@runlot/api 0.1.0-rc.100

package/dist/index.js

@@ -0,0 +1,1227 @@
+export const API_VERSION = "v1";
+/** The shared query for browsing. Empty values are not carried — the server reads "empty means default". */
+function gitQuery(ref, path) {
+    const q = new URLSearchParams();
+    if (ref !== "")
+        q.set("ref", ref);
+    if (path !== "")
+        q.set("path", path);
+    return q.size > 0 ? `?${q.toString()}` : "";
+}
+export const API_SCOPES = [
+    "project:read",
+    "deploy",
+    "db:read",
+    "db:write",
+    "repo:read",
+    "repo:write",
+    "org:admin",
+];
+/** The exception that carries the server's error envelope unchanged. */
+export class ApiError extends Error {
+    status;
+    code;
+    details;
+    constructor(status, body, fallback) {
+        super(body?.error?.message ?? fallback);
+        this.name = "ApiError";
+        this.status = status;
+        this.code = body?.error?.code ?? "unknown";
+        if (body?.error?.details)
+            this.details = body.error.details;
+    }
+}
+/**
+ * The cp-public client.
+ *
+ * The CLI and the dashboard use the same one. If each called fetch itself, their
+ * error handling would drift a little, and that difference shows up during an
+ * incident.
+ */
+function dbPath(org, name) {
+    return `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`;
+}
+export class Client {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    headers(extra) {
+        const h = { ...extra };
+        if (this.opts.token)
+            h["Authorization"] = `Bearer ${this.opts.token}`;
+        return h;
+    }
+    async request(method, path, init) {
+        const res = await fetch(new URL(path, this.opts.baseUrl), {
+            ...init,
+            method,
+            headers: this.headers(init?.headers),
+        });
+        if (!res.ok) {
+            let body;
+            try {
+                body = (await res.json());
+            }
+            catch {
+                // An error response that is not JSON (a 502 made by a proxy, for instance)
+                // is raised as the same exception — so the caller does not have to handle
+                // two shapes of failure.
+            }
+            if (body === undefined && res.status >= 502 && res.status <= 504) {
+                // The edge replaced the 5xx body with its own HTML. The code and reason
+                // the server wrote are not here — so say that, rather than "unknown". On
+                // 2026-09-10 a registrar rejection came out this way as
+                // "unknown: POST … → 502".
+                body = {
+                    error: {
+                        code: "edge_" + res.status,
+                        message: "The server returned an error (" + res.status + "), and the error details could not be read. Try again shortly.",
+                    },
+                };
+            }
+            throw new ApiError(res.status, body, `${method} ${path} → ${res.status}`);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+    /** A body that is not JSON (the raw mail). Error handling is the same as request. */
+    async text(method, path) {
+        const res = await fetch(new URL(path, this.opts.baseUrl), { method, headers: this.headers() });
+        if (!res.ok) {
+            let body;
+            try {
+                body = (await res.json());
+            }
+            catch {
+                // The same reason as in request
+            }
+            throw new ApiError(res.status, body, `${method} ${path} → ${res.status}`);
+        }
+        return await res.text();
+    }
+    json(method, path, body) {
+        if (body === undefined)
+            return this.request(method, path);
+        return this.request(method, path, {
+            body: JSON.stringify(body),
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    devLogin(subject) {
+        return this.json("POST", "/v1/auth/dev/login", { subject });
+    }
+    /**
+     * Takes the sign-up and sends the confirmation mail. Neither a session nor a
+     * password is created here — the password is chosen in `verifyEmail` by
+     * whoever opens the mailbox.
+     */
+    passwordSignUp(email, name) {
+        return this.json("POST", "/v1/auth/password/sign-up", {
+            email,
+            ...(name === undefined ? {} : { name }),
+        });
+    }
+    passwordSignIn(email, password) {
+        return this.json("POST", "/v1/auth/password/sign-in", { email, password });
+    }
+    /** The same accepted response comes back whether or not the email exists. */
+    passwordForgot(email) {
+        return this.json("POST", "/v1/auth/password/forgot", { email });
+    }
+    passwordReset(token, password) {
+        return this.json("POST", "/v1/auth/password/reset", { token, password });
+    }
+    /** Uses the confirmation link and sets the account's first password. */
+    verifyEmail(token, password) {
+        return this.json("POST", "/v1/auth/email/verify", { token, password });
+    }
+    /**
+     * Finishes a sign-in that came back `{mfa:"totp"}`.
+     *
+     * Callable without a token: `pending` is the credential, and it is not a
+     * session — no other endpoint accepts it.
+     */
+    completeTotpLogin(pending, factor) {
+        return this.json("POST", "/v1/auth/totp", { pending, ...factor });
+    }
+    /** This account's two-factor state, including which orgs require it. */
+    getTotp() {
+        return this.json("GET", "/v1/me/totp");
+    }
+    /**
+     * Draws a secret to scan. It does **not** turn the factor on — `confirmTotp`
+     * does, after the app has proved it can produce a code.
+     */
+    enrollTotp() {
+        return this.json("POST", "/v1/me/totp/enroll");
+    }
+    /** Turns the factor on and hands back the ten recovery codes. They are shown once. */
+    confirmTotp(code) {
+        return this.json("POST", "/v1/me/totp/confirm", { code });
+    }
+    /** Turns it off. A code or a recovery code is required — the session alone is not. */
+    disableTotp(factor) {
+        return this.json("DELETE", "/v1/me/totp", factor);
+    }
+    /**
+     * The GitHub OAuth start URL. It is a 302 the browser follows, so it goes into
+     * `window.location` rather than being called with fetch. `redirect` has to be
+     * on the server's allow-list.
+     */
+    githubStartUrl(redirect) {
+        const u = new URL("/v1/auth/github/start", this.opts.baseUrl);
+        u.searchParams.set("redirect", redirect);
+        return u.toString();
+    }
+    /** The Google OAuth start URL. Uses the same dashboard callback shape as GitHub. */
+    googleStartUrl(redirect) {
+        const u = new URL("/v1/auth/google/start", this.opts.baseUrl);
+        u.searchParams.set("redirect", redirect);
+        return u.toString();
+    }
+    /**
+     * The names of this deployment (app domain, docs address). Callable without auth.
+     *
+     * This exists so the dashboard does not hard-code a domain into the screen
+     * (docs/environments.md §3.2) — hard-coded, the dev screen tells people a
+     * production address, and because that address opens, nobody ever says it is
+     * wrong.
+     */
+    siteConfig() {
+        return this.json("GET", "/v1/config");
+    }
+    me() {
+        return this.json("GET", "/v1/me");
+    }
+    listOrgs() {
+        return this.json("GET", "/v1/orgs");
+    }
+    /** Changes the display name only (admin). The slug is the name that becomes an address, so it is not on this surface. */
+    /**
+     * `requireTotp` is left out when it is not given, on purpose: the server reads
+     * an absent field as "leave it alone". Sending `false` by default would mean a
+     * rename silently switched the org's second-factor requirement off.
+     */
+    updateOrg(org, name, requireTotp) {
+        return this.json("PATCH", `/v1/orgs/${encodeURIComponent(org)}`, {
+            name,
+            ...(requireTotp === undefined ? {} : { requireTotp }),
+        });
+    }
+    /**
+     * Deletes the organization (admin). **This cannot be undone.**
+     *
+     * `confirm` has to be the organization slug exactly — the confirmation lives on
+     * the server because three places call this surface (the screen, the CLI, and
+     * scripts). If a live project, domain, repository, or DNS zone is left, it is a
+     * 409 `org_not_empty` and `details.holdings` says what is left — **projects
+     * already deleted are not counted.**
+     *
+     * The `purgeAfter` in the answer is when the rows actually disappear. By the
+     * moment it returns the organization is already gone from every surface; what
+     * remains is retention until that time.
+     */
+    deleteOrg(org, confirm) {
+        return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}`, { confirm });
+    }
+    createOrg(slug, name) {
+        return this.json("POST", "/v1/orgs", { slug, name });
+    }
+    /**
+     * The organization's recent notifications (docs/limits.md §3.4).
+     *
+     * A row with no `sentAt` is either still queued or has no email address to
+     * reach — and for the second, this list is the only channel, so the screen
+     * draws both states the same way.
+     */
+    listNotifications(org, limit) {
+        const q = limit === undefined ? "" : `?limit=${limit}`;
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/notifications${q}`);
+    }
+    /**
+     * The plan and billing state (docs/billing.md). If `enabled` is false, this
+     * deployment has no billing — the screen shows only a contact address.
+     */
+    getBilling(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/billing`);
+    }
+    /**
+     * A Pro checkout session. Send the browser to the `url` that comes back. Even
+     * once payment finishes, the thing that changes the plan is the webhook, so
+     * read `getBilling` again after the browser returns.
+     */
+    createBillingCheckout(org, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/checkout`, { returnTo });
+    }
+    /** A one-time `url` for the customer portal (payment method, receipts, cancellation). */
+    createBillingPortal(org, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/portal`, { returnTo });
+    }
+    /** The customer session token for the payment-method embed (1 hour). An org with no payment history gets a 404. */
+    createBillingSession(org) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/session`, {});
+    }
+    /** Schedules cancellation at the end of the period (`cancel: true`), or undoes it. There is no immediate revocation. */
+    cancelBilling(org, body) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/cancel`, body);
+    }
+    listProjects(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects`);
+    }
+    createProject(org, name) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects`, { name });
+    }
+    getProject(org, name) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}`);
+    }
+    /**
+     * Renames the project (admin). **The default address moves with it and there is
+     * no alias** — which is why the response carries the new address. Unlike the
+     * org slug, this name can change because it is the inner label of the org
+     * wildcard certificate.
+     */
+    updateProject(org, name, next) {
+        return this.json("PATCH", this.projectPath(org, name), { name: next });
+    }
+    /**
+     * Starts tearing the project down (admin). **This cannot be undone and leaves
+     * no recovery generation.** `confirm` has to be the project name exactly.
+     */
+    deleteProject(org, name, confirm) {
+        return this.json("DELETE", this.projectPath(org, name), { confirm });
+    }
+    /**
+     * Disables a project (admin): it stops serving and taking new backups, and
+     * keeps everything it has. A project disabled for a year is deleted for good.
+     */
+    disableProject(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/disable`);
+    }
+    /** Enables a disabled project (admin). 409 `project_limit` when there is no room for it. */
+    enableProject(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/enable`);
+    }
+    /** Watches the teardown operation to its end even after the project is gone. */
+    getOrgOperation(org, opId) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/operations/${encodeURIComponent(opId)}`);
+    }
+    /** Everything the project's first screen takes in one call. Usage calls `getUsage` alongside it. */
+    getProjectOverview(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/overview`);
+    }
+    listDeployments(org, name) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/deployments`);
+    }
+    /**
+     * One deployment, with `migrations` when the control plane applied its
+     * `migrations/` — which today means a preview deployed with `db=branch`
+     * (docs/studio.md §6.6 step 2).
+     *
+     * A preview's deployment is read under **the parent project's name**, the name
+     * the caller deployed through: the preview is a project of its own, but the
+     * caller never learns its name.
+     */
+    getDeployment(org, name, deploymentId) {
+        return this.json("GET", `${this.projectPath(org, name)}/deployments/${encodeURIComponent(deploymentId)}`);
+    }
+    /**
+     * Scheduled runs: what the live deployment declares, when each fires next, and
+     * the recent history (docs/cron.md §8). `limit` bounds the history rows only —
+     * the schedules and the per-schedule last run are never paged.
+     */
+    getProjectCron(org, name, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/cron${qs}`);
+    }
+    /**
+     * Queues: what the live deployment declares, how deep each one is, and the
+     * recent batch history (docs/queues.md §6). The depth is read from the
+     * project's own database; `depthError` on the answer says when it could not be.
+     */
+    getProjectQueues(org, name, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/queues${qs}`);
+    }
+    /**
+     * Durable Objects: how many this project has placed, against the two caps
+     * (docs/durable-objects.md).
+     *
+     * **It answers how much, never which.** There is no actor id in the response
+     * and none is coming — those name individual objects, and a list of them would
+     * be an object enumeration wearing a quota's name. `nodes` is keyed by node id
+     * because `nodeLimit` is a separate bound that can refuse a placement while
+     * the project-wide cap still has room.
+     */
+    getProjectDurableObjects(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/durable-objects`);
+    }
+    queuePath(org, name, queue) {
+        return `${this.projectPath(org, name)}/queues/${encodeURIComponent(queue)}`;
+    }
+    listQueueRuns(org, name, queue, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.queuePath(org, name, queue)}/runs${qs}`);
+    }
+    /** The head of the queue without leasing it — looking cannot delay a delivery. */
+    peekQueue(org, name, queue, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.queuePath(org, name, queue)}/messages${qs}`);
+    }
+    /** Irreversible. The confirmation is the caller's — the server holds none. */
+    purgeQueue(org, name, queue) {
+        return this.json("DELETE", `${this.queuePath(org, name, queue)}/messages`);
+    }
+    /**
+     * Moves a dead-letter queue's messages back. `to` is required only when the
+     * dead-letter queue belongs to more than one consumer, or to none.
+     */
+    redriveQueue(org, name, queue, to) {
+        return this.json("POST", `${this.queuePath(org, name, queue)}/redrive`, to === undefined ? {} : { to });
+    }
+    /**
+     * The vector store: every namespace with its count and width, and the plan's
+     * bounds (docs/vectors.md §4). Read from the project's own database;
+     * `readError` on the answer says when it could not be.
+     */
+    getProjectVectors(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/vectors`);
+    }
+    /** Irreversible. The confirmation is the caller's — the server holds none. */
+    deleteVectorNamespace(org, name, namespace) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/vectors/${encodeURIComponent(namespace)}`);
+    }
+    /** The body is the bundle. One digest covers all of the code and the assets. */
+    /**
+     * Uploads the bundle. `headers` carries the provenance headers
+     * (`X-Runlot-Git-*`, openapi createDeployment) — the body is the bundle
+     * itself, so the metadata can only travel in headers.
+     */
+    deploy(org, name, bundle, headers = {}) {
+        return this.request("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/deployments`, {
+            body: bundle,
+            headers: { ...headers, "Content-Type": "application/gzip" },
+        });
+    }
+    /**
+     * The same upload, aimed at a preview (docs/preview.md). **It does not move
+     * production's live pointer** — that is the whole difference, and it is why
+     * this is a named method rather than an optional argument on `deploy`: a
+     * caller that forgets the argument deploys to production.
+     *
+     * `db` picks what `env.db` points at (`branch` by default, `shared` at
+     * production's own database, `none` for no database), and `from` pours the
+     * branch from a named generation instead of the newest one.
+     */
+    deployPreview(org, name, bundle, 
+    // `| undefined` spelled out: under exactOptionalPropertyTypes a caller that
+    // forwards an unset flag is passing the property, not omitting it.
+    opts, headers = {}) {
+        const q = new URLSearchParams({ preview: opts.preview });
+        // Empty values are not carried: the server reads "absent" as its default, and
+        // `?db=` would be neither absent nor a member of the enum.
+        if (opts.db)
+            q.set("db", opts.db);
+        if (opts.from)
+            q.set("from", opts.from);
+        return this.request("POST", `${this.projectPath(org, name)}/deployments?${q.toString()}`, {
+            body: bundle,
+            headers: { ...headers, "Content-Type": "application/gzip" },
+        });
+    }
+    /** The parent's live previews (viewer). A deleted preview is not listed. */
+    listPreviews(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/previews`);
+    }
+    /**
+     * Deletes a preview and its branch (member).
+     *
+     * No confirmation string, unlike `deleteProject`: a branch is a copy taken at a
+     * moment and nothing in it is the only copy of anything.
+     */
+    deletePreview(org, name, preview) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/previews/${encodeURIComponent(preview)}`);
+    }
+    /**
+     * Makes the preview's artifact the parent's live deployment (member).
+     *
+     * **The code, never the data** (docs/preview.md §7). The branch is not merged
+     * and production's database is not replaced. The preview stays alive.
+     */
+    promotePreview(org, name, preview) {
+        return this.json("POST", `${this.projectPath(org, name)}/previews/${encodeURIComponent(preview)}/promote`);
+    }
+    /**
+     * The project's share link — `<label>.share.<app-domain>`, the one address
+     * Studio hands to somebody who is not a developer (docs/studio.md §6.9).
+     *
+     * 404 when the project has never been shared: a link is minted by
+     * `putShareLink`, never as a side effect of reading.
+     */
+    getShareLink(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/share`);
+    }
+    /**
+     * Points the share link at a preview, minting the label if there is none.
+     *
+     * Idempotent: the label is kept across shares, so somebody holding the link
+     * keeps working. `rotate` mints a new label and retires the old name in the
+     * same request ("링크 재발급"), so the project never has two live links.
+     */
+    putShareLink(org, name, opts = {}) {
+        return this.json("PUT", `${this.projectPath(org, name)}/share`, {
+            ...(opts.preview === undefined ? {} : { preview: opts.preview }),
+            ...(opts.rotate === undefined ? {} : { rotate: opts.rotate }),
+        });
+    }
+    /** Stops the link answering and forgets the label. The preview keeps running. */
+    deleteShareLink(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/share`);
+    }
+    /** Idempotent. Called twice, the password is not rolled and the same connection details come back. */
+    createDatabase(org, name) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`);
+    }
+    getDatabase(org, name) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`);
+    }
+    /**
+     * The connection credentials as well. The route is split from `getDatabase`
+     * because of roles — a viewer may know whether there is a database, but not
+     * the password (proto/openapi.yaml).
+     */
+    getDatabaseConnect(org, name) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database/connect`);
+    }
+    /** The endpoint only — no credentials. A viewer gets it too. Used by `runlot port-forward`. */
+    getDatabaseEndpoint(org, name) {
+        return this.json("GET", `${dbPath(org, name)}/endpoint`);
+    }
+    /** Issues a short-lived machine credential. The password is carried in this response and nowhere else. */
+    createDatabaseToken(org, name, ttlSeconds) {
+        return this.json("POST", `${dbPath(org, name)}/tokens`, ttlSeconds === undefined ? {} : { ttlSeconds });
+    }
+    listDatabaseTokens(org, name) {
+        return this.json("GET", `${dbPath(org, name)}/tokens`);
+    }
+    deleteDatabaseToken(org, name, user) {
+        return this.json("DELETE", `${dbPath(org, name)}/tokens/${encodeURIComponent(user)}`);
+    }
+    /**
+     * Makes one diagnostic image.
+     *
+     * **Not idempotent** — every call makes another image. And it is slow: the
+     * response comes after the dump finishes, and that project's actor is held
+     * for the whole of it (proto/openapi.yaml).
+     */
+    exportDatabase(org, name) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database/export`);
+    }
+    /**
+     * Every generation a restore can choose, newest first. `lastCheckedAt` is the
+     * heartbeat of the no-change skip — it is what tells "no new generations"
+     * apart from "the backup is dead".
+     */
+    listGenerations(org, name) {
+        return this.json("GET", `${this.dbPath(org, name)}/generations`);
+    }
+    /**
+     * Runs one statement in the project's database (the dashboard console).
+     *
+     * `readOnly` is **omitted, not sent as false**, when the caller wants the safe
+     * mode: the server treats an absent field as read-only, so leaving it out is the
+     * one spelling that cannot be misread. Sending `false` is the explicit ask for
+     * write mode, and only then does the server run outside a transaction.
+     *
+     * SQL failures arrive as an `ApiError` whose body carries `details.sqlstate` —
+     * PostgreSQL's own code, which is what the error panel shows.
+     */
+    executeSQL(org, name, sql, opts = {}) {
+        const body = { sql };
+        if (opts.readOnly === false)
+            body.readOnly = false;
+        if (opts.params !== undefined && opts.params.length > 0)
+            body.params = opts.params;
+        return this.json("POST", `${this.dbPath(org, name)}/execute`, body);
+    }
+    /**
+     * Rolls back to a generation. **Writes made since then are lost.**
+     *
+     * It ends at 202 — what comes back is an operation id, and progress is read
+     * through `getDatabaseOperation`. The server does not resolve `latest`: the
+     * `(epoch, seq)` chosen from the list is carried as-is (proto/openapi.yaml).
+     */
+    restoreDatabase(org, name, epoch, seq) {
+        return this.json("POST", `${this.dbPath(org, name)}/restore`, { epoch, seq });
+    }
+    /**
+     * Rolls back to a restore point **inside** a backup (pg-feather docs/37):
+     * `txnId` is that commit, `at` is the last commit at or before that time. One
+     * backup carries the commits in between in order, so the place you can roll
+     * back to is not tied to a backup boundary. Everything else is as in
+     * restoreDatabase — 202, an operation id, and one safety backup before the
+     * rollback.
+     */
+    restoreDatabaseTo(org, name, target) {
+        return this.json("POST", `${this.dbPath(org, name)}/restore`, target);
+    }
+    /**
+     * Removes the database. `confirm` has to match the project name **exactly**;
+     * if it does not, the server refuses with 400 `confirm_mismatch`.
+     */
+    deleteDatabase(org, name, confirm) {
+        return this.json("POST", `${this.dbPath(org, name)}/delete`, { confirm });
+    }
+    /** The progress of one operation. The operation id is not a credential; it lives under the project path. */
+    getDatabaseOperation(org, name, opId) {
+        return this.json("GET", `${this.dbPath(org, name)}/operations/${encodeURIComponent(opId)}`);
+    }
+    /** Aborts an operation that has not yet reached a phase it cannot come back from. */
+    abortDatabaseOperation(org, name, opId) {
+        return this.json("POST", `${this.dbPath(org, name)}/operations/${encodeURIComponent(opId)}/abort`);
+    }
+    // ---- Phase 6 (docs/phase6.md) ----
+    /**
+     * A live tail of the logs. It is **a stream, not JSON**, so it does not go
+     * through `request` — what comes back is an async iterable of line-by-line
+     * `LogEvent`, and aborting `signal` closes the connection. An error response
+     * (4xx/5xx) is the same `ApiError` as in every other method.
+     */
+    async *tailLogs(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.tail !== undefined)
+            q.set("tail", String(opts.tail));
+        if (opts.follow !== undefined)
+            q.set("follow", String(opts.follow));
+        const path = `${this.projectPath(org, name)}/logs${q.size ? `?${q}` : ""}`;
+        const res = await fetch(new URL(path, this.opts.baseUrl), {
+            method: "GET",
+            headers: this.headers(),
+            signal: opts.signal ?? null,
+        });
+        if (!res.ok) {
+            let body;
+            try {
+                body = (await res.json());
+            }
+            catch {
+                // The same reason as in request above.
+            }
+            throw new ApiError(res.status, body, `GET ${path} → ${res.status}`);
+        }
+        if (!res.body)
+            return;
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buf = "";
+        try {
+            for (;;) {
+                const { value, done } = await reader.read();
+                if (done)
+                    break;
+                buf += decoder.decode(value, { stream: true });
+                let nl;
+                while ((nl = buf.indexOf("\n")) >= 0) {
+                    const line = buf.slice(0, nl).trim();
+                    buf = buf.slice(nl + 1);
+                    if (line)
+                        yield JSON.parse(line);
+                }
+            }
+            const rest = buf.trim();
+            if (rest)
+                yield JSON.parse(rest);
+        }
+        finally {
+            // If the consumer ends early (break), the server's follow has to end too.
+            await reader.cancel().catch(() => { });
+        }
+    }
+    /**
+     * The stored lane (0062). It is a plain JSON page, not a stream: the history
+     * does not reach a node, so it answers for a project that is cold, parked, or
+     * has moved since the lines were written — every one of which is a 409 on
+     * `tailLogs`.
+     *
+     * `q` is a plain substring, matched case-insensitively. It is not a regular
+     * expression — `%` and `_` match themselves.
+     *
+     * Paging is keyset: pass the `cursor` from a page back to get the next, older
+     * one. A page with no `cursor` is the end of what is kept.
+     */
+    getLogHistory(org, name, opts = {}) {
+        const params = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts)) {
+            if (v !== undefined && v !== "")
+                params.set(k, String(v));
+        }
+        const qs = params.size ? `?${params}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/logs/history${qs}`);
+    }
+    listSecrets(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/secrets`);
+    }
+    /** The value travels in this call only. It is in no response at all. */
+    setSecret(org, name, secret, value) {
+        return this.json("PUT", `${this.projectPath(org, name)}/secrets/${encodeURIComponent(secret)}`, { value });
+    }
+    deleteSecret(org, name, secret) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/secrets/${encodeURIComponent(secret)}`);
+    }
+    getUsage(org, name, hours) {
+        const q = hours === undefined ? "" : `?hours=${hours}`;
+        return this.json("GET", `${this.projectPath(org, name)}/usage${q}`);
+    }
+    // ---- Object storage (docs/storage.md §8) ----
+    /** Grant, prefix, quota, usage. `usedBytes` lags by the node's reporting interval. */
+    getStorage(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/storage`);
+    }
+    /**
+     * Grants storage. It is idempotent, so pressing twice leaves the prefix as it
+     * was. Taking neither the prefix nor the quota as an argument is the point —
+     * the prefix is the isolation boundary and the quota is set by the plan
+     * (proto/openapi.yaml).
+     */
+    grantStorage(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/storage`);
+    }
+    /** Removes the grant. **The objects are not deleted** (docs/storage.md §7). */
+    revokeStorage(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/storage`);
+    }
+    /**
+     * The key prefixes this project serves unsigned (docs/storage.md §4.7).
+     *
+     * A prefix is stored normalized — `assets` becomes `assets/`, and `/` becomes
+     * the empty string, which means every key. The value that comes back is the
+     * value that governs, so a screen must render the response rather than what
+     * the user typed.
+     */
+    listStoragePublic(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/storage/public`);
+    }
+    /** Publishes a prefix. Idempotent. All three verbs answer with the whole list. */
+    addStoragePublic(org, name, prefix) {
+        return this.json("POST", `${this.projectPath(org, name)}/storage/public`, { prefix });
+    }
+    /**
+     * Unpublishes a prefix. Idempotent.
+     *
+     * **The world keeps reading for up to a minute.** The object front caches the
+     * list, so this call is not a revocation that takes effect at the instant it
+     * returns — a screen that says "no longer public" the moment this resolves is
+     * telling a small lie.
+     */
+    removeStoragePublic(org, name, prefix) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/storage/public`, { prefix });
+    }
+    // ---- Email (docs/email.md §5) ----
+    /** Grant, address, sender, limits, recent counts. The address comes back as a preview even without a grant. */
+    getEmail(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/email`);
+    }
+    /** Turns it on. **Idempotent** — we choose the address. The deploy reads `"email": true` and calls this. */
+    grantEmail(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/email`);
+    }
+    /** Turns it off. Mail arriving at that address now gets a 550. */
+    revokeEmail(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/email`);
+    }
+    // ---- Custom sending domains (docs/email.md §2.4) ----
+    /** The project's own sending domains, each with the records to publish. */
+    listEmailDomains(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/email/domains`);
+    }
+    /**
+     * Creates the provider identity and answers with the records to publish.
+     * `publish` writes them into the zone when we host one covering the domain.
+     */
+    addEmailDomain(org, name, domain, publish = false) {
+        return this.json("POST", `${this.projectPath(org, name)}/email/domains`, { domain, publish });
+    }
+    /** Re-checks now. The background loop does the same once a minute while pending. */
+    verifyEmailDomain(org, name, domain) {
+        return this.json("POST", `${this.projectPath(org, name)}/email/domains/${encodeURIComponent(domain)}/verify`);
+    }
+    /** Deletes the identity and the row. Sending from it is refused from the next convergence. */
+    removeEmailDomain(org, name, domain) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/email/domains/${encodeURIComponent(domain)}`);
+    }
+    // ---- AI (docs/ai.md §6) ----
+    /**
+     * The model catalogue. **Being logged in is enough to see it** — what you can
+     * buy is not an organization's secret, and this list is the price table.
+     *
+     * Prices are integer **micro-cents** per million tokens (1 µ¢ = 1e-8 USD).
+     * Not letting the server pick the decimal place is the point — a small call
+     * rounded to cents becomes 0.
+     */
+    listAIModels() {
+        return this.json("GET", "/v1/ai/models");
+    }
+    /** Grant, limits, the org balance, 24 h usage. The limits come back as a preview even without a grant. */
+    getAI(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/ai`);
+    }
+    /** Turns it on. **Idempotent.** The deploy reads `"ai": true` and calls this. */
+    grantAI(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/ai`);
+    }
+    /** Turns it off. **The ledger and the balance are untouched** — the balance belongs to the org and the grant belongs to the project. */
+    revokeAI(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/ai`);
+    }
+    /** The org's credit balance and its automatic top-up settings. The balance is in micro-cents and can be negative. */
+    getAICredit(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/ai/credit`);
+    }
+    /** One page of the org ledger. The cursor is `ledger_id` — cutting on time splits the same millisecond. */
+    listAILedger(org, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.limit)
+            q.set("limit", String(opts.limit));
+        if (opts.before)
+            q.set("before", String(opts.before));
+        const qs = q.toString();
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/ai/ledger${qs ? "?" + qs : ""}`);
+    }
+    /**
+     * The credit top-up checkout. **A browser coming back is not evidence** — the
+     * one thing that raises the balance is the `order.paid` webhook, and the
+     * screen polls the balance after the success event.
+     */
+    createAICreditCheckout(org, microCents, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/ai/credit/checkout`, { microCents, returnTo });
+    }
+    /**
+     * Turns automatic top-up on or off. **Turning it on is explicit consent**
+     * (docs/ai.md §3.5) — the screen shows the charging terms verbatim and calls
+     * this only after the box is checked.
+     */
+    setAIAutoTopup(org, body) {
+        return this.json("PUT", `/v1/orgs/${encodeURIComponent(org)}/ai/autotopup`, body);
+    }
+    /** One page of the mail log (docs/email.md §6.1). Newest first, cursor-paged. */
+    listMailLog(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.direction)
+            q.set("direction", opts.direction);
+        if (opts.cursor)
+            q.set("cursor", opts.cursor);
+        if (opts.limit)
+            q.set("limit", String(opts.limit));
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/email/log${qs ? "?" + qs : ""}`);
+    }
+    /** The metadata of one message. */
+    getMailLog(org, name, mailId) {
+        return this.json("GET", `${this.projectPath(org, name)}/email/log/${encodeURIComponent(mailId)}`);
+    }
+    /** The URL of the raw message — the screen uses it as a download link (.eml). */
+    mailLogRawURL(org, name, mailId) {
+        return new URL(`${this.projectPath(org, name)}/email/log/${encodeURIComponent(mailId)}/raw`, this.opts.baseUrl).toString();
+    }
+    /** The raw text. What the detail view draws the headers and body from. */
+    getMailLogRaw(org, name, mailId) {
+        return this.text("GET", `${this.projectPath(org, name)}/email/log/${encodeURIComponent(mailId)}/raw`);
+    }
+    // ---- End-user authentication (docs/auth.md §9) ----
+    /**
+     * Grant, settings, providers, hosts. **The signed-up users do not come** —
+     * that table is inside the project DB (docs/auth.md §6) and only the worker's
+     * `env.auth` sees it.
+     *
+     * `providers` carries the client id only. The client secret is sealed and
+     * appears in no response.
+     */
+    getAuth(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/auth`);
+    }
+    /**
+     * Turns auth on (member). Idempotent.
+     *
+     * **With no database it is 409 `database_required`** — the user table lives
+     * inside the project DB, so standing up the grant alone leaves no table the
+     * moment the worker starts. The caller catches that code and points at the
+     * `"database": true` declaration — the deploy never sees this code, because
+     * its ordering rules it out.
+     */
+    grantAuth(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/auth`);
+    }
+    /**
+     * Changes the settings (member). **A partial update** — only the fields given
+     * change. Sending the whole thing on one switch means that when two people
+     * touch the same card, the later save overwrites the earlier one. With no
+     * grant it is 404 `not_granted`.
+     */
+    updateAuthSettings(org, name, settings) {
+        return this.json("PATCH", `${this.projectPath(org, name)}/auth`, { settings });
+    }
+    /**
+     * Turns auth off (admin). **The signed-up users are not deleted** — the
+     * `runlot_auth` tables stay in the project DB, and turning it back on lets the
+     * same people log in unchanged.
+     */
+    revokeAuth(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/auth`);
+    }
+    /**
+     * Registers or replaces a social provider (admin). It is the same PUT, so it
+     * is idempotent.
+     *
+     * **`clientSecret` cannot be read back.** The callback URL is
+     * `https://<host>/__runlot/auth/callback/<provider>` for each host, and the
+     * list of hosts is in the response's `hosts`.
+     */
+    setAuthProvider(org, name, provider, clientId, clientSecret) {
+        return this.json("PUT", `${this.projectPath(org, name)}/auth/providers/${encodeURIComponent(provider)}`, { clientId, clientSecret });
+    }
+    /**
+     * Removes a provider (admin). Someone who signed up only through that provider
+     * loses their way in, but the user row stays — register it again and they come
+     * back to the same account.
+     */
+    deleteAuthProvider(org, name, provider) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/auth/providers/${encodeURIComponent(provider)}`);
+    }
+    // ---- Deployment access control (docs/access.md §7) ----
+    /**
+     * Who can reach this deployment. **No values** — both the password and the
+     * bypass secret live only as hashes, and what comes back here is the fact that
+     * there is one: `hasPassword` and `hasBypass`.
+     *
+     * A project that has never set a policy is `mode: "public"` with no
+     * `updatedAt`. The screen tells those two apart for the reason in §7 — a
+     * sentence about the state instead of an empty state.
+     */
+    getAccess(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/access`);
+    }
+    /**
+     * Changes the policy (admin). Without a `password`, **the existing password
+     * stays** — if a save that only changes the mode wiped the password, coming
+     * back to that mode would mean setting it again.
+     */
+    setAccess(org, name, mode, password) {
+        return this.json("PUT", `${this.projectPath(org, name)}/access`, { mode, password });
+    }
+    /**
+     * Makes a bypass secret for automation (admin). **The value is in this answer
+     * and nowhere else** — the screen shows it once on arrival and can never fetch
+     * it again. Calling again kills the old value.
+     */
+    newAccessBypass(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/access/bypass`);
+    }
+    /** Removes the bypass (admin). Removing one that does not exist also succeeds. */
+    revokeAccessBypass(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/access/bypass`);
+    }
+    /**
+     * Gets a one-time address back into a protected deployment (docs/access.md §3.4-3).
+     *
+     * It is **not** under the project path: all the calling screen knows is the
+     * hostname (the original request went there), and the server derives the org
+     * and project names from it. Doing `location.replace` with the `redirect` that
+     * comes back is the caller's job.
+     */
+    authorizeAccess(to, next) {
+        return this.json("POST", "/v1/access/authorize", { to, next });
+    }
+    listMembers(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/members`);
+    }
+    /** This is not an invite — the user must already have logged in once (404 `user_not_found`). */
+    addMember(org, provider, subject, role) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/members`, { provider, subject, role });
+    }
+    setMemberRole(org, userId, role) {
+        return this.json("PUT", `/v1/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(userId)}`, { role });
+    }
+    /**
+     * Removing someone else is admin; **removing yourself is leaving**, which
+     * anyone can do (docs/members.md). The last admin can do neither
+     * (409 `last_admin`).
+     */
+    removeMember(org, userId) {
+        return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(userId)}`);
+    }
+    // --- Invites (docs/members.md) ---
+    /** Pending and expired invites (admin). Accepted and revoked ones are history, so they do not come. */
+    listInvites(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/invites`);
+    }
+    /**
+     * Invites by email (admin). **Calling again with the same address is a
+     * resend** — the same row is updated rather than a new one created, and the
+     * server gives 200 instead of 201.
+     */
+    createInvite(org, email, role) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/invites`, { email, role });
+    }
+    /** Revokes an invite (admin). Mail that has not gone out yet does not go out. */
+    revokeInvite(org, inviteId) {
+        return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}/invites/${encodeURIComponent(inviteId)}`);
+    }
+    /**
+     * A preview of the invite. **No session needed** — whoever got the link has
+     * not logged in yet, and they need to know what they are accepting before
+     * they do.
+     */
+    getInvite(token) {
+        return this.json("GET", `/v1/invites/${encodeURIComponent(token)}`);
+    }
+    /** Accepts (login required). If they are already a member the role does not change. */
+    acceptInvite(token) {
+        return this.json("POST", `/v1/invites/${encodeURIComponent(token)}/accept`);
+    }
+    // --- domains: D1 hostnames methods ---
+    /** The default hostname and the custom domains come together (viewer). */
+    listHostnames(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/hostnames`);
+    }
+    /**
+     * Attaches a custom domain (member).
+     *
+     * Idempotent — sending the same name again returns the existing row
+     * unchanged. The response's `verify` is the CNAME and TXT the customer has to
+     * add.
+     */
+    addHostname(org, name, hostname) {
+        return this.json("POST", `${this.projectPath(org, name)}/hostnames`, { hostname });
+    }
+    /** Runs the same check the background verifier makes, right now (member). */
+    verifyHostname(org, name, host) {
+        return this.json("POST", `${this.projectPath(org, name)}/hostnames/${encodeURIComponent(host)}/verify`);
+    }
+    /** Detaches a custom domain (member). The default hostname gives a 400. */
+    deleteHostname(org, name, host) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/hostnames/${encodeURIComponent(host)}`);
+    }
+    // --- domains: D2 dns methods ---
+    /** The organization's zones. No `rrsets` — those ride only on a single-zone lookup. */
+    listZones(org) {
+        return this.json("GET", this.dnsPath(org));
+    }
+    /** Idempotent. A zone that already exists comes back unchanged. */
+    createZone(org, name) {
+        return this.json("POST", this.dnsPath(org), { name });
+    }
+    getZone(org, zone) {
+        return this.json("GET", `${this.dnsPath(org)}/${encodeURIComponent(zone)}`);
+    }
+    deleteZone(org, zone) {
+        return this.json("DELETE", `${this.dnsPath(org)}/${encodeURIComponent(zone)}`);
+    }
+    /**
+     * Replaces one rrset **whole**. `records` is the complete new set for that
+     * (name, type), so adding a single value means sending the current ones with
+     * it.
+     */
+    putRRset(org, zone, name, type, ttl, records) {
+        return this.json("PUT", this.rrsetPath(org, zone, name, type), { ttl, records });
+    }
+    deleteRRset(org, zone, name, type) {
+        return this.json("DELETE", this.rrsetPath(org, zone, name, type));
+    }
+    setZoneDNSSEC(org, zone, enabled) {
+        return this.json("POST", `${this.dnsPath(org)}/${encodeURIComponent(zone)}/dnssec`, {
+            enabled,
+        });
+    }
+    setZoneDS(org, zone, ds) {
+        return this.json("PUT", `${this.dnsPath(org)}/${encodeURIComponent(zone)}/dnssec/ds`, { ds });
+    }
+    /** The shared prefix of the DNS surface. */
+    dnsPath(org) {
+        return `/v1/orgs/${encodeURIComponent(org)}/dns/zones`;
+    }
+    /** Both `@` and `*` arrive as a name. Keeps the same string out of four places. */
+    rrsetPath(org, zone, name, type) {
+        return (`${this.dnsPath(org)}/${encodeURIComponent(zone)}` +
+            `/rrsets/${encodeURIComponent(name)}/${encodeURIComponent(type)}`);
+    }
+    // --- domains: D3 domains methods ---
+    /**
+     * Looks a name up (member or above).
+     *
+     * `priceCents` is the first year of registration; `renewalCents` is one year
+     * of renewal. They are separate because a first-year discount is common —
+     * folded into one, the screen cannot say "buy it for $1, then $15 next year".
+     */
+    checkDomains(org, names) {
+        return this.json("POST", `${this.domainsPath(org)}/check`, { names });
+    }
+    /**
+     * Buys a domain (admin — this spends money).
+     *
+     * **The ICANN verification mail goes to `contact.email`.** The screen has to
+     * say so before the purchase (docs/domains.md §5.5).
+     *
+     * Sending the same request again is safe — a finished domain comes back
+     * unchanged, and a purchase that stopped part way resumes from where it
+     * stopped.
+     */
+    purchaseDomain(org, body) {
+        return this.json("POST", this.domainsPath(org), body);
+    }
+    /** Imports a domain you already own (admin). Creates the zone only; the registrar is not called. */
+    importDomain(org, name) {
+        return this.json("POST", `${this.domainsPath(org)}/import`, { name });
+    }
+    listDomains(org) {
+        return this.json("GET", this.domainsPath(org));
+    }
+    getDomain(org, name) {
+        return this.json("GET", this.domainPath(org, name));
+    }
+    renewDomain(org, name, years) {
+        return this.json("POST", `${this.domainPath(org, name)}/renew`, { years });
+    }
+    /**
+     * Changes only the **intent** to auto-renew.
+     *
+     * Auto-renew at the registrar stays on — a domain is an asset you lose if you
+     * are a day late, so we renew first and bill afterwards. The screen has to say
+     * this alongside.
+     */
+    setDomainAutoRenew(org, name, enabled) {
+        return this.json("POST", `${this.domainPath(org, name)}/auto-renew`, { enabled });
+    }
+    setDomainLock(org, name, locked) {
+        return this.json("POST", `${this.domainPath(org, name)}/lock`, { locked });
+    }
+    /** The transfer auth code. The audit records that one was issued and **not the code itself**. */
+    domainAuthCode(org, name) {
+        return this.json("POST", `${this.domainPath(org, name)}/auth-code`);
+    }
+    /** Re-reads from the registrar right now (member). */
+    syncDomain(org, name) {
+        return this.json("POST", `${this.domainPath(org, name)}/sync`);
+    }
+    /** The shared prefix of the domain surface. Keeps the same string out of ten places. */
+    domainsPath(org) {
+        return `/v1/orgs/${encodeURIComponent(org)}/domains`;
+    }
+    domainPath(org, name) {
+        return `${this.domainsPath(org)}/${encodeURIComponent(name)}`;
+    }
+    /** The shared prefix of the project surface. */
+    projectPath(org, name) {
+        return `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}`;
+    }
+    /** The shared prefix of the database surface. Keeps the same string out of five places. */
+    dbPath(org, name) {
+        return `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`;
+    }
+    // ---- Self-hosted Git (docs/git-hosting.md §12.1, §19) ----
+    //
+    // **git does the repository work and we handle only the metadata.** That is
+    // why there is nothing like `pushRepo` here — an API that wraps git either
+    // reimplements every one of git's flags or boxes the user in.
+    //
+    // A repository **belongs to a project**. That is why every method starts with
+    // (org, project) — the same shape as the database and the secrets.
+    listRepos(org, project) {
+        return this.json("GET", this.repoPath(org, project));
+    }
+    createRepo(org, project, body) {
+        return this.json("POST", this.repoPath(org, project), body);
+    }
+    getRepo(org, project, name) {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}`);
+    }
+    updateRepo(org, project, name, body) {
+        return this.json("PATCH", `${this.repoPath(org, project)}/${encodeURIComponent(name)}`, body);
+    }
+    deleteRepo(org, project, name) {
+        return this.json("DELETE", `${this.repoPath(org, project)}/${encodeURIComponent(name)}`);
+    }
+    /** The ref history. The lead for recovering a commit lost to a force-push is here. */
+    listRefUpdates(org, project, name) {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/ref-updates`);
+    }
+    // Push-to-deploy (docs/code/push-to-deploy). The hook hangs off the
+    // repository and the builds off the **project**, because a build outlives the
+    // repository it came from.
+    getDeployHook(org, project, name) {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy-hook`);
+    }
+    setDeployHook(org, project, name, body) {
+        return this.json("PUT", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy-hook`, body);
+    }
+    deleteDeployHook(org, project, name) {
+        return this.json("DELETE", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy-hook`);
+    }
+    /** Build a commit without pushing. Omit `commitSha` for the hooked branch's tip. */
+    deployRepoNow(org, project, name, commitSha) {
+        return this.json("POST", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy`, commitSha === undefined ? {} : { commitSha });
+    }
+    listBuilds(org, project, limit) {
+        const q = limit === undefined ? "" : `?limit=${limit}`;
+        return this.json("GET", `${this.projectPath(org, project)}/builds${q}`);
+    }
+    getBuild(org, project, buildId) {
+        return this.json("GET", `${this.projectPath(org, project)}/builds/${encodeURIComponent(buildId)}`);
+    }
+    /**
+     * A build's output. It comes back as **text**, not JSON — see the endpoint's
+     * description. `json()` would try to parse it and fail on the first line.
+     */
+    getBuildLog(org, project, buildId) {
+        return this.text("GET", `${this.projectPath(org, project)}/builds/${encodeURIComponent(buildId)}/log`);
+    }
+    cancelBuild(org, project, buildId) {
+        return this.json("POST", `${this.projectPath(org, project)}/builds/${encodeURIComponent(buildId)}/cancel`);
+    }
+    listSSHKeys() {
+        return this.json("GET", "/v1/me/ssh-keys");
+    }
+    addSSHKey(publicKey, name) {
+        return this.json("POST", "/v1/me/ssh-keys", { publicKey, name });
+    }
+    deleteSSHKey(keyId) {
+        return this.json("DELETE", `/v1/me/ssh-keys/${encodeURIComponent(keyId)}`);
+    }
+    listAccessTokens() {
+        return this.json("GET", "/v1/me/tokens");
+    }
+    /** The plaintext is carried in this response **once** and never again. */
+    createAccessToken(body) {
+        return this.json("POST", "/v1/me/tokens", body);
+    }
+    revokeAccessToken(tokenId) {
+        return this.json("DELETE", `/v1/me/tokens/${encodeURIComponent(tokenId)}`);
+    }
+    // ---- Browsing (docs/git-hosting.md §12.2) ----
+    getRepoRefs(org, project, name) {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/refs`);
+    }
+    getRepoTree(org, project, name, ref = "", path = "") {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/tree${gitQuery(ref, path)}`);
+    }
+    getRepoBlob(org, project, name, ref = "", path = "") {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/blob${gitQuery(ref, path)}`);
+    }
+    getRepoCommits(org, project, name, ref = "", limit) {
+        const q = new URLSearchParams();
+        if (ref !== "")
+            q.set("ref", ref);
+        if (limit !== undefined)
+            q.set("limit", String(limit));
+        const qs = q.size > 0 ? `?${q.toString()}` : "";
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/commits${qs}`);
+    }
+    /** The shared prefix of the repository surface. It sits under the project (§19). */
+    repoPath(org, project) {
+        return `${this.projectPath(org, project)}/repos`;
+    }
+    rollback(org, name, version) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/rollback`, { version });
+    }
+}
+//# sourceMappingURL=index.js.map