must stay absent for it.
+		wantJSON := func(key, want string) {
+			if want != "" {
+				want = `"` + want + `"`
+			}
+			if got := string(result[key]); got != want {
+				t.Errorf("%s = %s, want %s: %s", key, got, want, stdout.String())
 			}
 		}
-		if gotRemote != wantRemote {
-			t.Errorf("checkpoint_sync_remote = %q, want %q: %s", gotRemote, wantRemote, stdout.String())
-		}
-		if _, exists := result["checkpoint_sync_remote_source"]; exists != (wantRemote != "") {
-			t.Errorf("checkpoint_sync_remote_source presence = %v, want %v: %s", exists, wantRemote != "", stdout.String())
-		}
+		wantJSON("checkpoint_sync_remote", wantRemote)
+		wantJSON("checkpoint_read_fallback", wantFallback)
 		return
 	}
 	if !strings.Contains(stdout.String(), "Automatic checkpoint pushing: disabled (push_sessions=false)") {
@@ -2361,57 +2363,46 @@ func assertCheckpointPushDisabledStatus(t *testing.T, jsonOutput, detailed bool,
 			t.Errorf("disabled pushing must not show %q", unwanted)
 		}
 	}
-	if wantRemote != "" && !strings.Contains(stdout.String(), "Checkpoints read from: ") {
-		t.Errorf("disabled pushing must still name the read destination %q: %s", wantRemote, stdout.String())
-	}
-	if wantRemote == "" && strings.Contains(stdout.String(), "Checkpoints read from: ") {
-		t.Errorf("nothing resolved, so no read destination may be named: %s", stdout.String())
+	named := wantRemote + wantFallback
+	if named != "" && !strings.Contains(stdout.String(), "Checkpoints read from: ") {
+		t.Errorf("disabled pushing must still name the read source %q: %s", named, stdout.String())
 	}
-}
-
-// Not parallel: setupTestRepo changes CWD and isolates process environment.
-func TestRunStatus_CheckpointPushDisabledNamesReadSourceAndCount(t *testing.T) {
-	testutil.IsolateGitConfigEnv(t)
-	setupTestRepo(t)
-	writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false}}`)
-	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
-	head := checkpointSyncTestCommit(t, "a.txt", "one")
-	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
-
-	// With pushing off, status is the only surface naming where checkpoint
-	// reads resolve (CheckpointReadRemotesWithElection never consults
-	// push_sessions) and the only one reporting that checkpoint data is not
-	// reaching the destination — push_sessions gates pushing, not checkpoint
-	// creation. Both must be phrased without promising a push.
-	var text bytes.Buffer
-	if err := runStatus(t.Context(), &text, false, false); err != nil {
-		t.Fatal(err)
+	if named == "" && strings.Contains(stdout.String(), "Checkpoints read from: ") {
+		t.Errorf("nothing resolved, so no read source may be named: %s", stdout.String())
 	}
-	t.Logf("status output:\n%s", text.String())
-	for _, want := range []string{"Checkpoints read from: origin", "1 checkpoint not on origin"} {
-		if !strings.Contains(text.String(), want) {
-			t.Errorf("missing %q: %s", want, text.String())
-		}
-	}
-	// The count compares against the elected destination only, so it must not
-	// be phrased as proof the data exists nowhere else — a false reassurance
-	// about checkpoint data having left the machine.
-	for _, unwanted := range []string{"stored locally only", "local only", "only locally"} {
-		if strings.Contains(text.String(), unwanted) {
-			t.Errorf("count must not claim local-only storage (%q): %s", unwanted, text.String())
-		}
+	if (wantFallback != "") != strings.Contains(stdout.String(), "(fallback; nothing was elected)") {
+		t.Errorf("fallback suffix must appear only for a failed election (want fallback %q): %s", wantFallback, stdout.String())
 	}
+}
 
-	var jsonOut bytes.Buffer
-	if err := runStatus(t.Context(), &jsonOut, false, true); err != nil {
-		t.Fatal(err)
-	}
-	var result map[string]json.RawMessage
-	if err := json.Unmarshal(jsonOut.Bytes(), &result); err != nil {
-		t.Fatal(err)
-	}
-	if string(result["checkpoint_sync_remote"]) != `"origin"` || string(result["unpushed_checkpoints"]) != "1" {
-		t.Errorf("disabled pushing dropped read destination or unpushed count: %s", jsonOut.String())
+// formatUnpushedCheckpointsLine is pure, so its four branches are pinned here
+// rather than through a repo fixture. What the counter must never say with
+// pushing disabled is that the data is local-only: Unpushed compares against
+// the elected destination alone, so it cannot establish that checkpoints exist
+// nowhere else, and claiming otherwise would falsely reassure someone asking
+// whether checkpoint data has left their machine.
+func TestFormatUnpushedCheckpointsLine(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		name string
+		info checkpointSyncInfo
+		want string
+	}{
+		{"pushing_enabled", checkpointSyncInfo{Remote: "origin", Source: "default", Unpushed: 2},
+			"2 checkpoints not yet on origin — they sync with your next 'git push origin'"},
+		{"pushing_enabled_dedicated", checkpointSyncInfo{Remote: "org/cp", Source: checkpointSyncSourceDedicated, Unpushed: 2},
+			"2 checkpoints not yet pushed"},
+		{"pushing_disabled", checkpointSyncInfo{PushDisabled: true, Remote: "origin", Source: "default", Unpushed: 1},
+			"1 checkpoint not on origin"},
+		{"pushing_disabled_dedicated", checkpointSyncInfo{PushDisabled: true, Remote: "org/cp", Source: checkpointSyncSourceDedicated, Unpushed: 2},
+			"2 checkpoints not pushed to the checkpoint remote"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := formatUnpushedCheckpointsLine(tc.info); got != tc.want {
+				t.Errorf("formatUnpushedCheckpointsLine() = %q, want %q", got, tc.want)
+			}
+		})
 	}
 }
 
@@ -2428,13 +2419,16 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 			// the checkpoint read source when push_sessions is false.
 			wantRemote string
 			wantSource string
+			// wantFallback is the remote reads fall OPEN to when the election
+			// failed closed, reported instead of (never alongside) wantRemote.
+			wantFallback string
 		}{
-			{"origin", "", "https://github.com/org/repo.git", "origin", "default"},
-			{"explicit_fork", `,"checkpoint_push_remote":"fork"`, "https://github.com/org/repo.git", "fork", "config"},
-			{"dedicated", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/org/repo.git", "org/checkpoints", checkpointSyncSourceDedicated},
-			{"inherited_dedicated_rejected", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/other/repo.git", "origin", "default"},
-			{"no_remotes", "", "", "", ""},
-			{"missing_configured_remote", `,"checkpoint_push_remote":"gone"`, "https://github.com/org/repo.git", "", ""},
+			{"origin", "", "https://github.com/org/repo.git", "origin", "default", ""},
+			{"explicit_fork", `,"checkpoint_push_remote":"fork"`, "https://github.com/org/repo.git", "fork", "config", ""},
+			{"dedicated", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/org/repo.git", "org/checkpoints", checkpointSyncSourceDedicated, ""},
+			{"inherited_dedicated_rejected", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/other/repo.git", "origin", "default", ""},
+			{"no_remotes", "", "", "", "", ""},
+			{"missing_configured_remote", `,"checkpoint_push_remote":"gone"`, "https://github.com/org/repo.git", "", "", "origin"},
 		} {
 			t.Run(backend+"/"+tc.name, func(t *testing.T) {
 				testutil.IsolateGitConfigEnv(t)
@@ -2475,6 +2469,12 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				if !info.PushDisabled || info.Remote != tc.wantRemote || info.Source != tc.wantSource {
 					t.Errorf("disabled pushing must still resolve the read destination %q/%q: %+v", tc.wantRemote, tc.wantSource, info)
 				}
+				// Reads fail open where the election failed closed, so the
+				// fallback is reported — but never through Remote, which
+				// means "elected" and has nothing to name here.
+				if info.ReadFallback != tc.wantFallback {
+					t.Errorf("read fallback = %q, want %q: %+v", info.ReadFallback, tc.wantFallback, info)
+				}
 				// The counter is the only signal that checkpoint data is not
 				// reaching the destination, so it survives disabled pushing
 				// wherever it is meaningful at all. Dedicated URL mode on
@@ -2486,7 +2486,7 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 					t.Errorf("unpushed count = %d, want counted: %v (%+v)", info.Unpushed, wantCount, info)
 				}
 				for _, jsonOutput := range []bool{false, true} {
-					assertCheckpointPushDisabledStatus(t, jsonOutput, false, tc.wantRemote)
+					assertCheckpointPushDisabledStatus(t, jsonOutput, false, tc.wantRemote, tc.wantFallback)
 					after, err := queue.Peek()
 					if err != nil {
 						t.Fatal(err)
@@ -2587,7 +2587,7 @@ func TestRunStatus_CheckpointPushDisabledSettingsPrecedence(t *testing.T) {
 				if tc.disabled {
 					// --detailed and --json are mutually exclusive: only text
 					// exercises the detailed settings view.
-					assertCheckpointPushDisabledStatus(t, jsonOutput, !jsonOutput, "origin")
+					assertCheckpointPushDisabledStatus(t, jsonOutput, !jsonOutput, "origin", "")
 					continue
 				}
 				var stdout bytes.Buffer

From 47c7d750d6e78a8e40b6df921a0b0e7ddcd34b63 Mon Sep 17 00:00:00 2001
From: Kai Ramuenke <kai@entire.io>
Date: Fri, 11 Sep 2026 10:05:17 +1000
Subject: [PATCH 46/59] coreapi: make ListReposOutputBody.candidatesIncomplete
 optional too

The refresh made it required and the CLI never reads it; an older core that
omits it must not fail repo routing and search.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 internal/coreapi/UPSTREAM.md        |  3 ++-
 internal/coreapi/client_test.go     |  7 ++++---
 internal/coreapi/oas_json_gen.go    | 14 +++++++-------
 internal/coreapi/oas_schemas_gen.go |  8 ++++----
 internal/coreapi/spec/core.gen.json |  3 +--
 internal/coreapi/spec/normalize.go  |  9 +++++----
 6 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/internal/coreapi/UPSTREAM.md b/internal/coreapi/UPSTREAM.md
index 0fe17c1bd1..788698f456 100644
--- a/internal/coreapi/UPSTREAM.md
+++ b/internal/coreapi/UPSTREAM.md
@@ -54,7 +54,8 @@ Retire the allowlist entries as upstream loosens the corresponding fields.
 ## 2b. New read-model fields ship as `required`
 
 **Symptom:** `capabilities` on `Org`, `Project` and `Repo`, `Repo.provider`,
-and `org`/`provider` on `RepoIndexEntry` were added as `required`. ogen's
+`org`/`provider` on `RepoIndexEntry`, and `ListReposOutputBody.candidatesIncomplete`
+were added as `required`. ogen's
 decoder then fails the whole response when a field is absent, so a core that
 predates the field, or a mixed-version roll, breaks every list, get and
 repo-routing call in a client that does not depend on any of them.
diff --git a/internal/coreapi/client_test.go b/internal/coreapi/client_test.go
index 091b570a86..287a77b43b 100644
--- a/internal/coreapi/client_test.go
+++ b/internal/coreapi/client_test.go
@@ -319,14 +319,15 @@ func TestListRepos_UnsentRequiredReadFieldsDecode(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		// No "org", no "provider" — both required upstream, neither read here.
-		// "permission" carries a value the current spec's enum did NOT allow.
+		// No "org", no "provider", no "candidatesIncomplete" — all required
+		// upstream, none read here. "permission" carries a value the current
+		// spec's enum did NOT allow.
 		if _, err := w.Write([]byte(`{"repos":[{` +
 			`"id":"01H000000000000000000000R1","name":"web","full_name":"gh/acme/web",` +
 			`"jurisdiction":"us","cell":"aws-us-east-2","clusterSlug":"us","visibility":"private",` +
 			`"permission":"triage",` +
 			`"placements":[{"id":"01H000000000000000000000R1","jurisdiction":"us","cell":"aws-us-east-2","clusterSlug":"us","mirror":false,"status":"ready"}]` +
-			`}],"truncated":false,"candidatesIncomplete":false}`)); err != nil {
+			`}],"truncated":false}`)); err != nil {
 			t.Errorf("writing test response: %v", err)
 		}
 	}))
diff --git a/internal/coreapi/oas_json_gen.go b/internal/coreapi/oas_json_gen.go
index 25a2bd9c56..db56351ae1 100644
--- a/internal/coreapi/oas_json_gen.go
+++ b/internal/coreapi/oas_json_gen.go
@@ -17719,8 +17719,10 @@ func (s *ListReposOutputBody) encodeFields(e *jx.Encoder) {
 		}
 	}
 	{
-		e.FieldStart("candidatesIncomplete")
-		e.Bool(s.CandidatesIncomplete)
+		if s.CandidatesIncomplete.Set {
+			e.FieldStart("candidatesIncomplete")
+			s.CandidatesIncomplete.Encode(e)
+		}
 	}
 	{
 		if s.NextPageToken.Set {
@@ -17778,11 +17780,9 @@ func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
 				return errors.Wrap(err, "decode field \"$schema\"")
 			}
 		case "candidatesIncomplete":
-			requiredBitSet[0] |= 1 << 1
 			if err := func() error {
-				v, err := d.Bool()
-				s.CandidatesIncomplete = bool(v)
-				if err != nil {
+				s.CandidatesIncomplete.Reset()
+				if err := s.CandidatesIncomplete.Decode(d); err != nil {
 					return err
 				}
 				return nil
@@ -17850,7 +17850,7 @@ func (s *ListReposOutputBody) Decode(d *jx.Decoder) error {
 	// Validate required fields.
 	var failures []validate.FieldError
 	for i, mask := range [1]uint8{
-		0b00011010,
+		0b00011000,
 	} {
 		if result := (requiredBitSet[i] & mask) ^ mask; result != 0 {
 			// Mask only required fields and check equality to mask using XOR.
diff --git a/internal/coreapi/oas_schemas_gen.go b/internal/coreapi/oas_schemas_gen.go
index cbc8535232..651c89d248 100644
--- a/internal/coreapi/oas_schemas_gen.go
+++ b/internal/coreapi/oas_schemas_gen.go
@@ -6716,8 +6716,8 @@ func (s *ListReposOrder) UnmarshalText(data []byte) error {
 // Ref: #/components/schemas/ListReposOutputBody
 type ListReposOutputBody struct {
 	// A URL to the JSON Schema for this object.
-	Schema               OptURI `json:"$schema"`
-	CandidatesIncomplete bool   `json:"candidatesIncomplete"`
+	Schema               OptURI  `json:"$schema"`
+	CandidatesIncomplete OptBool `json:"candidatesIncomplete"`
 	// Pass back to fetch the next page; empty when no more entries.
 	NextPageToken   OptString        `json:"nextPageToken"`
 	Repos           []RepoIndexEntry `json:"repos"`
@@ -6731,7 +6731,7 @@ func (s *ListReposOutputBody) GetSchema() OptURI {
 }
 
 // GetCandidatesIncomplete returns the value of CandidatesIncomplete.
-func (s *ListReposOutputBody) GetCandidatesIncomplete() bool {
+func (s *ListReposOutputBody) GetCandidatesIncomplete() OptBool {
 	return s.CandidatesIncomplete
 }
 
@@ -6761,7 +6761,7 @@ func (s *ListReposOutputBody) SetSchema(val OptURI) {
 }
 
 // SetCandidatesIncomplete sets the value of CandidatesIncomplete.
-func (s *ListReposOutputBody) SetCandidatesIncomplete(val bool) {
+func (s *ListReposOutputBody) SetCandidatesIncomplete(val OptBool) {
 	s.CandidatesIncomplete = val
 }
 
diff --git a/internal/coreapi/spec/core.gen.json b/internal/coreapi/spec/core.gen.json
index 1d3451f626..a17b2eb2ab 100644
--- a/internal/coreapi/spec/core.gen.json
+++ b/internal/coreapi/spec/core.gen.json
@@ -2387,8 +2387,7 @@
         },
         "required": [
           "repos",
-          "truncated",
-          "candidatesIncomplete"
+          "truncated"
         ],
         "type": "object"
       },
diff --git a/internal/coreapi/spec/normalize.go b/internal/coreapi/spec/normalize.go
index 3cea3995be..14a6c68ec6 100644
--- a/internal/coreapi/spec/normalize.go
+++ b/internal/coreapi/spec/normalize.go
@@ -256,10 +256,11 @@ var readModelEnumFields = map[string][]string{
 // message when the server omits it. A field must leave this list when the
 // CLI needs it to be *present* to be correct.
 var readModelOptionalFields = map[string][]string{
-	"Org":            {"capabilities"},
-	"Project":        {"capabilities"},
-	"Repo":           {"capabilities", "provider"},
-	"RepoIndexEntry": {"org", "provider"},
+	"ListReposOutputBody": {"candidatesIncomplete"},
+	"Org":                 {"capabilities"},
+	"Project":             {"capabilities"},
+	"Repo":                {"capabilities", "provider"},
+	"RepoIndexEntry":      {"org", "provider"},
 }
 
 // loosenReadModelRequired removes each field named in readModelOptionalFields

From bbd6e986a2a12b3d52defd8bd09d7c2625cb2f78 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 17:47:25 -0700
Subject: [PATCH 47/59] fix(status): treat an unresolvable read source as
 unknown, not as the elected remote
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up review of the previous commit found the fetch-side routing incomplete
in two ways, one of them a bug.

A fetch-probe ERROR is not the same as a false. False means reads resolve
somewhere other than the dedicated store, so the elected remote is the answer;
an error means no read URL resolves at all — reachable with a configured
checkpoint_remote and no remote named origin, since the dedicated path derives
from origin. Falling soft to the elected remote there reported a working read
source for a repo whose checkpoint reads fail. Status now says it could not
determine one (checkpoint_read_source_unknown) rather than naming a remote.

The "not in use" diagnostic did not route by direction along with the verdict.
It votes with the push identity set, which ACCEPTS a store the fetch side
declines, so in that topology a configured checkpoint_remote served no reads
and nothing said so — the silent ignore the warning exists to prevent. It is
now reported for reads too, without a reason: the fetch side returns a verdict
and not a cause, and its false covers ownership, an unparseable origin URL and
an unmappable protocol alike.

Doc corrections, all cases of a comment claiming more than the code
establishes: PushDisabled no longer says it changes only phrasing (with a
checkpoint_remote configured it changes which probe decides, so Remote and
Source can differ in value); both ReadFallback docs state both preconditions,
so absence is not read as "reads fall open to nothing"; ReadsDedicatedStore no
longer describes leadReadRemote as the derivation source (it is an
ownership-vote identity — the dedicated path derives from origin) and no longer
implies "inherited" is the only false; and the remote-topology note points at
`entire status` for the read source instead of promising one it cannot always
give.

Tests: the destination table gains the probe-failure row and pins it through
ReadSourceUnknown, so it cannot pass for another reason, and moves to keyed
fields — nine positional columns with runs of "" is how an arity error got in
mid-edit. The integration case for the topology note becomes a unit test:
describeCheckpointDestination takes an io.Writer and a plain struct, so it
needed neither a TestEnv nor a bare remote.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M26YXZWMSEYHZ6B7EBN6XFAV
---
 cmd/entire/cli/checkpoint/remote/util.go      |  32 +++++
 .../integration_test/multi_pushurl_test.go    |  31 -----
 cmd/entire/cli/remote_topology.go             |  12 +-
 cmd/entire/cli/remote_topology_test.go        |  65 ++++++++++
 cmd/entire/cli/status.go                      | 114 ++++++++++++++----
 cmd/entire/cli/status_test.go                 | 114 +++++++++++++++---
 6 files changed, 294 insertions(+), 74 deletions(-)
 create mode 100644 cmd/entire/cli/remote_topology_test.go

diff --git a/cmd/entire/cli/checkpoint/remote/util.go b/cmd/entire/cli/checkpoint/remote/util.go
index ac6056e440..55339ba9c3 100644
--- a/cmd/entire/cli/checkpoint/remote/util.go
+++ b/cmd/entire/cli/checkpoint/remote/util.go
@@ -55,6 +55,38 @@ func FetchURL(ctx context.Context, opts ...FetchURLOptions) (string, error) {
 	return url, err
 }
 
+// ReadsDedicatedStore reports whether checkpoint READS resolve to the
+// configured dedicated checkpoint_remote.
+//
+// leadReadRemote contributes an IDENTITY to the ownership vote, and nothing
+// else: when a checkpoint_remote is configured the URL is always derived from
+// origin, which is why FetchURLOptions.LeadReadRemote says the dedicated path
+// "ignores it entirely". Pass the elected sync remote so the vote sees the
+// same fork-shaped identity the push side sees.
+//
+// The read counterpart of PushURL's enabled bit, and deliberately a separate
+// question: both require every identity to be owned by the checkpoint repo's
+// owner, but the push identity set is origin plus the elected remote's PUSH
+// URLs while the fetch set is origin plus leadReadRemote's FETCH URL — so a
+// remote whose two URLs have different owners is eligible on one side and not
+// the other. A caller reporting where checkpoints COME FROM must ask this
+// one; PushURL answers where they would GO.
+//
+// False covers every reason reads do not land on the configured store, not
+// only an inherited one: no checkpoint_remote configured, ownership not
+// confirmed, unreadable settings, an origin URL that will not parse, or a
+// protocol that maps to no checkpoint URL and no provider host. A caller that
+// needs to explain WHY cannot read it off this bool; the reasons are logged
+// where they are decided.
+//
+// Local-only, like FetchURL: git config and settings reads, no dialing. An
+// error means no read URL resolves at all — distinct from false, which means
+// reads resolve somewhere else.
+func ReadsDedicatedStore(ctx context.Context, leadReadRemote string) (bool, error) {
+	_, authoritative, err := fetchURLAuthoritative(ctx, FetchURLOptions{LeadReadRemote: leadReadRemote})
+	return authoritative, err
+}
+
 // fetchURLAuthoritative is FetchURL plus whether the returned URL is
 // authoritative for checkpoint refs. It is false exactly when a
 // checkpoint_remote IS configured (or cannot be determined) but resolution
diff --git a/cmd/entire/cli/integration_test/multi_pushurl_test.go b/cmd/entire/cli/integration_test/multi_pushurl_test.go
index 138019c0b2..5f1b04fe06 100644
--- a/cmd/entire/cli/integration_test/multi_pushurl_test.go
+++ b/cmd/entire/cli/integration_test/multi_pushurl_test.go
@@ -406,37 +406,6 @@ func TestMultiPushURL_DestinationNoteSurfaces(t *testing.T) {
 			want:   []string{"2 remotes", "single elected remote", "entire status"},
 			absent: []string{"follow whichever remote", "always looks at origin"},
 		},
-		{
-			// The note tells the user to run `entire status` for the elected
-			// destination, and describes where a push delivers checkpoints —
-			// both of which read as promises when push_sessions is false and
-			// nothing is pushed at all. The ambiguity is still real (it is
-			// what re-enabling pushing runs into), so the note is qualified
-			// rather than suppressed — and the caveat points at status for
-			// the read source instead of claiming the URLs listed here are
-			// it, since those are push URLs and reads use the fetch URL.
-			name: "several remotes, pushing disabled",
-			setup: func(env *TestEnv) {
-				env.SetupNamedBareRemote("backup")
-				env.PatchSettings(map[string]any{
-					"strategy_options": map[string]any{"push_sessions": false},
-				})
-			},
-			want: []string{
-				// One string proving the note still renders its body; the
-				// case above already covers that body in full.
-				"single elected remote",
-				"Automatic checkpoint pushing is disabled (push_sessions=false)",
-				// Substrings must not straddle the note's line wrapping.
-				"they would go if you re-enabled it",
-			},
-			absent: []string{
-				"checkpoints are waiting for it",
-				// The URLs listed here are push URLs; reads use the fetch
-				// URL, so this note must not present them as the read source.
-				"where they are read from today",
-			},
-		},
 	}
 
 	for _, tt := range tests {
diff --git a/cmd/entire/cli/remote_topology.go b/cmd/entire/cli/remote_topology.go
index 74cbd55565..4a857cf5a0 100644
--- a/cmd/entire/cli/remote_topology.go
+++ b/cmd/entire/cli/remote_topology.go
@@ -163,13 +163,17 @@ func (t remoteTopology) describeCheckpointDestination(w io.Writer, header string
 	// that is the live question when nothing is pushed: what this note lists
 	// is PUSH URLs, and a fan-out remote's reads use its fetch URL instead
 	// (the git-branch branch below says as much — "only the fetch URL is ever
-	// reconciled"). `entire status` names the read source correctly, as an
-	// elected remote rather than a URL.
+	// reconciled").
+	//
+	// It points at `entire status` for that rather than answering it, and
+	// without promising an answer: status names a read source where it can
+	// establish one, and says so when it cannot — a failed election with a
+	// configured checkpoint_remote resolves to neither.
 	if t.pushDisabled {
 		fmt.Fprintln(w, "  Automatic checkpoint pushing is disabled (push_sessions=false), so no")
 		fmt.Fprintln(w, "  checkpoints are pushed anywhere right now. The destination below is where")
-		fmt.Fprintln(w, "  they would go if you re-enabled it; `entire status` reports where")
-		fmt.Fprintln(w, "  checkpoints are read from meanwhile.")
+		fmt.Fprintln(w, "  they would go if you re-enabled it; for where they are read from today,")
+		fmt.Fprintln(w, "  see `entire status`.")
 	}
 
 	for _, d := range t.destinations {
diff --git a/cmd/entire/cli/remote_topology_test.go b/cmd/entire/cli/remote_topology_test.go
new file mode 100644
index 0000000000..5a31fcc33e
--- /dev/null
+++ b/cmd/entire/cli/remote_topology_test.go
@@ -0,0 +1,65 @@
+package cli
+
+import (
+	"strings"
+	"testing"
+)
+
+// describeCheckpointDestination writes to an io.Writer from a plain struct, so
+// the disabled-pushing caveat needs no repo, no remotes and no CLI run.
+//
+// What it must not do is present the URLs it lists as the read source: they
+// are PUSH urls, and a fan-out remote's reads use its fetch url. It points at
+// `entire status` for that instead, and does not promise status will always
+// have an answer.
+func TestDescribeCheckpointDestination_PushDisabledCaveat(t *testing.T) {
+	t.Parallel()
+	topology := remoteTopology{
+		destinations: []remoteDestination{
+			{name: "backup", pushURLs: []string{"https://github.com/org/backup.git"}},
+			{name: "origin", pushURLs: []string{"https://github.com/org/repo.git"}},
+		},
+	}
+	for _, tc := range []struct {
+		name           string
+		pushDisabled   bool
+		want, unwanted []string
+	}{
+		{
+			name:     "pushing enabled",
+			want:     []string{"2 remotes", "single elected remote"},
+			unwanted: []string{"push_sessions=false"},
+		},
+		{
+			name:         "pushing disabled",
+			pushDisabled: true,
+			want: []string{
+				// The note still renders its body: the ambiguity is what
+				// re-enabling pushing would run into.
+				"single elected remote",
+				"Automatic checkpoint pushing is disabled (push_sessions=false)",
+				"they would go if you re-enabled it",
+			},
+			// "waiting for it" implied a pending push that cannot happen.
+			unwanted: []string{"checkpoints are waiting for it"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			topology := topology
+			topology.pushDisabled = tc.pushDisabled
+			var b strings.Builder
+			topology.describeCheckpointDestination(&b, "Checkpoint destination: REVIEW")
+			for _, want := range tc.want {
+				if !strings.Contains(b.String(), want) {
+					t.Errorf("missing %q:\n%s", want, b.String())
+				}
+			}
+			for _, unwanted := range tc.unwanted {
+				if strings.Contains(b.String(), unwanted) {
+					t.Errorf("must not mention %q:\n%s", unwanted, b.String())
+				}
+			}
+		})
+	}
+}
diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index 27e2ae6aae..f2de122498 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -336,13 +336,20 @@ type checkpointSyncInfo struct {
 	// possible reason checkpoint sync might fail.
 	//
 	// It suppresses nothing else in this struct, because nothing else is a
-	// push promise. The elected remote stays the checkpoint READ source
-	// (strategy.CheckpointReadRemotesWithElection never consults
-	// push_sessions), the unpushed count is the only signal that checkpoint
-	// data is not reaching the elected destination, and the
-	// remote-configuration diagnostics explain read behavior too. Disabling
-	// uploads therefore changes how the renderers PHRASE these fields, not
-	// whether they are populated — see writeCheckpointSyncLines.
+	// push promise: reads keep working (push_sessions gates only the pre-push
+	// hook), the unpushed count is the only signal that checkpoint data is
+	// not reaching the elected destination, and the remote-configuration
+	// diagnostics explain read behavior too.
+	//
+	// What it does instead is switch the QUESTION these fields answer, from
+	// "where would checkpoints go" to "where do they come from" — so it
+	// changes more than phrasing. With a checkpoint_remote configured, the
+	// verdict behind Remote and Source is then the FETCH side's rather than
+	// the push side's, and in a repo whose two URLs have different owners
+	// that is a different VALUE, not a different wording. (With none
+	// configured both answer the elected remote, and only the wording
+	// differs.) ReadFallback and ReadSourceUnknown exist only while it is
+	// set.
 	PushDisabled bool
 	// Remote is the elected git remote name, or the org/repo slug in
 	// dedicated checkpoint_remote mode. Empty when nothing resolved (no
@@ -353,16 +360,23 @@ type checkpointSyncInfo struct {
 	Source string
 	// Err is the fail-closed misconfiguration message from the resolver.
 	Err string
+	// ReadSourceUnknown reports that the fetch-side probe failed, so nothing
+	// is known about where reads resolve and no read source is named. Set
+	// only while pushing is disabled, where that probe is consulted at all.
+	ReadSourceUnknown bool
 	// ReadFallback is the remote checkpoint READS fall open to when the
 	// election failed, so Err is set and nothing was elected. Deliberately
 	// not folded into Remote: that field means "the elected remote", and on
 	// this path there is none — reporting a fallback there would misstate
 	// checkpoint_sync_remote to JSON consumers.
 	//
-	// Populated only while pushing is disabled, where status is the sole
-	// surface naming the read source. With pushing enabled the headline is
-	// the broken setting and the user's next move is to fix it, so that
-	// output is left as it was.
+	// TWO preconditions, and its absence means whichever did not hold.
+	// Pushing must be disabled — with pushing enabled the headline is the
+	// broken setting and the user's next move is to fix it, so that output is
+	// left as it was. And no checkpoint_remote may be configured, because
+	// reads would then resolve to the dedicated store rather than to any read
+	// candidate, and this field names a git remote. So empty does NOT mean
+	// "reads fall open to nothing".
 	ReadFallback string
 	// Unpushed approximates checkpoints not yet on the sync destination; 0
 	// when none, when counting failed, or when the count would be a lie
@@ -394,7 +408,10 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		// them. Asked of the resolver rather than reproducing its fallback
 		// rule here; it re-runs the election, which is why this is on the
 		// error path only, and it stays local-only like the rest of status.
-		if info.PushDisabled {
+		// Skipped when a checkpoint_remote is configured: reads may resolve
+		// to the dedicated store instead of to any read candidate, and this
+		// field names a git remote, so it has nothing true to say there.
+		if info.PushDisabled && s.GetCheckpointRemote() == nil {
 			info.ReadFallback = strategy.LeadCheckpointReadRemote(ctx)
 		}
 		return info
@@ -403,16 +420,46 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		return info // no remotes configured: only report disabled pushing, if set
 	}
 
-	// Dedicated checkpoint_remote mode is reported only when PushURL derives
-	// an eligible URL for the elected remote, mirroring the pre-push
-	// exemption (ps.hasCheckpointURL); otherwise the gate applies normal
-	// single-remote sync, so status reports that instead. PushURL is
-	// local-only; never call resolvePushSettings here — its follow-up
-	// metadata fetch dials, and status must stay network-free.
+	// Dedicated checkpoint_remote mode is reported only when the direction
+	// this line describes actually resolves to it; otherwise the gate applies
+	// normal single-remote sync, so status reports that instead.
+	//
+	// Which direction that is depends on push_sessions, and the two are
+	// separate questions. With pushing enabled the line names a push
+	// destination, so PushURL decides, mirroring the pre-push exemption
+	// (ps.hasCheckpointURL). With pushing disabled it names a READ source,
+	// which is the fetch side's call over a different ownership identity set
+	// — origin plus the candidate's FETCH url, not its push urls — so a
+	// remote whose two urls have different owners is eligible on one side
+	// only, and asking the wrong side reports a store reads do not use.
+	//
+	// Both probes are local-only; never call resolvePushSettings here — its
+	// follow-up metadata fetch dials, and status must stay network-free.
 	// Accepted divergence: a real push to a different named remote may derive
 	// PushURL differently than this elected-remote probe does.
 	if cr := s.GetCheckpointRemote(); cr != nil {
-		if _, enabled, purlErr := checkpointremote.PushURL(ctx, elected.Name); purlErr == nil && enabled {
+		dedicated := false
+		if info.PushDisabled {
+			authoritative, fetchErr := checkpointremote.ReadsDedicatedStore(ctx, elected.Name)
+			if fetchErr != nil {
+				// Not the same as false. False means reads resolve somewhere
+				// else (so the elected remote is the answer); an error means
+				// no read URL resolves at all — reachable with a configured
+				// checkpoint_remote and no remote named origin. Falling soft
+				// to the elected remote there would report a working read
+				// source for a repo whose checkpoint reads fail. The push
+				// branch below may fall soft because resolvePushSettings
+				// degrades the same way it does; this one may not.
+				logging.Debug(ctx, "checkpoint read source probe failed; status omits the read source",
+					slog.String("error", fetchErr.Error()))
+				info.ReadSourceUnknown = true
+				return info
+			}
+			dedicated = authoritative
+		} else if _, enabled, purlErr := checkpointremote.PushURL(ctx, elected.Name); purlErr == nil {
+			dedicated = enabled
+		}
+		if dedicated {
 			info.Remote = cr.Repo
 			info.Source = checkpointSyncSourceDedicated
 			// The unpushed counter is meaningful here only on the git-refs
@@ -438,10 +485,23 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 	// (origin + push URLs of the elected remote), while a fetch votes with its
 	// read candidate, so a push-only owner mismatch shows "not in use" here
 	// even though a lead-less fetch still resolves the checkpoint remote.
-	if s.GetCheckpointRemote() != nil {
+	if cr := s.GetCheckpointRemote(); cr != nil {
 		if repo, reason, inherited := checkpointremote.InheritedCheckpointRemote(ctx, s, elected.Name); inherited {
 			info.IgnoredRemote = repo
 			info.IgnoredReason = reason
+		} else if info.PushDisabled {
+			// That verdict votes with the push identity set, so it accepts a
+			// store the fetch side declined — and with pushing disabled the
+			// fetch side is the one that decided the line above. Without this
+			// the configured store is reported by nothing at all, which is
+			// the silent-ignore the warning exists to prevent.
+			//
+			// No reason is given: the fetch side returns a verdict and not a
+			// cause, and its false covers ownership, an unparseable origin
+			// URL and an unmappable protocol alike, so naming one would be a
+			// guess. The causes are logged where they are decided.
+			info.IgnoredRemote = cr.Repo
+			info.IgnoredReason = "checkpoint reads do not resolve to it (see .entire/logs for the reason)"
 		}
 	}
 	return info
@@ -500,6 +560,9 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 		} else {
 			b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
 		}
+	case info.ReadSourceUnknown:
+		b.WriteString("\n")
+		b.WriteString(sty.render(sty.yellow, "  ! Could not determine where checkpoints are read from"))
 	case info.Remote == "":
 		// No remotes configured: nothing resolved, and the diagnostics and
 		// counter below are empty by construction on this path.
@@ -953,10 +1016,18 @@ type statusJSON struct {
 	CheckpointSyncRemote       string `json:"checkpoint_sync_remote,omitempty"`
 	CheckpointSyncRemoteSource string `json:"checkpoint_sync_remote_source,omitempty"` // config|observed|default|sole|first|dedicated
 	CheckpointSyncError        string `json:"checkpoint_sync_error,omitempty"`         // fail-closed message
+	// CheckpointReadSourceUnknown reports that the read-source probe failed,
+	// so no read source could be determined. Emitted only alongside
+	// checkpoint_push_disabled, and checkpoint_sync_remote is then absent
+	// rather than guessed at.
+	CheckpointReadSourceUnknown bool `json:"checkpoint_read_source_unknown,omitempty"`
 	// CheckpointReadFallback is the remote reads fall open to when the
 	// election failed (checkpoint_sync_error is then set and
 	// checkpoint_sync_remote is absent, because nothing was elected). Emitted
-	// only alongside checkpoint_push_disabled.
+	// only alongside checkpoint_push_disabled AND only when no
+	// checkpoint_remote is configured — with one configured, reads may
+	// resolve to the dedicated store instead, so absence here does not mean
+	// reads fall open to nothing.
 	CheckpointReadFallback string `json:"checkpoint_read_fallback,omitempty"`
 	UnpushedCheckpoints    int    `json:"unpushed_checkpoints,omitempty"`
 	// CheckpointRemoteIgnored/-Reason report a configured checkpoint_remote the
@@ -1053,6 +1124,7 @@ func runStatusJSON(ctx context.Context, w io.Writer) error {
 		result.CheckpointSyncRemoteSource = syncInfo.Source
 		result.CheckpointSyncError = syncInfo.Err
 		result.CheckpointReadFallback = syncInfo.ReadFallback
+		result.CheckpointReadSourceUnknown = syncInfo.ReadSourceUnknown
 		result.UnpushedCheckpoints = syncInfo.Unpushed
 		result.CheckpointRemoteIgnored = syncInfo.IgnoredRemote
 		result.CheckpointRemoteIgnoredReason = syncInfo.IgnoredReason
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index 83951538ae..c71b1044d7 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -2290,6 +2290,11 @@ func TestRunStatus_PrintsBothReviewAndInvestigation(t *testing.T) {
 
 // --- Checkpoint sync visibility (single-remote gate observability) ---
 
+// originRemoteName is the primary remote these fixtures create. Named rather
+// than repeated: it is also the remote the checkpoint election defaults to and
+// the read chain's legacy tier, so the string carries meaning here.
+const originRemoteName = "origin"
+
 func TestRunStatus_CheckpointPushDisabled(t *testing.T) {
 	testCheckpointPushDisabledFork(t, false)
 }
@@ -2304,7 +2309,7 @@ func testCheckpointPushDisabledFork(t *testing.T, jsonOutput bool) {
 	testutil.IsolateGitConfigEnv(t)
 	setupTestRepo(t)
 	writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false,"checkpoint_push_remote":"fork"}}`)
-	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+	testutil.AddRemote(t, ".", originRemoteName, "https://github.com/org/repo.git")
 	testutil.AddRemote(t, ".", "fork", "https://github.com/user/repo.git")
 	head := checkpointSyncTestCommit(t, "a.txt", "one")
 	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
@@ -2422,23 +2427,83 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 			// wantFallback is the remote reads fall OPEN to when the election
 			// failed closed, reported instead of (never alongside) wantRemote.
 			wantFallback string
+			// fork is the fetch URL of a second remote named "fork" ("" = none);
+			// forkPush overrides its push URL, so the two can have different
+			// owners and the push- and fetch-side ownership votes disagree.
+			fork     string
+			forkPush string
+			// originName renames the primary remote ("" = "origin"). A
+			// configured checkpoint_remote with no origin makes the read
+			// probe fail outright, which is not the same as it resolving
+			// elsewhere.
+			originName string
+			// wantReadUnknown pins that the probe failure is what suppressed
+			// the read source, rather than the row passing because nothing
+			// resolved for some other reason.
+			wantReadUnknown bool
 		}{
-			{"origin", "", "https://github.com/org/repo.git", "origin", "default", ""},
-			{"explicit_fork", `,"checkpoint_push_remote":"fork"`, "https://github.com/org/repo.git", "fork", "config", ""},
-			{"dedicated", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/org/repo.git", "org/checkpoints", checkpointSyncSourceDedicated, ""},
-			{"inherited_dedicated_rejected", `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`, "https://github.com/other/repo.git", "origin", "default", ""},
-			{"no_remotes", "", "", "", "", ""},
-			{"missing_configured_remote", `,"checkpoint_push_remote":"gone"`, "https://github.com/org/repo.git", "", "", "origin"},
+			{name: "origin", origin: "https://github.com/org/repo.git", wantRemote: "origin", wantSource: "default"},
+			{
+				name: "explicit_fork", options: `,"checkpoint_push_remote":"fork"`,
+				origin: "https://github.com/org/repo.git", fork: "https://github.com/user/repo.git",
+				wantRemote: "fork", wantSource: "config",
+			},
+			{
+				name: "dedicated", options: `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
+				origin:     "https://github.com/org/repo.git",
+				wantRemote: "org/checkpoints", wantSource: checkpointSyncSourceDedicated,
+			},
+			{
+				name: "inherited_dedicated_rejected", options: `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
+				origin:     "https://github.com/other/repo.git",
+				wantRemote: "origin", wantSource: "default",
+			},
+			{name: "no_remotes"},
+			{
+				name: "missing_configured_remote", options: `,"checkpoint_push_remote":"gone"`,
+				origin: "https://github.com/org/repo.git", wantFallback: "origin",
+			},
+			// Push- and fetch-side ownership disagree. Both require EVERY
+			// identity to be owned by the checkpoint repo's owner, but over
+			// different sets: origin plus fork's PUSH urls (all "org", so the
+			// push side certifies the dedicated store) versus origin plus
+			// fork's FETCH url ("other", so the fetch side rejects it). With
+			// pushing disabled the line names a read source, so the fetch
+			// side decides and the elected remote is reported; deciding it
+			// with PushURL named a store reads never use.
+			{
+				name:    "dedicated_rejected_by_fetch_owner",
+				options: `,"checkpoint_push_remote":"fork","checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
+				origin:  "https://github.com/org/repo.git",
+				fork:    "https://github.com/other/fork.git", forkPush: "https://github.com/org/fork.git",
+				wantRemote: "fork", wantSource: "config",
+			},
+			// The read probe cannot resolve any URL (a configured
+			// checkpoint_remote derives from origin, and there is none), so
+			// no read source is named rather than the sole remote being
+			// reported as one while reads fail.
+			{
+				name: "dedicated_without_origin", options: `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
+				origin: "https://github.com/org/repo.git", originName: "upstream",
+				wantReadUnknown: true,
+			},
 		} {
 			t.Run(backend+"/"+tc.name, func(t *testing.T) {
 				testutil.IsolateGitConfigEnv(t)
 				setupTestRepo(t)
 				writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":false`+tc.options+`},"checkpoints":{"primary":{"type":"`+backend+`"}}}`)
 				if tc.origin != "" {
-					testutil.AddRemote(t, ".", "origin", tc.origin)
+					name := tc.originName
+					if name == "" {
+						name = originRemoteName
+					}
+					testutil.AddRemote(t, ".", name, tc.origin)
 				}
-				if tc.name == "explicit_fork" {
-					testutil.AddRemote(t, ".", "fork", "https://github.com/user/repo.git")
+				if tc.fork != "" {
+					testutil.AddRemote(t, ".", "fork", tc.fork)
+					if tc.forkPush != "" {
+						testutil.RunGit(t, ".", "remote", "set-url", "--push", "fork", tc.forkPush)
+					}
 				}
 				head := checkpointSyncTestCommit(t, "a.txt", "one")
 				testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
@@ -2463,7 +2528,17 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 					t.Fatal(err)
 				}
 				info := computeCheckpointSyncInfo(t.Context(), s)
-				if (info.Err != "") != (tc.name == "missing_configured_remote") || (info.IgnoredRemote != "") != (tc.name == "inherited_dedicated_rejected") {
+				// Both rejections report "not in use", by different routes:
+				// the origin-owner row through the push-side verdict, the
+				// fetch-rejected row through the read-side branch that exists
+				// because that verdict ACCEPTS it. Without the second, a
+				// configured store that serves no reads is reported by
+				// nothing. (Not the divergence documented as accepted on
+				// InheritedCheckpointRemote — that one is the opposite
+				// direction, a warning where a lead-less fetch still resolves
+				// the store.)
+				wantIgnored := tc.name == "inherited_dedicated_rejected" || tc.name == "dedicated_rejected_by_fetch_owner"
+				if (info.Err != "") != (tc.name == "missing_configured_remote") || (info.IgnoredRemote != "") != wantIgnored {
 					t.Errorf("unexpected remote diagnostics: %+v", info)
 				}
 				if !info.PushDisabled || info.Remote != tc.wantRemote || info.Source != tc.wantSource {
@@ -2475,6 +2550,9 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				if info.ReadFallback != tc.wantFallback {
 					t.Errorf("read fallback = %q, want %q: %+v", info.ReadFallback, tc.wantFallback, info)
 				}
+				if info.ReadSourceUnknown != tc.wantReadUnknown {
+					t.Errorf("read source unknown = %v, want %v: %+v", info.ReadSourceUnknown, tc.wantReadUnknown, info)
+				}
 				// The counter is the only signal that checkpoint data is not
 				// reaching the destination, so it survives disabled pushing
 				// wherever it is meaningful at all. Dedicated URL mode on
@@ -2518,7 +2596,7 @@ func TestRunStatus_CheckpointDiagnosticsWithPushDisabled(t *testing.T) {
 				testutil.IsolateGitConfigEnv(t)
 				setupTestRepo(t)
 				writeSettings(t, `{"enabled":true,"strategy_options":{"push_sessions":`+pushSetting+`,`+tc.options+`}}`)
-				testutil.AddRemote(t, ".", "origin", "https://github.com/other/repo.git")
+				testutil.AddRemote(t, ".", originRemoteName, "https://github.com/other/repo.git")
 				for _, mode := range []struct {
 					name           string
 					detailed, json bool
@@ -2580,7 +2658,7 @@ func TestRunStatus_CheckpointPushDisabledSettingsPrecedence(t *testing.T) {
 			if tc.local != "" {
 				testutil.WriteFile(t, ".", ".entire/settings.local.json", tc.local)
 			}
-			testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+			testutil.AddRemote(t, ".", originRemoteName, "https://github.com/org/repo.git")
 			head := checkpointSyncTestCommit(t, "a.txt", "one")
 			testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, head)
 			for _, jsonOutput := range []bool{false, true} {
@@ -2827,7 +2905,7 @@ func TestRunStatus_CheckpointSyncDedicated_GitBranch_NoCounter(t *testing.T) {
 	writeSettings(t, `{"enabled": true, "strategy_options": {"checkpoint_remote": {"provider": "github", "repo": "org/checkpoints"}}}`)
 	// Same owner ("org") as checkpoint_remote and a parseable GitHub URL, so
 	// PushURL derivation succeeds locally and dedicated mode is verified.
-	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+	testutil.AddRemote(t, ".", originRemoteName, "https://github.com/org/repo.git")
 	head := checkpointSyncTestCommit(t, "a.txt", "one")
 	// A local v1 branch exists, but in dedicated URL mode on the git-branch
 	// backend the tracking-ref comparison would permanently read "all
@@ -2852,7 +2930,7 @@ func TestRunStatus_CheckpointSyncDedicated_GitRefs_QueueCounter(t *testing.T) {
 	testutil.IsolateGitConfigEnv(t)
 	setupTestRepo(t)
 	writeSettings(t, `{"enabled": true, "strategy_options": {"checkpoint_remote": {"provider": "github", "repo": "org/checkpoints"}}, "checkpoints": {"primary": {"type": "git-refs"}}}`)
-	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+	testutil.AddRemote(t, ".", originRemoteName, "https://github.com/org/repo.git")
 	checkpointSyncTestCommit(t, "a.txt", "one")
 
 	cwd, err := os.Getwd()
@@ -2947,7 +3025,7 @@ func TestRunStatusJSON_CheckpointSync_Dedicated(t *testing.T) {
 	testutil.IsolateGitConfigEnv(t)
 	setupTestRepo(t)
 	writeSettings(t, `{"enabled": true, "strategy_options": {"checkpoint_remote": {"provider": "github", "repo": "org/checkpoints"}}}`)
-	testutil.AddRemote(t, ".", "origin", "https://github.com/org/repo.git")
+	testutil.AddRemote(t, ".", originRemoteName, "https://github.com/org/repo.git")
 
 	var stdout bytes.Buffer
 	if err := runStatus(context.Background(), &stdout, false, true); err != nil {
@@ -2979,7 +3057,7 @@ func TestRunStatus_CheckpointSyncDedicated_IneligibleFallsBackToElected(t *testi
 	writeSettings(t, `{"enabled": true, "strategy_options": {"checkpoint_remote": {"provider": "github", "repo": "org/checkpoints"}}}`)
 	// Remote owner "other" != checkpoint_remote owner "org": fork detection
 	// rejects the dedicated store at push time.
-	testutil.AddRemote(t, ".", "origin", "https://github.com/other/repo.git")
+	testutil.AddRemote(t, ".", originRemoteName, "https://github.com/other/repo.git")
 	checkpointSyncTestCommit(t, "a.txt", "one")
 	second := checkpointSyncTestCommit(t, "b.txt", "two")
 	testutil.GitUpdateRef(t, ".", "refs/heads/"+paths.MetadataBranchName, second)
@@ -3007,7 +3085,7 @@ func TestRunStatusJSON_CheckpointSync_DedicatedIneligible(t *testing.T) {
 	testutil.IsolateGitConfigEnv(t)
 	setupTestRepo(t)
 	writeSettings(t, `{"enabled": true, "strategy_options": {"checkpoint_remote": {"provider": "github", "repo": "org/checkpoints"}}}`)
-	testutil.AddRemote(t, ".", "origin", "https://github.com/other/repo.git")
+	testutil.AddRemote(t, ".", originRemoteName, "https://github.com/other/repo.git")
 
 	var stdout bytes.Buffer
 	if err := runStatus(context.Background(), &stdout, false, true); err != nil {

From e176520f8a80cea2d999a23442cc5d96f07ffee0 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 18:04:35 -0700
Subject: [PATCH 48/59] fix(status): report the dedicated read source when the
 election fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A failed election does not stop reads — they fail open — so with a configured
checkpoint_remote the dedicated store can still be serving them with nothing
elected. The previous commit skipped the read source entirely on that path,
reasoning that ReadFallback names a git remote and so had nothing true to say.
That was true of the field and let it decide what STATUS says: Remote/Source
already carry a dedicated sense, which is exactly the shape this needs.

The fail-closed path now reports the dedicated store (Remote/Source), the
fail-open candidate when the fetch side does not own it (ReadFallback), or
that nothing could be determined (ReadSourceUnknown) — the same three answers
the resolved path gives, because both now go through one
resolveDedicatedReadSource. The asymmetry between those two paths is what
produced this finding and the previous one, so it is the asymmetry that is
removed rather than the symptom.

The renderer needed the matching change: the error line and the read source
were arms of one switch, so a warning shadowed the destination whenever both
applied. The warning is now emitted independently of the read-source switch.

Docs follow the behavior: Remote can hold the dedicated slug on the
fail-closed path, and ReadFallback's second precondition is "the dedicated
store is not what serves reads" rather than "no checkpoint_remote configured".

Tests: two rows for the failed-election-with-dedicated case, owned and
disowned. Expectations move from tc.name matching to explicit wantErr /
wantIgnored fields — several rows now reach each, and name matching silently
mis-expects every row added after it, which it did twice while writing this.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M26ZXE9SXJSVMWQYH5HE9FCN
---
 cmd/entire/cli/status.go      | 136 ++++++++++++++++++++++------------
 cmd/entire/cli/status_test.go |  56 ++++++++++----
 2 files changed, 128 insertions(+), 64 deletions(-)

diff --git a/cmd/entire/cli/status.go b/cmd/entire/cli/status.go
index f2de122498..e57b453724 100644
--- a/cmd/entire/cli/status.go
+++ b/cmd/entire/cli/status.go
@@ -352,8 +352,11 @@ type checkpointSyncInfo struct {
 	// set.
 	PushDisabled bool
 	// Remote is the elected git remote name, or the org/repo slug in
-	// dedicated checkpoint_remote mode. Empty when nothing resolved (no
-	// remotes configured, or the fail-closed case).
+	// dedicated checkpoint_remote mode. Empty when nothing resolved: no
+	// remotes configured, or the fail-closed case — except that with pushing
+	// disabled a failed election can still leave the dedicated slug here,
+	// since reads fail open and the store may serve them with nothing
+	// elected.
 	Remote string
 	// Source is config|observed|default|sole|first (resolver values) or
 	// "dedicated".
@@ -373,10 +376,11 @@ type checkpointSyncInfo struct {
 	// TWO preconditions, and its absence means whichever did not hold.
 	// Pushing must be disabled — with pushing enabled the headline is the
 	// broken setting and the user's next move is to fix it, so that output is
-	// left as it was. And no checkpoint_remote may be configured, because
-	// reads would then resolve to the dedicated store rather than to any read
-	// candidate, and this field names a git remote. So empty does NOT mean
-	// "reads fall open to nothing".
+	// left as it was. And the dedicated store must not be what serves reads:
+	// a configured checkpoint_remote the fetch side confirms is reported
+	// through Remote/Source instead (this field names a git remote), and a
+	// failed probe through ReadSourceUnknown. So empty does NOT mean "reads
+	// fall open to nothing".
 	ReadFallback string
 	// Unpushed approximates checkpoints not yet on the sync destination; 0
 	// when none, when counting failed, or when the count would be a lie
@@ -390,6 +394,46 @@ type checkpointSyncInfo struct {
 	IgnoredReason string
 }
 
+// resolveDedicatedReadSource records where checkpoint READS land when the
+// configured checkpoint_remote is what serves them. Used by both paths that
+// name a read source, so the two cannot answer the question differently — the
+// asymmetry between them is what this function exists to remove.
+//
+// lead is the read candidate whose FETCH url joins origin in the ownership
+// vote: the elected remote, or "" when the election failed and reads fall
+// open to origin alone.
+//
+// Reports whether it settled the answer — the dedicated store serves reads
+// (Remote/Source), or the probe failed so nothing is known
+// (ReadSourceUnknown). False means reads resolve to the caller's own
+// candidate, which the caller names.
+func resolveDedicatedReadSource(ctx context.Context, s *EntireSettings, lead string, info *checkpointSyncInfo) bool {
+	cr := s.GetCheckpointRemote()
+	if cr == nil {
+		return false
+	}
+	authoritative, err := checkpointremote.ReadsDedicatedStore(ctx, lead)
+	switch {
+	case err != nil:
+		// Not the same as false. False means reads resolve somewhere else,
+		// so the caller's candidate is the answer; an error means no read URL
+		// resolves at all — reachable with a configured checkpoint_remote and
+		// no remote named origin, since the dedicated derivation is from
+		// origin. Naming a candidate there would report a working read source
+		// for a repo whose checkpoint reads fail.
+		logging.Debug(ctx, "checkpoint read source probe failed; status omits the read source",
+			slog.String("error", err.Error()))
+		info.ReadSourceUnknown = true
+		return true
+	case authoritative:
+		info.Remote = cr.Repo
+		info.Source = checkpointSyncSourceDedicated
+		return true
+	default:
+		return false
+	}
+}
+
 func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpointSyncInfo {
 	info := checkpointSyncInfo{PushDisabled: s.IsPushSessionsDisabled()}
 
@@ -404,14 +448,13 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 		// elected remote left to probe PushURL against here.
 		info.Err = err.Error()
 		// Reads fail OPEN where the election failed closed (see
-		// strategy.CheckpointReadRemotes), so something may still be serving
-		// them. Asked of the resolver rather than reproducing its fallback
-		// rule here; it re-runs the election, which is why this is on the
-		// error path only, and it stays local-only like the rest of status.
-		// Skipped when a checkpoint_remote is configured: reads may resolve
-		// to the dedicated store instead of to any read candidate, and this
-		// field names a git remote, so it has nothing true to say there.
-		if info.PushDisabled && s.GetCheckpointRemote() == nil {
+		// strategy.CheckpointReadRemotes), so something is probably still
+		// serving them: the dedicated store when one is configured and the
+		// fetch side owns it, otherwise the fail-open candidate. Each is
+		// asked of its own resolver rather than reproduced here. Both re-run
+		// the election, which is why this is on the error path only, and both
+		// stay local-only like the rest of status.
+		if info.PushDisabled && !resolveDedicatedReadSource(ctx, s, "", &info) {
 			info.ReadFallback = strategy.LeadCheckpointReadRemote(ctx)
 		}
 		return info
@@ -440,23 +483,17 @@ func computeCheckpointSyncInfo(ctx context.Context, s *EntireSettings) checkpoin
 	if cr := s.GetCheckpointRemote(); cr != nil {
 		dedicated := false
 		if info.PushDisabled {
-			authoritative, fetchErr := checkpointremote.ReadsDedicatedStore(ctx, elected.Name)
-			if fetchErr != nil {
-				// Not the same as false. False means reads resolve somewhere
-				// else (so the elected remote is the answer); an error means
-				// no read URL resolves at all — reachable with a configured
-				// checkpoint_remote and no remote named origin. Falling soft
-				// to the elected remote there would report a working read
-				// source for a repo whose checkpoint reads fail. The push
-				// branch below may fall soft because resolvePushSettings
-				// degrades the same way it does; this one may not.
-				logging.Debug(ctx, "checkpoint read source probe failed; status omits the read source",
-					slog.String("error", fetchErr.Error()))
-				info.ReadSourceUnknown = true
-				return info
+			if resolveDedicatedReadSource(ctx, s, elected.Name, &info) {
+				if info.ReadSourceUnknown {
+					return info
+				}
+				dedicated = true
 			}
-			dedicated = authoritative
 		} else if _, enabled, purlErr := checkpointremote.PushURL(ctx, elected.Name); purlErr == nil {
+			// The push side may fall soft to the elected remote because
+			// resolvePushSettings degrades the same way; the read side may
+			// not, which is why the helper above distinguishes error from
+			// false and this branch does not need to.
 			dedicated = enabled
 		}
 		if dedicated {
@@ -542,34 +579,28 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 		// not claim exclusivity — "read from", never "only".
 		destination = "\n  Checkpoints read from: "
 	}
-	switch {
-	case info.Err != "":
+	// The misconfiguration warning is emitted independently of the read
+	// source below, not as one arm of the same switch: with pushing disabled
+	// a failed election does not stop reads, so the two can both have
+	// something to say and one must not shadow the other.
+	if info.Err != "" {
 		b.WriteString("\n")
 		// A fail-closed election is not a push failure when nothing is being
 		// pushed: name the misconfiguration without claiming a lost sync.
 		if info.PushDisabled {
 			b.WriteString(sty.render(sty.yellow, "  ! Checkpoint remote configuration: "+info.Err))
-			// Same label as the resolved case — to the reader it is one
-			// question, "where do checkpoints come from" — with the suffix
-			// saying this one was not chosen, it was fallen back to.
-			if info.ReadFallback != "" {
-				b.WriteString(destination)
-				b.WriteString(sty.render(sty.cyan, info.ReadFallback))
-				b.WriteString(sty.render(sty.dim, " (fallback; nothing was elected)"))
-			}
 		} else {
 			b.WriteString(sty.render(sty.yellow, "  ! Checkpoints NOT syncing: "+info.Err))
 		}
+	}
+	switch {
 	case info.ReadSourceUnknown:
 		b.WriteString("\n")
 		b.WriteString(sty.render(sty.yellow, "  ! Could not determine where checkpoints are read from"))
-	case info.Remote == "":
-		// No remotes configured: nothing resolved, and the diagnostics and
-		// counter below are empty by construction on this path.
 	case info.Source == checkpointSyncSourceDedicated:
 		b.WriteString(destination)
 		b.WriteString(sty.render(sty.cyan, "dedicated checkpoint remote ("+info.Remote+")"))
-	default:
+	case info.Remote != "":
 		b.WriteString(destination)
 		b.WriteString(sty.render(sty.cyan, info.Remote))
 		// Both suffixes describe how the remote was ELECTED, which is what
@@ -580,6 +611,13 @@ func writeCheckpointSyncLines(ctx context.Context, b *strings.Builder, s *Entire
 		case string(strategy.SyncRemoteSourceObserved):
 			b.WriteString(sty.render(sty.dim, " (follows your branch's push destination)"))
 		}
+	case info.ReadFallback != "":
+		// Same label as a resolved read source — to the reader it is one
+		// question, "where do checkpoints come from" — with the suffix
+		// saying this one was not chosen, it was fallen back to.
+		b.WriteString(destination)
+		b.WriteString(sty.render(sty.cyan, info.ReadFallback))
+		b.WriteString(sty.render(sty.dim, " (fallback; nothing was elected)"))
 	}
 	if info.IgnoredRemote != "" {
 		b.WriteString("\n")
@@ -1022,12 +1060,12 @@ type statusJSON struct {
 	// rather than guessed at.
 	CheckpointReadSourceUnknown bool `json:"checkpoint_read_source_unknown,omitempty"`
 	// CheckpointReadFallback is the remote reads fall open to when the
-	// election failed (checkpoint_sync_error is then set and
-	// checkpoint_sync_remote is absent, because nothing was elected). Emitted
-	// only alongside checkpoint_push_disabled AND only when no
-	// checkpoint_remote is configured — with one configured, reads may
-	// resolve to the dedicated store instead, so absence here does not mean
-	// reads fall open to nothing.
+	// election failed, so checkpoint_sync_error is set. Emitted only
+	// alongside checkpoint_push_disabled, and only when the dedicated store
+	// is not what serves reads — if it is, checkpoint_sync_remote carries it
+	// (with source "dedicated") even though nothing was elected, and a failed
+	// probe sets checkpoint_read_source_unknown instead. Absence here does
+	// not mean reads fall open to nothing.
 	CheckpointReadFallback string `json:"checkpoint_read_fallback,omitempty"`
 	UnpushedCheckpoints    int    `json:"unpushed_checkpoints,omitempty"`
 	// CheckpointRemoteIgnored/-Reason report a configured checkpoint_remote the
diff --git a/cmd/entire/cli/status_test.go b/cmd/entire/cli/status_test.go
index c71b1044d7..773e5d205a 100644
--- a/cmd/entire/cli/status_test.go
+++ b/cmd/entire/cli/status_test.go
@@ -2441,6 +2441,12 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 			// the read source, rather than the row passing because nothing
 			// resolved for some other reason.
 			wantReadUnknown bool
+			// wantErr is the fail-closed election, and wantIgnored the
+			// "checkpoint_remote not in use" warning. Stated per row rather
+			// than matched on tc.name: several rows now reach each, and name
+			// matching silently mis-expects every row added afterwards.
+			wantErr     bool
+			wantIgnored bool
 		}{
 			{name: "origin", origin: "https://github.com/org/repo.git", wantRemote: "origin", wantSource: "default"},
 			{
@@ -2456,12 +2462,12 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 			{
 				name: "inherited_dedicated_rejected", options: `,"checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
 				origin:     "https://github.com/other/repo.git",
-				wantRemote: "origin", wantSource: "default",
+				wantRemote: "origin", wantSource: "default", wantIgnored: true,
 			},
 			{name: "no_remotes"},
 			{
 				name: "missing_configured_remote", options: `,"checkpoint_push_remote":"gone"`,
-				origin: "https://github.com/org/repo.git", wantFallback: "origin",
+				origin: "https://github.com/org/repo.git", wantFallback: "origin", wantErr: true,
 			},
 			// Push- and fetch-side ownership disagree. Both require EVERY
 			// identity to be owned by the checkpoint repo's owner, but over
@@ -2476,7 +2482,26 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				options: `,"checkpoint_push_remote":"fork","checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
 				origin:  "https://github.com/org/repo.git",
 				fork:    "https://github.com/other/fork.git", forkPush: "https://github.com/org/fork.git",
-				wantRemote: "fork", wantSource: "config",
+				wantRemote: "fork", wantSource: "config", wantIgnored: true,
+			},
+			// A failed election does not stop reads: they fail open, so the
+			// dedicated store still serves them when the fetch side owns it,
+			// and status reports it rather than nothing. The elected-remote
+			// fields carry it — nothing was elected, but "dedicated" was
+			// never an election — so wantFallback stays empty.
+			{
+				name:       "missing_configured_remote_with_dedicated",
+				options:    `,"checkpoint_push_remote":"gone","checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
+				origin:     "https://github.com/org/repo.git",
+				wantRemote: "org/checkpoints", wantSource: checkpointSyncSourceDedicated, wantErr: true,
+			},
+			// Same, but the fetch side does not own the store, so reads land
+			// on the fail-open candidate and that is what is reported.
+			{
+				name:         "missing_configured_remote_with_disowned_dedicated",
+				options:      `,"checkpoint_push_remote":"gone","checkpoint_remote":{"provider":"github","repo":"org/checkpoints"}`,
+				origin:       "https://github.com/other/repo.git",
+				wantFallback: "origin", wantErr: true,
 			},
 			// The read probe cannot resolve any URL (a configured
 			// checkpoint_remote derives from origin, and there is none), so
@@ -2528,17 +2553,15 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 					t.Fatal(err)
 				}
 				info := computeCheckpointSyncInfo(t.Context(), s)
-				// Both rejections report "not in use", by different routes:
-				// the origin-owner row through the push-side verdict, the
-				// fetch-rejected row through the read-side branch that exists
-				// because that verdict ACCEPTS it. Without the second, a
-				// configured store that serves no reads is reported by
-				// nothing. (Not the divergence documented as accepted on
-				// InheritedCheckpointRemote — that one is the opposite
-				// direction, a warning where a lead-less fetch still resolves
-				// the store.)
-				wantIgnored := tc.name == "inherited_dedicated_rejected" || tc.name == "dedicated_rejected_by_fetch_owner"
-				if (info.Err != "") != (tc.name == "missing_configured_remote") || (info.IgnoredRemote != "") != wantIgnored {
+				// The two "not in use" rows reach that warning by different
+				// routes: the origin-owner row through the push-side verdict,
+				// the fetch-rejected row through the read-side branch that
+				// exists because that verdict ACCEPTS what the fetch side
+				// declines. Without the second, a configured store serving no
+				// reads is reported by nothing. (Not the divergence
+				// documented as accepted on InheritedCheckpointRemote — that
+				// one is the opposite direction.)
+				if (info.Err != "") != tc.wantErr || (info.IgnoredRemote != "") != tc.wantIgnored {
 					t.Errorf("unexpected remote diagnostics: %+v", info)
 				}
 				if !info.PushDisabled || info.Remote != tc.wantRemote || info.Source != tc.wantSource {
@@ -2558,7 +2581,10 @@ func TestRunStatus_CheckpointPushDisabledDestinations(t *testing.T) {
 				// wherever it is meaningful at all. Dedicated URL mode on
 				// git-branch has no tracking ref to compare against and stays
 				// uncounted, as it does with pushing enabled.
-				wantCount := tc.wantRemote != "" &&
+				// The fail-closed path returns before counting: with no
+				// election there is no destination to count against, even
+				// when the dedicated store still serves reads.
+				wantCount := !tc.wantErr && tc.wantRemote != "" &&
 					(tc.wantSource != checkpointSyncSourceDedicated || backend != "git-branch")
 				if (info.Unpushed > 0) != wantCount {
 					t.Errorf("unpushed count = %d, want counted: %v (%+v)", info.Unpushed, wantCount, info)

From eaaf7d08e9b2342d818c504146ce4cfda221634a Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 22:17:07 -0700
Subject: [PATCH 49/59] Only force-close Codex turns for a verified child
 rollout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

finalizeCodexObservedAtSessionEnd closed every observed turn regardless of
whether refreshCodexInventory had managed to read that child's rollout — an
absent or unreadable rollout, a fallback scan that timed out or breached its
budget, or an extraction that never ran at all all landed in the same branch
as a successful analysis.

Completing the record there is unrecoverable. It sets CompletedAt, which hides
the record from the completeLiveTaskRecords sweep running three lines later —
whose ResolveAgentTranscriptPath attempt and analyzer pass are a genuinely
different resolution path — and condensation then materializes a path-free
"unavailable" reason and drops the record via removeCompletedTaskRecords, with
no later hook to reconcile it.

Gate the loop on entry.ResolvedTranscriptPath, which refreshCodexInventory
records only after loading the rollout and matching session_meta.id to
AgentID, so it is the one piece of evidence here that the child was ever read.
An unresolved child's turn stays pending and its record stays live, so the
sweep retries it now and each later condensation re-materializes it. The
inner path-carry is now unconditional, since a skipped entry cannot reach it.

Collapses the two session-end finalize tests into one table over the
resolved/unresolved contrast.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M27EBV17CTACGSZPVYMFH0DR
---
 cmd/entire/cli/lifecycle.go      |  39 ++++++---
 cmd/entire/cli/lifecycle_test.go | 135 ++++++++++++++++++++++---------
 2 files changed, 124 insertions(+), 50 deletions(-)

diff --git a/cmd/entire/cli/lifecycle.go b/cmd/entire/cli/lifecycle.go
index 337af583c6..e2590af2ac 100644
--- a/cmd/entire/cli/lifecycle.go
+++ b/cmd/entire/cli/lifecycle.go
@@ -1198,13 +1198,32 @@ func handleLifecycleSessionEnd(ctx context.Context, ag agent.Agent, event *agent
 	return nil
 }
 
-// finalizeCodexObservedAtSessionEnd closes every observed turn that did not
-// have a matching terminal record in the same verified rollout analysis. This
-// deliberately iterates the inventory rather than live task records: a
-// follow-up can be hidden behind a completed-but-unmaterialized record.
+// finalizeCodexObservedAtSessionEnd closes every observed turn of a VERIFIED
+// child that did not have a matching terminal record in the same rollout
+// analysis. This deliberately iterates the inventory rather than live task
+// records: a follow-up can be hidden behind a completed-but-unmaterialized
+// record.
+//
+// A child whose rollout this session never resolved is skipped, because
+// completing its record here is unrecoverable: it hides the record from the
+// completeLiveTaskRecords sweep that runs next — whose independent
+// ResolveAgentTranscriptPath attempt and analyzer pass are a genuinely
+// different resolution path — and condensation then writes a path-free
+// "unavailable" reason and drops the record (removeCompletedTaskRecords), with
+// no later hook to reconcile it. Left pending, the record stays live, so the
+// sweep retries it now and each later condensation re-materializes it.
 func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
 	if err := strategy.MutateSessionState(ctx, sessionID, func(state *strategy.SessionState) error {
 		for _, entry := range state.SubagentInventory {
+			// refreshCodexInventory records this path only after loading the
+			// rollout and matching session_meta.id to AgentID, so it is the
+			// only evidence here that the child was ever read. Its absence
+			// covers every way resolution can fail — an unreadable or absent
+			// rollout, a fallback scan that timed out or breached its budget,
+			// an extraction that never ran at all.
+			if entry.ResolvedTranscriptPath == "" {
+				continue
+			}
 			for _, turnID := range entry.ObservedTurnIDs {
 				if !state.FinalizeSubagentTurn(entry.AgentID, turnID) {
 					continue
@@ -1217,13 +1236,11 @@ func finalizeCodexObservedAtSessionEnd(ctx context.Context, sessionID string) {
 					if record.CompletedAt.IsZero() {
 						record.CompletedAt = time.Now()
 					}
-					// refreshCodexInventory accepts this path only after loading the
-					// rollout and matching session_meta.id to AgentID. Carry that
-					// verified path into the durable task record even when this
-					// fallback has no exact terminal file/token snapshot.
-					if entry.ResolvedTranscriptPath != "" {
-						record.DeclaredTranscriptPath = entry.ResolvedTranscriptPath
-					}
+					// Carry the verified path into the durable task record so
+					// condensation can still materialize the transcript even
+					// though this fallback has no exact terminal file/token
+					// snapshot.
+					record.DeclaredTranscriptPath = entry.ResolvedTranscriptPath
 					// No new snapshot exists here. Preserve evidence captured for earlier turns.
 					break
 				}
diff --git a/cmd/entire/cli/lifecycle_test.go b/cmd/entire/cli/lifecycle_test.go
index fc12d2574a..0536cc3948 100644
--- a/cmd/entire/cli/lifecycle_test.go
+++ b/cmd/entire/cli/lifecycle_test.go
@@ -213,47 +213,104 @@ func TestRefreshCodexInventory_MultiTurnChildRefreshesCompletedTaskRecord(t *tes
 	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
 }
 
-func TestFinalizeCodexObservedAtSessionEnd_MultiTurnChildPreservesCapturedEvidence(t *testing.T) {
-	// NOT parallel: setupStopTestRepo changes the process working directory.
-	setupStopTestRepo(t)
-	ctx := context.Background()
-	const (
-		sessionID = "codex-session-end-multi-turn-child"
-		agentID   = "child-1"
-	)
-	completedAt := time.Now().UTC().Truncate(time.Microsecond)
-	require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{
-		SessionID: sessionID,
-		StartedAt: time.Now(),
-		Phase:     session.PhaseActive,
-		SubagentInventory: []session.SubagentInventoryEntry{{
-			AgentID:                agentID,
-			ResolvedTranscriptPath: "/tmp/verified-child-1.jsonl",
-			ObservedTurnIDs:        []string{"turn-1", "turn-2"},
-			FinalizedTurnIDs:       []string{"turn-1"},
-		}},
-		TaskRecords: []session.TaskRecord{{
-			ToolUseID:   agentID,
-			AgentID:     agentID,
-			StartedAt:   completedAt.Add(-time.Minute),
-			CompletedAt: completedAt,
-			Files:       []string{"first.go"},
-			TokenUsage:  &agent.TokenUsage{InputTokens: 10},
-		}},
-	}))
+func TestFinalizeCodexObservedAtSessionEnd(t *testing.T) {
+	// A turn is force-closed only when the inventory carries a rollout path
+	// refreshCodexInventory verified by matching session_meta.id to AgentID.
+	// Without one there is no evidence to close on, and closing anyway would
+	// complete the record — hiding it from the SessionEnd sweep that runs next
+	// and letting condensation drop it with neither files nor a transcript.
+	const agentID = "child-1"
+	tests := []struct {
+		name             string
+		resolvedPath     string
+		seedCompleted    bool
+		wantFinalized    bool
+		wantCompletion   string // "unchanged" | "set" | "live"
+		wantDeclaredPath string
+	}{
+		{
+			name:             "verified path closes a live turn and completes the record",
+			resolvedPath:     "/tmp/verified-child-1.jsonl",
+			wantFinalized:    true,
+			wantCompletion:   "set",
+			wantDeclaredPath: "/tmp/verified-child-1.jsonl",
+		},
+		{
+			name:             "verified path closes a later turn without completing twice",
+			resolvedPath:     "/tmp/verified-child-1.jsonl",
+			seedCompleted:    true,
+			wantFinalized:    true,
+			wantCompletion:   "unchanged",
+			wantDeclaredPath: "/tmp/verified-child-1.jsonl",
+		},
+		{
+			name:           "unresolved rollout leaves the turn pending and the record retryable",
+			wantFinalized:  false,
+			wantCompletion: "live",
+		},
+	}
 
-	finalizeCodexObservedAtSessionEnd(ctx, sessionID)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// NOT parallel: setupStopTestRepo changes the process working directory.
+			setupStopTestRepo(t)
+			ctx := context.Background()
+			sessionID := "codex-session-end-" + strings.ReplaceAll(tt.name, " ", "-")
+			seededAt := time.Now().UTC().Truncate(time.Microsecond)
+			record := session.TaskRecord{
+				ToolUseID:  agentID,
+				AgentID:    agentID,
+				StartedAt:  seededAt.Add(-time.Minute),
+				Files:      []string{"first.go"},
+				TokenUsage: &agent.TokenUsage{InputTokens: 10},
+			}
+			if tt.seedCompleted {
+				record.CompletedAt = seededAt
+			}
+			require.NoError(t, strategy.SaveSessionState(ctx, &strategy.SessionState{
+				SessionID: sessionID,
+				StartedAt: time.Now(),
+				Phase:     session.PhaseActive,
+				SubagentInventory: []session.SubagentInventoryEntry{{
+					AgentID:                agentID,
+					ResolvedTranscriptPath: tt.resolvedPath,
+					ObservedTurnIDs:        []string{"turn-1", "turn-2"},
+					FinalizedTurnIDs:       []string{"turn-1"},
+				}},
+				TaskRecords: []session.TaskRecord{record},
+			}))
 
-	state, err := strategy.LoadSessionState(ctx, sessionID)
-	require.NoError(t, err)
-	record := state.FindTaskRecord(agentID)
-	require.NotNil(t, record)
-	assert.Equal(t, completedAt, record.CompletedAt, "force-closing a later turn must not complete the task twice")
-	assert.Equal(t, []string{"first.go"}, record.Files, "closing an unresolved turn must preserve previously captured files")
-	assert.Equal(t, &agent.TokenUsage{InputTokens: 10}, record.TokenUsage, "without a new snapshot, preserve captured tokens")
-	assert.Equal(t, "/tmp/verified-child-1.jsonl", record.DeclaredTranscriptPath,
-		"force-closing must retain the inventory's exact-ID-verified rollout path for condensation")
-	assert.Contains(t, state.FindSubagentInventory(agentID).FinalizedTurnIDs, "turn-2")
+			finalizeCodexObservedAtSessionEnd(ctx, sessionID)
+
+			state, err := strategy.LoadSessionState(ctx, sessionID)
+			require.NoError(t, err)
+			got := state.FindTaskRecord(agentID)
+			require.NotNil(t, got)
+
+			entry := state.FindSubagentInventory(agentID)
+			require.NotNil(t, entry)
+			if tt.wantFinalized {
+				assert.Contains(t, entry.FinalizedTurnIDs, "turn-2")
+			} else {
+				assert.NotContains(t, entry.FinalizedTurnIDs, "turn-2",
+					"an unresolved rollout is not evidence the turn ended")
+			}
+
+			switch tt.wantCompletion {
+			case "unchanged":
+				assert.Equal(t, seededAt, got.CompletedAt, "force-closing a later turn must not complete the task twice")
+			case "set":
+				assert.False(t, got.CompletedAt.IsZero(), "a verified path closes the record")
+			case "live":
+				assert.True(t, got.CompletedAt.IsZero(),
+					"the record must stay live so the SessionEnd sweep can retry it and condensation retains it")
+			}
+
+			assert.Equal(t, tt.wantDeclaredPath, got.DeclaredTranscriptPath)
+			assert.Equal(t, []string{"first.go"}, got.Files, "closing a turn must preserve previously captured files")
+			assert.Equal(t, &agent.TokenUsage{InputTokens: 10}, got.TokenUsage, "without a new snapshot, preserve captured tokens")
+		})
+	}
 }
 
 func TestRefreshCodexInventory_UsesCurrentCompletenessWhenPersistingUsage(t *testing.T) {

From 2a6fbef1d516531a201b7d859c8721c724538cc5 Mon Sep 17 00:00:00 2001
From: Peyton Montei <peyton@entire.io>
Date: Thu, 10 Sep 2026 22:42:00 -0700
Subject: [PATCH 50/59] Count a Codex child's API calls from its usage
 snapshots

analyzeRolloutForTurns read only the last token_count snapshot, so a child's
exact usage always carried APICallCount 0 and checkpoints underreported API
calls whenever Codex subagents ran.

Codex was the only agent doing this. The Codex PARENT path already counts the
same token_count events as apiCalls (CalculateTokenUsage), and both other
subagent-capable agents roll their children's counts up
(claudecode/transcript.go, factoryaidroid/transcript.go). The count is
user-visible through session_tokens.go, which surfaces it as APICalls and
gates its "nothing to report" check on it.

Count each in-scope token_count event that carries a total_token_usage
snapshot, which is the same test the parent applies. A token_count with no
snapshot (a rate-limit-only update) is not a model turn and does not count.
The subagent_history_start_ordinal scoping already skips out-of-scope lines
before this point, so it bounds the count the way fromOffset bounds the
parent's.

The count is attached only when exact usage survives validation: an unusable
final snapshot makes the child's whole total unavailable, and a bare call
count with no tokens would read as a child that burned nothing.

exactUsageFromInfo splits into decodeTotalTokenUsage (shared by the count and
the usage read, so both agree on what a usage-bearing event is) and
exactUsageFromSnapshot (the consistency checks, unchanged). The loop now
carries the decoded snapshot rather than raw bytes, so there is still exactly
one decode per event.

Replaces the assertion that pinned the old behaviour, and adds a case for a
snapshot-free token_count.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M27FSCA1DWSY16E2VB7EVM17
---
 cmd/entire/cli/agent/codex/subagent_test.go | 24 +++++++----
 cmd/entire/cli/agent/codex/transcript.go    | 45 ++++++++++++++++-----
 2 files changed, 52 insertions(+), 17 deletions(-)

diff --git a/cmd/entire/cli/agent/codex/subagent_test.go b/cmd/entire/cli/agent/codex/subagent_test.go
index 2cf48a9b9e..40631a2f9d 100644
--- a/cmd/entire/cli/agent/codex/subagent_test.go
+++ b/cmd/entire/cli/agent/codex/subagent_test.go
@@ -148,7 +148,8 @@ func TestAnalyzeRollout_PaginatedSubagentIgnoresInheritedParentHistory(t *testin
 	result := analyzeRollout(append([]byte(joinLines(encoded)), '\n'))
 	require.Equal(t, []string{"child-turn"}, result.TerminalTurnIDs)
 	require.Equal(t, []string{"/repo/child.txt"}, result.ModifiedFiles)
-	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1}, result.ExactTokenUsage)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1, APICallCount: 1},
+		result.ExactTokenUsage, "the inherited snapshot below the start ordinal is out of scope for the call count too")
 }
 
 func TestExactTokenUsage_UsesOnlyLastRecognizableSnapshot(t *testing.T) {
@@ -159,7 +160,7 @@ func TestExactTokenUsage_UsesOnlyLastRecognizableSnapshot(t *testing.T) {
 		"reasoning_output_tokens": 2, "total_tokens": 18,
 	}})
 	usage := analyzeRollout(rolloutData(t, "child", []json.RawMessage{valid})).ExactTokenUsage
-	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 12, OutputTokens: 3}, usage)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 12, OutputTokens: 3, APICallCount: 1}, usage)
 
 	malformedLast := tokenCountEvent(map[string]any{"total_token_usage": map[string]any{
 		"input_tokens": 10, "cached_input_tokens": 11, "output_tokens": 3,
@@ -197,15 +198,22 @@ func TestExactTokenUsage_RejectsEveryUnavailableOrInconsistentSnapshot(t *testin
 	}
 
 	zeros := analyzeRollout(valid(map[string]any{"input_tokens": 0, "cached_input_tokens": 0, "output_tokens": 0})).ExactTokenUsage
-	require.Equal(t, &agent.TokenUsage{}, zeros)
+	require.Equal(t, &agent.TokenUsage{APICallCount: 1}, zeros)
 
 	multiple := rolloutData(t, "child", []json.RawMessage{
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 9, "cached_input_tokens": 1, "output_tokens": 2}}),
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
 	})
 	usage := analyzeRollout(multiple).ExactTokenUsage
-	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 1, OutputTokens: 2}, usage)
-	require.Zero(t, usage.APICallCount, "snapshot record count is not an API-call count")
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 1, OutputTokens: 2, APICallCount: 2}, usage,
+		"each usage-bearing snapshot is one model turn, as it is for the parent")
+
+	withoutUsage := rolloutData(t, "child", []json.RawMessage{
+		tokenCountEvent(map[string]any{"rate_limits": map[string]any{"primary_used_percent": 12}}),
+		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
+	})
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 1, OutputTokens: 2, APICallCount: 1},
+		analyzeRollout(withoutUsage).ExactTokenUsage, "a token_count carrying no usage snapshot is not a model turn")
 
 	malformedFinal := rolloutData(t, "child", []json.RawMessage{
 		tokenCountEvent(map[string]any{"total_token_usage": map[string]any{"input_tokens": 4, "cached_input_tokens": 1, "output_tokens": 2}}),
@@ -279,16 +287,16 @@ func TestSubagentInventory_AggregatesOnlyCompleteExactChildren(t *testing.T) {
 	require.Equal(t, first, result.Children[0].ResolvedPath)
 	require.Equal(t, []string{"first.txt"}, result.Children[0].ModifiedFiles)
 	require.Equal(t, []string{"first-turn"}, result.Children[0].TerminalTurnIDs)
-	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1}, result.Children[0].TokenUsage)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 3, CacheReadTokens: 2, OutputTokens: 1, APICallCount: 1}, result.Children[0].TokenUsage)
 	require.Equal(t, "second", result.Children[1].AgentID)
 	require.Equal(t, second, result.Children[1].ResolvedPath)
 	require.Equal(t, []string{"second.txt"}, result.Children[1].ModifiedFiles)
 	require.Equal(t, []string{"second-turn"}, result.Children[1].TerminalTurnIDs)
-	require.Equal(t, &agent.TokenUsage{InputTokens: 7, CacheReadTokens: 3, OutputTokens: 5}, result.Children[1].TokenUsage)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 7, CacheReadTokens: 3, OutputTokens: 5, APICallCount: 1}, result.Children[1].TokenUsage)
 	require.NotNil(t, result.TokenUsage)
 	require.NotNil(t, result.TokenUsage.SubagentTokensComplete)
 	require.True(t, *result.TokenUsage.SubagentTokensComplete)
-	require.Equal(t, &agent.TokenUsage{InputTokens: 10, CacheReadTokens: 5, OutputTokens: 6}, result.TokenUsage.SubagentTokens)
+	require.Equal(t, &agent.TokenUsage{InputTokens: 10, CacheReadTokens: 5, OutputTokens: 6, APICallCount: 2}, result.TokenUsage.SubagentTokens)
 }
 
 func TestSubagentInventory_EmptyInventoryIsExactWithoutChildTotal(t *testing.T) {
diff --git a/cmd/entire/cli/agent/codex/transcript.go b/cmd/entire/cli/agent/codex/transcript.go
index 72ade50e4a..c51afc211d 100644
--- a/cmd/entire/cli/agent/codex/transcript.go
+++ b/cmd/entire/cli/agent/codex/transcript.go
@@ -499,8 +499,14 @@ func analyzeRolloutForTurns(ctx context.Context, data []byte, observedTurns []st
 	openTurn := ""
 	seenTurns := make(map[string]struct{})
 	seenFiles := make(map[string]struct{})
-	var lastTokenInfo json.RawMessage
+	var lastTokenSnapshot *exactTokenUsageData
 	foundToken := false
+	// Every token_count event carrying a usage snapshot is one model turn —
+	// the same test CalculateTokenUsage applies when counting the parent's API
+	// calls. Counting them here keeps a child's APICallCount comparable with
+	// its parent's, and with the Claude Code and Droid subagent rollups, which
+	// both sum their children's counts.
+	tokenSnapshots := 0
 	lines := splitJSONL(data)
 	var localStartOrdinal *int
 	inherited := false
@@ -570,14 +576,17 @@ func analyzeRolloutForTurns(ctx context.Context, data []byte, observedTurns []st
 				terminalValid = false
 			} else {
 				foundToken = true
-				lastTokenInfo = nil
+				lastTokenSnapshot = nil
 			}
 			continue
 		}
 		switch header.Type {
 		case eventMsgTypeTokenCount:
 			foundToken = true
-			lastTokenInfo = event.Info
+			lastTokenSnapshot = decodeTotalTokenUsage(event.Info)
+			if lastTokenSnapshot != nil {
+				tokenSnapshots++
+			}
 		case "task_started":
 			// Forks copy an unfinished parent turn. A later explicit turn start
 			// replaces that orphan; only balanced pairs can yield terminal IDs.
@@ -610,7 +619,13 @@ func analyzeRolloutForTurns(ctx context.Context, data []byte, observedTurns []st
 		result.TerminalTurnIDs = nil
 	}
 	if foundToken && (!inherited || localStartOrdinal != nil) {
-		result.ExactTokenUsage = exactUsageFromInfo(lastTokenInfo)
+		result.ExactTokenUsage = exactUsageFromSnapshot(lastTokenSnapshot)
+		if result.ExactTokenUsage != nil {
+			// Reported only alongside exact usage: an unusable final snapshot
+			// makes the child's whole total unavailable, and a bare call count
+			// with no tokens would read as a child that burned nothing.
+			result.ExactTokenUsage.APICallCount = tokenSnapshots
+		}
 	}
 	return result
 }
@@ -645,17 +660,29 @@ func extractFilesFromParsedLine(line rolloutLine) []string {
 	}
 }
 
-func exactUsageFromInfo(lastInfo json.RawMessage) *agent.TokenUsage {
-	if len(lastInfo) == 0 {
+// decodeTotalTokenUsage pulls the cumulative usage snapshot out of a
+// token_count event's info payload, or nil when it is absent or malformed.
+// The API-call count and the exact-usage read share it so both agree on what
+// counts as a usage-bearing event.
+func decodeTotalTokenUsage(info json.RawMessage) *exactTokenUsageData {
+	if len(info) == 0 {
 		return nil
 	}
-	var info struct {
+	var payload struct {
 		TotalTokenUsage *exactTokenUsageData `json:"total_token_usage"`
 	}
-	if json.Unmarshal(lastInfo, &info) != nil || info.TotalTokenUsage == nil {
+	if json.Unmarshal(info, &payload) != nil {
+		return nil
+	}
+	return payload.TotalTokenUsage
+}
+
+// exactUsageFromSnapshot converts a decoded snapshot into usage, rejecting any
+// snapshot whose fields are absent or mutually inconsistent.
+func exactUsageFromSnapshot(usage *exactTokenUsageData) *agent.TokenUsage {
+	if usage == nil {
 		return nil
 	}
-	usage := info.TotalTokenUsage
 	if usage.InputTokens == nil || usage.CachedInputTokens == nil || usage.OutputTokens == nil {
 		return nil
 	}

From 97e2f3c16f8248ca67b17058ed0147b0e284ae48 Mon Sep 17 00:00:00 2001
From: dipree <daniel@entire.io>
Date: Fri, 11 Sep 2026 09:55:28 +0200
Subject: [PATCH 51/59] Remove retired semantic search gate wording

---
 cmd/entire/cli/search/search.go            | 11 ++++-------
 cmd/entire/cli/search_v4.go                |  7 +++----
 cmd/entire/cli/search_v4_test.go           | 12 +++++-------
 cmd/entire/cli/telemetry/search_outcome.go |  3 +--
 4 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/cmd/entire/cli/search/search.go b/cmd/entire/cli/search/search.go
index 0822272940..f5291e1e11 100644
--- a/cmd/entire/cli/search/search.go
+++ b/cmd/entire/cli/search/search.go
@@ -33,10 +33,8 @@ const v4ServicePath = "/api/v1/semantic-search/search/v1/search"
 var ErrCellUnavailable = errors.New("semantic search is not available in this cell")
 
 // ErrRepoFilterUnmatched reports that query-serve answered (the route exists)
-// but the explicit repo filter matched nothing the caller can search — the
-// repo isn't indexed yet, or its owner org isn't enabled on the
-// semantic-search feature flag (entire-search fails closed with a JSON 404,
-// existence not disclosed). A typo'd repo can't produce this from the CLI:
+// but the explicit repo filter matched nothing the caller can search. The
+// repository might not be indexed yet. A typo'd repo can't produce this from the CLI:
 // the slug was already resolved against the control-plane index before any
 // cell was contacted. Distinct from ErrCellUnavailable so fan-out callers
 // don't misreport a repo-level miss as a region without query-serve.
@@ -768,9 +766,8 @@ func CellV4(ctx context.Context, client *api.Client, cfg Config, repoIDs []strin
 	if resp.StatusCode == http.StatusNotFound {
 		// Two distinct 404s share this status. A JSON error body is
 		// query-serve answering through the gateway: the route exists but the
-		// repo filter matched nothing the caller may search (not indexed, or
-		// the owner org isn't flag-enabled — entire-search fails closed,
-		// existence not disclosed). A plain "404 page not found" is the
+		// repo filter matched nothing because query-serve has not indexed it.
+		// A plain "404 page not found" is the
 		// gateway itself: no semantic-search route, query-serve not deployed
 		// in this cell. Deployed cells answer unfiltered searches of unknown
 		// repos with an empty 200, so the split is unambiguous. The
diff --git a/cmd/entire/cli/search_v4.go b/cmd/entire/cli/search_v4.go
index 49e4435e22..318860eb2a 100644
--- a/cmd/entire/cli/search_v4.go
+++ b/cmd/entire/cli/search_v4.go
@@ -434,10 +434,9 @@ func classifySemanticCells(ctx context.Context, results []cellCallResult[*search
 
 // errNoRepoAvailable is returned when at least one cell answered but none
 // matched the repo filter. A typo'd name or missing access cannot reach this
-// point — resolveScope already validated the slug against the control-plane
-// repo index — so the message names only the causes that survive: query-serve
-// hasn't indexed the repo, or its owner org isn't enabled for semantic search.
-var errNoRepoAvailable = errors.New("semantic search cannot search this repo yet — it may not be indexed, or semantic search may not be enabled for its owner")
+// point because resolveScope already validated the slug against the control-plane
+// repo index. The remaining cause is that query-serve has not indexed the repo.
+var errNoRepoAvailable = errors.New("semantic search cannot search this repo yet — it may not be indexed")
 
 // errNoRegionAvailable is returned when every queried cell lacks query-serve.
 var errNoRegionAvailable = errors.New("semantic search is not yet available in the region(s) hosting this search")
diff --git a/cmd/entire/cli/search_v4_test.go b/cmd/entire/cli/search_v4_test.go
index 3845e7beb2..cb5ab4bfc6 100644
--- a/cmd/entire/cli/search_v4_test.go
+++ b/cmd/entire/cli/search_v4_test.go
@@ -765,11 +765,9 @@ func TestNewSemanticSearcher_RejectsMultipleRepoFilters(t *testing.T) {
 }
 
 // TestMergeSemanticV4Responses_AllCellsRepoUnmatched verifies the error when
-// every queried cell answered but none matched the repo filter (not indexed,
-// or the owner org isn't flag-enabled — a typo can't reach this point, the
-// slug already resolved). The old behavior lumped this in with undeployed
-// cells and told the user their REGION lacked semantic search — a
-// misdiagnosis that sent a flag-enrollment gap to the wrong team.
+// every queried cell answered but none has indexed the repo. A typo cannot
+// reach this point because the slug already resolved. The error must not
+// misdiagnose the miss as a region without semantic search.
 func TestMergeSemanticV4Responses_AllCellsRepoUnmatched(t *testing.T) {
 	t.Parallel()
 
@@ -783,8 +781,8 @@ func TestMergeSemanticV4Responses_AllCellsRepoUnmatched(t *testing.T) {
 	if strings.Contains(err.Error(), "region") {
 		t.Errorf("error = %q, must not blame the region for a repo-filter miss", err.Error())
 	}
-	if !strings.Contains(err.Error(), "repo") || !strings.Contains(err.Error(), "enabled") {
-		t.Errorf("error = %q, want it to point at the repo name, access, or semantic-search enablement", err.Error())
+	if !strings.Contains(err.Error(), "repo") || !strings.Contains(err.Error(), "indexed") {
+		t.Errorf("error = %q, want it to identify the repository as not indexed", err.Error())
 	}
 }
 
diff --git a/cmd/entire/cli/telemetry/search_outcome.go b/cmd/entire/cli/telemetry/search_outcome.go
index 0b9e2f9409..b3628841f6 100644
--- a/cmd/entire/cli/telemetry/search_outcome.go
+++ b/cmd/entire/cli/telemetry/search_outcome.go
@@ -26,8 +26,7 @@ const (
 	// has no query-serve route (search.ErrCellUnavailable). Distinct from
 	// SearchErrClassCellSkip — these are the two "region" failure variants.
 	SearchErrClassRegionUnavailable = "region_unavailable"
-	// SearchErrClassRepoUnavailable: cells answered but the repo is not
-	// searchable (not indexed, or not enabled for semantic search).
+	// SearchErrClassRepoUnavailable: cells answered but the repo is not indexed.
 	SearchErrClassRepoUnavailable = "repo_unavailable"
 	// SearchErrClassNetwork: network failure or timeout.
 	SearchErrClassNetwork = "network"

From 6d854686e67c544d8aea870643b795be7c2d2632 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Fri, 11 Sep 2026 10:32:16 +0200
Subject: [PATCH 52/59] deps: bump auth-go for the cross-host redirect and
 TLS-downgrade guards
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

entireio/auth-go#25, merged as f3d099d. oauthhttp.HTTPClient — the one
construction point behind sts, refresh, authcode and deviceflow — now
refuses a redirect that leaves the host the caller targeted, and refuses
any hop that leaves https once a chain has reached it.

First in the series because the next commit's regression test depends on
it: without this bump TestRoundTripper_RejectsRedirectedExchangePOST
fails, reporting the login JWT reaching the redirect target.

This replaces the local-path `replace` directive the branch carried while
#25 was in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M27SH4XARVKD62BMEGSM42YF
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index bae1f165cc..adb79e45e4 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/charmbracelet/x/ansi v0.11.8
 	github.com/creack/pty v1.1.24
 	github.com/denisbrodbeck/machineid v1.0.1
-	github.com/entireio/auth-go v0.5.3-0.20260902072340-78f4dc59700e
+	github.com/entireio/auth-go v0.5.3-0.20260911082959-f3d099d20e7b
 	github.com/go-faster/errors v0.8.0
 	github.com/go-faster/jx v1.2.0
 	github.com/go-git/go-billy/v6 v6.0.0-alpha.2
diff --git a/go.sum b/go.sum
index c563c17849..497ea28e8b 100644
--- a/go.sum
+++ b/go.sum
@@ -103,8 +103,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/entireio/auth-go v0.5.3-0.20260902072340-78f4dc59700e h1:DVQYuqzB0x7oUjz8nh5hzasRyklC3mLD1VkyVoFNw0I=
-github.com/entireio/auth-go v0.5.3-0.20260902072340-78f4dc59700e/go.mod h1:Uc1inZN5I4R60jU1mFqxDnT/S6PaZy8GvdMqXJAEw20=
+github.com/entireio/auth-go v0.5.3-0.20260911082959-f3d099d20e7b h1:5RiZn+I83yeu3b7U9wfRMWuw9RyGmE9P7E7gBEqZ6+k=
+github.com/entireio/auth-go v0.5.3-0.20260911082959-f3d099d20e7b/go.mod h1:Uc1inZN5I4R60jU1mFqxDnT/S6PaZy8GvdMqXJAEw20=
 github.com/expr-lang/expr v1.17.8 h1:W1loDTT+0PQf5YteHSTpju2qfUfNoBt4yw9+wOEU9VM=
 github.com/expr-lang/expr v1.17.8/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=

From de8555f63aaf113e58b3e130919ccd3242b81a12 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 3 Sep 2026 12:37:56 +0200
Subject: [PATCH 53/59] coreapi: pin that the cross-juris exchange refuses a
 redirected POST
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The existing TestRoundTripper_RejectsOffOrigin401ExchangeURL covers a hint
that names a foreign host, which validateExchangeURL refuses up front.
This is the case that check cannot see: an impeccable hint — same origin
as the 401, https-or-loopback, path exactly /oauth/token — whose origin
then answers the exchange POST with a 307 pointing elsewhere. Validation
has already passed by then, so the only thing between the user's login
JWT and the redirect target is the exchange client's redirect policy.

net/http strips sensitive headers on a cross-host redirect but replays
the body, and the body is where subject_token lives.

The guard itself belongs in auth-go, but the test belongs here, because
"the CLI reaches a guarded client" is a property of the CLI's wiring, not
of the library: #2224 added the guard to httputil.PostOAuthToken, and
#2235 moved this path off that helper twelve hours later without anyone
noticing, precisely because #2224's regression test sits in httputil and
kept passing. Anchored where the CLI actually makes the call, this fails
against auth-go without the fix — reporting both the leaked JWT and the
attacker-issued token being presented to the core.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M1KDHGDWNKKJEEA6ZFSB4Z0A
---
 internal/coreapi/cross_juris_client_test.go | 67 +++++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/internal/coreapi/cross_juris_client_test.go b/internal/coreapi/cross_juris_client_test.go
index a2148dec2e..6247fc8deb 100644
--- a/internal/coreapi/cross_juris_client_test.go
+++ b/internal/coreapi/cross_juris_client_test.go
@@ -424,6 +424,73 @@ func TestRoundTripper_RejectsOffOrigin401ExchangeURL(t *testing.T) {
 	}
 }
 
+// TestRoundTripper_RejectsRedirectedExchangePOST is the sibling of
+// TestRoundTripper_RejectsOffOrigin401ExchangeURL, for the case that check
+// cannot see. There, the hint names a foreign host and validateExchangeURL
+// refuses it up front. Here the hint is impeccable — same origin as the 401,
+// https-or-loopback, path exactly /oauth/token — and the origin's OWN
+// /oauth/token then answers 307 pointing elsewhere. Validation has already
+// passed by that point, so the only thing standing between the user's login
+// JWT and the redirect target is the exchange client's redirect policy.
+//
+// This is exercised at the coreapi layer on purpose. The guard itself lives in
+// auth-go, but the CLI reached it only for as long as coreapi kept routing the
+// exchange through a guarded client: the guard was added to
+// httputil.PostOAuthToken in #2224, and #2235 moved this path off that helper
+// twelve hours later, unnoticed, because #2224's regression test sits in
+// httputil and kept passing. A test anchored where the CLI actually makes the
+// call is what notices.
+func TestRoundTripper_RejectsRedirectedExchangePOST(t *testing.T) {
+	t.Parallel()
+	attackerSawJWT := atomic.Bool{}
+	attacker := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := r.ParseForm(); err == nil && r.PostForm.Get("subject_token") == "user-jwt" {
+			attackerSawJWT.Store(true)
+		}
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"access_token":"attacker-issued","expires_in":300}`)) //nolint:errcheck // test
+	}))
+	t.Cleanup(attacker.Close)
+
+	api := newCrossJurisTestServer(t, func(s *crossJurisTestServer, w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == crossjuris.TokenPath {
+			// An open redirect or a misconfigured proxy in front of a core
+			// the caller legitimately dials.
+			http.Redirect(w, r, attacker.URL+crossjuris.TokenPath, http.StatusTemporaryRedirect)
+			return
+		}
+		s.record(r)
+		w.WriteHeader(http.StatusUnauthorized)
+		w.Write([]byte(`{"error":"cross_juris_token_required","token_exchange_url":"` + s.srv.URL + crossjuris.TokenPath + `","audience":"` + s.srv.URL + `"}`)) //nolint:errcheck // test
+	})
+
+	client := &http.Client{Transport: transportFor(t)}
+	req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, api.srv.URL+"/api/v1/me", nil) //nolint:errcheck // test
+	req.Header.Set("Authorization", "Bearer user-jwt")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	// Leak first: it is this test's headline claim, and t.Fatal below would
+	// abort before it was ever evaluated.
+	if attackerSawJWT.Load() {
+		t.Errorf("REGRESSION: the login JWT reached the redirect target")
+	}
+	// A refused exchange surfaces the server's original 401 untouched.
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("got %d, want the original 401 passed through", resp.StatusCode)
+	}
+	// The attacker's access_token must not have been presented to the core.
+	for _, auth := range api.auths.snapshot() {
+		if auth == "Bearer attacker-issued" {
+			t.Errorf("REGRESSION: an attacker-issued token was presented to the core")
+		}
+	}
+}
+
 // TestRoundTripper_BodyReplayedOnRetry: a retried request replays its body.
 func TestRoundTripper_BodyReplayedOnRetry(t *testing.T) {
 	t.Parallel()

From 899265de3e45cd2d5c3d990124ecea3a5800a4b0 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 3 Sep 2026 12:38:13 +0200
Subject: [PATCH 54/59] auth: mint jurisdiction tokens through auth-go's sts
 client
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CLI had two RFC 8693 implementations. internal/coreapi's
cross-jurisdiction transport moved onto auth-go's sts in #2235; this
moves the last caller of the other one — the jurisdictional identity
token in cmd/entire/cli/auth — and deletes it.

The duplicate had drifted in ways that mattered:

  - Its OAuthError.Error() rendered the server-supplied response body
    into the terminal verbatim. auth-go sanitises the OAuth error code
    and description for terminal escapes; the CLI's parallel copy never
    picked that up.
  - It was the CLI's only exchange whose cross-host redirect guard lived
    in the CLI rather than in the library, which is how #2235 dropped
    that guard for coreapi without any test noticing.

BEHAVIOUR CHANGE, deliberate but worth reviewing: plain-HTTP handling
narrows. PostOAuthToken applied no scheme gate at all, so
--insecure-http-auth reached a plain-http core on any host, and a
misconfigured https-less core was dialled in the clear without one. sts
permits http only on loopback, even with AllowInsecureHTTP. So a
non-loopback plain-http core stops working under --insecure-http-auth,
and a plain-http core without the flag now fails closed instead of
shipping the login JWT unencrypted. This matches what the cross-juris
path already does (cross_juris_client.go gates on isLoopbackHTTP) and
what auth-go chose deliberately ("Restricted explicit insecure HTTP
opt-in to loopback hosts").

subject_token_type stays access_token, not JWT: that is what the form
this replaces sent and what entire-core matches on.

Client.Timeout does not carry over — only the Transport does. sts
applies the same 30s budget via context.WithTimeout, which unlike
Client.Timeout does not cancel the body read after the response returns.

git-remote-entire's wrong-cluster hint now digs *sts.ExchangeError out of
the error chain instead of *httputil.OAuthError; the fields it reads
(Code, Description) are the same, and TestFatalMessage still passes.

httputil is left holding only OAuthClientID.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M1KDJ19XTTYJKW0WD3ZZGR7Y
---
 cmd/entire/cli/auth/cell_data_api.go         |  47 ++++-
 cmd/entire/cli/auth/refresh.go               |   2 +-
 cmd/git-remote-entire/main.go                |   5 +-
 cmd/git-remote-entire/main_test.go           |  11 +-
 internal/entireclient/httputil/oauth.go      | 177 ++-----------------
 internal/entireclient/httputil/oauth_test.go | 133 --------------
 6 files changed, 65 insertions(+), 310 deletions(-)
 delete mode 100644 internal/entireclient/httputil/oauth_test.go

diff --git a/cmd/entire/cli/auth/cell_data_api.go b/cmd/entire/cli/auth/cell_data_api.go
index 6ba8e5f865..70b71dda6d 100644
--- a/cmd/entire/cli/auth/cell_data_api.go
+++ b/cmd/entire/cli/auth/cell_data_api.go
@@ -14,6 +14,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/entireio/auth-go/sts"
+
 	"github.com/entireio/cli/cmd/entire/cli/api"
 	"github.com/entireio/cli/cmd/entire/cli/versioninfo"
 	"github.com/entireio/cli/internal/entireclient/clusterdiscovery"
@@ -676,18 +678,53 @@ func resolveCellAPIBaseURL(ctx context.Context, coreURL, loginJWT, jurisdiction
 	return strings.TrimRight(chosen.APIURL, "/"), nil
 }
 
+// exchangeJurisdictionToken mints the jurisdictional identity token for a
+// cell, trading the login JWT for one pinned to audience.
+//
+// It runs through auth-go's sts client rather than a hand-rolled POST so the
+// CLI has exactly one RFC 8693 implementation: the cross-jurisdiction
+// transport in internal/coreapi already uses it, and the duplicate this
+// replaced had drifted — it never picked up auth-go's terminal-escape
+// sanitisation of the server-supplied error code and description, and it was
+// the CLI's only exchange whose cross-host redirect guard lived in the CLI
+// rather than in the library.
+//
+// Only httpClient's Transport carries over. Its Client.Timeout does not:
+// sts applies the same budget through context.WithTimeout, which (unlike
+// Client.Timeout) does not cancel the body read that happens after the
+// response returns.
+//
+// subject_token_type is access_token, not JWT — the login token is presented
+// to entire-core as an access token, which is what the form this replaced
+// sent and what the server matches on.
 func exchangeJurisdictionToken(ctx context.Context, coreURL, loginJWT, audience string, httpClient *http.Client) (string, error) {
 	if coreURL == "" {
 		return "", errors.New("no entire-core URL configured for jurisdiction token exchange")
 	}
-	form := httputil.TokenExchangeForm(loginJWT, audience, JurisdictionIdentityScope)
-
-	token, _, err := httputil.PostOAuthToken(ctx, httpClient, coreURL, form)
+	var transport http.RoundTripper
+	if httpClient != nil {
+		transport = httpClient.Transport
+	}
+	client := &sts.Client{
+		Transport:         transport,
+		BaseURL:           coreURL,
+		Path:              oauthTokenPath,
+		AllowInsecureHTTP: shouldUsePlainHTTPDiscovery(coreURL),
+		RequestTimeout:    cellDataAPITimeout,
+	}
+	ts, err := client.Exchange(ctx, sts.ExchangeRequest{
+		SubjectToken:       loginJWT,
+		SubjectTokenType:   sts.SubjectTokenTypeAccessToken,
+		RequestedTokenType: sts.SubjectTokenTypeAccessToken,
+		Audience:           audience,
+		Scope:              JurisdictionIdentityScope,
+		ClientID:           httputil.OAuthClientID,
+	})
 	if err != nil {
 		return "", fmt.Errorf("post token exchange: %w", err)
 	}
-	if strings.TrimSpace(token) == "" {
+	if strings.TrimSpace(ts.AccessToken) == "" {
 		return "", errors.New("token exchange returned an empty access token")
 	}
-	return token, nil
+	return ts.AccessToken, nil
 }
diff --git a/cmd/entire/cli/auth/refresh.go b/cmd/entire/cli/auth/refresh.go
index 1ba5fdb685..520eaa695e 100644
--- a/cmd/entire/cli/auth/refresh.go
+++ b/cmd/entire/cli/auth/refresh.go
@@ -112,7 +112,7 @@ func (s contextTokenStore) DeleteTokens(string) error {
 // multi-core user's credentials never travel to (or get keyed under) a host
 // the context doesn't belong to. No RFC 8693 exchange runs through it any
 // more — data-plane bearers are the login JWT itself (ResolveDataAPIToken) and
-// jurisdiction tokens are minted via httputil.PostOAuthToken.
+// jurisdiction tokens are minted via sts (exchangeJurisdictionToken).
 //
 // transport carries the caller's TLS configuration; allowInsecureHTTP permits
 // an http:// core/resource for loopback/dev.
diff --git a/cmd/git-remote-entire/main.go b/cmd/git-remote-entire/main.go
index f0f86b833d..6d6b48c709 100644
--- a/cmd/git-remote-entire/main.go
+++ b/cmd/git-remote-entire/main.go
@@ -34,12 +34,13 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/entireio/auth-go/sts"
+
 	"github.com/entireio/cli/cmd/entire/cli/auth"
 	"github.com/entireio/cli/cmd/entire/cli/gitremote"
 	"github.com/entireio/cli/cmd/entire/cli/versioninfo"
 	"github.com/entireio/cli/internal/entireclient/clusterdiscovery"
 	"github.com/entireio/cli/internal/entireclient/httpclient"
-	"github.com/entireio/cli/internal/entireclient/httputil"
 	"github.com/entireio/cli/internal/entireclient/userdirs"
 	"github.com/entireio/cli/internal/remotehelper"
 	"github.com/entireio/cli/internal/remotehelper/debuglog"
@@ -242,7 +243,7 @@ var wrongClusterRe = regexp.MustCompile(`lives on "([^"]+)"`)
 // naming the correct host (and the corrected entire:// URL). Everything else
 // falls back to the verbatim error.
 func fatalMessage(err error, parsedURL *url.URL) string {
-	var oe *httputil.OAuthError
+	var oe *sts.ExchangeError
 	if errors.As(err, &oe) && oe.Code == "invalid_target" {
 		if m := wrongClusterRe.FindStringSubmatch(oe.Description); m != nil {
 			host := m[1]
diff --git a/cmd/git-remote-entire/main_test.go b/cmd/git-remote-entire/main_test.go
index 22de1f4e77..c9a0d0fcd0 100644
--- a/cmd/git-remote-entire/main_test.go
+++ b/cmd/git-remote-entire/main_test.go
@@ -13,8 +13,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/entireio/auth-go/sts"
 	"github.com/entireio/cli/cmd/entire/cli/auth"
-	"github.com/entireio/cli/internal/entireclient/httputil"
 )
 
 func TestInfoFlagText(t *testing.T) {
@@ -121,11 +121,10 @@ func TestGitActionFromRequest(t *testing.T) {
 func TestFatalMessage(t *testing.T) {
 	t.Parallel()
 	parsedURL := &url.URL{Scheme: "entire", Host: "aws-us-east-2.entire.io", Path: "/et/paul/dogbark"}
-	wrongCluster := &httputil.OAuthError{
-		Status:      http.StatusBadRequest,
+	wrongCluster := &sts.ExchangeError{
+		StatusCode:  http.StatusBadRequest,
 		Code:        "invalid_target",
 		Description: `audience host "aws-us-east-2.entire.io" does not host this repo; it lives on "aws-eu-central-1.entire.io" — re-target the request there`,
-		Body:        "{...}",
 	}
 	tests := []struct {
 		name        string
@@ -135,7 +134,7 @@ func TestFatalMessage(t *testing.T) {
 	}{
 		{
 			name: "wrong cluster names correct host and URL",
-			// Wrapped to mirror production: the OAuthError surfaces buried under
+			// Wrapped to mirror production: the ExchangeError surfaces buried under
 			// several fmt.Errorf layers, so errors.As must dig it out.
 			err: fmt.Errorf("stateless-connect v2 info/refs: fetching info/refs from entry domain: repo-scoped token exchange: oauth token exchange: %w", wrongCluster),
 			contains: []string{
@@ -146,7 +145,7 @@ func TestFatalMessage(t *testing.T) {
 		},
 		{
 			name:     "invalid_target without lives-on hint falls back",
-			err:      &httputil.OAuthError{Status: http.StatusBadRequest, Code: "invalid_target", Description: "no servable mirror", Body: "HTTP 400: no servable mirror"},
+			err:      &sts.ExchangeError{StatusCode: http.StatusBadRequest, Code: "invalid_target", Description: "no servable mirror"},
 			contains: []string{"fatal:", "no servable mirror"},
 		},
 		{
diff --git a/internal/entireclient/httputil/oauth.go b/internal/entireclient/httputil/oauth.go
index dd03001f11..b6883a2e1d 100644
--- a/internal/entireclient/httputil/oauth.go
+++ b/internal/entireclient/httputil/oauth.go
@@ -1,167 +1,18 @@
+// Package httputil holds the OAuth identity the CLI presents to
+// entire-core.
+//
+// It used to carry a second RFC 8693 token-exchange implementation
+// (PostOAuthToken and its form builder, error type, and cross-host
+// redirect guard). That is gone: every exchange the CLI performs now runs
+// through auth-go's sts client — the cross-jurisdiction transport in
+// internal/coreapi and the jurisdictional identity token in
+// cmd/entire/cli/auth alike — so the wire format, the error taxonomy, the
+// terminal-escape sanitisation of server-supplied error text, and the
+// redirect policy have exactly one implementation to keep correct.
 package httputil
 
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-)
-
-// rejectCrossHostRedirect stops a redirect chain from leaving the host the
-// request was sent to. Mirrors cmd/entire/cli/api.rejectCrossHostRedirect —
-// duplicated rather than imported to avoid a dependency from this
-// low-level package onto the CLI's api package. Same-host redirects (e.g.
-// a trailing-slash normalize) still follow, up to Go's usual 10-hop cap.
-func rejectCrossHostRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return errors.New("stopped after 10 redirects")
-	}
-	if len(via) > 0 && !strings.EqualFold(req.URL.Host, via[0].URL.Host) {
-		return fmt.Errorf("refusing redirect to a different host (%s -> %s): the OAuth token request body must not leave its origin", via[0].URL.Host, req.URL.Host)
-	}
-	return nil
-}
-
-// RFC 8693 grant + token-type URNs. Re-export the literals so callers
-// composing /oauth/token forms don't keep parallel copies. Lifted out
-// of core/repoadmin and core/api during COR-337 cleanup.
-const (
-	GrantTypeTokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange" //nolint:gosec // G101: an OAuth grant_type URN, not a credential
-	TokenTypeAccessToken   = "urn:ietf:params:oauth:token-type:access_token"   //nolint:gosec // G101: an RFC 8693 token-type URN, not a credential
-)
-
 // OAuthClientID is the public OAuth client_id the CLI identifies as on
-// /oauth/token. Lifted into Basic auth by PostOAuthToken.
+// /oauth/token. auth-go lifts it into HTTP Basic per RFC 6749 §2.3.1
+// (zitadel/oidc's token endpoint reads client credentials only from
+// Basic auth, so a form-only client_id produces invalid_client).
 const OAuthClientID = "entire-cli"
-
-// TokenExchangeForm builds the RFC 8693 token-exchange form every CLI
-// exchange POSTs to /oauth/token: subjectToken (the login JWT) is traded
-// for an access token pinned to audience with the given scope. The one
-// form shape serves repo-scoped and jurisdiction tokens alike — only
-// audience and scope differ — so keep call sites on this builder rather
-// than open-coding the fields.
-func TokenExchangeForm(subjectToken, audience, scope string) url.Values {
-	form := url.Values{}
-	form.Set("grant_type", GrantTypeTokenExchange)
-	form.Set("subject_token_type", TokenTypeAccessToken)
-	form.Set("subject_token", subjectToken)
-	form.Set("requested_token_type", TokenTypeAccessToken)
-	form.Set("audience", audience)
-	form.Set("scope", scope)
-	form.Set("client_id", OAuthClientID)
-	return form
-}
-
-// cloneValuesWithoutClient returns a shallow copy of v with the
-// client_id and client_secret keys removed. Used so we can lift them
-// into Basic auth without mutating the caller's form.
-func cloneValuesWithoutClient(v url.Values) url.Values {
-	out := make(url.Values, len(v))
-	for k, vs := range v {
-		if k == "client_id" || k == "client_secret" {
-			continue
-		}
-		out[k] = vs
-	}
-	return out
-}
-
-// OAuthError is returned by PostOAuthToken when the OAuth endpoint
-// responds with a non-200 status. Callers can errors.As it to surface
-// status-specific UX (e.g. a friendly 403 message) or branch on the
-// RFC 6749 error code.
-type OAuthError struct {
-	Status      int
-	Code        string // RFC 6749 `error` code from the response body; "" when not present
-	Description string // RFC 6749 `error_description` from the response body; "" when not present
-	Body        string
-}
-
-func (e *OAuthError) Error() string {
-	return fmt.Sprintf("HTTP %d: %s", e.Status, e.Body)
-}
-
-// PostOAuthToken posts a form-encoded request to coreURL+"/oauth/token"
-// and parses the standard {access_token, expires_in} response. Callers
-// build the form (grant_type, subject_token, audience, etc.) so the
-// helper stays neutral about which OAuth grant is being exercised.
-//
-// If the form carries client_id (and optionally client_secret), the
-// helper lifts both into an HTTP Basic Authorization header and drops
-// them from the form body. zitadel/oidc's token endpoint reads client
-// credentials only from Basic auth, so form-only client_id produces
-// invalid_client even when the form is otherwise well-formed. Both values
-// are url.QueryEscaped per RFC 6749 §2.3.1 because pkg/op QueryUnescapes
-// them on the other side — a raw '+'/'%xx' would round-trip to a different
-// value and fail invalid_client (matches core/api/token_endpoint.go).
-//
-// coreURL must already be trimmed of any trailing slash. A non-200
-// response is surfaced as *OAuthError (RFC 6749 defines token-endpoint
-// success as 200 only); transport and decode failures
-// are wrapped plain errors.
-func PostOAuthToken(ctx context.Context, httpClient *http.Client, coreURL string, form url.Values) (accessToken string, expiresIn int, err error) {
-	clientID := form.Get("client_id")
-	clientSecret := form.Get("client_secret")
-	if clientID != "" {
-		form = cloneValuesWithoutClient(form)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
-		coreURL+"/oauth/token", strings.NewReader(form.Encode()))
-	if err != nil {
-		return "", 0, fmt.Errorf("build token request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	if clientID != "" {
-		// RFC 6749 §2.3.1: percent-encode before Basic so pkg/op's
-		// QueryUnescape recovers the original (matches token_endpoint.go).
-		req.SetBasicAuth(url.QueryEscape(clientID), url.QueryEscape(clientSecret))
-	}
-
-	// The form body (subject_token, and for password-style exchanges the
-	// caller's credentials) must never follow a redirect to a different
-	// host: Go's default client only strips sensitive *headers* on a
-	// cross-host redirect (net/http's shouldCopyHeaderOnRedirect), and
-	// copies the request body unconditionally — a POST body is not
-	// protected the way a bearer header is. Guard here, once, for every
-	// caller, rather than requiring each constructed *http.Client to set
-	// its own CheckRedirect. The guard is applied to a shallow copy so a
-	// client instance callers may share elsewhere is not mutated; note
-	// that it does take precedence over any CheckRedirect the caller had
-	// set, for the duration of this request. No caller sets one today,
-	// and a caller that needs a different policy here should be given a
-	// same-host-preserving hook rather than having this guard removed.
-	guarded := *httpClient
-	guarded.CheckRedirect = rejectCrossHostRedirect
-	resp, err := guarded.Do(req)
-	if err != nil {
-		return "", 0, fmt.Errorf("token request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		msg, _ := io.ReadAll(io.LimitReader(resp.Body, 1024)) //nolint:errcheck // best-effort body read for error message
-		var oauthBody struct {
-			Code        string `json:"error"`
-			Description string `json:"error_description"`
-		}
-		_ = json.Unmarshal(msg, &oauthBody) //nolint:errcheck // best-effort code extraction; non-JSON bodies leave Code empty
-		return "", 0, &OAuthError{Status: resp.StatusCode, Code: oauthBody.Code, Description: oauthBody.Description, Body: strings.TrimSpace(string(msg))}
-	}
-
-	var out struct {
-		AccessToken string `json:"access_token"`
-		ExpiresIn   int    `json:"expires_in"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		return "", 0, fmt.Errorf("decode token response: %w", err)
-	}
-	if out.AccessToken == "" {
-		return "", 0, errors.New("token response missing access_token")
-	}
-	return out.AccessToken, out.ExpiresIn, nil
-}
diff --git a/internal/entireclient/httputil/oauth_test.go b/internal/entireclient/httputil/oauth_test.go
deleted file mode 100644
index 6eb85b9e08..0000000000
--- a/internal/entireclient/httputil/oauth_test.go
+++ /dev/null
@@ -1,133 +0,0 @@
-package httputil
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestPostOAuthToken_LiftsAndPercentEncodesClientCreds pins that a form
-// client_id/secret is lifted into Basic, dropped from the body, and
-// url.QueryEscaped per RFC 6749 §2.3.1 — so pkg/op's QueryUnescape on the
-// other side recovers the original. A raw '+'/'%xx' would otherwise round-trip
-// to a different value and fail invalid_client. Matches token_endpoint.go.
-func TestPostOAuthToken_LiftsAndPercentEncodesClientCreds(t *testing.T) {
-	var gotUser, gotPass string
-	var gotForm url.Values
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotUser, gotPass, _ = r.BasicAuth()
-		_ = r.ParseForm() //nolint:errcheck // test stub
-		gotForm = r.PostForm
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"access_token":"tok","expires_in":900}`)) //nolint:errcheck // test stub
-	}))
-	defer srv.Close()
-
-	form := url.Values{}
-	form.Set("grant_type", GrantTypeTokenExchange)
-	form.Set("client_id", "cli+id")
-	form.Set("client_secret", "se+cr%et")
-
-	tok, exp, err := PostOAuthToken(context.Background(), srv.Client(), srv.URL, form)
-	require.NoError(t, err)
-	assert.Equal(t, "tok", tok)
-	assert.Equal(t, 900, exp)
-
-	// r.BasicAuth base64-decodes but does not unescape; QueryUnescape mirrors
-	// what pkg/op does next and must recover the originals.
-	gotID, err := url.QueryUnescape(gotUser)
-	require.NoError(t, err)
-	gotSecret, err := url.QueryUnescape(gotPass)
-	require.NoError(t, err)
-	assert.Equal(t, "cli+id", gotID, "client_id must round-trip through QueryEscape→base64→QueryUnescape")
-	assert.Equal(t, "se+cr%et", gotSecret, "client_secret must round-trip too")
-
-	assert.Empty(t, gotForm.Get("client_id"), "client_id must be dropped from the body once lifted into Basic")
-	assert.Empty(t, gotForm.Get("client_secret"), "client_secret must be dropped from the body")
-}
-
-// TestPostOAuthToken_RefusesCrossHostRedirect proves the subject_token (the
-// caller's login JWT) never reaches a different host, even when the origin
-// server issues a 307/308 redirect. Go's default client only strips
-// sensitive *headers* on a cross-host redirect (shouldCopyHeaderOnRedirect in
-// net/http) — the POST body, where subject_token actually lives, is copied
-// unconditionally. This is a genuine two-server reproduction: origin
-// redirects to attacker, and the test fails if attacker ever sees the token.
-func TestPostOAuthToken_RefusesCrossHostRedirect(t *testing.T) {
-	t.Parallel()
-
-	const secretSubjectToken = "super-secret-login-jwt"
-
-	// atomic.Bool because the write happens on the attacker server's
-	// handler goroutine and the read below happens on the test goroutine.
-	// The handler never runs while the guard works, so this does not race
-	// in practice — it is atomic so that a future regression is reported
-	// as a failed assertion rather than as a data race.
-	var attackerSawToken atomic.Bool
-	attacker := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_ = r.ParseForm() //nolint:errcheck // test stub
-		if r.PostForm.Get("subject_token") == secretSubjectToken {
-			attackerSawToken.Store(true)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"access_token":"stolen","expires_in":900}`)) //nolint:errcheck // test stub
-	}))
-	defer attacker.Close()
-
-	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, attacker.URL+"/oauth/token", http.StatusTemporaryRedirect)
-	}))
-	defer origin.Close()
-
-	form := url.Values{}
-	form.Set("grant_type", GrantTypeTokenExchange)
-	form.Set("subject_token", secretSubjectToken)
-
-	_, _, err := PostOAuthToken(context.Background(), origin.Client(), origin.URL, form)
-
-	// The leak check comes first, deliberately. It is the assertion that
-	// pins this test's headline claim, and require.Error below aborts the
-	// test — so with the two in the other order any regression failed on
-	// the error assertion alone and never evaluated whether the token had
-	// actually reached the attacker.
-	assert.False(t, attackerSawToken.Load(), "subject_token must never reach a host other than the one the caller targeted")
-	require.Error(t, err, "a cross-host redirect must be refused, not silently followed")
-}
-
-// TestPostOAuthToken_ErrorCode pins that a non-200 response surfaces as
-// *OAuthError with the RFC 6749 `error` code and `error_description` parsed
-// from the body (both empty for non-JSON bodies), so callers can branch on
-// e.g. invalid_target and render the description (the git-remote-entire
-// wrong-cluster UX relies on Description being extracted here).
-func TestPostOAuthToken_ErrorCode(t *testing.T) {
-	t.Parallel()
-	for _, tc := range []struct {
-		name, body, wantCode, wantDesc string
-	}{
-		{"json error code", `{"error":"invalid_target","error_description":"no mirror"}`, "invalid_target", "no mirror"},
-		{"non-json body", `gateway exploded`, "", ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(http.StatusBadRequest)
-				_, _ = w.Write([]byte(tc.body)) //nolint:errcheck // test stub
-			}))
-			defer srv.Close()
-
-			_, _, err := PostOAuthToken(context.Background(), srv.Client(), srv.URL, url.Values{})
-			var oe *OAuthError
-			require.ErrorAs(t, err, &oe)
-			assert.Equal(t, http.StatusBadRequest, oe.Status)
-			assert.Equal(t, tc.wantCode, oe.Code)
-			assert.Equal(t, tc.wantDesc, oe.Description)
-			assert.Equal(t, tc.body, oe.Body)
-		})
-	}
-}

From 1f886761376da7e0b6b82fba19936d35c8fa83fc Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Thu, 3 Sep 2026 18:47:10 +0200
Subject: [PATCH 55/59] simplify: fold the one-const httputil package into auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up cleanup on the two preceding commits, from /simplify.

internal/entireclient/httputil was left holding a single const plus a
paragraph describing the RFC 8693 implementation that no longer lives
there — the residue of a deletion that stopped one file early. Its three
importers are gone: package auth already aliased the const as
oauthClientID (so cell_data_api.go was the only site in the package
reaching around its own alias), and internal/coreapi already imports
cmd/entire/cli/auth, so exporting auth.OAuthClientID adds no package
edge. The const now sits in provider.go's block beside oauthTokenPath,
which is where the rest of the OAuth wiring is.

exchangeJurisdictionToken takes an http.RoundTripper rather than an
*http.Client. It only ever used the client's Transport, and the nil check
guarding that was unreachable — every caller routes through
cellExchangeHTTPClient, whose every branch returns a non-nil client. The
signature now states what the function needs, so "the Timeout does not
carry over" is true by construction rather than by comment.

The coreapi test keeps the #2224/#2235 rationale, which is the load-
bearing half, and loses the paragraph restating what its own name and its
sibling's already say. Its third assertion went too: an attacker-issued
token can only reach the core if the redirect was followed, which the
first assertion already catches, so it was a second spelling of the
headline claim rather than independent coverage.

Its doc comment is also trimmed. Measured against the rest of the repo
the rationale here had outgrown its neighbours, and the narrative it
carried is already in the PR body; what stays is the part a reader of
this function cannot recover elsewhere. Folded in while doing that: a
note that sts narrows plain HTTP to loopback on top of AllowInsecureHTTP,
so that is the effective policy regardless of --insecure-http-auth —
the line otherwise reads as permitting more than it does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M1XPFQQK00625TT7SRA41VSY
---
 cmd/entire/cli/auth/cell_data_api.go        | 37 +++++++++------------
 cmd/entire/cli/auth/provider.go             | 12 +++++--
 internal/coreapi/cross_juris_client.go      |  4 +--
 internal/coreapi/cross_juris_client_test.go | 25 ++++----------
 internal/entireclient/httputil/oauth.go     | 18 ----------
 5 files changed, 32 insertions(+), 64 deletions(-)
 delete mode 100644 internal/entireclient/httputil/oauth.go

diff --git a/cmd/entire/cli/auth/cell_data_api.go b/cmd/entire/cli/auth/cell_data_api.go
index 70b71dda6d..7e58de640d 100644
--- a/cmd/entire/cli/auth/cell_data_api.go
+++ b/cmd/entire/cli/auth/cell_data_api.go
@@ -20,7 +20,6 @@ import (
 	"github.com/entireio/cli/cmd/entire/cli/versioninfo"
 	"github.com/entireio/cli/internal/entireclient/clusterdiscovery"
 	"github.com/entireio/cli/internal/entireclient/contexts"
-	"github.com/entireio/cli/internal/entireclient/httputil"
 	"github.com/entireio/cli/internal/entireclient/userdirs"
 )
 
@@ -187,7 +186,7 @@ func JurisdictionToken(ctx context.Context, insecureHTTP bool, jurisdiction stri
 	}
 
 	audience := jurisdictionAudience(j, subject.dataOrigin, subject.discoveredCore)
-	token, err := exchangeJurisdictionToken(ctx, coreURL, subject.loginJWT, audience, subject.httpClient)
+	token, err := exchangeJurisdictionToken(ctx, coreURL, subject.loginJWT, audience, subject.httpClient.Transport)
 	if err != nil {
 		return "", fmt.Errorf("exchange jurisdictional identity token: %w", err)
 	}
@@ -681,30 +680,24 @@ func resolveCellAPIBaseURL(ctx context.Context, coreURL, loginJWT, jurisdiction
 // exchangeJurisdictionToken mints the jurisdictional identity token for a
 // cell, trading the login JWT for one pinned to audience.
 //
-// It runs through auth-go's sts client rather than a hand-rolled POST so the
-// CLI has exactly one RFC 8693 implementation: the cross-jurisdiction
-// transport in internal/coreapi already uses it, and the duplicate this
-// replaced had drifted — it never picked up auth-go's terminal-escape
-// sanitisation of the server-supplied error code and description, and it was
-// the CLI's only exchange whose cross-host redirect guard lived in the CLI
-// rather than in the library.
+// Through auth-go's sts client rather than a hand-rolled POST, so the CLI has
+// one RFC 8693 implementation: the duplicate this replaced had drifted, losing
+// auth-go's terminal-escape sanitisation of server error text and keeping its
+// own redirect guard in the CLI rather than the library.
 //
-// Only httpClient's Transport carries over. Its Client.Timeout does not:
-// sts applies the same budget through context.WithTimeout, which (unlike
-// Client.Timeout) does not cancel the body read that happens after the
-// response returns.
+// Takes the transport, not the caller's *http.Client: only the transport (and
+// so the connection pool) carries over. The Timeout deliberately does not —
+// sts applies the same budget via context.WithTimeout, which unlike
+// Client.Timeout does not cancel the post-response body read. Note sts also
+// narrows plain HTTP to loopback on top of AllowInsecureHTTP, so that is the
+// effective policy here regardless of --insecure-http-auth.
 //
-// subject_token_type is access_token, not JWT — the login token is presented
-// to entire-core as an access token, which is what the form this replaced
-// sent and what the server matches on.
-func exchangeJurisdictionToken(ctx context.Context, coreURL, loginJWT, audience string, httpClient *http.Client) (string, error) {
+// subject_token_type stays access_token, not JWT — what the replaced form sent
+// and what entire-core matches on.
+func exchangeJurisdictionToken(ctx context.Context, coreURL, loginJWT, audience string, transport http.RoundTripper) (string, error) {
 	if coreURL == "" {
 		return "", errors.New("no entire-core URL configured for jurisdiction token exchange")
 	}
-	var transport http.RoundTripper
-	if httpClient != nil {
-		transport = httpClient.Transport
-	}
 	client := &sts.Client{
 		Transport:         transport,
 		BaseURL:           coreURL,
@@ -718,7 +711,7 @@ func exchangeJurisdictionToken(ctx context.Context, coreURL, loginJWT, audience
 		RequestedTokenType: sts.SubjectTokenTypeAccessToken,
 		Audience:           audience,
 		Scope:              JurisdictionIdentityScope,
-		ClientID:           httputil.OAuthClientID,
+		ClientID:           oauthClientID,
 	})
 	if err != nil {
 		return "", fmt.Errorf("post token exchange: %w", err)
diff --git a/cmd/entire/cli/auth/provider.go b/cmd/entire/cli/auth/provider.go
index 1b979c54a0..a9e6131368 100644
--- a/cmd/entire/cli/auth/provider.go
+++ b/cmd/entire/cli/auth/provider.go
@@ -1,7 +1,5 @@
 package auth
 
-import "github.com/entireio/cli/internal/entireclient/httputil"
-
 // OAuth wiring for the entire-cli public client against an entire-core
 // login server. Matches an OIDC-standard auth server's discovery doc —
 // confirmed against a regional core's (us.auth.entire.io)
@@ -16,7 +14,15 @@ import "github.com/entireio/cli/internal/entireclient/httputil"
 // dialled there, and both are redirected to a region. The token endpoint is
 // retargeted at that region mid-login — see UseTokenIssuer in client.go.
 const (
-	oauthClientID       = httputil.OAuthClientID
+	// OAuthClientID is the public OAuth client_id the CLI identifies as on
+	// /oauth/token. Exported because internal/coreapi presents the same
+	// identity on the cross-jurisdiction exchange; auth-go lifts it into HTTP
+	// Basic per RFC 6749 §2.3.1 (zitadel/oidc's token endpoint reads client
+	// credentials only from Basic auth, so a form-only client_id produces
+	// invalid_client).
+	OAuthClientID = "entire-cli"
+
+	oauthClientID       = OAuthClientID
 	oauthDeviceCodePath = "/device_authorization"
 	oauthAuthorizePath  = "/authorize"
 	oauthTokenPath      = "/oauth/token" //nolint:gosec // G101: an endpoint path, not a credential
diff --git a/internal/coreapi/cross_juris_client.go b/internal/coreapi/cross_juris_client.go
index e283b0ad11..971d7841d4 100644
--- a/internal/coreapi/cross_juris_client.go
+++ b/internal/coreapi/cross_juris_client.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/entireio/auth-go/crossjuris"
 
+	"github.com/entireio/cli/cmd/entire/cli/auth"
 	"github.com/entireio/cli/cmd/entire/cli/versioninfo"
 	"github.com/entireio/cli/internal/entireclient/httpclient"
-	"github.com/entireio/cli/internal/entireclient/httputil"
 )
 
 // newCrossJurisHTTPClient builds the *http.Client the control-plane
@@ -42,7 +42,7 @@ func newCrossJurisHTTPClient(coreURL string) (*http.Client, error) {
 func newCrossJurisRoundTripper(base http.RoundTripper, allowInsecureHTTP bool) (http.RoundTripper, error) {
 	inner, err := crossjuris.New(crossjuris.Config{
 		Base:              base,
-		ClientID:          httputil.OAuthClientID,
+		ClientID:          auth.OAuthClientID,
 		AllowInsecureHTTP: allowInsecureHTTP,
 		Logf:              debugf,
 	})
diff --git a/internal/coreapi/cross_juris_client_test.go b/internal/coreapi/cross_juris_client_test.go
index 6247fc8deb..7f856d2e27 100644
--- a/internal/coreapi/cross_juris_client_test.go
+++ b/internal/coreapi/cross_juris_client_test.go
@@ -424,20 +424,13 @@ func TestRoundTripper_RejectsOffOrigin401ExchangeURL(t *testing.T) {
 	}
 }
 
-// TestRoundTripper_RejectsRedirectedExchangePOST is the sibling of
-// TestRoundTripper_RejectsOffOrigin401ExchangeURL, for the case that check
-// cannot see. There, the hint names a foreign host and validateExchangeURL
-// refuses it up front. Here the hint is impeccable — same origin as the 401,
-// https-or-loopback, path exactly /oauth/token — and the origin's OWN
-// /oauth/token then answers 307 pointing elsewhere. Validation has already
-// passed by that point, so the only thing standing between the user's login
-// JWT and the redirect target is the exchange client's redirect policy.
+// TestRoundTripper_RejectsRedirectedExchangePOST: an impeccable 401 hint whose
+// origin then 307s the exchange POST elsewhere must not leak the JWT.
 //
-// This is exercised at the coreapi layer on purpose. The guard itself lives in
-// auth-go, but the CLI reached it only for as long as coreapi kept routing the
-// exchange through a guarded client: the guard was added to
-// httputil.PostOAuthToken in #2224, and #2235 moved this path off that helper
-// twelve hours later, unnoticed, because #2224's regression test sits in
+// auth-go owns the guard and tests the mechanism; this one is about the CLI's
+// wiring, which is a property no auth-go test can assert. The guard was added
+// to httputil.PostOAuthToken in #2224, and #2235 moved this path off that
+// helper twelve hours later, unnoticed, because #2224's regression test sat in
 // httputil and kept passing. A test anchored where the CLI actually makes the
 // call is what notices.
 func TestRoundTripper_RejectsRedirectedExchangePOST(t *testing.T) {
@@ -483,12 +476,6 @@ func TestRoundTripper_RejectsRedirectedExchangePOST(t *testing.T) {
 	if resp.StatusCode != http.StatusUnauthorized {
 		t.Fatalf("got %d, want the original 401 passed through", resp.StatusCode)
 	}
-	// The attacker's access_token must not have been presented to the core.
-	for _, auth := range api.auths.snapshot() {
-		if auth == "Bearer attacker-issued" {
-			t.Errorf("REGRESSION: an attacker-issued token was presented to the core")
-		}
-	}
 }
 
 // TestRoundTripper_BodyReplayedOnRetry: a retried request replays its body.
diff --git a/internal/entireclient/httputil/oauth.go b/internal/entireclient/httputil/oauth.go
deleted file mode 100644
index b6883a2e1d..0000000000
--- a/internal/entireclient/httputil/oauth.go
+++ /dev/null
@@ -1,18 +0,0 @@
-// Package httputil holds the OAuth identity the CLI presents to
-// entire-core.
-//
-// It used to carry a second RFC 8693 token-exchange implementation
-// (PostOAuthToken and its form builder, error type, and cross-host
-// redirect guard). That is gone: every exchange the CLI performs now runs
-// through auth-go's sts client — the cross-jurisdiction transport in
-// internal/coreapi and the jurisdictional identity token in
-// cmd/entire/cli/auth alike — so the wire format, the error taxonomy, the
-// terminal-escape sanitisation of server-supplied error text, and the
-// redirect policy have exactly one implementation to keep correct.
-package httputil
-
-// OAuthClientID is the public OAuth client_id the CLI identifies as on
-// /oauth/token. auth-go lifts it into HTTP Basic per RFC 6749 §2.3.1
-// (zitadel/oidc's token endpoint reads client credentials only from
-// Basic auth, so a form-only client_id produces invalid_client).
-const OAuthClientID = "entire-cli"

From 21bf9f36f945e977a331ac59126c590f6bcd29c0 Mon Sep 17 00:00:00 2001
From: Stefan Haubold <stefan@entire.io>
Date: Fri, 11 Sep 2026 11:49:07 +0200
Subject: [PATCH 56/59] ci: skip the SARIF upload on fork PRs, as the
 predecessor workflow did
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A fork PR gets a read-only GITHUB_TOKEN, so `security-events: write` is not
granted and the upload fails the job rather than the analysis completing with
findings in the log. codeql-actions.yml guarded this explicitly; replacing that
file dropped the guard, so restore it.

The condition is NOT the predecessor's, and the difference matters. That
workflow ran only on pull_request, so it could compare
`github.event.pull_request.head.repo.full_name` directly. This one also runs on
push and schedule, where that expression is null — copied verbatim it resolves
to 'never' and silently stops main from ever being uploaded, which is the one
thing this workflow exists to do. Testing `github.event_name` first keeps push
and schedule on 'always' and narrows the skip to fork PRs alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 01M27XXVZZ4RS1QAEN095Z9H41
---
 .github/workflows/codeql.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8fa5bd0f97..a139504070 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -74,3 +74,12 @@ jobs:
         uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: /language:${{ matrix.language }}
+          # A fork PR gets a read-only GITHUB_TOKEN, so `security-events: write`
+          # is not granted and the upload fails the job. Analyze still runs and
+          # surfaces findings in the log. Note the condition tests the EVENT
+          # first: the predecessor workflow ran only on pull_request, so it could
+          # compare head.repo directly, but that expression is null on push and
+          # schedule — copied here verbatim it would resolve to 'never' and
+          # silently stop main from ever being uploaded, which is the one thing
+          # this workflow exists to do.
+          upload: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && 'always' || 'never' }}

From 170267dd153ff17adbf840c8b4a4ac91c47133d4 Mon Sep 17 00:00:00 2001
From: Muskan Paliwal <muskan10112002@gmail.com>
Date: Fri, 11 Sep 2026 17:09:47 +0530
Subject: [PATCH 57/59] fix(strategy): preserve session token totals on
 condensation

Entire-Checkpoint: 01M2848G1CNPKDA8YJDA1MDFJA
---
 .../strategy/manual_commit_condensation.go    |  4 -
 .../manual_commit_condensation_test.go        | 92 +++++++++++++++++++
 2 files changed, 92 insertions(+), 4 deletions(-)

diff --git a/cmd/entire/cli/strategy/manual_commit_condensation.go b/cmd/entire/cli/strategy/manual_commit_condensation.go
index 012f6a9c99..d9f2ba042b 100644
--- a/cmd/entire/cli/strategy/manual_commit_condensation.go
+++ b/cmd/entire/cli/strategy/manual_commit_condensation.go
@@ -1190,10 +1190,6 @@ func sessionStateBackfillTokenUsage(ctx context.Context, ag agent.Agent, agentTy
 		return checkpointUsage
 	}
 
-	if checkpointUsage != nil && checkpointUsage.InputTokens > 0 {
-		return checkpointUsage
-	}
-
 	return nil
 }
 
diff --git a/cmd/entire/cli/strategy/manual_commit_condensation_test.go b/cmd/entire/cli/strategy/manual_commit_condensation_test.go
index 7915b10af7..f0bff06696 100644
--- a/cmd/entire/cli/strategy/manual_commit_condensation_test.go
+++ b/cmd/entire/cli/strategy/manual_commit_condensation_test.go
@@ -258,6 +258,83 @@ func TestCountTranscriptItems_CursorEmpty(t *testing.T) {
 	}
 }
 
+func TestNonCopilotCondensationPreservesSessionTokenUsage(t *testing.T) {
+	t.Parallel()
+
+	sessionUsage := &agent.TokenUsage{
+		InputTokens:         10_000,
+		OutputTokens:        999,
+		CacheReadTokens:     2_000,
+		CacheCreationTokens: 500,
+		APICallCount:        42,
+	}
+	state := &SessionState{
+		SessionID:  "s1",
+		AgentType:  agent.AgentTypeClaudeCode,
+		TokenUsage: sessionUsage,
+	}
+	checkpointUsage := &agent.TokenUsage{
+		InputTokens:         100,
+		OutputTokens:        10,
+		CacheReadTokens:     20,
+		CacheCreationTokens: 5,
+		APICallCount:        1,
+	}
+
+	applyBackfilledSessionTokenUsage(t.Context(), nil, state, nil, checkpointUsage)
+
+	require.Equal(t, sessionUsage, state.TokenUsage)
+}
+
+func TestCondenseSessionByID_NonCopilotPreservesSessionTokenUsage(t *testing.T) { //nolint:paralleltest // uses t.Chdir
+	dir := setupGitRepo(t)
+	t.Chdir(dir)
+
+	s := &ManualCommitStrategy{}
+	sessionID := "non-copilot-token-usage"
+	metadataDir := ".entire/metadata/" + sessionID
+	metadataDirAbs := filepath.Join(dir, metadataDir)
+	require.NoError(t, os.MkdirAll(metadataDirAbs, 0o755))
+
+	transcript := strings.Join([]string{
+		`{"type":"human","uuid":"u1","message":{"content":"hello"}}`,
+		`{"type":"assistant","uuid":"u2","message":{"id":"msg_001","usage":{"input_tokens":100,"output_tokens":10}}}`,
+	}, "\n") + "\n"
+	require.NoError(t, os.WriteFile(
+		filepath.Join(metadataDirAbs, paths.TranscriptFileName), []byte(transcript), 0o644,
+	))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "test.txt"), []byte("agent content"), 0o644))
+
+	sessionUsage := &agent.TokenUsage{
+		InputTokens:         10_000,
+		OutputTokens:        999,
+		CacheReadTokens:     2_000,
+		CacheCreationTokens: 500,
+		APICallCount:        42,
+	}
+	require.NoError(t, s.SaveStep(t.Context(), StepContext{
+		SessionID:     sessionID,
+		ModifiedFiles: []string{"test.txt"},
+		MetadataDir:   metadataDir,
+		CommitMessage: "Checkpoint 1",
+		AuthorName:    "Test",
+		AuthorEmail:   "test@test.com",
+		AgentType:     agent.AgentTypeClaudeCode,
+		TokenUsage:    sessionUsage,
+	}))
+
+	state, err := s.loadSessionState(t.Context(), sessionID)
+	require.NoError(t, err)
+	require.Equal(t, sessionUsage, state.TokenUsage)
+
+	require.NoError(t, s.CondenseSessionByID(t.Context(), sessionID))
+
+	state, err = s.loadSessionState(t.Context(), sessionID)
+	require.NoError(t, err)
+	require.Equal(t, sessionUsage, state.TokenUsage)
+	require.Nil(t, state.CheckpointTokenUsage)
+}
+
 func TestSessionStateBackfillTokenUsage_CopilotUsesZeroInputSessionAggregate(t *testing.T) {
 	t.Parallel()
 
@@ -284,6 +361,21 @@ func TestSessionStateBackfillTokenUsage_CopilotUsesZeroInputSessionAggregate(t *
 	require.Equal(t, 3, backfillUsage.APICallCount)
 }
 
+func TestSessionStateBackfillTokenUsage_CopilotFallsBackToCheckpointUsage(t *testing.T) {
+	t.Parallel()
+
+	checkpointUsage := &agent.TokenUsage{
+		OutputTokens: 25,
+		APICallCount: 1,
+	}
+
+	backfillUsage := sessionStateBackfillTokenUsage(
+		t.Context(), nil, agent.AgentTypeCopilotCLI, nil, checkpointUsage,
+	)
+
+	require.Same(t, checkpointUsage, backfillUsage)
+}
+
 func TestSessionStateBackfillModel_PiReadsModelFromTranscript(t *testing.T) {
 	t.Parallel()
 

From 5c44abe7ce8f2de66eff36941841e4a3035c6037 Mon Sep 17 00:00:00 2001
From: Muskan Paliwal <muskan10112002@gmail.com>
Date: Fri, 11 Sep 2026 21:13:26 +0530
Subject: [PATCH 58/59] test(strategy): cover session token backfill boundaries

Entire-Checkpoint: 01M28J6MX4M92Y88PWYE3WPRFK
---
 .../manual_commit_condensation_test.go        | 49 +++++++++++++++++++
 .../cli/strategy/subagent_tokens_test.go      | 21 ++------
 2 files changed, 53 insertions(+), 17 deletions(-)

diff --git a/cmd/entire/cli/strategy/manual_commit_condensation_test.go b/cmd/entire/cli/strategy/manual_commit_condensation_test.go
index f0bff06696..5a60611171 100644
--- a/cmd/entire/cli/strategy/manual_commit_condensation_test.go
+++ b/cmd/entire/cli/strategy/manual_commit_condensation_test.go
@@ -286,6 +286,24 @@ func TestNonCopilotCondensationPreservesSessionTokenUsage(t *testing.T) {
 	require.Equal(t, sessionUsage, state.TokenUsage)
 }
 
+func TestNonCopilotCondensationDoesNotPromoteCheckpointUsage(t *testing.T) {
+	t.Parallel()
+
+	state := &SessionState{
+		SessionID: "s1",
+		AgentType: agent.AgentTypeClaudeCode,
+	}
+	checkpointUsage := &agent.TokenUsage{
+		InputTokens:  100,
+		OutputTokens: 10,
+		APICallCount: 1,
+	}
+
+	applyBackfilledSessionTokenUsage(t.Context(), nil, state, nil, checkpointUsage)
+
+	require.Nil(t, state.TokenUsage)
+}
+
 func TestCondenseSessionByID_NonCopilotPreservesSessionTokenUsage(t *testing.T) { //nolint:paralleltest // uses t.Chdir
 	dir := setupGitRepo(t)
 	t.Chdir(dir)
@@ -376,6 +394,37 @@ func TestSessionStateBackfillTokenUsage_CopilotFallsBackToCheckpointUsage(t *tes
 	require.Same(t, checkpointUsage, backfillUsage)
 }
 
+func TestApplyBackfilledSessionTokenUsage_CopilotPreservesSubagentTotal(t *testing.T) {
+	t.Parallel()
+
+	checkpointUsage := &agent.TokenUsage{
+		OutputTokens: 25,
+		APICallCount: 1,
+	}
+	state := &SessionState{
+		AgentType: agent.AgentTypeCopilotCLI,
+		TokenUsage: &agent.TokenUsage{
+			InputTokens: 1_000,
+			SubagentTokens: &agent.TokenUsage{
+				InputTokens:  200,
+				OutputTokens: 50,
+				APICallCount: 2,
+			},
+		},
+	}
+
+	applyBackfilledSessionTokenUsage(t.Context(), nil, state, nil, checkpointUsage)
+
+	require.Equal(t, 25, state.TokenUsage.OutputTokens)
+	require.Equal(t, 1, state.TokenUsage.APICallCount)
+	require.Equal(t, &agent.TokenUsage{
+		InputTokens:  200,
+		OutputTokens: 50,
+		APICallCount: 2,
+	}, state.TokenUsage.SubagentTokens)
+	require.Nil(t, checkpointUsage.SubagentTokens)
+}
+
 func TestSessionStateBackfillModel_PiReadsModelFromTranscript(t *testing.T) {
 	t.Parallel()
 
diff --git a/cmd/entire/cli/strategy/subagent_tokens_test.go b/cmd/entire/cli/strategy/subagent_tokens_test.go
index 86cd25e96d..98559f1024 100644
--- a/cmd/entire/cli/strategy/subagent_tokens_test.go
+++ b/cmd/entire/cli/strategy/subagent_tokens_test.go
@@ -518,9 +518,6 @@ func TestCalculateLiveTranscriptTokenUsage_RescopesSubagentCumulativeTotal(t *te
 	require.Equal(t, 200, state.TokenUsage.SubagentTokens.InputTokens,
 		"session state must retain the cumulative snapshot for the next baseline")
 
-	applyBackfilledSessionTokenUsage(t.Context(), ag, state, mainTranscript, usage)
-	require.Equal(t, 200, state.TokenUsage.SubagentTokens.InputTokens,
-		"main-token backfill must not replace the cumulative snapshot with the checkpoint delta")
 	state.RebaselineSubagentTokens()
 	require.NoError(t, os.WriteFile(subagentPath, []byte(`{"type":"assistant","uuid":"a-sub","message":{"id":"msg_sub","type":"message","role":"assistant","content":[{"type":"text","text":"done"}],"usage":{"input_tokens":260,"output_tokens":35}}}
 `), 0o644))
@@ -627,15 +624,8 @@ func TestCondenseSessionByID_CapturesSubagentBaselineViaRealResetPath(t *testing
 	metadataDir := ".entire/metadata/" + sessionID
 	metadataDirAbs := filepath.Join(dir, metadataDir)
 	require.NoError(t, os.MkdirAll(metadataDirAbs, 0o755))
-	// The assistant line carries real usage data (message.id + usage). Real
-	// Claude Code transcripts always do, which makes sessionStateBackfillTokenUsage
-	// fire during condensation (its InputTokens > 0 branch) and overwrite
-	// state.TokenUsage with the transcript-recomputed value — which is computed
-	// with subagentsDir="" and therefore drops SubagentTokens. This is what makes
-	// this test guard the REAL condensation path: without preserving the
-	// cumulative subagent total across the backfill, resetCheckpointWindow would
-	// snapshot a nil baseline and the next checkpoint would re-report the full
-	// cumulative subagent total (finding 019f5ebf-a57e).
+	// Checkpoint-scoped transcript usage must not replace the cumulative session
+	// total here, so the reset can retain the subagent baseline.
 	transcript := `{"type":"human","message":{"content":"do the thing"}}
 {"type":"assistant","uuid":"a1","message":{"id":"m1","usage":{"input_tokens":300,"output_tokens":150}}}
 `
@@ -715,11 +705,8 @@ func TestCondenseSessionByID_CapturesSubagentBaselineViaRealResetPath(t *testing
 	require.Equal(t, 60, summary.TokenUsage.SubagentTokens.OutputTokens)
 }
 
-// TestWithSubagentTokensFrom_DoesNotMutateInput guards the copy semantics directly.
-// The condensation tests cannot: applyBackfilledSessionTokenUsage already hands back
-// a copy on that path, so a mutate-in-place implementation passes them. Mutating
-// would overwrite the session-wide cumulative with a window delta and make
-// resetCheckpointWindow snapshot a too-small baseline for the next window.
+// Session and checkpoint token snapshots can share pointers, so replacement must
+// not mutate either input.
 func TestSubagentCoverageSurvivesBackfill(t *testing.T) {
 	t.Parallel()
 	incomplete := false

From b7f56e460af08db15c74e2bba77d9392d57f6fc6 Mon Sep 17 00:00:00 2001
From: Muskan Paliwal <muskan10112002@gmail.com>
Date: Sat, 12 Sep 2026 12:28:19 +0530
Subject: [PATCH 59/59] refactor(strategy): simplify session token backfill

Entire-Checkpoint: 01M2A6HV96SV0206QW63R1V23N
---
 cmd/entire/cli/strategy/manual_commit_condensation.go  |  8 ++++++--
 .../cli/strategy/manual_commit_condensation_test.go    | 10 +++-------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/cmd/entire/cli/strategy/manual_commit_condensation.go b/cmd/entire/cli/strategy/manual_commit_condensation.go
index d9f2ba042b..92e52a00f1 100644
--- a/cmd/entire/cli/strategy/manual_commit_condensation.go
+++ b/cmd/entire/cli/strategy/manual_commit_condensation.go
@@ -1178,7 +1178,11 @@ func applyBackfilledSessionTokenUsage(ctx context.Context, ag agent.Agent, state
 // sessionStateBackfillTokenUsage returns the best session-level token usage to
 // persist in session state after condensation.
 func sessionStateBackfillTokenUsage(ctx context.Context, ag agent.Agent, agentType types.AgentType, transcript []byte, checkpointUsage *agent.TokenUsage) *agent.TokenUsage {
-	if agentType == agent.AgentTypeCopilotCLI && len(transcript) > 0 {
+	if agentType != agent.AgentTypeCopilotCLI {
+		return nil
+	}
+
+	if len(transcript) > 0 {
 		fullSessionUsage := agent.CalculateTokenUsage(ctx, ag, transcript, 0, "")
 		if hasTokenUsageData(fullSessionUsage) {
 			return fullSessionUsage
@@ -1186,7 +1190,7 @@ func sessionStateBackfillTokenUsage(ctx context.Context, ag agent.Agent, agentTy
 		logging.Debug(ctx, "copilot-cli: full-session token read produced no data, falling back to checkpoint usage")
 	}
 
-	if agentType == agent.AgentTypeCopilotCLI && hasTokenUsageData(checkpointUsage) {
+	if hasTokenUsageData(checkpointUsage) {
 		return checkpointUsage
 	}
 
diff --git a/cmd/entire/cli/strategy/manual_commit_condensation_test.go b/cmd/entire/cli/strategy/manual_commit_condensation_test.go
index 5a60611171..f3308fed72 100644
--- a/cmd/entire/cli/strategy/manual_commit_condensation_test.go
+++ b/cmd/entire/cli/strategy/manual_commit_condensation_test.go
@@ -310,18 +310,14 @@ func TestCondenseSessionByID_NonCopilotPreservesSessionTokenUsage(t *testing.T)
 
 	s := &ManualCommitStrategy{}
 	sessionID := "non-copilot-token-usage"
-	metadataDir := ".entire/metadata/" + sessionID
-	metadataDirAbs := filepath.Join(dir, metadataDir)
-	require.NoError(t, os.MkdirAll(metadataDirAbs, 0o755))
+	metadataDir := paths.SessionMetadataDirFromSessionID(sessionID)
 
 	transcript := strings.Join([]string{
 		`{"type":"human","uuid":"u1","message":{"content":"hello"}}`,
 		`{"type":"assistant","uuid":"u2","message":{"id":"msg_001","usage":{"input_tokens":100,"output_tokens":10}}}`,
 	}, "\n") + "\n"
-	require.NoError(t, os.WriteFile(
-		filepath.Join(metadataDirAbs, paths.TranscriptFileName), []byte(transcript), 0o644,
-	))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "test.txt"), []byte("agent content"), 0o644))
+	testutil.WriteFile(t, dir, filepath.Join(metadataDir, paths.TranscriptFileName), transcript)
+	testutil.WriteFile(t, dir, "test.txt", "agent content")
 
 	sessionUsage := &agent.TokenUsage{
 		InputTokens:         10_000,