@runlot/api 0.1.0-rc.115 → 0.1.0-rc.117

package/dist/schema.d.ts

@@ -256,6 +256,64 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/oidc/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Start a generic OIDC login
+         * @description The provider is configured per installation (`RUNLOT_OIDC_ISSUER`), and the three
+         *     endpoints come from that issuer's `/.well-known/openid-configuration` rather than from
+         *     this document. **The two OIDC routes exist only when an issuer is configured**; without
+         *     one they are not registered and answer 404, which is how a client can tell whether this
+         *     deployment federates an identity provider.
+         *
+         *     `redirect` is the client callback the token is carried back to, as a fragment, and it
+         *     has to match the server allowlist. The redirect to the provider uses PKCE S256 and a
+         *     `nonce` that binds the resulting `id_token` to this attempt.
+         */
+        get: operations["oidcStart"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/oidc/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Generic OIDC callback
+         * @description This path is the registered redirect URI of the installation's OIDC client. It exchanges
+         *     the authorization code and PKCE verifier at the token endpoint, **verifies the
+         *     `id_token`'s signature against the issuer's JWKS** (RS256 and ES256) along with its
+         *     issuer, audience, expiry and nonce, and then redirects to the client callback with the
+         *     result in the URL fragment — the same shape as the GitHub and Google callbacks.
+         *
+         *     The identity is stored as `provider = "oidc:<issuer host>"`, so two installations
+         *     federating different providers never collide on a subject.
+         *
+         *     A sign-up the installation's `RUNLOT_SIGNUP` policy refuses comes back as
+         *     `#error=signup_closed`, and the account is not created.
+         */
+        get: operations["oidcCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/hooks/ses": {
         parameters: {
             query?: never;
@@ -513,6 +571,38 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/license": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * This installation's licence, its state, and the counts against its ceilings
+         * @description What the dashboard footer and `runlot license` read (docs/onprem-delivery.md §6.5).
+         *
+         *     **Any signed-in user may call it**, with the same bearer credential as `/v1/me`. The
+         *     reason it is not admin-only: the footer is drawn on every page for everybody, and the
+         *     deterrent the licence actually relies on is that the customer's own name is on every
+         *     screen (§6.8). Nothing here is a secret — the signature is not returned, and neither is
+         *     the licence file's path.
+         *
+         *     On SaaS, and on any deployment with no licence file configured, the answer is
+         *     `onPrem: false` with `state: "none"` and zeroed ceilings, and every surface draws
+         *     nothing. `state` is never absent: a missing, unparseable or expired-past-grace licence
+         *     is `restricted` with the reason, because a licence problem that shows as "no licence
+         *     feature" is the one nobody reports.
+         */
+        get: operations["getLicense"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/me": {
         parameters: {
             query?: never;
@@ -4772,7 +4862,9 @@ export interface components {
              * @description How many projects this organization's plan allows (Free 3, Pro 30). It is
              *     returned here so clients do not need their own copy of the plan table.
              *     Enforcement happens on the server — `createProject` answers 409
-             *     `project_limit` once the limit is reached.
+             *     `project_limit` once the limit is reached. **0 means no per-org cap**: an
+             *     on-prem install publishes 0, because its only project bound is the
+             *     licence's installation-wide one (`409 license_project_limit`).
              */
             projectLimit: number;
             /**
@@ -4783,7 +4875,37 @@ export interface components {
             dbCapBytes: number;
             /** @description This organization requires its members to use two-factor authentication. */
             requireTotp?: boolean;
-        };
+            appCertState?: components["schemas"]["AppCertState"];
+        };
+        /**
+         * @description Whether this organization's default app addresses can be opened yet.
+         *
+         *     A default address is three labels — `<project>.<org>.<app-domain>` — so a single
+         *     `*.<app-domain>` certificate cannot cover it and each organization gets its own
+         *     `*.<org>.<app-domain>`. That certificate is issued **after** the organization
+         *     exists, which leaves a window where an address we have already told you about
+         *     cannot be opened at all: the edge holds no certificate for that name and drops
+         *     the TLS handshake, which browsers report as
+         *     `ERR_SSL_VERSION_OR_CIPHER_MISMATCH`. Nothing can be written inside that error,
+         *     so this field is how you learn about the window — show it next to the address
+         *     rather than letting someone click through to a browser error page.
+         *
+         *     - `pending` — being issued. The default addresses do not answer yet. It
+         *       normally clears in well under a minute; it is retried with backoff.
+         *     - `active` — issued. The address answers.
+         *     - `failed` — issuance gave up for now. It is retried when the control plane
+         *       restarts. Treat it as "will not open" rather than as a slow `pending`, and
+         *       contact support if it persists.
+         *     - `none` — this deployment issues no wildcard for app addresses, which is the
+         *       local and development shape. **Nothing to wait for** — never render this as
+         *       "not ready".
+         *
+         *     A custom domain is not covered by this field. Those have their own per-name
+         *     certificate and their own state machine, and they appear in `urls` only once
+         *     they are serving.
+         * @enum {string}
+         */
+        AppCertState: "none" | "pending" | "active" | "failed";
         Notification: {
             /** Format: int64 */
             id: number;
@@ -4792,7 +4914,7 @@ export interface components {
              *     human-readable wording is produced separately by the dashboard and by email.
              * @enum {string}
              */
-            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "overage_charge_failed" | "disabled_project_deletion" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled" | "new_device";
+            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "overage_charge_failed" | "disabled_project_deletion" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled" | "license_expiring" | "license_grace" | "license_restricted" | "new_device";
             /** @description If this is a project-related notification, the name of that project. Absent for org-level notifications (`project_limit`) */
             projectName?: string;
             /**
@@ -4829,8 +4951,13 @@ export interface components {
              * @description `hostnames` as full, reachable URLs. The scheme and port depend on the
              *     environment (`https://…` in production, `http://…:8787` locally), so use these
              *     rather than building URLs yourself.
+             *
+             *     A default address is listed here while `appCertState` is `pending` — it is the
+             *     address, and it is about to start working. Read that field before presenting
+             *     one of these as something to click.
              */
             urls?: string[];
+            appCertState?: components["schemas"]["AppCertState"];
             /** Format: date-time */
             createdAt: string;
             /**
@@ -6985,6 +7112,13 @@ export interface components {
              * @description When it was last registered or replaced
              */
             updatedAt: string;
+            /**
+             * @description The base URL of your own GitHub Enterprise Server installation, when this
+             *     provider is pointed at one. **Absent means the public provider** —
+             *     github.com — which is the default.
+             * @example https://github.acme.example
+             */
+            issuer?: string;
         };
         /**
          * @description The project's end-user authentication status.
@@ -7055,6 +7189,18 @@ export interface components {
              *     new one from the login provider's console and PUT it again.
              */
             clientSecret: string;
+            /**
+             * @description The base URL of your own GitHub Enterprise Server installation, for example
+             *     `https://github.acme.example`. Only the `github` provider takes one — the
+             *     four OAuth endpoints are derived from this base, and no other provider has a
+             *     layout we can derive, so a non-empty value on `google` or `kakao` is a 400.
+             *
+             *     **Empty means github.com**, which is the default. This PUT is the whole row,
+             *     so send the field on every call: leave it out on a save that means to go back
+             *     to github.com and the old installation stays.
+             * @example https://github.acme.example
+             */
+            issuer?: string;
         };
         /**
          * @description A single hostname attached to the project. `state` progresses from
@@ -7267,6 +7413,75 @@ export interface components {
              */
             sandbox: boolean;
         };
+        /**
+         * @description The licence payload minus its signature, the state computed from it, and the counts
+         *     against each ceiling. `docs/onprem-delivery.md §6.2` is the payload's definition and
+         *     §6.3 the state machine.
+         */
+        License: {
+            /**
+             * @description Whether this deployment is licensed at all — true when a licence file is
+             *     configured. False is SaaS, and then `state` is `none` and every surface draws
+             *     nothing.
+             */
+            onPrem: boolean;
+            /**
+             * @description `valid` — in force. `expiring` — within 30 days of `expiresAt`; a banner and a
+             *     daily notification. `grace` — past `expiresAt` and inside `graceDays`; nothing is
+             *     refused yet. `restricted` — past grace, or the file is missing, or it does not
+             *     parse or verify; new nodes, projects, deploys and sign-ups are refused and
+             *     everything already running keeps running (§6.4). `none` — not an on-prem
+             *     deployment.
+             * @enum {string}
+             */
+            state: "valid" | "expiring" | "grace" | "restricted" | "none";
+            /**
+             * @description Why the state is what it is, for the states that have a why: `signature`,
+             *     `expired`, `kid unknown`, `missing`. Empty when there is nothing to explain.
+             *     **It is a code, not a sentence** — the surfaces translate it, and a sentence from
+             *     the server would arrive in one language on a trilingual screen.
+             */
+            reason?: string;
+            /**
+             * @description The licensee's name, as it is printed in the footer on every page.
+             * @example Acme Corp
+             */
+            customer?: string;
+            /**
+             * @description `eval`, `single` or `ha` (§6.1). `eval` is watermarked as an evaluation.
+             * @example single
+             */
+            tier?: string;
+            /**
+             * Format: date-time
+             * @description When the term ends. Null when there is no licence.
+             */
+            expiresAt: string | null;
+            /**
+             * Format: date-time
+             * @description `expiresAt` plus the licence's grace days — the date new deploys stop. Null when
+             *     there is no licence.
+             */
+            graceEnd: string | null;
+            /** @description The node ceiling. Never 0 — the node is the unit of price (§6.1). */
+            maxNodes: number;
+            /** @description The project ceiling. **0 means unlimited.** */
+            maxProjects: number;
+            /** @description The user ceiling. **0 means unlimited.** */
+            maxUsers: number;
+            /**
+             * @description The licensed feature names, from a closed set the binary knows (`git`,
+             *     `durable_objects`, `ai_byok`). An unknown name is a parse error at issuance, not a
+             *     silent grant of nothing.
+             */
+            features: string[];
+            /** @description What the installation is actually using, for `nodes 1/1` and `projects 42/∞`. */
+            counts: {
+                nodes: number;
+                projects: number;
+                users: number;
+            };
+        };
     };
     responses: {
         /** @description Bad request */
@@ -7747,6 +7962,71 @@ export interface operations {
             400: components["responses"]["BadRequest"];
         };
     };
+    oidcStart: {
+        parameters: {
+            query: {
+                redirect: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description to the provider's authorization endpoint */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description No identity provider is configured on this deployment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The provider's discovery document could not be read */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    oidcCallback: {
+        parameters: {
+            query: {
+                code?: string;
+                state: string;
+                error?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description to the client callback */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description No identity provider is configured on this deployment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     sesHook: {
         parameters: {
             query?: never;
@@ -7875,6 +8155,15 @@ export interface operations {
                          * @example KR
                          */
                         country: string;
+                        /**
+                         * @description The name of this deployment (`production`, `dev`, `local`, or an
+                         *     installation's own name). The dashboard tags its error reports with it
+                         *     and sends nothing on `local`. **This can be empty** — the server did not
+                         *     say, and the client falls back to its own hostname rule rather than
+                         *     reading an environment named "".
+                         * @example production
+                         */
+                        environment: string;
                     };
                 };
             };
@@ -8201,6 +8490,27 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    getLicense: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The licence as this installation currently reads it */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["License"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
     getMe: {
         parameters: {
             query?: never;
@@ -11494,7 +11804,8 @@ export interface operations {
             };
             /**
              * @description `invalid_provider` — the name is outside `github`, `google`, `kakao`, or
-             *     `clientId`/`clientSecret` is empty.
+             *     `clientId`/`clientSecret` is empty. `bad_request` — `issuer` was given for a
+             *     provider other than `github`, or it is not an http(s) base URL.
              */
             400: {
                 headers: {