diff --git a/OMICRON_VERSION b/OMICRON_VERSION
index 402ae7e..9aee6aa 100644
--- a/OMICRON_VERSION
+++ b/OMICRON_VERSION
@@ -1 +1 @@
-e4bcfeeef8b73d60fd880a4bce3cd2465cb11c65
+9b595e985721f8ab83d13c4dc4f257cbf8ac525c
diff --git a/oxide-api/package-lock.json b/oxide-api/package-lock.json
index a7d548a..3cd3152 100644
--- a/oxide-api/package-lock.json
+++ b/oxide-api/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@oxide/api",
-  "version": "0.2.1",
+  "version": "0.3.0-alpha.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@oxide/api",
-      "version": "0.2.1",
+      "version": "0.3.0-alpha.0",
       "license": "MPL-2.0",
       "devDependencies": {
         "tsup": "^8.0.2",
diff --git a/oxide-api/package.json b/oxide-api/package.json
index 90860dd..76836ff 100644
--- a/oxide-api/package.json
+++ b/oxide-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@oxide/api",
-  "version": "0.2.1",
+  "version": "0.3.0-alpha.0",
   "description": "TypeScript client for the Oxide API",
   "engines": {
     "node": ">=18"
diff --git a/oxide-api/src/Api.ts b/oxide-api/src/Api.ts
index c8b4f7b..3172071 100644
--- a/oxide-api/src/Api.ts
+++ b/oxide-api/src/Api.ts
@@ -69,6 +69,7 @@ export type AddressConfig = {
 export type AddressLotKind =
   /** Infrastructure address lots are used for network infrastructure like addresses assigned to rack switches. */
   | "infra"
+
   /** Pool address lots are used by IP pools. */
   | "pool";
 
@@ -162,6 +163,7 @@ export type BgpMessageHistory = Record<string, unknown>;
 export type SwitchLocation =
   /** Switch in upper slot */
   | "switch0"
+
   /** Switch in lower slot */
   | "switch1";
 
@@ -222,10 +224,13 @@ export type AllowListUpdate = {
 export type AuthzScope =
   /** Timeseries data is limited to fleet readers. */
   | "fleet"
+
   /** Timeseries data is limited to the authorized silo for a user. */
   | "silo"
+
   /** Timeseries data is limited to the authorized projects for a user. */
   | "project"
+
   /** The timeseries is viewable to all without limitation. */
   | "viewable_to_all";
 
@@ -270,10 +275,13 @@ export type BfdSessionEnable = {
 export type BfdState =
   /** A stable down state. Non-responsive to incoming messages. */
   | "admin_down"
+
   /** The initial state. */
   | "down"
+
   /** The peer has detected a remote peer in the down state. */
   | "init"
+
   /** The peer has detected a remote peer in the up or init state while in the init state. */
   | "up";
 
@@ -449,16 +457,22 @@ export type BgpPeerConfig = { peers: BgpPeer[] };
 export type BgpPeerState =
   /** Initial state. Refuse all incoming BGP connections. No resources allocated to peer. */
   | "idle"
+
   /** Waiting for the TCP connection to be completed. */
   | "connect"
+
   /** Trying to acquire peer by listening for and accepting a TCP connection. */
   | "active"
+
   /** Waiting for open message from peer. */
   | "open_sent"
+
   /** Waiting for keepaliave or notification from peer. */
   | "open_confirm"
+
   /** Synchronizing with peer. */
   | "session_setup"
+
   /** Session established. Able to exchange update, notification and keepalive messages with peers. */
   | "established";
 
@@ -1710,22 +1724,31 @@ export type InstanceCpuCount = number;
 export type InstanceState =
   /** The instance is being created. */
   | "creating"
+
   /** The instance is currently starting up. */
   | "starting"
+
   /** The instance is currently running. */
   | "running"
+
   /** The instance has been requested to stop and a transition to "Stopped" is imminent. */
   | "stopping"
+
   /** The instance is currently stopped. */
   | "stopped"
+
   /** The instance is in the process of rebooting - it will remain in the "rebooting" state until the VM is starting once more. */
   | "rebooting"
+
   /** The instance is in the process of migrating - it will remain in the "migrating" state until the migration process is complete and the destination propolis is ready to continue execution. */
   | "migrating"
+
   /** The instance is attempting to recover from a failure. */
   | "repairing"
+
   /** The instance has encountered a failure. */
   | "failed"
+
   /** The instance has been deleted. */
   | "destroyed";
 
@@ -2044,7 +2067,7 @@ export type IpPoolUtilization = {
 /**
  * A range of IP ports
  *
- * An inclusive-inclusive range of IP ports. The second port may be omitted to represent a single port
+ * An inclusive-inclusive range of IP ports. The second port may be omitted to represent a single port.
  */
 export type L4PortRange = string;
 
@@ -2054,8 +2077,10 @@ export type L4PortRange = string;
 export type LinkFec =
   /** Firecode forward error correction. */
   | "firecode"
+
   /** No forward error correction. */
   | "none"
+
   /** Reed-Solomon forward error correction. */
   | "rs";
 
@@ -2075,20 +2100,28 @@ export type LldpServiceConfigCreate = {
 export type LinkSpeed =
   /** Zero gigabits per second. */
   | "speed0_g"
+
   /** 1 gigabit per second. */
   | "speed1_g"
+
   /** 10 gigabits per second. */
   | "speed10_g"
+
   /** 25 gigabits per second. */
   | "speed25_g"
+
   /** 40 gigabits per second. */
   | "speed40_g"
+
   /** 50 gigabits per second. */
   | "speed50_g"
+
   /** 100 gigabits per second. */
   | "speed100_g"
+
   /** 200 gigabits per second. */
   | "speed200_g"
+
   /** 400 gigabits per second. */
   | "speed400_g";
 
@@ -2185,8 +2218,10 @@ export type MeasurementResultsPage = {
 export type MetricType =
   /** The value represents an instantaneous measurement in time. */
   | "gauge"
+
   /** The value represents a difference between two points in time. */
   | "delta"
+
   /** The value represents an accumulation between two points in time. */
   | "cumulative";
 
@@ -2253,6 +2288,7 @@ An expunged disk is always non-provisionable. */
 export type PhysicalDiskState =
   /** The disk is currently active, and has resources allocated on it. */
   | "active"
+
   /** The disk has been permanently removed from service.
 
 This is a terminal state: once a particular disk ID is decommissioned, it will never return to service. (The actual hardware may be reused, but it will be treated as a brand-new disk.) */
@@ -2545,14 +2581,17 @@ export type RouterRouteKind =
 
 `Destination: An Internet Gateway` `Modifiable: true` */
   | "default"
+
   /** Automatically added for each VPC Subnet in the VPC
 
 `Destination: A VPC Subnet` `Modifiable: false` */
   | "vpc_subnet"
+
   /** Automatically added when VPC peering is established
 
 `Destination: A different VPC` `Modifiable: false` */
   | "vpc_peering"
+
   /** Created by a user; see `RouteTarget`
 
 `Destination: User defined` `Modifiable: true` */
@@ -2676,6 +2715,7 @@ export type SamlIdentityProviderCreate = {
 export type SiloIdentityMode =
   /** Users are authenticated with SAML using an external authentication provider.  The system updates information about users and groups only during successful authentication (i.e,. "JIT provisioning" of users and groups). */
   | "saml_jit"
+
   /** The system is the source of truth about users.  There is no linkage to an external authentication provider or identity provider. */
   | "local_only";
 
@@ -2877,6 +2917,7 @@ export type SiloUtilizationResultsPage = {
 export type SledProvisionPolicy =
   /** New resources will be provisioned on this sled. */
   | "provisionable"
+
   /** New resources will not be provisioned on this sled. However, if the sled is currently in service, existing resources will continue to be on this sled unless manually migrated off. */
   | "non_provisionable";
 
@@ -2903,6 +2944,7 @@ An expunged sled is always non-provisionable. */
 export type SledState =
   /** The sled is currently active, and has resources allocated on it. */
   | "active"
+
   /** The sled has been permanently removed from service.
 
 This is a terminal state: once a particular sled ID is decommissioned, it will never return to service. (The actual hardware may be reused, but it will be treated as a brand-new sled.) */
@@ -3097,8 +3139,10 @@ export type Switch = {
 export type SwitchInterfaceKind2 =
   /** Primary interfaces are associated with physical links. There is exactly one primary interface per physical link. */
   | "primary"
+
   /** VLAN interfaces allow physical interfaces to be multiplexed onto multiple logical links, each distinguished by a 12-bit 802.1Q Ethernet tag. */
   | "vlan"
+
   /** Loopback interfaces are anchors for IP addresses that are not specific to any particular port. */
   | "loopback";
 
@@ -3191,8 +3235,10 @@ export type SwitchPortApplySettings = {
 export type SwitchPortGeometry2 =
   /** The port contains a single QSFP28 link with four lanes. */
   | "qsfp28x1"
+
   /** The port contains two QSFP28 links each with two lanes. */
   | "qsfp28x2"
+
   /** The port contains four SFP28 links each with one lane. */
   | "sfp28x4";
 
@@ -3212,8 +3258,10 @@ export type SwitchPortConfig = {
 export type SwitchPortGeometry =
   /** The port contains a single QSFP28 link with four lanes. */
   | "qsfp28x1"
+
   /** The port contains two QSFP28 links each with two lanes. */
   | "qsfp28x2"
+
   /** The port contains four SFP28 links each with one lane. */
   | "sfp28x4";
 
@@ -3410,7 +3458,14 @@ export type TimeseriesQuery = {
 /**
  * Measurement units for timeseries samples.
  */
-export type Units = "count" | "bytes" | "seconds" | "nanoseconds";
+export type Units =
+  | "count"
+  | "bytes"
+  | "seconds"
+  | "nanoseconds"
+
+  /** No meaningful units, e.g. a dimensionless quanity. */
+  | "none";
 
 /**
  * The schema for a timeseries.
@@ -3502,9 +3557,9 @@ export type UserBuiltinResultsPage = {
 };
 
 /**
- * A name unique within the parent collection
+ * A username for a local-only user
  *
- * Names must begin with a lower case ASCII letter, be composed exclusively of lowercase ASCII, uppercase ASCII, numbers, and '-', and may not end with a '-'. Names cannot be a UUID, but they may contain a UUID. They can be at most 63 characters long.
+ * Usernames must begin with a lower case ASCII letter, be composed exclusively of lowercase ASCII, uppercase ASCII, numbers, and '-', and may not end with a '-'. Usernames cannot be a UUID, but they may contain a UUID. They can be at most 63 characters long.
  */
 export type UserId = string;
 
@@ -3617,12 +3672,12 @@ export type VpcFirewallRuleHostFilter =
 export type VpcFirewallRuleProtocol = "TCP" | "UDP" | "ICMP";
 
 /**
- * Filter for a firewall rule. A given packet must match every field that is present for the rule to apply to it. A packet matches a field if any entry in that field matches the packet.
+ * Filters reduce the scope of a firewall rule. Without filters, the rule applies to all packets to the targets (or from the targets, if it's an outbound rule). With multiple filters, the rule applies only to packets matching ALL filters. The maximum number of each type of filter is 256.
  */
 export type VpcFirewallRuleFilter = {
-  /** If present, the sources (if incoming) or destinations (if outgoing) this rule applies to. */
+  /** If present, host filters match the "other end" of traffic from the target’s perspective: for an inbound rule, they match the source of traffic. For an outbound rule, they match the destination. */
   hosts?: VpcFirewallRuleHostFilter[];
-  /** If present, the destination ports this rule applies to. */
+  /** If present, the destination ports or port ranges this rule applies to. */
   ports?: L4PortRange[];
   /** If present, the networking protocols this rule applies to. */
   protocols?: VpcFirewallRuleProtocol[];
@@ -3631,7 +3686,7 @@ export type VpcFirewallRuleFilter = {
 export type VpcFirewallRuleStatus = "disabled" | "enabled";
 
 /**
- * A `VpcFirewallRuleTarget` is used to specify the set of `Instance`s to which a firewall rule applies.
+ * A `VpcFirewallRuleTarget` is used to specify the set of instances to which a firewall rule applies. You can target instances directly by name, or specify a VPC, VPC subnet, IP, or IP subnet, which will apply the rule to traffic going to all matching instances. Targets are additive: the rule applies to instances matching ANY target.
  */
 export type VpcFirewallRuleTarget =
   /** The rule applies to all instances in the VPC */
@@ -3649,29 +3704,29 @@ export type VpcFirewallRuleTarget =
  * A single rule in a VPC firewall
  */
 export type VpcFirewallRule = {
-  /** whether traffic matching the rule should be allowed or dropped */
+  /** Whether traffic matching the rule should be allowed or dropped */
   action: VpcFirewallRuleAction;
   /** human-readable free-form text about a resource */
   description: string;
-  /** whether this rule is for incoming or outgoing traffic */
+  /** Whether this rule is for incoming or outgoing traffic */
   direction: VpcFirewallRuleDirection;
-  /** reductions on the scope of the rule */
+  /** Reductions on the scope of the rule */
   filters: VpcFirewallRuleFilter;
   /** unique, immutable, system-controlled identifier for each resource */
   id: string;
   /** unique, mutable, user-controlled identifier for each resource */
   name: Name;
-  /** the relative priority of this rule */
+  /** The relative priority of this rule */
   priority: number;
-  /** whether this rule is in effect */
+  /** Whether this rule is in effect */
   status: VpcFirewallRuleStatus;
-  /** list of sets of instances that the rule applies to */
+  /** Determine the set of instances that the rule applies to */
   targets: VpcFirewallRuleTarget[];
   /** timestamp when this resource was created */
   timeCreated: Date;
   /** timestamp when this resource was last modified */
   timeModified: Date;
-  /** the VPC to which this rule belongs */
+  /** The VPC to which this rule belongs */
   vpcId: string;
 };
 
@@ -3679,26 +3734,26 @@ export type VpcFirewallRule = {
  * A single rule in a VPC firewall
  */
 export type VpcFirewallRuleUpdate = {
-  /** whether traffic matching the rule should be allowed or dropped */
+  /** Whether traffic matching the rule should be allowed or dropped */
   action: VpcFirewallRuleAction;
-  /** human-readable free-form text about a resource */
+  /** Human-readable free-form text about a resource */
   description: string;
-  /** whether this rule is for incoming or outgoing traffic */
+  /** Whether this rule is for incoming or outgoing traffic */
   direction: VpcFirewallRuleDirection;
-  /** reductions on the scope of the rule */
+  /** Reductions on the scope of the rule */
   filters: VpcFirewallRuleFilter;
-  /** name of the rule, unique to this VPC */
+  /** Name of the rule, unique to this VPC */
   name: Name;
-  /** the relative priority of this rule */
+  /** The relative priority of this rule */
   priority: number;
-  /** whether this rule is in effect */
+  /** Whether this rule is in effect */
   status: VpcFirewallRuleStatus;
-  /** list of sets of instances that the rule applies to */
+  /** Determine the set of instances that the rule applies to */
   targets: VpcFirewallRuleTarget[];
 };
 
 /**
- * Updateable properties of a `Vpc`'s firewall Note that VpcFirewallRules are implicitly created along with a Vpc, so there is no explicit creation.
+ * Updated list of firewall rules. Will replace all existing rules.
  */
 export type VpcFirewallRuleUpdateParams = { rules: VpcFirewallRuleUpdate[] };
 
@@ -3833,8 +3888,10 @@ export type VpcUpdate = { description?: string; dnsName?: Name; name?: Name };
 export type NameOrIdSortMode =
   /** sort in increasing order of "name" */
   | "name_ascending"
+
   /** sort in decreasing order of "name" */
   | "name_descending"
+
   /** sort in increasing order of "id" */
   | "id_ascending";
 
diff --git a/oxide-openapi-gen-ts/package-lock.json b/oxide-openapi-gen-ts/package-lock.json
index 303979e..2f62b42 100644
--- a/oxide-openapi-gen-ts/package-lock.json
+++ b/oxide-openapi-gen-ts/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@oxide/openapi-gen-ts",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@oxide/openapi-gen-ts",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "license": "MPL-2.0",
       "dependencies": {
         "minimist": "^1.2.8",
diff --git a/oxide-openapi-gen-ts/package.json b/oxide-openapi-gen-ts/package.json
index 6305e53..b94d26f 100644
--- a/oxide-openapi-gen-ts/package.json
+++ b/oxide-openapi-gen-ts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@oxide/openapi-gen-ts",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "OpenAPI client generator used to generate Oxide TypeScript SDK",
   "keywords": [
     "oxide",
diff --git a/oxide-openapi-gen-ts/src/schema/types.ts b/oxide-openapi-gen-ts/src/schema/types.ts
index 705dedc..55f3472 100644
--- a/oxide-openapi-gen-ts/src/schema/types.ts
+++ b/oxide-openapi-gen-ts/src/schema/types.ts
@@ -16,12 +16,10 @@ export const schemaToTypes = makeSchemaGenerator({
     }
   },
   enum(schema, { w0, w }) {
-    if (schema.enum!.length === 1) {
-      return w0(JSON.stringify(schema.enum![0]));
-    }
-    for (const arm of schema.enum!) {
-      w(`| ${JSON.stringify(arm)}`);
-    }
+    schema.enum!.forEach((arm, i) => {
+      if (i > 0) w0("| ");
+      w(JSON.stringify(arm));
+    });
   },
   boolean(_, { w0 }) {
     w0(`boolean`);
@@ -77,7 +75,7 @@ export const schemaToTypes = makeSchemaGenerator({
       if ("description" in s) {
         io.w(`/** ${s.description} */`);
       }
-      io.w0("|");
+      io.w0("| ");
       schemaToTypes(s, io);
       io.w("");
     }