@runlot/api 0.1.0-rc.205 → 0.1.0-rc.207

package/dist/schema.d.ts

@@ -1028,7 +1028,7 @@ export interface paths {
          * Delete a project (`runlot project delete`)
          * @description Requires admin or higher. **This cannot be undone, and there is no recovery
          *     generation to restore from afterwards.** Export anything you need first with
-         *     `runlot pg export`.
+         *     `runlot db export`.
          *
          *     The `confirm` field must carry the exact project name.
          *
@@ -1045,6 +1045,11 @@ export interface paths {
          *     The 202 carries an operation id you can read with
          *     `GET /v1/orgs/{orgSlug}/operations/{opId}`, which reports the first step. Clients
          *     should not block on it.
+         *
+         *     **Deleting a project never deletes a database.** A project with a database of its
+         *     own leaves it in the organization under the project's name (`databaseKept`), with
+         *     its data, backups and the projects that bind it; delete it separately with
+         *     `runlot db delete`. The project's own bindings to other databases go with it.
          */
         delete: operations["deleteProject"];
         options?: never;
@@ -2548,51 +2553,42 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         /**
-         * Whether the database is available
-         * @description The response is just `{db: bool}`. Size and generation are not reported here.
+         * One database in the organization
+         * @description The database's size, state and the projects that bind it — the same row as the
+         *     list. A project whose name matches a database but which has none answers 404.
          *
          *     **No credentials are returned.** Viewer and above may call this; connection details
-         *     live at `/database/connect`.
+         *     live at `…/connect`.
          */
         get: operations["getDatabase"];
         put?: never;
-        /**
-         * Creates the project's database
-         * @description A database is created when your app uses one; this creates it by name, whether the
-         *     project never had one or its database was deleted. A new database starts empty. It
-         *     also clears the turn-off, so later deploys keep it. It returns the connection
-         *     details. Shortly afterwards
-         *     the running worker picks up a connected `env.db`. No redeploy is needed.
-         *
-         *     **It is idempotent and never rotates the password.** A second call returns the same
-         *     connection details, so a connection string saved from the first response keeps
-         *     working.
-         */
-        post: operations["createDatabase"];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/connect": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/connect": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -2611,20 +2607,21 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/endpoint": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/endpoint": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         /**
-         * Connection info without credentials (`runlot port-forward`)
+         * Connection info without credentials (`runlot db forward`)
          * @description Only host, port, database and `sslmode` — no secret, so viewer and above may call it.
-         *     `runlot port-forward` authenticates with your login session rather than a password,
+         *     `runlot db forward` authenticates with your login session rather than a password,
          *     so this endpoint is all it needs.
          */
         get: operations["getDatabaseEndpoint"];
@@ -2636,13 +2633,14 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/tokens": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/tokens": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -2653,7 +2651,7 @@ export interface paths {
         get: operations["listDatabaseTokens"];
         put?: never;
         /**
-         * Issue a credential for short-lived automation (`runlot pg token`)
+         * Issue a credential for short-lived automation (`runlot db token`)
          * @description Issues a user/password pair for use in a connection string. **The password appears
          *     only in this response** — only its SCRAM verifier is stored, so a lost password must
          *     be reissued. The session still opens under the project's own database role; the token
@@ -2666,13 +2664,14 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/tokens/{tokenUser}": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/tokens/{tokenUser}": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
                 tokenUser: string;
             };
             cookie?: never;
@@ -2690,13 +2689,14 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/execute": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/execute": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -2705,11 +2705,11 @@ export interface paths {
         /**
          * Run one statement (the dashboard's SQL console)
          * @description Runs a single SQL statement against the project's database and returns the rows. This
-         *     backs the dashboard's SQL console; from a terminal, use `runlot pg execute`, which
+         *     backs the dashboard's SQL console; from a terminal, use `runlot db execute`, which
          *     connects directly instead.
          *
          *     The statement is executed over an ordinary PostgreSQL connection using the same
-         *     host, port, `sslmode` and credential that `…/database/connect` hands a member for
+         *     host, port, `sslmode` and credential that `…/databases/{databaseName}/connect` hands a member for
          *     psql, so every rule that applies to a normal connection applies here too, including
          *     the 10 s statement ceiling.
          *
@@ -2726,7 +2726,7 @@ export interface paths {
          *     **Write mode belongs to a dashboard session.** A personal access token reaches this
          *     route with `db:read` and runs read-only statements; asking for `readOnly: false`
          *     with a token is 403 `console_write_needs_session`. No scope opens it — a credential
-         *     that has to write goes through `…/database/connect` or `…/database/tokens` and
+         *     that has to write goes through `…/databases/{databaseName}/connect` or `…/databases/{databaseName}/tokens` and
          *     connects, where the power it carries is named on the token.
          *
          *     Requires member or higher. A write leaves a `db.execute` audit event; a read leaves
@@ -2739,26 +2739,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/export": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/export": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         get?: never;
         put?: never;
         /**
-         * Creates a diagnostic image (`runlot pg export`)
+         * Creates a diagnostic image (`runlot db export`)
          * @description **This is not a backup.** It creates an immutable diagnostic image of the database as
          *     it is right now. It does not move any backup pointer, does not affect retention, and
          *     cannot be selected by a restore.
          *
          *     Scheduled backups are separate and run on their own hourly schedule. List them at
-         *     `…/database/generations` and pick one at `…/database/restore`. Diagnostic images stay
+         *     `…/databases/{databaseName}/generations` and pick one at `…/databases/{databaseName}/restore`. Diagnostic images stay
          *     outside that history entirely: restore cannot choose one and pruning ignores them.
          *
          *     **This is not idempotent.** Each call creates one more image.
@@ -2775,18 +2776,19 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/generations": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/generations": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         /**
-         * List of backup generations (`runlot pg generations`)
+         * List of backup generations (`runlot db backups`)
          * @description Lists the backup generations a restore can choose from, newest first, each with its
          *     storage key, size and `sha256` digest so the restore can verify what it receives.
          *
@@ -2797,7 +2799,7 @@ export interface paths {
          *     Requires member or higher.
          *
          *     **The database does not have to be enabled.** A final safety generation is kept even
-         *     after `runlot pg delete`, so it still appears here after deletion.
+         *     after `runlot db delete`, so it still appears here after deletion.
          *
          *     **`objects` is the Durable Object half of the same history**, returned alongside the
          *     database generations because a project's restorable state is the union of the two.
@@ -2824,20 +2826,21 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/restore": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/restore": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         get?: never;
         put?: never;
         /**
-         * Restore to a generation (`runlot pg restore`)
+         * Restore to a generation (`runlot db restore`)
          * @description A restore stops the project's database, replaces its contents with the chosen
          *     generation, and starts it again. The data as it stands immediately before the restore
          *     is archived first, so there is a way back.
@@ -2851,7 +2854,7 @@ export interface paths {
          *     whole restore, database included, rather than restoring only part of the project.
          *
          *     **Check `objects.restorable` before calling this, for the generation you are about to
-         *     pass.** Call `…/database/generations?at=<the chosen generation's lastAt>` first: the
+         *     pass.** Call `…/databases/{databaseName}/generations?at=<the chosen generation's lastAt>` first: the
          *     object half is selected on its own instant, independent of the `(epoch, seq)` you
          *     send here, so a `restorable=true` read at another instant answers a different
          *     question. Even a correctly timed `restorable=true` is eligibility, not a guarantee —
@@ -2861,7 +2864,7 @@ export interface paths {
          *     list, so a generation created in the meantime cannot send you somewhere else.
          *
          *     Returns 202 with an operation id, not the result. Poll
-         *     `…/database/operations/{opId}` for progress.
+         *     `…/databases/{databaseName}/operations/{opId}` for progress.
          */
         post: operations["restoreDatabase"];
         delete?: never;
@@ -2870,29 +2873,37 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/delete": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/delete": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         get?: never;
         put?: never;
         /**
-         * Delete a database (`runlot pg delete`)
-         * @description Deletes the project's database. A final safety generation is kept, so the data can
-         *     still be listed and restored afterwards. Once the deletion completes, the worker runs
-         *     without `env.db`. Requires admin or higher.
+         * Delete a database (`runlot db delete`)
+         * @description Deletes a database in the organization. Requires admin or higher.
+         *
+         *     **A bound database is not deleted.** The call answers 409 `database_bound` with
+         *     `details.bindings` (`project`, `binding`); the project whose name the database
+         *     shares counts as a binding (`db`). Remove the `databases` entry from each project's
+         *     `runlot.json` and deploy, or send `unbindAll: true`, which removes every binding
+         *     (each recorded in the audit log). Bound projects then fail calls on that binding
+         *     with `DatabaseNotAttached`, and their next deploy is refused with
+         *     `database_not_found` until their `runlot.json` drops the entry.
          *
-         *     **This also turns end-user auth off.** The subscriber records live inside the
-         *     project's database, so they go with it, and `env.auth` is disabled in the same step.
-         *     The stored OAuth provider secrets are removed with it and are not recoverable.
+         *     While the project of the same name exists, a final safety generation is kept and
+         *     that project runs without `env.db` afterwards; this also turns end-user auth off,
+         *     because the subscriber records live in the database. A database with no project of
+         *     its name is erased with no generation left — export it first (`runlot db export`).
          *
-         *     **`confirm` must match the project name exactly.** If it does not, the call returns
+         *     **`confirm` must match the database name exactly.** If it does not, the call returns
          *     400 `confirm_mismatch` and nothing starts.
          *
          *     This is a `POST` rather than a `DELETE` because it is a long-running operation that
@@ -2906,13 +2917,14 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/operations/{opId}": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/operations/{opId}": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
                 /**
                  * @description The operation id. **Not a credential** — an operation that does not belong to the
                  *     project in the path returns 404.
@@ -2940,13 +2952,14 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/orgs/{orgSlug}/projects/{projectName}/database/operations/{opId}/abort": {
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/operations/{opId}/abort": {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
                 /**
                  * @description The operation id. **Not a credential** — an operation that does not belong to the
                  *     project in the path returns 404.
@@ -2958,7 +2971,7 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Aborts an in-progress operation (`runlot pg abort`)
+         * Aborts an in-progress operation (`runlot db abort`)
          * @description Only possible **before** the operation reaches a point of no return: evict,
          *     restore_generation and delete can be aborted up to the committing phase; restore
          *     cannot. Aborting returns the project to active and leaves `terminalCode=aborted`.
@@ -3570,8 +3583,9 @@ export interface paths {
         /**
          * Desktops of the org's members that can lend to this project right now
          * @description Each desktop lending to apps, with the models it lends and whether its Runlot Studio is
-         *     too old to carry `reasoning` or `responseFormat` (`outdated`). `reachable` is false when
-         *     the lending service could not be asked. Requires `observability:read`.
+         *     too old to carry `reasoning` or `responseFormat` (`outdated`), followed by the members'
+         *     desktops that are online with lending switched off (`lending: false`). `reachable` is
+         *     false when the lending service could not be asked. Requires `observability:read`.
          */
         get: operations["getAILenders"];
         put?: never;
@@ -3713,7 +3727,10 @@ export interface paths {
          * @description The call a local `runlot dev` makes when your worker calls `env.ai.run`. It is forwarded to the
          *     same lane Studio's local runtime uses: catalog models only, the free plan's caps on every plan
          *     (4,096 output tokens, 30 calls a minute, two at a time), the org's balance checked before and
-         *     debited after, recorded in the ledger as `lane = dev`. No streaming — one JSON answer.
+         *     debited after, recorded in the ledger as `lane = dev`. One JSON answer, or with `stream: true`
+         *     server-sent events: `data: {"delta"}` pieces, then `event: done` (model, stopReason, usage,
+         *     usageComplete) or `event: error` (code, message, usage). A stream takes no tools and no
+         *     `responseFormat` (`400 stream_unsupported`, `400 format_unsupported`).
          *
          *     This is not an API for calling models from outside a worker: it needs a member's login and a
          *     project with AI turned on, and it answers `env.ai.run`'s own shape. Requires member or higher.
@@ -4016,7 +4033,7 @@ export interface paths {
          *
          *     **The end-user table is not part of this API.** User records live in the `runlot_auth`
          *     schema of the project's database; read them through the worker's `env.auth.users.*` or
-         *     with `runlot pg shell`.
+         *     with `runlot db shell`.
          *
          *     `providers` carries only the client id. Client secrets are stored encrypted and never
          *     appear in any response.
@@ -4032,10 +4049,10 @@ export interface paths {
          *
          *     **Login creates the database it needs.** The end-user tables live inside the
          *     project's database, so a project without one gets it first, as if you had run
-         *     `runlot pg on`. Two cases are refused instead, each with a 409 that says why: the
+         *     `runlot db create <project>`. Two cases are refused instead, each with a 409 that says why: the
          *     project's database was deleted (`database_required`), or the live deployment's
          *     `runlot.json` says `"database": false` (`database_disabled`). Create the database with
-         *     `POST …/database` (`runlot pg on`) and call this again.
+         *     `POST /v1/orgs/{orgSlug}/databases` (`runlot db create <project>`) and call this again.
          *
          *     Once enabled, the built-in login endpoints start serving shortly afterwards. As with
          *     `env.db` and `env.storage`, no redeploy is needed. Table initialization is idempotent,
@@ -4050,7 +4067,7 @@ export interface paths {
          * Disables auth (`runlot auth delete`)
          * @description **End-user data is not deleted.** The `runlot_auth` tables stay in the project's
          *     database as they are — deleting them is a database operation you run yourself with
-         *     `runlot pg`. Turning auth back on lets the same people log in as before.
+         *     `runlot db`. Turning auth back on lets the same people log in as before.
          *
          *     Shortly afterwards the built-in login endpoints stop serving, and `/__runlot/auth/*`
          *     passes straight through to your worker — if that path has no route, it is a 404.
@@ -4258,7 +4275,7 @@ export interface paths {
          * The app's end users (`runlot auth users`)
          * @description The people who signed up to **your app** — not the members of your organization.
          *     They live in the project's own database, under the `runlot_auth` schema, and this
-         *     route reads them over the same connection `…/database/connect` hands you for psql.
+         *     route reads them over the same connection `…/databases/{databaseName}/connect` hands you for psql.
          *     Everything here is also visible through `env.db` and `psql`; this is a convenience,
          *     not a second source.
          *
@@ -4579,6 +4596,119 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/billing/spending-limit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+            };
+            cookie?: never;
+        };
+        /**
+         * The org's spending limit, this month's overage and the lock
+         * @description The spending limit is the most a Pro organization is billed in a month for usage above
+         *     the included amounts. It is always on (default $20) and has no "unlimited" value: when
+         *     this month's overage reaches it, every HTTP request to the organization's projects is
+         *     refused with `429 budget_exhausted` until the first of next month, and uploads past the
+         *     storage quota get `507`. Raising the limit releases the lock within one map poll.
+         *
+         *     `overageMicroCents` is this month's accrued overage; `breakdown` names the axes that
+         *     made it (requests, CPU, storage held, memory above the plan, and collection). Held
+         *     storage and memory never take the month past the limit; requests and CPU in the
+         *     2–3 minute enforcement lag can. `applies` is false on Free (Free is never billed past
+         *     its included amounts) and on a granted Pro (not billed). `projects` lists every project
+         *     with its own spending limit (null where it has none) and its share of this month's
+         *     overage (see `getProjectLimits`). Requires viewer or higher.
+         */
+        get: operations["getSpendingLimit"];
+        /**
+         * Set the org's spending limit
+         * @description Sets the limit in cents, from 0 (stop at the first cent past the included amounts) up to
+         *     `maxCents` ($1,000); above that, contact us. The lock is judged again at once: a limit
+         *     above this month's overage releases it, and a limit below it locks the organization now —
+         *     the answer's `throttled` shows the lock the change left. Pro only:
+         *     `409 spending_limit_not_applicable` on Free and on a granted Pro, with
+         *     `details.reason` `free` or `granted`. A value out of range is
+         *     `400 spending_limit_out_of_range`. Requires admin. Audited as `org.spending_limit`.
+         */
+        put: operations["setSpendingLimit"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/limits": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * A project's app memory, per-request CPU and spending limits
+         * @description `appMemory` is the most one copy of the app may use. For a project with a database this
+         *     is the app process's own limit (the database keeps the plan's memory); the project's
+         *     memory cap, `projectBytes`, is raised to twice it, because a deploy runs two copies side
+         *     by side. For a project without a database it is the project's whole cap. An app over its
+         *     limit is restarted and reported as an `app_out_of_memory` issue.
+         *
+         *     A limit is a ceiling, not reserved memory. On Pro, memory the project actually holds
+         *     above `includedProjectBytes` (the plan's project cap) is billed per hour of use within
+         *     the organization's spending limit, when `billed` is true. `p99Bytes` is the project's
+         *     14-day p99 hourly peak, database and app together.
+         *
+         *     `requestCpu` is the CPU one request may spend before it fails with `exceededCpu`.
+         *
+         *     `spend` is the project's own spending limit, under the organization's. Optional: with
+         *     none (`cents` null) only the organization's limit applies. The project's share of the
+         *     organization's overage this month (`shareMicroCents`) is, per axis, that axis's overage
+         *     times the project's fraction of the organization's use of it — requests, CPU and file
+         *     storage held — plus the memory the project held above the plan. Error and observability
+         *     collection is not part of it. Because the included amounts are the organization's, a
+         *     project's share can grow while it is idle when another project takes the organization
+         *     further past them. When the share reaches the limit, only this project's HTTP requests
+         *     are refused, with `429 project_budget_exhausted`, until the first of next month
+         *     (`throttledUntil`); the organization's other projects keep serving, and the
+         *     organization's own limit still applies on top. Requires viewer or higher.
+         */
+        get: operations["getProjectLimits"];
+        /**
+         * Set a project's app memory, per-request CPU or spending limit
+         * @description A field left out is unchanged; `null` puts it back on the plan's value. Free may lower
+         *     either limit and raising one needs Pro (`403 plan_required`). Pro may raise app memory to
+         *     `maxBytes` (at most 2 GiB) and the CPU limit to 300 s. The change reaches the running app
+         *     by a zero-downtime replacement.
+         *
+         *     `spendCents` sets the project's own spending limit, from 0 (stop at the first cent of the
+         *     project's share) up to the organization's limit (`spend.orgCents`); `null` removes it.
+         *     The lock is judged again at once: a limit above the project's share releases it within
+         *     one map poll, and a limit at or below it refuses the project's requests now — the
+         *     answer's `spend.throttled` shows the lock the change left. Pro only:
+         *     `409 spending_limit_not_applicable` on Free and on a granted Pro (`details.reason`). Out
+         *     of range is `400 limit_out_of_range` with `details.maxCents`. Audited as
+         *     `project.spending_limit`.
+         *
+         *     Refusals: `409 memory_limit_below_use` lowers app memory below the 14-day p99
+         *     (`details.p99Bytes`) — send `confirm: true` to set it anyway; `409
+         *     memory_limit_exceeds_node` raises past what the project's server can offer
+         *     (`details.maxBytes`); `409 memory_limit_set_by_operator` raises past a value Runlot set;
+         *     `400 limit_out_of_range` is outside the bounds (`details.field`). Requires admin. Memory
+         *     and CPU changes are audited as `project.limits`.
+         */
+        put: operations["setProjectLimits"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/members": {
         parameters: {
             query?: never;
@@ -7168,6 +7298,126 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/health": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: string;
+                projectName: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * Read a project's capacity risks
+         * @description The project's capacity risks: how close its memory, CPU, database, AI calls and the
+         *     organization's budget are to the hard limits they will hit, each with its evidence
+         *     and the next step. Call before a launch, after a deploy, and when the app is slow or
+         *     restarting. `checks` lists every signal: `unknown` means it was not measured (the
+         *     reason says why), which is not the same as `ok`. Every plan. Viewer.
+         */
+        get: operations["getProjectHealth"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/databases": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Every database in the organization, with the projects that bind it
+         * @description One row per database: its size against the plan's cap, whether it is running, and
+         *     every project that binds it with the binding name and mode — including the project
+         *     whose name it shares, as `db`. A database no project binds is `unbound`: it keeps
+         *     its data and its bill until it is deleted. Viewer and above.
+         */
+        get: operations["listOrgDatabases"];
+        put?: never;
+        /**
+         * Create a database in the organization (`runlot db create`)
+         * @description Creates a database named `name` and places it, so it runs before any project binds
+         *     it. Projects bind it by name in `runlot.json`
+         *     (`"databases": [{"binding": "shared", "database": "<name>"}]`) and deploy. Member
+         *     and above.
+         *
+         *     If `name` is a project without a database, this creates that project's own
+         *     database (its `env.db`), on every plan. A database that stands alone is Pro.
+         *
+         *     Names share one namespace with projects: a name held by a project with a database
+         *     or by another database answers 409 `name_taken`. The plan's database count applies
+         *     (`database_limit`). It is idempotent for a project's own database: a second call
+         *     returns the same connection details.
+         */
+        post: operations["createOrgDatabase"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/databases/{databaseName}/bindings/{projectName}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a project's binding to this database
+         * @description For a project nobody will redeploy: its running app loses `env.<binding>` shortly
+         *     and calls on it fail with `DatabaseNotAttached`. A binding is otherwise written and
+         *     removed by the project's own deploy from its `runlot.json`, so a later deploy that
+         *     still names this database binds it again. The project whose name the database
+         *     shares cannot be unbound (delete the database instead). Admin and above.
+         */
+        delete: operations["unbindDatabase"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/health": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * Read every project's capacity status
+         * @description One line per project of the organization: its worst open capacity risk and how many
+         *     are open, and the organization's budget check. Use it to find the project that needs
+         *     `getProjectHealth`. Viewer.
+         */
+        get: operations["getOrgHealth"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/synthetics": {
         parameters: {
             query?: never;
@@ -9062,7 +9312,7 @@ export interface components {
         MonitorQuery: {
             /** @enum {string} */
             source?: "apm" | "database" | "infra" | "custom";
-            /** @description apm: requests, errors, error_rate (percent), status_4xx, status_5xx, latency_avg, latency_p50, latency_p75, latency_p90, latency_p95, latency_p99, latency_p999. database: calls, errors, latency_avg, latency_p50, latency_p95, latency_p99, wait_share (percent of route wall time). infra: memory_pct, memory_bytes, psi_cpu_some, psi_mem_some, psi_mem_full, psi_io_some, oom_kills, oom_exits, high_events, cpu_throttled_us. */
+            /** @description apm: requests, errors, error_rate (percent), status_4xx, status_5xx, latency_avg, latency_p50, latency_p75, latency_p90, latency_p95, latency_p99, latency_p999. database: calls, errors, latency_avg, latency_p50, latency_p95, latency_p99, wait_share (percent of route wall time). infra: memory_pct, memory_bytes, cpu_cores (cores used over the sampled minutes; an app uses at most one), psi_cpu_some, psi_mem_some, psi_mem_full, psi_io_some, oom_kills, oom_exits, high_events, cpu_throttled_us. */
             metric?: string;
             name?: string;
             /** @enum {string} */
@@ -9900,7 +10150,7 @@ export interface components {
              *     human-readable wording is produced separately by the dashboard and by email.
              * @enum {string}
              */
-            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "overage_charge_failed" | "domain_renewal_failed" | "disabled_project_deletion" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled" | "license_expiring" | "license_grace" | "license_restricted" | "new_device" | "error_issue_new" | "app_out_of_memory" | "monitor_alert" | "watchdog_digest";
+            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "overage_charge_failed" | "domain_renewal_failed" | "disabled_project_deletion" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled" | "license_expiring" | "license_grace" | "license_restricted" | "new_device" | "error_issue_new" | "app_out_of_memory" | "monitor_alert" | "watchdog_digest" | "capacity_risk" | "budget_near";
             /** @description If this is a project-related notification, the name of that project. Absent for org-level notifications (`project_limit`) */
             projectName?: string;
             /**
@@ -9917,6 +10167,11 @@ export interface components {
              *     `{app, clientId, device}`, `error_issue_new` is `{issueId, shortId, title, origin}` and
              *     `app_out_of_memory` is `{issueId, limitMiB, peakMiB, release}`.
              *     `monitor_alert` is `{monitorId, monitorName, monitorKind, monitorState, monitorGroup, monitorValue, monitorThreshold, monitorMessage, monitorLink}`.
+             *     `capacity_risk` is `{insightId, signal, severity, route, summary, magnitude}` and
+             *     `budget_near` is `{kind, used, limit, period, until}` (kind is `requests`, `cpu` or `spend`,
+             *     or `project_spend` for a project's own spending limit, with the project set and `used`
+             *     and `limit` in cents). `budget_exhausted` is `{throttled, until, plan}`; a project's own
+             *     limit carries `throttled: ["project_spend"]`, the project and the limit in `cents`.
              */
             detail: {
                 [key: string]: unknown;
@@ -9932,6 +10187,15 @@ export interface components {
         Project: {
             /** Format: uuid */
             projectId: string;
+            /**
+             * @description Only on the answer to creating a project: the organization already had a database
+             *     with this name (its project was deleted earlier), and the new project uses it as
+             *     `env.db`. `runlot deploy` prints it on its first line.
+             */
+            existingDatabase?: {
+                /** Format: int64 */
+                sizeBytes: number | null;
+            };
             orgSlug: components["schemas"]["Slug"];
             name: components["schemas"]["Slug"];
             hostnames: string[];
@@ -10020,7 +10284,7 @@ export interface components {
         /** @description A deployment in the overview. Same shape as `Deployment`, including `actor`. */
         OverviewDeployment: components["schemas"]["Deployment"];
         OverviewDatabase: {
-            /** @description Whether the project has a database. One is created when the app uses it, or by `runlot pg on`. */
+            /** @description Whether the project has a database. One is created when the app uses it, or by `runlot db create <project>`. */
             granted: boolean;
             /**
              * Format: date-time
@@ -10110,6 +10374,8 @@ export interface components {
              *     contradicts, or a recognised framework deployed without `runWorkerFirst: false`.
              */
             warnings?: string[];
+            /** @description What the deploy-time static checks found in this deployment's code. Absent when it was not checked. */
+            staticChecks?: components["schemas"]["DeployStaticChecks"];
         };
         /**
          * @description The one address Studio hands to a person who is not a developer
@@ -11633,7 +11899,7 @@ export interface components {
             available: boolean;
             /** @description **Always `false`.** The database and the objects are not restored to one consistent instant, so do not present a single restore time for both. */
             atomic: boolean;
-            /** @description `available && complete` — eligibility, not a success guarantee. The restore call (`POST /orgs/{orgSlug}/projects/{projectName}/database/restore`) refuses outright when `missing` or `gaps` is non-empty, so `false` here means the call is not worth attempting. `true` means only that the preflight would pass; the restore can still fail afterwards on a holder's own store (unreachable node, a lost or corrupted archive, a digest mismatch found only when the file is read). It is also computed at this response's `at`, which is one instant for the whole project — a restore targets one generation's own `lastAt`, so re-query with `?at=<that generation's lastAt>` before trusting this field for that restore. */
+            /** @description `available && complete` — eligibility, not a success guarantee. The restore call (`POST /orgs/{orgSlug}/databases/{databaseName}/restore`) refuses outright when `missing` or `gaps` is non-empty, so `false` here means the call is not worth attempting. `true` means only that the preflight would pass; the restore can still fail afterwards on a holder's own store (unreachable node, a lost or corrupted archive, a digest mismatch found only when the file is read). It is also computed at this response's `at`, which is one instant for the whole project — a restore targets one generation's own `lastAt`, so re-query with `?at=<that generation's lastAt>` before trusting this field for that restore. */
             restorable: boolean;
             /** Format: date-time */
             at?: string;
@@ -11801,17 +12067,64 @@ export interface components {
              * @example app
              */
             confirm: string;
+            /**
+             * @description Remove every binding of this database first. Without it, a bound database
+             *     refuses the deletion with 409 `database_bound`.
+             */
+            unbindAll?: boolean;
+        };
+        OrgDatabase: {
+            /** @description The database's name in the organization */
+            name: string;
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: int64
+             * @description The last measured size, when one has been reported
+             */
+            sizeBytes: number | null;
+            /**
+             * Format: int64
+             * @description The plan's size cap for one database
+             */
+            capBytes: number;
+            /**
+             * @description `running`: placed on a node (an idle database stops after a few minutes and
+             *     starts again on the next connection). `cold`: stored offsite, woken by the next
+             *     connection. `none`: not placed yet (its project was never deployed).
+             * @enum {string}
+             */
+            state: "running" | "cold" | "none";
+            /** @description No project of the same name exists: the database stands alone */
+            standalone: boolean;
+            /** @description No project binds it, including one of the same name */
+            unbound: boolean;
+            /**
+             * @description Projects that reach this database. The project of the same name, if any, is listed
+             *     with `binding: db`.
+             */
+            bindings: components["schemas"]["DatabaseBinding"][];
+        };
+        DatabaseBinding: {
+            project: string;
+            /** @example service_db */
+            binding: string;
+            /** @enum {string} */
+            mode: "write" | "read";
+        };
+        OrgDatabases: {
+            databases: components["schemas"]["OrgDatabase"][];
         };
         /**
          * @description This response means the multi-step operation was queued (202). **It does not mean it
-         *     finished** — check progress at `…/database/operations/{opId}`.
+         *     finished** — check progress at `…/databases/{databaseName}/operations/{opId}`.
          */
         OperationStarted: {
             /** Format: uuid */
             projectId: string;
             opId: string;
             /** @enum {string} */
-            kind: "restore_generation" | "delete_database" | "delete_project" | "purge_project" | "evict" | "restore";
+            kind: "restore_generation" | "delete_database" | "delete_project" | "purge_project" | "retire_app" | "evict" | "restore";
             /** Format: int64 */
             epoch: number;
             node?: string;
@@ -11822,6 +12135,12 @@ export interface components {
              *     value rather than computing it from a retention window.
              */
             purgeAfter?: string;
+            /**
+             * @description Project deletion only: the name of the project's database, which stays in the
+             *     organization (listed under databases; delete it with `runlot db delete`). Absent
+             *     when the project had no database.
+             */
+            databaseKept?: string;
         };
         Operation: {
             opId: string;
@@ -12016,11 +12335,42 @@ export interface components {
              *       of `@runlot/auth`; a `migrations/NNNN_*.sql` file; or `env.db` / `env.DB` in the
              *       project's own sources. A value set in your `runlot.json` wins over that guess.
              *     - **`false`** — never create one. Neither the deployment nor a call creates it, and
-             *       `env.db` rejects with `DatabaseNotEnabled`. `runlot pg on` still creates one,
+             *       `env.db` rejects with `DatabaseNotEnabled`. `runlot db create <project>` still creates one,
              *       because it asks by name. Declaring `queues` with `false` is refused with a 400:
              *       queue messages are kept in the database.
              */
             database?: boolean;
+            /**
+             * @description Databases in the organization this code reaches, each as `env.<binding>`. The
+             *     deployment binds them: it adds, changes and removes this project's bindings to
+             *     match this list, and a database that does not exist is refused with 409
+             *     `database_not_found` (create it with `runlot db create`). At most two besides
+             *     `db`; binding a database into a second project is Pro.
+             *
+             *     `{"binding": "db", "database": "<this project's name>"}` is the explicit form of
+             *     the default `env.db`; `db` cannot name another database yet. A bound database is
+             *     not this project's own `env.db`, and naming one does not create a database for
+             *     this project.
+             */
+            databases?: {
+                /** @example service_db */
+                binding: string;
+                /** @description The database's name, in the same organization */
+                database: string;
+                /**
+                 * @description `write` runs statements as the database owner. `read` runs every statement
+                 *     as a read-only role.
+                 * @default write
+                 * @enum {string}
+                 */
+                mode: "write" | "read";
+                /**
+                 * @description Path to the database's `migrations/`, used only by `runlot dev` to prepare
+                 *     the local stand-in database. A deployment never applies it
+                 *     (`runlot db migrate <name>` does).
+                 */
+                migrations?: string;
+            }[];
             /**
              * @description Declares email sending and receiving. When `true`, the worker receives
              *     `env.email`, and `export default { email() }` becomes the receiving handler.
@@ -12783,8 +13133,9 @@ export interface components {
             byosCreditFallback?: boolean;
             /**
              * @description How many members of the project's organization have a Studio desktop lending to
-             *     apps right now. Present only on the answer to a PATCH that leaves `byos` on, and
-             *     only when Studio could be asked. With `byos` on, `byosCreditFallback` off and 0
+             *     apps right now. Present on the answer to a PATCH that leaves `byos` on, on a GET
+             *     while `byos` is on and `byosCreditFallback` off, and only when Studio could be
+             *     asked. With `byos` on, `byosCreditFallback` off and 0
              *     here, every lendable call is refused.
              */
             byosLenders?: number;
@@ -12970,6 +13321,8 @@ export interface components {
             tags: string[];
             hasBody: boolean;
             deploymentVersion: number;
+            /** @description The cache counts the provider did not report: their 0 above means unknown, not none. Absent when both were reported, or on a call recorded before the field existed. */
+            cacheUnreported?: ("cachedInputTokens" | "cacheWriteInputTokens")[];
         };
         AICallDetail: components["schemas"]["AICallRow"] & {
             input?: string;
@@ -13029,6 +13382,16 @@ export interface components {
                 p50Ms: number;
                 p95Ms: number;
                 ttftP50Ms: number;
+                /**
+                 * Format: int64
+                 * @description tokensIn over the chat calls whose provider reported a read count. The hit rate is tokensCachedReadKnown / tokensInReadKnown; 0 here (no such call, or only hours rolled up before the field) means no hit rate, not 0 %.
+                 */
+                tokensInReadKnown?: number;
+                /**
+                 * Format: int64
+                 * @description tokensCached over the same calls as tokensInReadKnown.
+                 */
+                tokensCachedReadKnown?: number;
             };
             series?: {
                 /** Format: date-time */
@@ -13069,6 +13432,16 @@ export interface components {
                 byosServed: number;
                 p50Ms: number;
                 p95Ms: number;
+                /**
+                 * Format: int64
+                 * @description As in totals.
+                 */
+                tokensInReadKnown?: number;
+                /**
+                 * Format: int64
+                 * @description As in totals.
+                 */
+                tokensCachedReadKnown?: number;
             }[];
             byosReasons?: {
                 code: string;
@@ -13116,6 +13489,10 @@ export interface components {
                     email: string;
                 };
                 device: string;
+                /** @description False for a desktop that is online but has lending to apps switched off in Studio. Such a desktop is never offered a call, and its `models` is empty. */
+                lending: boolean;
+                /** @description The desktop app's own version. Absent from a desktop that does not announce it. */
+                studioVersion?: string;
                 models: string[];
                 options: string[];
                 outdated: boolean;
@@ -13123,6 +13500,10 @@ export interface components {
                     vendor: string;
                     connected: boolean;
                     version?: string;
+                    /** @description How the vendor is signed in on the desktop: `claudeai`, `console`, `bedrock`, `vertex`, `foundry`, `chatgpt`, `device` or `apikey` */
+                    via?: string;
+                    /** @description The vendor's plan code for the signed-in account (`plus`, `pro`, `max` …), when the desktop knows it. The vendor account's email is never sent. */
+                    planType?: string;
                 }[];
                 inflight: number;
                 /** @description How many lent calls at once this desktop's owner allows (1–8; 2 when the desktop does not say) */
@@ -13324,72 +13705,259 @@ export interface components {
                 pro: components["schemas"]["PlanLimits"];
             };
         };
-        /** @description The limits that apply to one plan */
-        PlanLimits: {
-            projects: number;
-            /** Format: int64 */
-            storageBytes: number;
+        /** @description The org's spending limit and this month's overage against it. */
+        SpendingLimit: {
+            orgId: string;
+            /** @enum {string} */
+            plan: "free" | "pro";
+            /** @description The plan's billing status (active, past_due, canceled, granted), empty on Free */
+            status: string;
+            /** @description False on Free and on a granted Pro: the limit does nothing there */
+            applies: boolean;
+            /** @enum {string} */
+            notApplicableReason?: "free" | "granted";
+            /** @description The limit, in cents per month above the included amounts */
+            cents: number;
+            /** @description The default limit ($20) */
+            defaultCents: number;
+            /** @description The most it can be set to here ($1,000) */
+            maxCents: number;
             /**
-             * Format: int64
-             * @description The project Postgres size cap for this plan (Free 500 MiB, Pro 8 GiB). The
-             *     dashboard's usage meter and chart read this value, and you are notified when a
-             *     project passes 90% of it.
+             * Format: date
+             * @description First day of the month the overage belongs to
              */
-            dbCapBytes: number;
-            /** @description how many database generations are retained */
-            backupKeep: number;
-            crons: number;
-            mailPerHour: number;
-        };
-        /**
-         * @description The state of the project's dedicated object storage.
-         *
-         *     **Objects are not part of database generations** — `runlot pg restore` does not roll back
-         *     files. Read-after-write is guaranteed, but `list` may lag.
-         */
-        StorageStatus: {
+            month: string;
             /**
-             * @description Whether object storage is turned on for this project. When it is off, there is no
-             *     bucket at all, and `prefix` and `quotaBytes` are empty.
+             * Format: int64
+             * @description This month's accrued overage (1 cent = 1,000,000)
              */
-            granted: boolean;
+            overageMicroCents: number;
             /**
-             * @description The prefix every object of this project is stored under. It is added for you, so
-             *     your own keys stay relative to it and no key you send can reach another project's
-             *     storage. Empty when storage is not configured.
-             * @example p/6f1a0b4c-0000-0000-0000-000000000001/
+             * @description This month's overage by axis, in microcents. The platform axes are the nominal price
+             *     of what was used; `collection` is what error and observability collection was billed
+             *     within the limit. Their sum can exceed `overageMicroCents` when held storage and memory
+             *     were stopped at the limit.
              */
-            prefix: string;
+            breakdown: {
+                /** Format: int64 */
+                requests: number;
+                /** Format: int64 */
+                cpu: number;
+                /** Format: int64 */
+                storage: number;
+                /** Format: int64 */
+                memory: number;
+                /** Format: int64 */
+                collection: number;
+            };
+            /** @description The locks in force; `spend` is the spending limit */
+            throttled: ("requests" | "cpu" | "spend")[];
             /**
-             * Format: int64
-             * @description The quota (10 GiB on Free, 100 GiB on Pro). Once you exceed it, only `put` and
-             *     `presign(PUT)` are rejected — `get`, `list`, and `delete` keep working, so you can
-             *     always delete your way back under the cap. Without storage enabled, it is 0.
+             * Format: date-time
+             * @description When the locks end
              */
-            quotaBytes: number;
+            throttledUntil: string | null;
+            /** @description The limit before the change (PUT only) */
+            previousCents?: number;
+            /** @description The organization's projects, by name, with their own spending limits and shares */
+            projects?: components["schemas"]["ProjectSpendLine"][];
+        };
+        /** @description One project's own spending limit and its share of this month's overage. */
+        ProjectSpendLine: {
+            name: string;
+            /** @description The project's own limit in cents; null is none (only the organization's applies) */
+            cents: number | null;
             /**
              * Format: int64
-             * @description The last observed byte count. It lags a little behind your writes, so usage can
-             *     briefly go past the quota in between. 0 if there is no observation yet.
+             * @description The project's share of the organization's overage this month (1 cent = 1,000,000)
              */
-            usedBytes: number;
-        };
-        /** @description One key prefix to publish or unpublish. */
-        StoragePublicRequest: {
+            shareMicroCents: number;
+            breakdown: components["schemas"]["ProjectSpendBreakdown"];
+            /** @description The project's own limit is spent: its requests get 429 project_budget_exhausted */
+            throttled: boolean;
             /**
-             * @description The prefix, relative to the project's own storage — `assets`, `assets/`, or
-             *     `avatars/img`. It is stored with a trailing slash, because matching is a plain string
-             *     prefix test and `assets` without the slash would also open `assets-private/`.
-             *
-             *     `/` means **every key in the project**. The empty string is refused, so an
-             *     accidentally empty argument cannot publish everything by looking like a default.
-             * @example assets/
+             * Format: date-time
+             * @description When the project's lock ends
              */
-            prefix: string;
+            throttledUntil: string | null;
         };
-        /**
-         * @description The prefixes this project serves without a signature. All three verbs answer with the
-         *     full list, so a screen never has to guess what the list became after a change.
+        /** @description A project's share by axis, in microcents. Collection is not part of a project's share. */
+        ProjectSpendBreakdown: {
+            /** Format: int64 */
+            requests: number;
+            /** Format: int64 */
+            cpu: number;
+            /** Format: int64 */
+            storage: number;
+            /** Format: int64 */
+            memory: number;
+        };
+        SpendingLimitUpdate: {
+            /** @description The new limit in cents */
+            cents: number;
+        };
+        /** @description A project's app memory, per-request CPU and spending limits. */
+        ProjectLimits: {
+            projectId: string;
+            /** @enum {string} */
+            plan: "free" | "pro";
+            hasDatabase: boolean;
+            appMemory: {
+                /**
+                 * Format: int64
+                 * @description The most one copy of the app may use
+                 */
+                bytes: number;
+                /**
+                 * Format: int64
+                 * @description The value with no project setting
+                 */
+                planBytes: number;
+                /** Format: int64 */
+                minBytes: number;
+                /**
+                 * Format: int64
+                 * @description The most it can be set to now (plan and server together)
+                 */
+                maxBytes: number;
+                /**
+                 * Format: int64
+                 * @description The project's memory cap, database and app together
+                 */
+                projectBytes: number;
+                /**
+                 * Format: int64
+                 * @description Memory a project-hour holds without being billed
+                 */
+                includedProjectBytes: number;
+                /** @description Memory above includedProjectBytes is billed for this project */
+                billed: boolean;
+                /**
+                 * @description Who set the value; null is the plan's
+                 * @enum {string|null}
+                 */
+                setBy: "customer" | "operator" | null;
+                /**
+                 * Format: int64
+                 * @description 14-day p99 hourly peak, database and app together
+                 */
+                p99Bytes: number | null;
+            };
+            requestCpu: {
+                /** @description CPU one request may spend, in milliseconds */
+                ms: number;
+                planMs: number;
+                minMs: number;
+                maxMs: number;
+                /** @enum {string|null} */
+                setBy: "customer" | null;
+            };
+            /** @description The project's own spending limit, under the organization's, and its share this month */
+            spend: {
+                /** @description False on Free and on a granted Pro: a limit does nothing there */
+                applies: boolean;
+                /** @enum {string} */
+                notApplicableReason?: "free" | "granted";
+                /** @description The project's own limit in cents a month; null is none */
+                cents: number | null;
+                /** @description The organization's spending limit, the most this one can be set to */
+                orgCents: number;
+                /**
+                 * Format: date
+                 * @description First day of the month the share belongs to
+                 */
+                month: string;
+                /**
+                 * Format: int64
+                 * @description The project's share of the organization's overage this month (1 cent = 1,000,000)
+                 */
+                shareMicroCents: number;
+                breakdown: components["schemas"]["ProjectSpendBreakdown"];
+                /** @description The limit is spent: this project's requests get 429 project_budget_exhausted */
+                throttled: boolean;
+                /**
+                 * Format: date-time
+                 * @description When the project's lock ends
+                 */
+                throttledUntil: string | null;
+            };
+        };
+        /** @description A field left out is unchanged; null puts it back on the plan's value (for spendCents: no limit of the project's own). */
+        ProjectLimitsUpdate: {
+            /** Format: int64 */
+            appMemoryBytes?: number | null;
+            requestCpuMs?: number | null;
+            /** @description The project's own spending limit in cents a month, at most the organization's */
+            spendCents?: number | null;
+            /** @description Set app memory below the 14-day p99 anyway */
+            confirm?: boolean;
+        };
+        /** @description The limits that apply to one plan */
+        PlanLimits: {
+            projects: number;
+            /** Format: int64 */
+            storageBytes: number;
+            /**
+             * Format: int64
+             * @description The project Postgres size cap for this plan (Free 500 MiB, Pro 8 GiB). The
+             *     dashboard's usage meter and chart read this value, and you are notified when a
+             *     project passes 90% of it.
+             */
+            dbCapBytes: number;
+            /** @description how many database generations are retained */
+            backupKeep: number;
+            crons: number;
+            mailPerHour: number;
+        };
+        /**
+         * @description The state of the project's dedicated object storage.
+         *
+         *     **Objects are not part of database generations** — `runlot db restore` does not roll back
+         *     files. Read-after-write is guaranteed, but `list` may lag.
+         */
+        StorageStatus: {
+            /**
+             * @description Whether object storage is turned on for this project. When it is off, there is no
+             *     bucket at all, and `prefix` and `quotaBytes` are empty.
+             */
+            granted: boolean;
+            /**
+             * @description The prefix every object of this project is stored under. It is added for you, so
+             *     your own keys stay relative to it and no key you send can reach another project's
+             *     storage. Empty when storage is not configured.
+             * @example p/6f1a0b4c-0000-0000-0000-000000000001/
+             */
+            prefix: string;
+            /**
+             * Format: int64
+             * @description The quota (10 GiB on Free, 100 GiB on Pro). Once you exceed it, only `put` and
+             *     `presign(PUT)` are rejected — `get`, `list`, and `delete` keep working, so you can
+             *     always delete your way back under the cap. Without storage enabled, it is 0.
+             */
+            quotaBytes: number;
+            /**
+             * Format: int64
+             * @description The last observed byte count. It lags a little behind your writes, so usage can
+             *     briefly go past the quota in between. 0 if there is no observation yet.
+             */
+            usedBytes: number;
+        };
+        /** @description One key prefix to publish or unpublish. */
+        StoragePublicRequest: {
+            /**
+             * @description The prefix, relative to the project's own storage — `assets`, `assets/`, or
+             *     `avatars/img`. It is stored with a trailing slash, because matching is a plain string
+             *     prefix test and `assets` without the slash would also open `assets-private/`.
+             *
+             *     `/` means **every key in the project**. The empty string is refused, so an
+             *     accidentally empty argument cannot publish everything by looking like a default.
+             * @example assets/
+             */
+            prefix: string;
+        };
+        /**
+         * @description The prefixes this project serves without a signature. All three verbs answer with the
+         *     full list, so a screen never has to guess what the list became after a change.
          */
         StoragePublicList: {
             prefixes: {
@@ -14224,6 +14792,150 @@ export interface components {
             /** @description false on Free: deploy regressions only. */
             full: boolean;
         };
+        /**
+         * @description The worst open risk: alert, then warn; ok when none is open.
+         * @enum {string}
+         */
+        HealthStatus: "ok" | "warn" | "alert";
+        HealthCheck: {
+            /** @description app_memory, app_restarts, db_memory, app_cpu, request_cpu, app_stall, busy_latency, db_admission, rpc_not_disposed, ai_refusals, org_budget, project_budget, db_size, file_storage, log_cap or cron_overlap. */
+            signal: string;
+            /** @enum {string} */
+            state: "ok" | "warn" | "alert" | "unknown";
+            /** @description Why an `unknown` check was not measured. */
+            reason?: string;
+        };
+        HealthEvidence: {
+            /** @description What was measured, for example `peak`, `cores` or `share`. */
+            name: string;
+            value: number;
+            /** @description bytes, fraction, cores, ms, count, per_second or cents. */
+            unit: string;
+            /** @description The hard limit the value is compared with, in the same unit. */
+            limit?: number;
+            /** @description The span the value covers, for example `24h` or `3d`. */
+            window: string;
+        };
+        HealthRisk: {
+            /** Format: uuid */
+            id: string;
+            signal: string;
+            /** @enum {string} */
+            severity: "warn" | "alert";
+            /** @description The route, cron expression or log template the risk is about; absent when it is the whole project. */
+            route?: string;
+            /** Format: date-time */
+            since: string;
+            /** Format: date-time */
+            updatedAt: string;
+            /** @description One sentence: what, how close. */
+            summary: string;
+            evidence: components["schemas"]["HealthEvidence"][];
+            /** @description Concrete steps, the most useful first. */
+            next: string[];
+            links: {
+                label: string;
+                /** @description A dashboard path under the project, for example `/observability/infrastructure?range=24h`. */
+                path: string;
+            }[];
+        };
+        CapacityEstimate: {
+            /** @description The span the estimate reads: `3d`, the per-minute samples of the last three days. */
+            window: string;
+            /** @description Requests in the window that reached the app. Below 1,000 there is no estimate. */
+            requests: number;
+            /** @description Requests in the same minutes that Runlot answered before the app ran (outcome `unavailable`: the rate limit, the budget, the access gate, a failed wake). They cost the app no CPU, so the mean leaves them out. */
+            refusedRequests?: number;
+            busiestMinute?: {
+                /** Format: date-time */
+                at: string;
+                /** @description Requests that reached the app, per second, in the busiest minute. */
+                requestsPerSecond: number;
+                appCores: number;
+                ownerCores?: number;
+            };
+            appCpuMsPerRequest?: {
+                mean: number;
+            };
+            /** @description 0.7 of one core divided by the mean app CPU per request. */
+            ceilingRequestsPerSecond?: number;
+            /** @description The ceiling divided by the busiest minute's rate. */
+            headroom?: number;
+            /** @description The app's peak memory as a fraction of its limit over the window. */
+            memoryPeakFraction?: number;
+            /** @description What the estimate cannot see. */
+            notCovered: string[];
+        };
+        ProjectHealth: {
+            /**
+             * Format: date-time
+             * @description When the checks last ran. Absent when they have never run for this project.
+             */
+            checkedAt?: string;
+            status: components["schemas"]["HealthStatus"];
+            /** @description Open risks, alert first, then warn. */
+            risks: components["schemas"]["HealthRisk"][];
+            checks: components["schemas"]["HealthCheck"][];
+            capacity?: components["schemas"]["CapacityEstimate"];
+            /** @description The live deployment's deploy-time static checks. They do not change `status`: the checks read code, `status` reads production. Absent when nothing is deployed. */
+            staticChecks?: {
+                /** @description The live deployment's version. */
+                version: number;
+                /** Format: date-time */
+                deployedAt: string;
+                /** @description Absent when that deployment was not checked. */
+                report?: components["schemas"]["DeployStaticChecks"];
+            };
+        };
+        OrgHealth: {
+            /** Format: date-time */
+            checkedAt?: string;
+            status: components["schemas"]["HealthStatus"];
+            budget: components["schemas"]["HealthCheck"];
+            projects: {
+                name: string;
+                status: components["schemas"]["HealthStatus"];
+                alerts: number;
+                warns: number;
+                /** Format: date-time */
+                checkedAt?: string;
+            }[];
+        };
+        DeployStaticCheckFinding: {
+            /** @description The rule's id: `rpc-result-not-disposed`, `module-cache-unbounded`, `module-state-per-request`, `interval-in-request`, `time-loop-never-ends`, `sync-cpu-in-request`, `bundle-size`, `source-map-size`. New ids may appear. */
+            rule: string;
+            /**
+             * @description No finding refuses a deploy.
+             * @enum {string}
+             */
+            severity: "warn" | "info";
+            /** @description Project-relative path of the user's own source file. Absent for a finding about the whole bundle. */
+            file?: string;
+            line?: number;
+            column?: number;
+            /** @description This occurrence, one sentence. */
+            message: string;
+            /** @description The Runlot limit it runs into. */
+            why: string;
+            fix: string;
+        };
+        /**
+         * @description What `runlot deploy` found in the project's own code (never node_modules) before the
+         *     upload: known patterns that hurt an app on Runlot under traffic. Warnings only.
+         *     Silence one line with `// runlot-ignore <rule>` on it or the line above.
+         */
+        DeployStaticChecks: {
+            findings: components["schemas"]["DeployStaticCheckFinding"][];
+            /** @description Findings past the 50 listed. */
+            omitted: number;
+            filesScanned: number;
+            /** @description Files that did not parse or were too large to read. */
+            filesSkipped: number;
+            /** @description Why some or all of the code was not read, when it was not. */
+            note?: string;
+            /** @description The CLI that ran the checks. */
+            analyzer?: string;
+        };
         UptimeAssertion: {
             /** @enum {string} */
             source: "status" | "header" | "body" | "jsonPath" | "latency";
@@ -15181,6 +15893,8 @@ export interface components {
         ReleaseIssueCursor: string;
         OrgSlug: components["schemas"]["Slug"];
         ProjectName: components["schemas"]["Slug"];
+        /** @description A database's name in the organization */
+        DatabaseName: components["schemas"]["Slug"];
         /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
         QueueName: string;
         /**
@@ -16842,7 +17556,10 @@ export interface operations {
             403: components["responses"]["Forbidden"];
             /**
              * @description The name is already taken (`project_name_taken`, `hostname_taken`), or the plan's
-             *     project limit has been reached (`project_limit`).
+             *     project limit has been reached (`project_limit`). A database of the same name
+             *     whose earlier project's leftovers are still being erased answers
+             *     `database_name_pending` (`details.purgeAfter`); otherwise the new project takes
+             *     that database over as `env.db` and the answer carries `existingDatabase`.
              *
              *     The `details` of `project_limit` is `{limit, count, plan}` — read the numbers from
              *     there rather than parsing the message. It is 409 because retrying will not change
@@ -16913,7 +17630,7 @@ export interface operations {
             400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            /** @description Another operation is in progress (`op_in_flight`) */
+            /** @description Another operation is in progress (`op_in_flight`). */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -17111,6 +17828,11 @@ export interface operations {
              *     allows (usually after a downgrade). Every project's deploys are paused until one is
              *     disabled or deleted, or the plan is upgraded; nothing is deleted automatically.
              *     `project_disabled` — this project is disabled; enable it first.
+             *     `database_not_found` — `runlot.json` names a database (`databases`) the
+             *     organization does not have; `details` carries `binding` and `database`.
+             *     `binding_needs_colocation` — this project already runs where it cannot reach a
+             *     database it binds. `database_limit`, `plan_required` (binding a database into a
+             *     second project is Pro), `database_name_pending`.
              */
             409: {
                 headers: {
@@ -17247,7 +17969,18 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        /**
+         * @description Optional. What the deploy-time static checks found in this bundle's code, stored with
+         *     the deployment. A report that does not fit the schema is dropped and named in the
+         *     deployment's `warnings`; it never refuses the deploy.
+         */
+        requestBody?: {
+            content: {
+                "application/json": {
+                    staticChecks?: components["schemas"]["DeployStaticChecks"];
+                };
+            };
+        };
         responses: {
             /** @description The created deployment */
             201: {
@@ -19005,46 +19738,20 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Whether the database is available */
+            /** @description The database */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        db: boolean;
-                    };
-                };
-            };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    createDatabase: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Credentials and connection info */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["DatabaseConnect"];
+                    "application/json": components["schemas"]["OrgDatabase"];
                 };
             };
             403: components["responses"]["Forbidden"];
@@ -19057,7 +19764,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19090,7 +19798,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19118,7 +19827,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19145,7 +19855,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19178,7 +19889,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
                 tokenUser: string;
             };
             cookie?: never;
@@ -19202,7 +19914,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19270,7 +19983,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19339,7 +20053,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19364,7 +20079,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19423,7 +20139,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
             };
             cookie?: never;
         };
@@ -19442,7 +20159,7 @@ export interface operations {
                     "application/json": components["schemas"]["OperationStarted"];
                 };
             };
-            /** @description The confirmation string does not match the project name (`confirm_mismatch`) */
+            /** @description The confirmation string does not match the database name (`confirm_mismatch`) */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19461,7 +20178,11 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description Another operation is already in progress (`operation_in_progress`) */
+            /**
+             * @description Another operation is already in progress (`operation_in_progress`), or the
+             *     database is bound into projects (`database_bound`, `details.bindings` lists
+             *     them).
+             */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -19478,7 +20199,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
                 /**
                  * @description The operation id. **Not a credential** — an operation that does not belong to the
                  *     project in the path returns 404.
@@ -19516,7 +20238,8 @@ export interface operations {
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
                 /**
                  * @description The operation id. **Not a credential** — an operation that does not belong to the
                  *     project in the path returns 404.
@@ -20788,6 +21511,8 @@ export interface operations {
                     /** @description capped at 4,096 by the lane */
                     maxTokens?: number;
                     temperature?: number;
+                    /** @description answer as server-sent events instead of one JSON body */
+                    stream?: boolean;
                     /** @description `env.ai.run`'s reasoning option. cp-core checks `effort` against the model's catalog row. */
                     reasoning?: {
                         /** @description one of the model's `effortLevels` */
@@ -20841,8 +21566,11 @@ export interface operations {
                              * @description the part of inputTokens written to the prompt cache
                              */
                             cacheWriteInputTokens?: number;
+                            /** @description the cache counts the provider did not report; each is 0 above for lack of information. Absent when every count was reported */
+                            unreported?: ("cachedInputTokens" | "cacheWriteInputTokens")[];
                         };
                     };
+                    "text/event-stream": string;
                 };
             };
             400: components["responses"]["BadRequest"];
@@ -21454,7 +22182,7 @@ export interface operations {
             /**
              * @description `database_required` — this project's database was deleted.
              *     `database_disabled` — `runlot.json` says `"database": false`.
-             *     Either way, create the database with `POST …/database` (`runlot pg on`) first.
+             *     Either way, create the database with `POST /v1/orgs/{orgSlug}/databases` (`runlot db create <project>`) first.
              */
             409: {
                 headers: {
@@ -22445,6 +23173,132 @@ export interface operations {
             };
         };
     };
+    getSpendingLimit: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The spending limit */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SpendingLimit"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setSpendingLimit: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SpendingLimitUpdate"];
+            };
+        };
+        responses: {
+            /** @description The spending limit after the change */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SpendingLimit"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `spending_limit_not_applicable` */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getProjectLimits: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The limits */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProjectLimits"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setProjectLimits: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ProjectLimitsUpdate"];
+            };
+        };
+        responses: {
+            /** @description The limits after the change */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProjectLimits"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `memory_limit_below_use`, `memory_limit_exceeds_node`, `memory_limit_set_by_operator` or `spending_limit_not_applicable` */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     listMembers: {
         parameters: {
             query?: never;
@@ -27781,6 +28635,203 @@ export interface operations {
             };
         };
     };
+    getProjectHealth: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: string;
+                projectName: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Health */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProjectHealth"];
+                };
+            };
+            /** @description Request refused */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Request refused */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Request refused */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listOrgDatabases: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Databases */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OrgDatabases"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    createOrgDatabase: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    name: components["schemas"]["Slug"];
+                };
+            };
+        };
+        responses: {
+            /** @description The project's own database already existed or was created */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DatabaseConnect"];
+                };
+            };
+            /** @description A new database */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DatabaseConnect"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Not a member, or a standalone database on a plan without it (`plan_required`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /**
+             * @description `name_taken` (`details.kind` is `project` or `database`), `database_limit`
+             *     (`details.limit`, `details.unbound` names databases no project binds),
+             *     `database_name_pending` (a deleted project's leftovers are still being erased
+             *     under this name; `details.purgeAfter`).
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    unbindDatabase: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                /** @description A database's name in the organization */
+                databaseName: components["parameters"]["DatabaseName"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Unbound */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getOrgHealth: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Health */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OrgHealth"];
+                };
+            };
+            /** @description Request refused */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Request refused */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Request refused */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     listSynthetics: {
         parameters: {
             query?: never;