@runlot/api 0.1.0-rc.145 → 0.1.0-rc.147

package/dist/schema.d.ts

@@ -212,6 +212,106 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/app-auth/start/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Managed app sign-in: start leg
+         * @description The sign-in broker for apps using a managed provider. The app's own
+         *     `/__runlot/auth/sign-in/<provider>` sends the browser here; `id` was minted
+         *     for one project, provider and attached host and lives ten minutes. Sends a 302
+         *     to the provider with identity-only scopes (GitHub `read:user user:email`,
+         *     Google `openid email profile` with PKCE).
+         */
+        get: operations["appAuthStart"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-auth/choose/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Runlot sign-in: chooser page
+         * @description For the `runlot` provider the start leg sends the browser here instead of straight
+         *     to an upstream. An HTML page, branded Runlot and naming the app, offering email and
+         *     password, Google and GitHub. Google and GitHub continue through the
+         *     `/v1/auth/{provider}/callback/app` legs; the grant always carries
+         *     `provider = runlot` and a pairwise subject.
+         */
+        get: operations["appAuthChoose"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-auth/choose/{id}/password": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Runlot sign-in: email and password
+         * @description The chooser's email-and-password form. `sign-up` creates an end-user Runlot account
+         *     with no organization. On success, a 302 to the app host's
+         *     `/__runlot/auth/callback/managed?code=<grant>`; a refusal re-renders the chooser
+         *     with the error.
+         */
+        post: operations["appAuthChoosePassword"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/{provider}/callback/app": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Managed app sign-in: provider callback
+         * @description The provider returns here. The broker exchanges the code, reads the profile and
+         *     verified email, and sends a 302 to
+         *     `https://<app host>/__runlot/auth/callback/managed?code=<grant>` with a
+         *     single-use grant valid five minutes. A denial or cancel goes to
+         *     `/__runlot/auth/sign-in?error=provider_denied` on the app host. No provider
+         *     token ever leaves the broker.
+         *
+         *     Register `<public origin>/v1/auth/google/callback/app` on the Google OAuth
+         *     client. GitHub accepts it as a subpath of the app's registered
+         *     `<public origin>/v1/auth/github/callback`.
+         */
+        get: operations["appAuthCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/google/start": {
         parameters: {
             query?: never;
@@ -2671,11 +2771,41 @@ export interface paths {
          *
          *     `sessionDays` also sets how long an end user's session is kept.
          *
+         *     `password` and `magicLink` turn the email-and-password and email-link methods on or
+         *     off. A change that would leave no sign-in method enabled is refused with 409
+         *     `last_method`; turn login off instead.
+         *
          *     Requires member or higher. Audited as `auth.settings`.
          */
         patch: operations["updateAuthSettings"];
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/auth/schema": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * The `runlot_auth` schema DDL
+         * @description The statements that install the `runlot_auth` schema, the same ones the auth
+         *     system installs on first use. The CLI applies them before a project's own
+         *     migrations so a migration can reference `runlot_auth.users(id)`. Every statement
+         *     is idempotent; run them in order as one script. Viewer or higher.
+         */
+        get: operations["getAuthSchema"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/auth/providers/{provider}": {
         parameters: {
             query?: never;
@@ -2684,8 +2814,9 @@ export interface paths {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
                 /**
-                 * @description A single social login provider. Only the names in the enum are accepted; the name is
-                 *     also the last segment of the provider's callback URL.
+                 * @description A login provider id. `github`, `google` and `runlot` are the built-in names; any
+                 *     other id names one of the project's OIDC providers. The id is also the last segment
+                 *     of the provider's callback URL.
                  */
                 provider: components["parameters"]["AuthProviderName"];
             };
@@ -2694,8 +2825,11 @@ export interface paths {
         get?: never;
         /**
          * Register or replace a social provider (`runlot auth provider set`)
-         * @description Your project registers its own OAuth app with the provider, so the consent
-         *     screen, review, and privacy policy stay under your control.
+         * @description Three kinds (see `AuthProviderPut`). **builtin** registers your project's own
+         *     GitHub or Google OAuth app. **oidc** registers any OpenID Connect provider under a
+         *     project-chosen id; the CP reads its discovery document when saving. **runlot**
+         *     (id `runlot`) turns on "Continue with Runlot": email, Google and GitHub at Runlot,
+         *     through the sign-in broker, with nothing to register.
          *
          *     The callback URL to register with the provider is per host:
          *     `https://<host>/__runlot/auth/callback/<provider>`. The host list is in
@@ -2815,7 +2949,9 @@ export interface paths {
          * Changes the policy (`runlot access set`)
          * @description `public` leaves the deployment open to anyone, `org` requires member or higher in the
          *     org the project belongs to, and `password` uses **one** shared password for the whole
-         *     project.
+         *     project. `app` admits only requests that carry a valid `env.auth` session for this
+         *     project; a browser without one is sent to the app's sign-in page and anything else
+         *     gets 401 `sign_in_required`. It requires login to be on for the project.
          *
          *     **If you don't send a password, the existing one stays.** Send a new value to replace
          *     it.
@@ -6044,6 +6180,61 @@ export interface components {
              *     ]
              */
             trustedCertificates?: string[];
+            /**
+             * @description Path rules that **narrow** the project's access policy (`runlot access`) for this
+             *     deployment. Each request is checked against every rule whose `path` matches it,
+             *     and every matching rule must hold; a refused request gets
+             *     `403 access_rule_denied`.
+             *
+             *     The rules only apply while the policy is `org` or `password`. On a `public`
+             *     project they are ignored (the deploy warns), because there is no identity to
+             *     test. A visitor admitted by the shared password or the automation bypass secret
+             *     satisfies only a rule with an empty `require`.
+             *
+             *     The rules move with the deployment: rolling back restores the old list.
+             * @example [
+             *       {
+             *         "path": "/admin/*",
+             *         "require": {
+             *           "orgRole": "admin"
+             *         }
+             *       },
+             *       {
+             *         "path": "/staff",
+             *         "require": {
+             *           "emailDomain": "example.com"
+             *         }
+             *       }
+             *     ]
+             */
+            access?: components["schemas"]["ManifestAccessRule"][];
+        };
+        /** @description One manifest path rule (`access[]`). */
+        ManifestAccessRule: {
+            /**
+             * @description An absolute path. An exact path, or a prefix ending in `/*`, which also covers the
+             *     prefix itself (`/admin/*` covers `/admin` and `/admin/x`). `*` is accepted nowhere
+             *     else. Matching is case-insensitive on the cleaned request path.
+             * @example /admin/*
+             */
+            path: string;
+            /**
+             * @description What the visitor must satisfy. Every field that is set must hold; `{}` admits
+             *     anyone the project policy already admitted.
+             */
+            require: {
+                /**
+                 * @description The minimum org role: viewer < member < admin.
+                 * @enum {string}
+                 */
+                orgRole?: "viewer" | "member" | "admin";
+                /**
+                 * @description The visitor's email must be at one of these domains. One string or a list;
+                 *     a leading `@` is ignored.
+                 * @example example.com
+                 */
+                emailDomain?: string | string[];
+            };
         };
         /**
          * @description Scheduled execution. It ships in the bundle exactly as you wrote it in
@@ -6587,6 +6778,10 @@ export interface components {
             dimensionOptions?: number[];
             /** @description Embedding models only: every value `env.ai.embed(model, input, { taskType })` may carry. A task type tells the model what the vectors are for, and the same text embedded under two of them is a different vector — so a namespace has to be filled under one choice and queried under the same one. Absent when the model has no such notion (Titan has none). Leaving `taskType` out sends the model's own default, which is what every vector stored before this option existed was embedded under. */
             taskTypes?: string[];
+            /** @description Chat models only: every value `env.ai.run(model, { reasoning: { effort } })` may carry. Absent when the model has no reasoning-effort control (`@runlot/…` have none), in which case asking for one is `400 bad_effort` rather than a silently ignored field. The vocabularies differ by family — the OpenAI rows include `none`, the Claude rows do not, and Gemini has only `low`/`medium`/`high`. Leaving `reasoning` out sends the model's own default. */
+            effortLevels?: string[];
+            /** @description Chat models only, present when true: `env.ai.run(model, { responseFormat })` is honoured on this model. False or absent means asking for a response format is `400 format_unsupported` rather than prose wearing the caller's schema. Read off each model card, so it is a per-row fact and not a family rule — Claude Haiku 4.5 has it and Claude Sonnet 5 does not, on the same endpoint. */
+            structuredOutput?: boolean;
             /** @enum {string} */
             lane: "frontier" | "value";
             display: string;
@@ -6762,7 +6957,7 @@ export interface components {
             /** @description Lowercased. Empty for an account that has only a social identity. */
             email: string;
             name?: string;
-            /** @description `password`, `github`, `google`, `kakao` … sorted, from the linked identities. */
+            /** @description `password`, `github`, `google`, `runlot`, OIDC ids … sorted, from the linked identities. */
             providers: string[];
             /** Format: date-time */
             createdAt: string;
@@ -7050,10 +7245,11 @@ export interface components {
         AccessPolicy: {
             /**
              * @description `public` means anyone, `org` means a member or higher of the org that owns the
-             *     project, and `password` means one shared password for the project.
+             *     project, `password` means one shared password for the project, and `app` means
+             *     only people signed in to this app through `env.auth` (docs/auth-access-unify.md §3).
              * @enum {string}
              */
-            mode: "public" | "org" | "password";
+            mode: "public" | "org" | "password" | "app";
             /** @description Whether a password is set. The value itself is never returned. */
             hasPassword: boolean;
             /** @description Whether a bypass key for automation exists. The key is shown only once, when it is issued. */
@@ -7085,11 +7281,12 @@ export interface components {
             redirect: string;
         };
         /**
-         * @description A social login provider you can register a per-project OAuth app for.
-         *     GitHub, Google, and Kakao are supported.
-         * @enum {string}
+         * @description A login provider id. `github` and `google` are your own OAuth apps, `runlot` is
+         *     Runlot's sign-in (email, Google and GitHub at Runlot), and any other id is an OIDC
+         *     provider the project registered under that name.
+         * @example github
          */
-        AuthProvider: "github" | "google" | "kakao";
+        AuthProvider: string;
         /** @description End-user authentication settings for the project. */
         AuthSettings: {
             /**
@@ -7109,6 +7306,24 @@ export interface components {
              */
             sessionDays: number;
             brand: components["schemas"]["AuthBrand"];
+            /**
+             * @description Automatic row level security. When on, `env.db` statements from a signed-in user run
+             *     as that user (`runlot_authenticated`), from a signed-out visitor as `runlot_anon`, and
+             *     from cron and queue as the owner. Tables without row level security are closed to
+             *     app users. Off by default.
+             */
+            rls: boolean;
+            /**
+             * @description The email-and-password method. Off makes the password routes answer 404
+             *     `method_disabled` and hides the form; stored password hashes stay.
+             * @default true
+             */
+            password: boolean;
+            /**
+             * @description The email-link method. Off makes `sign-in/email` answer 404 `method_disabled`.
+             * @default true
+             */
+            magicLink: boolean;
         };
         /**
          * @description Branding for the hosted login page. For finer-grained branding, build your own
@@ -7139,7 +7354,13 @@ export interface components {
          */
         AuthProviderMeta: {
             provider: components["schemas"]["AuthProvider"];
-            /** @description The public id given by the provider */
+            /**
+             * @description `builtin` is your own GitHub or Google OAuth app, `oidc` a generic OpenID
+             *     Connect provider, and `runlot` Runlot's sign-in (no callback URL to register).
+             * @enum {string}
+             */
+            kind: "builtin" | "oidc" | "runlot";
+            /** @description The public id given by the provider. Empty for `runlot` */
             clientId: string;
             /**
              * Format: date-time
@@ -7147,12 +7368,17 @@ export interface components {
              */
             updatedAt: string;
             /**
-             * @description The base URL of your own GitHub Enterprise Server installation, when this
-             *     provider is pointed at one. **Absent means the public provider** —
-             *     github.com — which is the default.
+             * @description For `github`, the base URL of your own GitHub Enterprise Server installation
+             *     (**absent means github.com**). For `oidc`, the issuer URL.
              * @example https://github.acme.example
              */
             issuer?: string;
+            /** @description OIDC only. The button label on the hosted sign-in page */
+            displayName?: string;
+            /** @description OIDC only. The button icon on the hosted sign-in page */
+            iconUrl?: string;
+            /** @description OIDC only. Space-separated scopes requested at sign-in */
+            scopes?: string;
         };
         /**
          * @description The project's end-user authentication status.
@@ -7199,6 +7425,9 @@ export interface components {
                 allowSignup?: boolean;
                 requireVerifiedEmail?: boolean;
                 sessionDays?: number;
+                rls?: boolean;
+                password?: boolean;
+                magicLink?: boolean;
                 /**
                  * @description Branding is patched the same way — a save that only changes the colour does not
                  *     erase the logo.
@@ -7211,30 +7440,49 @@ export interface components {
             };
         };
         /**
-         * @description The login provider credentials. Replacing them goes through this same PUT, so both
-         *     values are required every time; sending the ID alone would leave it unclear whether the
-         *     old secret still applies.
+         * @description The whole provider row; three shapes by `kind`:
+         *
+         *     - **builtin** (default; `github` and `google`): `{clientId, clientSecret}`, and
+         *       `issuer` on `github` only. Both credentials are required every time.
+         *     - **oidc** (any other id): `{kind:"oidc", issuer, clientId, clientSecret,
+         *       displayName?, iconUrl?, scopes?}`. `issuer` must be https; the CP fetches
+         *       `<issuer>/.well-known/openid-configuration` when saving and pins its endpoints.
+         *     - **runlot** (id `runlot` only): `{kind:"runlot"}` and no other field.
+         *
+         *     `{"source":"managed"}` is no longer accepted (400 `managed_removed`); use the
+         *     `runlot` provider.
          */
         AuthProviderPut: {
-            /** @description The public id given by the provider */
-            clientId: string;
             /**
-             * @description Stored encrypted. **It is never returned in any response.** If you lose it, issue a
-             *     new one from the login provider's console and PUT it again.
+             * @default builtin
+             * @enum {string}
              */
-            clientSecret: string;
+            kind: "builtin" | "oidc" | "runlot";
+            /** @description The public id given by the provider. Required for builtin and oidc */
+            clientId?: string;
             /**
-             * @description The base URL of your own GitHub Enterprise Server installation, for example
-             *     `https://github.acme.example`. Only the `github` provider takes one — the
-             *     four OAuth endpoints are derived from this base, and no other provider has a
-             *     layout we can derive, so a non-empty value on `google` or `kakao` is a 400.
-             *
-             *     **Empty means github.com**, which is the default. This PUT is the whole row,
-             *     so send the field on every call: leave it out on a save that means to go back
-             *     to github.com and the old installation stays.
+             * @description Required for builtin and oidc. Stored encrypted. **It is never returned in any
+             *     response.** If you lose it, issue a new one from the login provider's console and
+             *     PUT it again.
+             */
+            clientSecret?: string;
+            /**
+             * @description On `github`: the base URL of your own GitHub Enterprise Server installation, for
+             *     example `https://github.acme.example`; **empty means github.com**. This PUT is
+             *     the whole row, so send it on every call. On `google` it is a 400.
+             *     On `oidc`: required, the https issuer URL.
              * @example https://github.acme.example
              */
             issuer?: string;
+            /**
+             * @description OIDC only. The button label
+             * @example Kakao
+             */
+            displayName?: string;
+            /** @description OIDC only. An https URL of the button icon */
+            iconUrl?: string;
+            /** @description OIDC only. Space-separated; defaults to `openid email profile` */
+            scopes?: string;
         };
         /**
          * @description A single hostname attached to the project. `state` progresses from
@@ -7255,6 +7503,11 @@ export interface components {
             kind: "default" | "custom";
             /** @enum {string} */
             state: "pending_dns" | "pending_tls" | "active" | "error";
+            /**
+             * @description `app` serves your app. `login` is the project's login domain: it serves the Runlot sign-in page for this project on your own name, and never the app
+             * @enum {string}
+             */
+            role?: "app" | "login";
             /** @description The reason the last check failed. Read it to fix your own DNS */
             lastError?: string;
             /** Format: date-time */
@@ -7594,8 +7847,9 @@ export interface components {
         RepoName: components["schemas"]["RepoName"];
         SecretName: components["schemas"]["SecretName"];
         /**
-         * @description A single social login provider. Only the names in the enum are accepted; the name is
-         *     also the last segment of the provider's callback URL.
+         * @description A login provider id. `github`, `google` and `runlot` are the built-in names; any
+         *     other id names one of the project's OIDC providers. The id is also the last segment
+         *     of the provider's callback URL.
          */
         AuthProviderName: components["schemas"]["AuthProvider"];
     };
@@ -7952,6 +8206,145 @@ export interface operations {
             400: components["responses"]["BadRequest"];
         };
     };
+    appAuthStart: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description to the provider */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `sign_in_expired` — unknown, expired or used id */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `managed_unavailable` — no broker credential for that provider */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    appAuthChoose: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The chooser page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+            /** @description `sign_in_expired` — unknown, expired or used id */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    appAuthChoosePassword: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": {
+                    email: string;
+                    password: string;
+                    /** @enum {string} */
+                    mode: "sign-in" | "sign-up";
+                };
+            };
+        };
+        responses: {
+            /** @description The chooser re-rendered with an error */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+            /** @description to the app host with a grant */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `sign_in_expired` — unknown, expired or used id */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    appAuthCallback: {
+        parameters: {
+            query: {
+                code?: string;
+                state: string;
+                error?: string;
+            };
+            header?: never;
+            path: {
+                provider: "github" | "google";
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description to the app host */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `sign_in_expired` — unknown, expired or used state */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     googleStart: {
         parameters: {
             query: {
@@ -11212,6 +11605,18 @@ export interface operations {
                     /** @description capped at 4,096 by the lane */
                     maxTokens?: number;
                     temperature?: number;
+                    /** @description `env.ai.run`'s reasoning option. cp-core checks `effort` against the model's catalog row. */
+                    reasoning?: {
+                        /** @description one of the model's `effortLevels` */
+                        effort?: string;
+                    };
+                    /** @description `env.ai.run`'s structured output. Only on a model whose catalog row says `structuredOutput`. */
+                    responseFormat?: {
+                        /** @enum {string} */
+                        type?: "json_schema";
+                        name?: string;
+                        schema?: Record<string, never>;
+                    };
                 };
             };
         };
@@ -11225,6 +11630,8 @@ export interface operations {
                     "application/json": {
                         text: string;
                         model: string;
+                        stopReason: string;
+                        usageComplete?: boolean;
                         usage: {
                             /** Format: int64 */
                             inputTokens?: number;
@@ -11804,6 +12211,18 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /**
+             * @description `access_mode_app` — the deployment's access mode is `app`, which needs login.
+             *     Choose another access mode first; login is never turned off under it silently.
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` — the service is temporarily unavailable */
             503: {
                 headers: {
@@ -11854,6 +12273,15 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
+            /** @description `last_method` — the change would leave no sign-in method enabled */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` — the service is temporarily unavailable */
             503: {
                 headers: {
@@ -11865,6 +12293,34 @@ export interface operations {
             };
         };
     };
+    getAuthSchema: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The schema version and its statements */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        version: number;
+                        statements: string[];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     setAuthProvider: {
         parameters: {
             query?: never;
@@ -11873,8 +12329,9 @@ export interface operations {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
                 /**
-                 * @description A single social login provider. Only the names in the enum are accepted; the name is
-                 *     also the last segment of the provider's callback URL.
+                 * @description A login provider id. `github`, `google` and `runlot` are the built-in names; any
+                 *     other id names one of the project's OIDC providers. The id is also the last segment
+                 *     of the provider's callback URL.
                  */
                 provider: components["parameters"]["AuthProviderName"];
             };
@@ -11896,9 +12353,14 @@ export interface operations {
                 };
             };
             /**
-             * @description `invalid_provider` — the name is outside `github`, `google`, `kakao`, or
-             *     `clientId`/`clientSecret` is empty. `bad_request` — `issuer` was given for a
-             *     provider other than `github`, or it is not an http(s) base URL.
+             * @description `invalid_provider` — the id does not match the pattern, the kind does not fit
+             *     the id (`builtin` outside `github`/`google`, `runlot` outside `runlot`, `oidc` on
+             *     a reserved id), or `clientId`/`clientSecret` is empty. `bad_request` — `issuer`
+             *     on `google`, a non-http(s) GitHub base, a non-https OIDC issuer, or fields a
+             *     `runlot` PUT does not take. `oidc_discovery_failed` — the issuer's
+             *     `/.well-known/openid-configuration` could not be read; the message quotes the
+             *     provider's answer. `managed_removed` — `{"source":"managed"}`; use the `runlot`
+             *     provider.
              */
             400: {
                 headers: {
@@ -11910,6 +12372,18 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /**
+             * @description `runlot_unavailable` — this deployment has no sign-in broker, so the `runlot`
+             *     provider cannot be turned on. Register your own app instead.
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` — the service is temporarily unavailable. */
             503: {
                 headers: {
@@ -11929,8 +12403,9 @@ export interface operations {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
                 /**
-                 * @description A single social login provider. Only the names in the enum are accepted; the name is
-                 *     also the last segment of the provider's callback URL.
+                 * @description A login provider id. `github`, `google` and `runlot` are the built-in names; any
+                 *     other id names one of the project's OIDC providers. The id is also the last segment
+                 *     of the provider's callback URL.
                  */
                 provider: components["parameters"]["AuthProviderName"];
             };
@@ -11947,6 +12422,15 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /** @description `last_method` — removing it would leave no sign-in method enabled */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` — the service is temporarily unavailable. */
             503: {
                 headers: {
@@ -12110,7 +12594,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @enum {string} */
-                    mode: "public" | "org" | "password";
+                    mode: "public" | "org" | "password" | "app";
                     /**
                      * @description The shared password for `password` mode. If left empty, the existing one is
                      *     kept; if there was never one, this returns 400.
@@ -12132,6 +12616,18 @@ export interface operations {
             400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /**
+             * @description `login_required` — mode `app` needs login turned on for this project
+             *     (`runlot auth on`) first.
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` — the service is temporarily unavailable. */
             503: {
                 headers: {
@@ -12876,6 +13372,17 @@ export interface operations {
                      * @example app.example.com
                      */
                     hostname: string;
+                    /**
+                     * @description `login` (`runlot domain add <host> --login`) makes the name the project's
+                     *     login domain: sign-in starts for this project are sent to
+                     *     `https://<host>` once it is connected and its certificate is issued. Pro
+                     *     plan only (403 `plan_required`), one per project (409
+                     *     `login_domain_exists`); the same name already attached with the other role
+                     *     is 409 `hostname_role_conflict`. It counts toward the custom domain limit.
+                     * @default app
+                     * @enum {string}
+                     */
+                    role?: "app" | "login";
                 };
             };
         };