@runlot/api 0.1.0-rc.21 → 0.1.0-rc.211

package/dist/index.js

@@ -1,5 +1,13 @@
 export const API_VERSION = "v1";
-/** 브라우즈의 공통 질의. 빈 값은 안 싣는다 — 서버가 "비면 기본" 으로 읽는다. */
+/** The shared query for browsing. Empty values are not carried — the server reads "empty means default". */
+/** base64url of the UTF-8 JSON, no padding — the `draft` parameter's encoding. */
+export function base64urlJson(v) {
+    const bytes = new TextEncoder().encode(JSON.stringify(v));
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function gitQuery(ref, path) {
     const q = new URLSearchParams();
     if (ref !== "")
@@ -8,7 +16,50 @@ function gitQuery(ref, path) {
         q.set("path", path);
     return q.size > 0 ? `?${q.toString()}` : "";
 }
-/** 서버가 돌려준 오류 봉투를 그대로 들고 있는 예외. */
+function obsProfileQS(q = {}) {
+    const p = new URLSearchParams();
+    for (const [k, v] of Object.entries(q)) {
+        if (v !== undefined && v !== "")
+            p.set(k, String(v));
+    }
+    const s = p.toString();
+    return s ? `?${s}` : "";
+}
+export const API_SCOPES = [
+    "project:read",
+    "deploy",
+    "db:read",
+    "db:write",
+    "repo:read",
+    "repo:write",
+    "org:admin",
+];
+export const BUILTIN_AUTH_PROVIDERS = ["github", "google"];
+export const RESERVED_AUTH_PROVIDER_IDS = ["github", "google", "runlot"];
+/** The id pattern for an OIDC provider (`^[a-z][a-z0-9-]{1,30}$`). */
+export const AUTH_PROVIDER_ID = /^[a-z][a-z0-9-]{1,30}$/;
+export const AUTH_RUNLOT_METHODS = ["password", "google", "github", "passkey"];
+/**
+ * A purchase or renewal answers with the domain once it is paid and done, or with
+ * the charge while payment is still on its way (a checkout to pay in, or a charge
+ * settling). The charge is the one with a `chargeId`.
+ */
+export function isDomainCharge(v) {
+    return "chargeId" in v;
+}
+/**
+ * A status the edge in front of cp-public can produce on its own: 502–504, and
+ * Cloudflare's 520–527 (524 is its 100 s origin timeout). With no JSON body these
+ * are the edge's words, not the server's, and are raised as `edge_<status>`.
+ */
+export function isEdgeStatus(status) {
+    return (status >= 502 && status <= 504) || (status >= 520 && status <= 527);
+}
+/** True for the `edge_<status>` ApiError `isEdgeStatus` produces. */
+export function isEdgeError(err) {
+    return err instanceof ApiError && err.code.startsWith("edge_");
+}
+/** The exception that carries the server's error envelope unchanged. */
 export class ApiError extends Error {
     status;
     code;
@@ -23,13 +74,29 @@ export class ApiError extends Error {
     }
 }
 /**
- * cp-public 클라이언트.
+ * The cp-public client.
  *
- * CLI와 대시보드가 같은 것을 쓴다. 각자 fetch를 부르면 오류 해석이 조금씩
- * 달라지고, 그 차이는 장애 중에 드러난다.
+ * The CLI and the dashboard use the same one. If each called fetch itself, their
+ * error handling would drift a little, and that difference shows up during an
+ * incident.
+ */
+/**
+ * A database's routes live under the org and take the database's name
+ * (docs/org-database.md §5.1). The database named after a project is that
+ * project's `env.db`, so callers that hold a project name pass it unchanged.
  */
 function dbPath(org, name) {
-    return `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`;
+    return `/v1/orgs/${encodeURIComponent(org)}/databases/${encodeURIComponent(name)}`;
+}
+function previewQuery(opts) {
+    const q = new URLSearchParams({ preview: opts.preview });
+    // Empty values are not carried: the server reads "absent" as its default, and
+    // `?db=` would be neither absent nor a member of the enum.
+    if (opts.db)
+        q.set("db", opts.db);
+    if (opts.from)
+        q.set("from", opts.from);
+    return q.toString();
 }
 export class Client {
     opts;
@@ -42,7 +109,25 @@ export class Client {
             h["Authorization"] = `Bearer ${this.opts.token}`;
         return h;
     }
-    async request(method, path, init) {
+    /** Runs one attempt again under `opts.retry`, for a safe method only. */
+    async retrying(method, once) {
+        const r = this.opts.retry;
+        const safe = method === "GET" || method === "HEAD";
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                return await once();
+            }
+            catch (err) {
+                if (r === undefined || !safe || attempt >= r.attempts || !(isEdgeError(err) || r.transport(err)))
+                    throw err;
+                await new Promise((done) => setTimeout(done, r.backoffMs * 2 ** attempt));
+            }
+        }
+    }
+    request(method, path, init) {
+        return this.retrying(method, () => this.requestOnce(method, path, init));
+    }
+    async requestOnce(method, path, init) {
         const res = await fetch(new URL(path, this.opts.baseUrl), {
             ...init,
             method,
@@ -54,8 +139,21 @@ export class Client {
                 body = (await res.json());
             }
             catch {
-                // 오류 응답이 JSON이 아닌 경우(프록시가 만든 502 등)도 같은 예외로
-                // 올린다 — 호출부가 두 가지 실패 모양을 다루지 않게.
+                // An error response that is not JSON (a 502 made by a proxy, for instance)
+                // is raised as the same exception — so the caller does not have to handle
+                // two shapes of failure.
+            }
+            if (body === undefined && isEdgeStatus(res.status)) {
+                // The edge replaced the 5xx body with its own HTML. The code and reason
+                // the server wrote are not here — so say that, rather than "unknown". On
+                // 2026-09-10 a registrar rejection came out this way as
+                // "unknown: POST … → 502".
+                body = {
+                    error: {
+                        code: "edge_" + res.status,
+                        message: "The server returned an error (" + res.status + "), and the error details could not be read. Try again shortly.",
+                    },
+                };
             }
             throw new ApiError(res.status, body, `${method} ${path} → ${res.status}`);
         }
@@ -63,6 +161,24 @@ export class Client {
             return undefined;
         return (await res.json());
     }
+    /** A body that is not JSON (the raw mail). Error handling is the same as request. */
+    text(method, path) {
+        return this.retrying(method, () => this.textOnce(method, path));
+    }
+    async textOnce(method, path) {
+        const res = await fetch(new URL(path, this.opts.baseUrl), { method, headers: this.headers() });
+        if (!res.ok) {
+            let body;
+            try {
+                body = (await res.json());
+            }
+            catch {
+                // The same reason as in request
+            }
+            throw new ApiError(res.status, body, `${method} ${path} → ${res.status}`);
+        }
+        return await res.text();
+    }
     json(method, path, body) {
         if (body === undefined)
             return this.request(method, path);
@@ -75,33 +191,267 @@ export class Client {
         return this.json("POST", "/v1/auth/dev/login", { subject });
     }
     /**
-     * GitHub OAuth 시작 URL. 브라우저가 따라가는 302 라 fetch 로 부르지 않고
-     * `window.location` 에 넣는다. `redirect` 는 서버 허용 목록에 있어야 한다.
+     * Takes the sign-up and sends the confirmation mail. Neither a session nor a
+     * password is created here — the password is chosen in `verifyEmail` by
+     * whoever opens the mailbox.
+     */
+    passwordSignUp(email, name) {
+        return this.json("POST", "/v1/auth/password/sign-up", {
+            email,
+            ...(name === undefined ? {} : { name }),
+        });
+    }
+    passwordSignIn(email, password) {
+        return this.json("POST", "/v1/auth/password/sign-in", { email, password });
+    }
+    /** The same accepted response comes back whether or not the email exists. */
+    passwordForgot(email) {
+        return this.json("POST", "/v1/auth/password/forgot", { email });
+    }
+    passwordReset(token, password) {
+        return this.json("POST", "/v1/auth/password/reset", { token, password });
+    }
+    /** Uses the confirmation link and sets the account's first password. */
+    verifyEmail(token, password) {
+        return this.json("POST", "/v1/auth/email/verify", { token, password });
+    }
+    /**
+     * Finishes a sign-in that came back `{mfa:"totp"}`.
+     *
+     * Callable without a token: `pending` is the credential, and it is not a
+     * session — no other endpoint accepts it.
+     */
+    completeTotpLogin(pending, factor) {
+        return this.json("POST", "/v1/auth/totp", { pending, ...factor });
+    }
+    /** This account's two-factor state, including which orgs require it. */
+    getTotp() {
+        return this.json("GET", "/v1/me/totp");
+    }
+    /**
+     * Draws a secret to scan. It does **not** turn the factor on — `confirmTotp`
+     * does, after the app has proved it can produce a code.
+     */
+    enrollTotp() {
+        return this.json("POST", "/v1/me/totp/enroll");
+    }
+    /** Turns the factor on and hands back the ten recovery codes. They are shown once. */
+    confirmTotp(code) {
+        return this.json("POST", "/v1/me/totp/confirm", { code });
+    }
+    /** Turns it off. A code or a recovery code is required — the session alone is not. */
+    disableTotp(factor) {
+        return this.json("DELETE", "/v1/me/totp", factor);
+    }
+    /**
+     * Answers "How did you hear about Runlot?" once. An empty answer dismisses it;
+     * a second call changes nothing (the first answer stands).
+     */
+    answerHeardFrom(answer) {
+        return this.json("PUT", "/v1/me/heard-from", { answer });
+    }
+    /**
+     * Gives or withdraws consent to advertising email. `granted: true` must come
+     * only from a box the person ticked (opt-in, docs/marketing-consent.md).
+     */
+    setMarketingConsent(granted, source) {
+        return this.json("PUT", "/v1/me/marketing-consent", { granted, source });
+    }
+    /**
+     * Withdraws advertising-email consent with the token from a mail's unsubscribe link.
+     * No session: withdrawal must not ask for a login (docs/marketing-consent.md).
+     */
+    unsubscribeMarketing(token) {
+        return this.json("POST", "/v1/marketing/unsubscribe", { token });
+    }
+    /**
+     * The GitHub OAuth start URL. It is a 302 the browser follows, so it goes into
+     * `window.location` rather than being called with fetch. `redirect` has to be
+     * on the server's allow-list.
      */
     githubStartUrl(redirect) {
         const u = new URL("/v1/auth/github/start", this.opts.baseUrl);
         u.searchParams.set("redirect", redirect);
         return u.toString();
     }
+    /** The Google OAuth start URL. Uses the same dashboard callback shape as GitHub. */
+    googleStartUrl(redirect) {
+        const u = new URL("/v1/auth/google/start", this.opts.baseUrl);
+        u.searchParams.set("redirect", redirect);
+        return u.toString();
+    }
+    /**
+     * The generic OIDC start URL (docs/onprem-delivery.md §7.7). Same 302-and-fragment
+     * shape as the other two; which provider is behind it is the installation's choice.
+     */
+    oidcStartUrl(redirect) {
+        const u = new URL("/v1/auth/oidc/start", this.opts.baseUrl);
+        u.searchParams.set("redirect", redirect);
+        return u.toString();
+    }
+    /**
+     * Does this deployment federate an identity provider?
+     *
+     * **There is no endpoint that answers "which logins are on"** — one existed and was
+     * deleted, because its only reader was the login screen and it put a round trip in
+     * front of every login button (cp/internal/public/public.go). This is not that
+     * endpoint coming back: cp-public **does not register** the two OIDC routes when no
+     * issuer is configured, so the mux's own 404 is the answer, and the probe is a HEAD
+     * that no handler runs.
+     *
+     * Any other status means the route is there — a 400 (this probe carries no
+     * `redirect`) or a 502 (the provider's discovery document could not be read) both say
+     * the handler exists, and a button that leads to a readable error beats no button.
+     * A network failure answers false: on SaaS, where the answer is false anyway, a dead
+     * API address must not draw a login that cannot work.
+     */
+    async oidcAvailable() {
+        try {
+            const res = await fetch(new URL("/v1/auth/oidc/start", this.opts.baseUrl), { method: "HEAD" });
+            return res.status !== 404;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * This installation's licence (docs/onprem-delivery.md §6.5). Readable by any
+     * signed-in user: the footer it feeds is on every page for everybody.
+     *
+     * On SaaS it answers `onPrem: false` rather than 404, so the caller has one shape to
+     * read and the surfaces draw nothing on the flag.
+     */
+    license() {
+        return this.json("GET", "/v1/license");
+    }
+    /**
+     * The names of this deployment (app domain, docs address). Callable without auth.
+     *
+     * This exists so the dashboard does not hard-code a domain into the screen
+     * (docs/environments.md §3.2) — hard-coded, the dev screen tells people a
+     * production address, and because that address opens, nobody ever says it is
+     * wrong.
+     */
+    siteConfig() {
+        return this.json("GET", "/v1/config");
+    }
     me() {
         return this.json("GET", "/v1/me");
     }
     listOrgs() {
         return this.json("GET", "/v1/orgs");
     }
+    /** Changes the display name only (admin). The slug is the name that becomes an address, so it is not on this surface. */
+    /**
+     * `requireTotp` is left out when it is not given, on purpose: the server reads
+     * an absent field as "leave it alone". Sending `false` by default would mean a
+     * rename silently switched the org's second-factor requirement off.
+     */
+    updateOrg(org, name, requireTotp) {
+        return this.json("PATCH", `/v1/orgs/${encodeURIComponent(org)}`, {
+            name,
+            ...(requireTotp === undefined ? {} : { requireTotp }),
+        });
+    }
+    /**
+     * Deletes the organization (admin). **This cannot be undone.**
+     *
+     * `confirm` has to be the organization slug exactly — the confirmation lives on
+     * the server because three places call this surface (the screen, the CLI, and
+     * scripts). If a live project, domain, repository, or DNS zone is left, it is a
+     * 409 `org_not_empty` and `details.holdings` says what is left — **projects
+     * already deleted are not counted.**
+     *
+     * The `purgeAfter` in the answer is when the rows actually disappear. By the
+     * moment it returns the organization is already gone from every surface; what
+     * remains is retention until that time.
+     */
+    deleteOrg(org, confirm) {
+        return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}`, { confirm });
+    }
     createOrg(slug, name) {
         return this.json("POST", "/v1/orgs", { slug, name });
     }
     /**
-     * org 의 최근 알림 (docs/limits.md §3.4).
+     * The organization's recent notifications (docs/limits.md §3.4).
      *
-     * `sentAt` 이 없는 행은 아직 큐에 있거나 받을 이메일이 없는 것이다 — 후자에게
-     * 이 목록이 유일한 통로라, 화면은 두 상태를 같게 그린다.
+     * A row with no `sentAt` is either still queued or has no email address to
+     * reach — and for the second, this list is the only channel, so the screen
+     * draws both states the same way.
      */
     listNotifications(org, limit) {
         const q = limit === undefined ? "" : `?limit=${limit}`;
         return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/notifications${q}`);
     }
+    /**
+     * The plan and billing state (docs/billing.md). If `enabled` is false, this
+     * deployment has no billing — the screen shows only a contact address.
+     */
+    getBilling(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/billing`);
+    }
+    /**
+     * A Pro checkout session. Send the browser to the `url` that comes back. Even
+     * once payment finishes, the thing that changes the plan is the webhook, so
+     * read `getBilling` again after the browser returns.
+     */
+    createBillingCheckout(org, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/checkout`, { returnTo });
+    }
+    /** A one-time `url` for the customer portal (payment method, receipts, cancellation). */
+    createBillingPortal(org, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/portal`, { returnTo });
+    }
+    /** The customer session token for the payment-method embed (1 hour). An org with no payment history gets a 404. */
+    createBillingSession(org) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/session`, {});
+    }
+    /**
+     * The org's saved cards, read live from Polar (admin). `customer: false` means the org has
+     * no Polar billing account yet — the first checkout creates it. Nothing here is stored by runlot.
+     */
+    getBillingPaymentMethods(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/billing/payment-methods`);
+    }
+    /**
+     * A one-time `url` for Polar's hosted page where a card is added (admin). The browser comes back
+     * to `returnTo`. An org with no Polar billing account gets one made first.
+     */
+    addBillingPaymentMethod(org, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/payment-methods/add`, { returnTo });
+    }
+    /** Makes a saved card Polar's default — the card automatic charges use (admin). */
+    setBillingDefaultPaymentMethod(org, id) {
+        return this.json("PUT", `/v1/orgs/${encodeURIComponent(org)}/billing/payment-methods/default`, { id });
+    }
+    /**
+     * Removes a saved card (admin). Pro keeps a valid card (409 `replacement_required`), and so does
+     * auto top-up while it is on (409 `autotopup_needs_card`). Removing the default promotes another
+     * valid card first (`promotedDefault`).
+     */
+    removeBillingPaymentMethod(org, id) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/payment-methods/remove`, { id });
+    }
+    /** Schedules cancellation at the end of the period (`cancel: true`), or undoes it. There is no immediate revocation. */
+    cancelBilling(org, body) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/billing/cancel`, body);
+    }
+    /** The org's spending limit, this month's overage against it and the lock (docs/customer-limits.md §3). */
+    getSpendingLimit(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/billing/spending-limit`);
+    }
+    /** Sets the spending limit in cents (admin). A value below this month's overage locks the org at once. */
+    setSpendingLimit(org, cents) {
+        return this.json("PUT", `/v1/orgs/${encodeURIComponent(org)}/billing/spending-limit`, { cents });
+    }
+    /** A project's app memory, per-request CPU and spending limits (docs/customer-limits.md §4, §12). */
+    getProjectLimits(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/limits`);
+    }
+    /** A field left out is unchanged; null puts it back on the plan's value, or removes the project's spending limit (admin). */
+    setProjectLimits(org, name, body) {
+        return this.json("PUT", `${this.projectPath(org, name)}/limits`, body);
+    }
     listProjects(org) {
         return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects`);
     }
@@ -111,35 +461,895 @@ export class Client {
     getProject(org, name) {
         return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}`);
     }
+    /**
+     * Renames the project (admin). **The default address moves with it and there is
+     * no alias** — which is why the response carries the new address. Unlike the
+     * org slug, this name can change because it is the inner label of the org
+     * wildcard certificate.
+     */
+    updateProject(org, name, next) {
+        return this.json("PATCH", this.projectPath(org, name), { name: next });
+    }
+    /**
+     * Starts tearing the project down (admin). **This cannot be undone and leaves
+     * no recovery generation.** `confirm` has to be the project name exactly.
+     */
+    deleteProject(org, name, confirm) {
+        // A project's own database stays in the org (`databaseKept` on the answer).
+        return this.json("DELETE", this.projectPath(org, name), { confirm });
+    }
+    /**
+     * Disables a project (admin): it stops serving and taking new backups, and
+     * keeps everything it has. A project disabled for a year is deleted for good.
+     */
+    disableProject(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/disable`);
+    }
+    /** Enables a disabled project (admin). 409 `project_limit` when there is no room for it. */
+    enableProject(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/enable`);
+    }
+    /** Watches the teardown operation to its end even after the project is gone. */
+    getOrgOperation(org, opId) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/operations/${encodeURIComponent(opId)}`);
+    }
+    /** Everything the project's first screen takes in one call. Usage calls `getUsage` alongside it. */
+    getProjectOverview(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/overview`);
+    }
     listDeployments(org, name) {
         return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/deployments`);
     }
-    /** 본문이 곧 번들이다. 다이제스트 하나가 코드와 자산 전부를 덮는다. */
-    deploy(org, name, bundle) {
+    /**
+     * One deployment, with `migrations` when the control plane applied its
+     * `migrations/` — which today means a preview deployed with `db=branch`
+     * (docs/studio.md §6.6 step 2).
+     *
+     * A preview's deployment is read under **the parent project's name**, the name
+     * the caller deployed through: the preview is a project of its own, but the
+     * caller never learns its name.
+     */
+    getDeployment(org, name, deploymentId) {
+        return this.json("GET", `${this.projectPath(org, name)}/deployments/${encodeURIComponent(deploymentId)}`);
+    }
+    /** Completed-front HTTP outcomes only; native crash-free health is unknown. */
+    getReleaseHealth(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/error-releases`);
+    }
+    /** Historical first transition per issue; never substitutes a latest occurrence. */
+    listReleaseIssues(org, name, version, opts) {
+        const q = new URLSearchParams({ kind: opts.kind, windowStart: opts.windowStart, windowEnd: opts.windowEnd });
+        if (opts.cursor !== undefined)
+            q.set("cursor", opts.cursor);
+        return this.json("GET", `${this.projectPath(org, name)}/error-releases/${encodeURIComponent(String(version))}/issues?${q}`);
+    }
+    /** Runlot Errors: the issue stream (docs/customer-error-tracking.md). */
+    listErrorIssues(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.status)
+            q.set("status", opts.status);
+        if (opts.query)
+            q.set("query", opts.query);
+        if (opts.cursor)
+            q.set("cursor", opts.cursor);
+        if (opts.limit !== undefined)
+            q.set("limit", String(opts.limit));
+        const qs = q.size > 0 ? `?${q}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/errors${qs}`);
+    }
+    getErrorIssue(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}`);
+    }
+    updateErrorIssue(org, name, issueId, update) {
+        return this.json("PATCH", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}`, update);
+    }
+    /** Source context, suspects and owners for the selected stored occurrence, or latest when omitted. */
+    async getErrorInsights(org, name, issueId, opts = {}) {
+        const eventId = opts.eventId;
+        const q = new URLSearchParams();
+        if (eventId !== undefined)
+            q.set("eventId", eventId);
+        const qs = q.size > 0 ? `?${q}` : "";
+        const out = await this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/insights${qs}`);
+        if (eventId !== undefined && (eventId === "" || out.eventId !== eventId)) {
+            throw new Error("Code insights did not identify the requested occurrence; this server may not support event selection.");
+        }
+        return out;
+    }
+    listErrorEvents(org, name, issueId, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.cursor)
+            q.set("cursor", opts.cursor);
+        if (opts.limit !== undefined)
+            q.set("limit", String(opts.limit));
+        const qs = q.size > 0 ? `?${q}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/events${qs}`);
+    }
+    getErrorEvent(org, name, issueId, eventId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/events/${encodeURIComponent(eventId)}`);
+    }
+    /**
+     * Other events of the project joined to this one by front's request ID or a
+     * browser-minted trace ID (§12). Correlation only: issues are never merged.
+     */
+    getRelatedErrorEvents(org, name, issueId, eventId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/events/${encodeURIComponent(eventId)}/related`);
+    }
+    /** An issue's hourly history from the ClickHouse store; `available: false` where there is none. */
+    getErrorHistory(org, name, issueId, days) {
+        const qs = days !== undefined ? `?days=${encodeURIComponent(String(days))}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/history${qs}`);
+    }
+    /** Assign an issue to an org member, or clear it with null. */
+    assignErrorIssue(org, name, issueId, userId) {
+        return this.json("PUT", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/assignee`, { userId });
+    }
+    listErrorComments(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/comments`);
+    }
+    /** Plain text, at most 4000 characters; the author is the signed-in user. */
+    addErrorComment(org, name, issueId, body) {
+        return this.json("POST", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/comments`, { body });
+    }
+    /** Merge up to ten issues of the same origin into `targetIssueId`. */
+    mergeErrorIssues(org, name, targetIssueId, sourceIssueIds) {
+        return this.json("POST", `${this.projectPath(org, name)}/errors/${encodeURIComponent(targetIssueId)}/merge`, {
+            sourceIssueIds,
+        });
+    }
+    /** Take a merged source back out of the issue it was merged into. */
+    unmergeErrorIssue(org, name, issueId) {
+        return this.json("POST", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/unmerge`);
+    }
+    /** Shared stack hints: frame overlap, never a merge or a causal claim. */
+    similarErrorIssues(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/similar`);
+    }
+    getErrorFingerprintRules(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors-fingerprint-rules`);
+    }
+    putErrorFingerprintRules(org, name, rules) {
+        return this.json("PUT", `${this.projectPath(org, name)}/errors-fingerprint-rules`, { rules });
+    }
+    getErrorAlerts(org, name) { return this.json("GET", `${this.projectPath(org, name)}/error-alerts`); }
+    putErrorAlertRule(org, name, id, rule) { return this.json("PUT", `${this.projectPath(org, name)}/error-alerts/rules/${encodeURIComponent(id)}`, rule); }
+    deleteErrorAlertRule(org, name, id) { return this.json("DELETE", `${this.projectPath(org, name)}/error-alerts/rules/${encodeURIComponent(id)}`); }
+    putErrorAlertDestination(org, name, id, input) { return this.json("PUT", `${this.projectPath(org, name)}/error-alerts/destinations/${encodeURIComponent(id)}`, input); }
+    deleteErrorAlertDestination(org, name, id) { return this.json("DELETE", `${this.projectPath(org, name)}/error-alerts/destinations/${encodeURIComponent(id)}`); }
+    getErrorAlertMail(org, name) { return this.json("GET", `${this.projectPath(org, name)}/error-alerts/mail`); }
+    putErrorAlertMail(org, name, preference) { return this.json("PUT", `${this.projectPath(org, name)}/error-alerts/mail`, preference); }
+    listErrorAlertDeliveries(org, name) { return this.json("GET", `${this.projectPath(org, name)}/error-alerts/deliveries`); }
+    // Monitors, downtimes and SLOs (docs/customer-observability.md §17.8, §17.9).
+    // Destinations are the error-alert destinations above, shared by both.
+    listMonitors(org, name) { return this.json("GET", `${this.projectPath(org, name)}/observability/monitors`); }
+    exportMonitors(org, name) { return this.json("GET", `${this.projectPath(org, name)}/observability/monitors/export`); }
+    getMonitor(org, name, id) { return this.json("GET", `${this.projectPath(org, name)}/observability/monitors/${encodeURIComponent(id)}`); }
+    putMonitor(org, name, id, monitor) { return this.json("PUT", `${this.projectPath(org, name)}/observability/monitors/${encodeURIComponent(id)}`, monitor); }
+    deleteMonitor(org, name, id) { return this.json("DELETE", `${this.projectPath(org, name)}/observability/monitors/${encodeURIComponent(id)}`); }
+    getMonitorHistory(org, name, id, limit) {
+        const q = limit ? `?limit=${encodeURIComponent(String(limit))}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/observability/monitors/${encodeURIComponent(id)}/history${q}`);
+    }
+    testMonitor(org, name, id) { return this.json("POST", `${this.projectPath(org, name)}/observability/monitors/${encodeURIComponent(id)}/test`); }
+    listDowntimes(org, name) { return this.json("GET", `${this.projectPath(org, name)}/observability/downtimes`); }
+    putDowntime(org, name, id, downtime) { return this.json("PUT", `${this.projectPath(org, name)}/observability/downtimes/${encodeURIComponent(id)}`, downtime); }
+    deleteDowntime(org, name, id) { return this.json("DELETE", `${this.projectPath(org, name)}/observability/downtimes/${encodeURIComponent(id)}`); }
+    listSLOs(org, name) { return this.json("GET", `${this.projectPath(org, name)}/observability/slos`); }
+    getSLO(org, name, id) { return this.json("GET", `${this.projectPath(org, name)}/observability/slos/${encodeURIComponent(id)}`); }
+    putSLO(org, name, id, slo) { return this.json("PUT", `${this.projectPath(org, name)}/observability/slos/${encodeURIComponent(id)}`, slo); }
+    deleteSLO(org, name, id) { return this.json("DELETE", `${this.projectPath(org, name)}/observability/slos/${encodeURIComponent(id)}`); }
+    /**
+     * Observability access and governance (customer-observability.md §12, §16, §17.15):
+     * the caller's grants, per-project role overrides, the audit trail, the data page,
+     * caps, export destinations and rehydration.
+     */
+    getObservabilityPermissions(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/permissions`);
+    }
+    listObservabilityRoles(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/roles`);
+    }
+    putObservabilityRole(org, name, userId, grants) {
+        return this.json("PUT", `${this.projectPath(org, name)}/observability/roles/${encodeURIComponent(userId)}`, { grants });
+    }
+    deleteObservabilityRole(org, name, userId) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/observability/roles/${encodeURIComponent(userId)}`);
+    }
+    listObservabilityAudit(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.limit !== undefined)
+            q.set("limit", String(opts.limit));
+        if (opts.before !== undefined)
+            q.set("before", opts.before);
+        const qs = q.size > 0 ? `?${q.toString()}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/observability/audit${qs}`);
+    }
+    getObservabilityData(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/data`);
+    }
+    getObservabilityCaps(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/caps`);
+    }
+    /** Named meters only: a number, -1 (no cap, Pro) or null (the plan's included amount). */
+    putObservabilityCaps(org, name, caps) {
+        return this.json("PUT", `${this.projectPath(org, name)}/observability/caps`, caps);
+    }
+    listObservabilityExports(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/exports`);
+    }
+    getObservabilityExport(org, name, exportId) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/exports/${encodeURIComponent(exportId)}`);
+    }
+    createObservabilityExport(org, name, input) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/exports`, input);
+    }
+    updateObservabilityExport(org, name, exportId, input) {
+        return this.json("PATCH", `${this.projectPath(org, name)}/observability/exports/${encodeURIComponent(exportId)}`, input);
+    }
+    deleteObservabilityExport(org, name, exportId) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/observability/exports/${encodeURIComponent(exportId)}`);
+    }
+    listObservabilityRehydrations(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rehydrations`);
+    }
+    getObservabilityRehydration(org, name, jobId) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rehydrations/${encodeURIComponent(jobId)}`);
+    }
+    /** Loads an archived range back for seven days; the answer is the queued job. */
+    createObservabilityRehydration(org, name, input) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/rehydrations`, input);
+    }
+    /** `runlot bug-report` (customer-observability.md §14): the CP snapshots what the references name. */
+    createBugReport(org, input) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/bug-reports`, input);
+    }
+    listBugReports(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/bug-reports`);
+    }
+    getBugReport(org, reportId, opts = {}) {
+        const qs = opts.snapshot === false ? "?snapshot=0" : "";
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/bug-reports/${encodeURIComponent(reportId)}${qs}`);
+    }
+    deleteBugReport(org, reportId) {
+        return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}/bug-reports/${encodeURIComponent(reportId)}`);
+    }
+    /** Synthetic HTTP checks of the project's own addresses (customer-observability.md §17.11). */
+    listUptimeChecks(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/uptime-checks`);
+    }
+    putUptimeCheck(org, name, id, input) {
+        return this.json("PUT", `${this.projectPath(org, name)}/uptime-checks/${encodeURIComponent(id)}`, input);
+    }
+    deleteUptimeCheck(org, name, id) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/uptime-checks/${encodeURIComponent(id)}`);
+    }
+    listUptimeRuns(org, name, id, limit) {
+        const qs = limit !== undefined ? `?limit=${encodeURIComponent(String(limit))}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/uptime-checks/${encodeURIComponent(id)}/runs${qs}`);
+    }
+    /** Dashboards (customer-observability.md §17.7). A built-in's id is `builtin:<key>`. */
+    listDashboards(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/dashboards`);
+    }
+    createDashboard(org, name, input) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/dashboards`, input);
+    }
+    getDashboard(org, name, id) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}`);
+    }
+    putDashboard(org, name, id, input) {
+        return this.json("PUT", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}`, input);
+    }
+    deleteDashboard(org, name, id) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}`);
+    }
+    /** The `.runlot/dashboards/<key>.json` form of a dashboard. */
+    exportDashboard(org, name, id) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}/export`);
+    }
+    /** Make (or rotate) the public link; the token is shown once. */
+    shareDashboard(org, name, id, isPublic = true) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}/share`, { public: isPublic });
+    }
+    unshareDashboard(org, name, id) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}/share`);
+    }
+    getDashboardWidgetData(org, name, id, widgetId, req = {}) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/dashboards/${encodeURIComponent(id)}/widgets/${encodeURIComponent(widgetId)}/data`, req);
+    }
+    getDashboardSettings(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/dashboard-settings`);
+    }
+    putDashboardSettings(org, name, settings) {
+        return this.json("PUT", `${this.projectPath(org, name)}/observability/dashboard-settings`, settings);
+    }
+    /** Deploy and OOM markers for every time series. */
+    getObservabilityMarkers(org, name, range = {}) {
+        const q = new URLSearchParams();
+        if (range.from)
+            q.set("from", range.from);
+        if (range.to)
+            q.set("to", range.to);
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/observability/markers${qs ? `?${qs}` : ""}`);
+    }
+    /** Watchdog insights (§17.10). Free: deploy regressions only. */
+    listInsights(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.state)
+            q.set("state", opts.state);
+        if (opts.limit !== undefined)
+            q.set("limit", String(opts.limit));
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/observability/insights${qs ? `?${qs}` : ""}`);
+    }
+    /** A project's capacity risks and every check (docs/capacity-risk-alerts.md §5.3). Every plan. */
+    getProjectHealth(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/health`);
+    }
+    /** Every project's capacity status and the organization's budget check. */
+    getOrgHealth(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/health`);
+    }
+    resolveInsight(org, name, id) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/insights/${encodeURIComponent(id)}/resolve`);
+    }
+    /** Synthetic checks (§17.11): the uptime checks, including multi-step API checks. */
+    listSynthetics(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/synthetics`);
+    }
+    putSynthetic(org, name, id, input) {
+        return this.json("PUT", `${this.projectPath(org, name)}/synthetics/${encodeURIComponent(id)}`, input);
+    }
+    deleteSynthetic(org, name, id) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/synthetics/${encodeURIComponent(id)}`);
+    }
+    listSyntheticRuns(org, name, id, limit) {
+        const qs = limit !== undefined ? `?limit=${encodeURIComponent(String(limit))}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/synthetics/${encodeURIComponent(id)}/runs${qs}`);
+    }
+    /** A public dashboard link. Needs no credential. */
+    getSharedDashboard(token) {
+        return this.json("GET", `/v1/shared/dashboards/${encodeURIComponent(token)}`);
+    }
+    getSharedDashboardWidgetData(token, widgetId, req = {}) {
+        return this.json("POST", `/v1/shared/dashboards/${encodeURIComponent(token)}/widgets/${encodeURIComponent(widgetId)}/data`, req);
+    }
+    // Customer observability, APM read side (docs/customer-observability.md §8, §17.2–§17.4,
+    // §17.6). Range options are RFC 3339 times; `step` is seconds or a duration ("5m").
+    obsApmPath(org, name, sub, q) {
+        const qs = new URLSearchParams();
+        for (const [k, v] of Object.entries(q ?? {}))
+            if (v !== undefined && v !== "")
+                qs.set(k, String(v));
+        const tail = qs.size > 0 ? `?${qs}` : "";
+        return `${this.projectPath(org, name)}/observability/${sub}${tail}`;
+    }
+    getObsMetricsOverview(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "metrics/overview", opts));
+    }
+    getObsMetricsMemory(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "metrics/memory", opts));
+    }
+    getObsMetricsInfrastructure(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "metrics/infrastructure", opts));
+    }
+    getObsMetricsCustom(org, name, opts) {
+        return this.json("GET", this.obsApmPath(org, name, "metrics/custom", opts));
+    }
+    getObsMetricsCustomNames(org, name) {
+        return this.json("GET", this.obsApmPath(org, name, "metrics/custom/names"));
+    }
+    listObsRoutes(org, name) {
+        return this.json("GET", this.obsApmPath(org, name, "routes"));
+    }
+    putObsRoute(org, name, input) {
+        return this.json("PUT", this.obsApmPath(org, name, "routes"), input);
+    }
+    getObsAPMRoutes(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "apm/routes", opts));
+    }
+    getObsAPMBreakdown(org, name, route, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, `apm/routes/${encodeURIComponent(route)}/breakdown`, opts));
+    }
+    getObsAPMServiceMap(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "apm/service-map", opts));
+    }
+    getObsAPMCompare(org, name, a, b, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "apm/compare", { ...opts, a, b }));
+    }
+    listObsAPMTraces(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "apm/traces", opts));
+    }
+    getObsAPMTrace(org, name, traceId) {
+        return this.json("GET", this.obsApmPath(org, name, `apm/traces/${encodeURIComponent(traceId)}`));
+    }
+    listObsTraceFilters(org, name) {
+        return this.json("GET", this.obsApmPath(org, name, "trace-filters"));
+    }
+    createObsTraceFilter(org, name, input) {
+        return this.json("POST", this.obsApmPath(org, name, "trace-filters"), input);
+    }
+    updateObsTraceFilter(org, name, id, input) {
+        return this.json("PUT", this.obsApmPath(org, name, `trace-filters/${encodeURIComponent(id)}`), input);
+    }
+    deleteObsTraceFilter(org, name, id) {
+        return this.json("DELETE", this.obsApmPath(org, name, `trace-filters/${encodeURIComponent(id)}`));
+    }
+    listObsDBQueries(org, name, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, "database/queries", opts));
+    }
+    getObsDBQuery(org, name, fingerprint, opts = {}) {
+        return this.json("GET", this.obsApmPath(org, name, `database/queries/${encodeURIComponent(fingerprint)}`, opts));
+    }
+    getObsDBHealth(org, name) {
+        return this.json("GET", this.obsApmPath(org, name, "database/health"));
+    }
+    /** The continuous profiler's switch (customer-observability.md §17.13). */
+    getObsProfilerSettings(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/profiler`);
+    }
+    /** On, off, or null for the default. Applies from the next deployment or restart. Admin. */
+    putObsProfilerSettings(org, name, enabled) {
+        return this.json("PUT", `${this.projectPath(org, name)}/observability/profiler`, { enabled });
+    }
+    /** The logs/traces sampling override; a null field is the manifest's. */
+    getObsSampling(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/sampling`);
+    }
+    /** Replaces the override (null = the manifest's). Admin. */
+    putObsSampling(org, name, body) {
+        return this.json("PUT", `${this.projectPath(org, name)}/observability/sampling`, body);
+    }
+    listObsProfiles(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/profiles${obsProfileQS({ ...q })}`);
+    }
+    /** The windows within a minute of `ts` — the profile of a slow trace's minute. */
+    nearObsProfiles(org, name, ts) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/profiles/near${obsProfileQS({ ts })}`);
+    }
+    getObsFlamegraph(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/profiles/flamegraph${obsProfileQS({ ...q })}`);
+    }
+    getObsProfileTop(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/profiles/top${obsProfileQS({ ...q })}`);
+    }
+    /** Self-time share per function, version a against version b; `route` compares only the samples attributed to it. */
+    compareObsProfiles(org, name, a, b, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/profiles/compare${obsProfileQS({ a, b, ...q })}`);
+    }
+    /** RUM: page views, sessions and p75 vitals over time (Pro). */
+    getObsRUMOverview(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rum/overview${obsProfileQS({ ...q })}`);
+    }
+    /** RUM by page template, with vitals, long tasks and resource/fetch timings (Pro). */
+    listObsRUMPages(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rum/pages${obsProfileQS({ ...q })}`);
+    }
+    /** RUM by device class (Pro). */
+    listObsRUMDevices(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rum/devices${obsProfileQS({ ...q })}`);
+    }
+    /** RUM page views, newest (or slowest LCP) first (Pro). */
+    listObsRUMViews(org, name, q = {}) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rum/views${obsProfileQS({ ...q })}`);
+    }
+    /** One page view and the server requests it caused (Pro). */
+    getObsRUMView(org, name, viewId) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/rum/views/${encodeURIComponent(viewId)}`);
+    }
+    /** Starts one heap snapshot (Pro, admin; pauses the app while taken). Poll the list. */
+    createObsHeapSnapshot(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/observability/heap-snapshots`, {});
+    }
+    listObsHeapSnapshots(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/observability/heap-snapshots`);
+    }
+    /** The download URL of a ready snapshot (a `.heapsnapshot` file). */
+    obsHeapSnapshotURL(org, name, snapshotId) {
+        return new URL(`${this.projectPath(org, name)}/observability/heap-snapshots/${encodeURIComponent(snapshotId)}`, this.opts.baseUrl).toString();
+    }
+    /** A ready snapshot's text (Chrome DevTools heap snapshot JSON). */
+    downloadObsHeapSnapshot(org, name, snapshotId) {
+        return this.text("GET", `${this.projectPath(org, name)}/observability/heap-snapshots/${encodeURIComponent(snapshotId)}`);
+    }
+    getErrorOwnership(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors-ownership`);
+    }
+    createErrorOwnershipPin(org, name, input) {
+        return this.json("POST", `${this.projectPath(org, name)}/errors-ownership/pins`, input);
+    }
+    revokeErrorOwnershipPin(org, name, deploymentId, selector) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/errors-ownership/pins/${encodeURIComponent(deploymentId)}/${encodeURIComponent(selector)}`);
+    }
+    getErrorCapturePolicy(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors-capture-policy`);
+    }
+    putErrorCapturePolicy(org, name, policy, acknowledgePII = false) {
+        return this.json("PUT", `${this.projectPath(org, name)}/errors-capture-policy`, { policy, acknowledgePII });
+    }
+    // ---- Observability (docs/customer-observability.md §7, §17.5) ----
+    obsPath(org, name) {
+        return `${this.projectPath(org, name)}/observability`;
+    }
+    getObservabilityCapabilities(org, name) {
+        return this.json("GET", `${this.obsPath(org, name)}/capabilities`);
+    }
+    /** Runs a query; `{ available: false }` where there is no event store. */
+    queryObservability(org, name, query) {
+        return this.json("POST", `${this.obsPath(org, name)}/query`, query);
+    }
+    listObservabilityKeys(org, name, opts = {}) {
+        return this.json("GET", `${this.obsPath(org, name)}/keys${obsQS(opts)}`);
+    }
+    listObservabilityValues(org, name, key, opts = {}) {
+        return this.json("GET", `${this.obsPath(org, name)}/values${obsQS({ ...opts, key })}`);
+    }
+    listObservabilityPatterns(org, name, opts = {}) {
+        return this.json("GET", `${this.obsPath(org, name)}/patterns${obsQS(opts)}`);
+    }
+    getObservabilityRequest(org, name, requestId) {
+        return this.json("GET", `${this.obsPath(org, name)}/requests/${encodeURIComponent(requestId)}`);
+    }
+    listSavedQueries(org, name) {
+        return this.json("GET", `${this.obsPath(org, name)}/saved-queries`);
+    }
+    getSavedQuery(org, name, queryId) {
+        return this.json("GET", `${this.obsPath(org, name)}/saved-queries/${encodeURIComponent(queryId)}`);
+    }
+    createSavedQuery(org, name, input) {
+        return this.json("POST", `${this.obsPath(org, name)}/saved-queries`, input);
+    }
+    updateSavedQuery(org, name, queryId, input) {
+        return this.json("PUT", `${this.obsPath(org, name)}/saved-queries/${encodeURIComponent(queryId)}`, input);
+    }
+    deleteSavedQuery(org, name, queryId) {
+        return this.json("DELETE", `${this.obsPath(org, name)}/saved-queries/${encodeURIComponent(queryId)}`);
+    }
+    starSavedQuery(org, name, queryId) {
+        return this.json("PUT", `${this.obsPath(org, name)}/saved-queries/${encodeURIComponent(queryId)}/star`);
+    }
+    unstarSavedQuery(org, name, queryId) {
+        return this.json("DELETE", `${this.obsPath(org, name)}/saved-queries/${encodeURIComponent(queryId)}/star`);
+    }
+    getObservabilityPipeline(org, name) {
+        return this.json("GET", `${this.obsPath(org, name)}/pipeline`);
+    }
+    putObservabilityPipeline(org, name, processors) {
+        return this.json("PUT", `${this.obsPath(org, name)}/pipeline`, { processors });
+    }
+    getObservabilityScanner(org, name) {
+        return this.json("GET", `${this.obsPath(org, name)}/scanner`);
+    }
+    putObservabilityScanner(org, name, scanner) {
+        return this.json("PUT", `${this.obsPath(org, name)}/scanner`, scanner);
+    }
+    /** Runs a scanner (the project's, or `scanner`) over a sample; nothing is stored. */
+    testObservabilityScanner(org, name, text, scanner) {
+        return this.json("POST", `${this.obsPath(org, name)}/scanner/test`, scanner ? { text, scanner } : { text });
+    }
+    /** The whole ingest configuration, shaped as `.runlot/logs.json`. */
+    exportObservabilityLogsConfig(org, name) {
+        return this.json("GET", `${this.obsPath(org, name)}/logs-config`);
+    }
+    listObservabilityLogMetrics(org, name) {
+        return this.json("GET", `${this.obsPath(org, name)}/log-metrics`);
+    }
+    putObservabilityLogMetric(org, name, metric, def) {
+        return this.json("PUT", `${this.obsPath(org, name)}/log-metrics/${encodeURIComponent(metric)}`, def);
+    }
+    deleteObservabilityLogMetric(org, name, metric) {
+        return this.json("DELETE", `${this.obsPath(org, name)}/log-metrics/${encodeURIComponent(metric)}`);
+    }
+    getErrorEventPII(org, name, issueId, eventId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/events/${encodeURIComponent(eventId)}?includePII=true`);
+    }
+    getErrorSettings(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors-settings`);
+    }
+    putErrorSettings(org, name, 
+    /** Omitted writable fields preserve their values; ownership assignment defaults off. */
+    settings) {
+        return this.json("PUT", `${this.projectPath(org, name)}/errors-settings`, settings);
+    }
+    /**
+     * One AI diagnosis of an issue, billed to the org's AI credit. There is no
+     * prompt to pass: the control plane builds it from the issue's stored event.
+     * The same `idempotencyKey` again returns the stored answer without a second
+     * charge, so a caller retrying after a timeout must reuse its key.
+     */
+    diagnoseErrorIssue(org, name, issueId, body) {
+        return this.json("POST", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/diagnoses`, body);
+    }
+    listErrorDiagnoses(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/diagnoses`);
+    }
+    fixPath(org, name, issueId) {
+        return `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/fix-proposals`;
+    }
+    /**
+     * Ask a model to propose a fix for an issue. Billed to the org's AI credit and
+     * writes nothing: the repository, base commit and files are chosen by the control
+     * plane. Reuse `idempotencyKey` on a retry so it is not charged twice.
+     */
+    proposeErrorFix(org, name, issueId, body) {
+        return this.json("POST", this.fixPath(org, name, issueId), body);
+    }
+    listErrorFixProposals(org, name, issueId) {
+        return this.json("GET", this.fixPath(org, name, issueId));
+    }
+    getErrorFixProposal(org, name, issueId, proposalId) {
+        return this.json("GET", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}`);
+    }
+    /**
+     * Write a ready proposal as one commit on its own `runlot/autofix/` branch. It
+     * builds, deploys and merges nothing. `proposalSha` must be the proposal's exactly.
+     */
+    applyErrorFix(org, name, issueId, proposalId, proposalSha) {
+        return this.json("POST", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}/apply`, {
+            proposalSha,
+            acknowledgeUnreviewedCode: true,
+        });
+    }
+    lookupErrorFixProposal(org, name, issueId, key) {
+        return this.request("GET", `${this.fixPath(org, name, issueId)}/lookup`, { headers: { "Idempotency-Key": key } });
+    }
+    lookupErrorFixPreview(org, name, issueId, proposalId, key) {
+        return this.request("GET", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}/previews/lookup`, { headers: { "Idempotency-Key": key } });
+    }
+    lookupErrorFixVerification(org, name, issueId, proposalId, jobId, key) {
+        return this.request("GET", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}/previews/${encodeURIComponent(jobId)}/verify/lookup`, { headers: { "Idempotency-Key": key } });
+    }
+    approveErrorFixPreview(org, name, issueId, proposalId, body) {
+        return this.json("POST", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}/previews`, body);
+    }
+    getErrorFixPreview(org, name, issueId, proposalId, jobId) {
+        return this.json("GET", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}/previews/${encodeURIComponent(jobId)}`);
+    }
+    approveErrorFixPreviewVerification(org, name, issueId, proposalId, jobId, body) {
+        return this.json("POST", `${this.fixPath(org, name, issueId)}/${encodeURIComponent(proposalId)}/previews/${encodeURIComponent(jobId)}/verify`, body);
+    }
+    /** Erase captured issue data, after explicit review. Admin; unmerge first. */
+    deleteErrorIssue(org, name, issueId) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}`);
+    }
+    /** Erase an exact application user ID; anonymous aggregates remain. Admin. */
+    eraseErrorUser(org, name, userId) {
+        return this.json("POST", `${this.projectPath(org, name)}/errors-erasure`, { userId });
+    }
+    /** Untrusted browser histograms and technical-fuse counters, not billed usage. Viewer. */
+    getBrowserTelemetry(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/browser-telemetry`);
+    }
+    /** Unverified feedback whose exact browser error anchor belongs to this issue. Never includes email. */
+    listBrowserFeedback(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/feedback`);
+    }
+    /** Explicit sensitive read. Admin + errors:pii; optional unverified email only while feedback-email retention is on. */
+    listBrowserFeedbackWithPII(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/feedback?includePII=true`);
+    }
+    /** The masked structural replay switch, cap and this month's count. Viewer. */
+    getErrorReplaySettings(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors-replay-settings`);
+    }
+    /**
+     * Both fields are required: `monthlyCap` null is the plan's amount, `0` stops collection,
+     * `-1` removes the cap (Pro). Admin.
+     */
+    putErrorReplaySettings(org, name, settings) {
+        return this.json("PUT", `${this.projectPath(org, name)}/errors-replay-settings`, settings);
+    }
+    /** An issue's complete masked structural replays. Admin, until a granular PII scope exists. */
+    listErrorReplays(org, name, issueId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/replays`);
+    }
+    /** One replay and its re-validated batches, for the sandboxed player. Admin. */
+    getErrorReplay(org, name, issueId, replayId) {
+        return this.json("GET", `${this.projectPath(org, name)}/errors/${encodeURIComponent(issueId)}/replays/${encodeURIComponent(replayId)}`);
+    }
+    /**
+     * Scheduled runs: what the live deployment declares, when each fires next, and
+     * the recent history (docs/cron.md §8). `limit` bounds the history rows only —
+     * the schedules and the per-schedule last run are never paged.
+     */
+    getProjectCron(org, name, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/cron${qs}`);
+    }
+    /**
+     * Queues: what the live deployment declares, how deep each one is, and the
+     * recent batch history (docs/queues.md §6). The depth is read from the
+     * project's own database; `depthError` on the answer says when it could not be.
+     */
+    getProjectQueues(org, name, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/queues${qs}`);
+    }
+    /**
+     * Durable Objects: how many this project has placed, against the two caps
+     * (docs/durable-objects.md).
+     *
+     * **It answers how much, never which.** There is no actor id in the response
+     * and none is coming — those name individual objects, and a list of them would
+     * be an object enumeration wearing a quota's name. `nodes` is keyed by node id
+     * because `nodeLimit` is a separate bound that can refuse a placement while
+     * the project-wide cap still has room.
+     */
+    getProjectDurableObjects(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/durable-objects`);
+    }
+    queuePath(org, name, queue) {
+        return `${this.projectPath(org, name)}/queues/${encodeURIComponent(queue)}`;
+    }
+    listQueueRuns(org, name, queue, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.queuePath(org, name, queue)}/runs${qs}`);
+    }
+    /** The head of the queue without leasing it — looking cannot delay a delivery. */
+    peekQueue(org, name, queue, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        return this.json("GET", `${this.queuePath(org, name, queue)}/messages${qs}`);
+    }
+    /** Irreversible. The confirmation is the caller's — the server holds none. */
+    purgeQueue(org, name, queue) {
+        return this.json("DELETE", `${this.queuePath(org, name, queue)}/messages`);
+    }
+    /**
+     * Moves a dead-letter queue's messages back. `to` is required only when the
+     * dead-letter queue belongs to more than one consumer, or to none.
+     */
+    redriveQueue(org, name, queue, to) {
+        return this.json("POST", `${this.queuePath(org, name, queue)}/redrive`, to === undefined ? {} : { to });
+    }
+    /**
+     * The vector store: every namespace with its count and width, and the plan's
+     * bounds (docs/vectors.md §4). Read from the project's own database;
+     * `readError` on the answer says when it could not be.
+     */
+    getProjectVectors(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/vectors`);
+    }
+    /** Irreversible. The confirmation is the caller's — the server holds none. */
+    deleteVectorNamespace(org, name, namespace) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/vectors/${encodeURIComponent(namespace)}`);
+    }
+    /** The body is the bundle. One digest covers all of the code and the assets. */
+    /**
+     * Uploads the bundle. `headers` carries the provenance headers
+     * (`X-Runlot-Git-*`, openapi createDeployment) — the body is the bundle
+     * itself, so the metadata can only travel in headers.
+     */
+    deploy(org, name, bundle, headers = {}) {
         return this.request("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/deployments`, {
             body: bundle,
+            headers: { ...headers, "Content-Type": "application/gzip" },
+        });
+    }
+    /**
+     * The same upload, aimed at a preview (docs/preview.md). **It does not move
+     * production's live pointer** — that is the whole difference, and it is why
+     * this is a named method rather than an optional argument on `deploy`: a
+     * caller that forgets the argument deploys to production.
+     *
+     * `db` picks what `env.db` points at (`branch` by default, `shared` at
+     * production's own database, `none` for no database), and `from` pours the
+     * branch from a named generation instead of the newest one.
+     */
+    deployPreview(org, name, bundle, 
+    // `| undefined` spelled out: under exactOptionalPropertyTypes a caller that
+    // forwards an unset flag is passing the property, not omitting it.
+    opts, headers = {}) {
+        return this.request("POST", `${this.projectPath(org, name)}/deployments?${previewQuery(opts)}`, {
+            body: bundle,
+            headers: { ...headers, "Content-Type": "application/gzip" },
+        });
+    }
+    /**
+     * Opens an incremental upload (docs/incremental-deploy-upload.md §1.1). `files` is
+     * the bundle's entry list in tar order; the answer names the hashes to upload.
+     * An older CP answers 404 here — the caller falls back to `deploy`.
+     */
+    createDeploymentUpload(org, name, files, preview) {
+        let path = `${this.projectPath(org, name)}/deployments/uploads`;
+        if (preview)
+            path += `?${previewQuery(preview)}`;
+        return this.json("POST", path, { files });
+    }
+    /** One batch: a gzip tar whose entries are named by their content's sha256 (§1.2). */
+    uploadDeploymentBlobs(org, name, uploadId, batch) {
+        return this.request("POST", `${this.projectPath(org, name)}/deployments/uploads/${encodeURIComponent(uploadId)}/blobs`, {
+            body: batch,
             headers: { "Content-Type": "application/gzip" },
         });
     }
-    /** 멱등이다. 두 번 불러도 비밀번호는 굴지 않고 같은 접속 정보가 온다. */
+    /**
+     * Assembles and deploys the session (§1.3). The answer is `createDeployment`'s
+     * (with `preview` for a preview session). Idempotent per session, so a retry
+     * after an edge timeout returns the same deployment.
+     */
+    commitDeploymentUpload(org, name, uploadId, headers = {}, staticChecks) {
+        // The body is optional: a CP from before the checks reads none, and the deploy is the same.
+        return this.request("POST", `${this.projectPath(org, name)}/deployments/uploads/${encodeURIComponent(uploadId)}/commit`, {
+            headers: staticChecks !== undefined ? { ...headers, "Content-Type": "application/json" } : headers,
+            ...(staticChecks !== undefined ? { body: JSON.stringify({ staticChecks }) } : {}),
+        });
+    }
+    /** The parent's live previews (viewer). A deleted preview is not listed. */
+    listPreviews(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/previews`);
+    }
+    /**
+     * Deletes a preview and its branch (member).
+     *
+     * No confirmation string, unlike `deleteProject`: a branch is a copy taken at a
+     * moment and nothing in it is the only copy of anything.
+     */
+    deletePreview(org, name, preview) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/previews/${encodeURIComponent(preview)}`);
+    }
+    /**
+     * Makes the preview's artifact the parent's live deployment (member).
+     *
+     * **The code, never the data** (docs/preview.md §7). The branch is not merged
+     * and production's database is not replaced. The preview stays alive.
+     */
+    promotePreview(org, name, preview) {
+        return this.json("POST", `${this.projectPath(org, name)}/previews/${encodeURIComponent(preview)}/promote`);
+    }
+    /**
+     * The project's share link — `<label>.share.<app-domain>`, the one address
+     * Studio hands to somebody who is not a developer (docs/studio.md §6.9).
+     *
+     * 404 when the project has never been shared: a link is minted by
+     * `putShareLink`, never as a side effect of reading.
+     */
+    getShareLink(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/share`);
+    }
+    /**
+     * Points the share link at a preview, minting the label if there is none.
+     *
+     * Idempotent: the label is kept across shares, so somebody holding the link
+     * keeps working. `rotate` mints a new label and retires the old name in the
+     * same request ("링크 재발급"), so the project never has two live links.
+     */
+    putShareLink(org, name, opts = {}) {
+        return this.json("PUT", `${this.projectPath(org, name)}/share`, {
+            ...(opts.preview === undefined ? {} : { preview: opts.preview }),
+            ...(opts.rotate === undefined ? {} : { rotate: opts.rotate }),
+        });
+    }
+    /** Stops the link answering and forgets the label. The preview keeps running. */
+    deleteShareLink(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/share`);
+    }
+    /**
+     * Creates a database named `name` in the org (member). When `name` is a project
+     * without a database, this is that project's own `env.db`. Idempotent for a
+     * project's own database: the password is not rolled and the same connection
+     * details come back.
+     */
     createDatabase(org, name) {
-        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`);
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/databases`, { name });
     }
+    /** One database: size, state and the projects that bind it. 404 when there is none. */
     getDatabase(org, name) {
-        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`);
+        return this.json("GET", dbPath(org, name));
     }
     /**
-     * 접속 자격까지. `getDatabase` 와 라우트가 갈린 것은 역할 때문이다 —
-     * viewer 는 여부를 알아도 되지만 비밀번호는 아니다 (proto/openapi.yaml).
+     * The connection credentials as well. The route is split from `getDatabase`
+     * because of roles — a viewer may know whether there is a database, but not
+     * the password (proto/openapi.yaml).
      */
     getDatabaseConnect(org, name) {
-        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database/connect`);
+        return this.json("GET", `${dbPath(org, name)}/connect`);
     }
-    /** 접속 끝점만 — 자격 없음. viewer 도 받는다. `runlot port-forward` 가 쓴다. */
+    /** The endpoint only — no credentials. A viewer gets it too. Used by `runlot db forward`. */
     getDatabaseEndpoint(org, name) {
         return this.json("GET", `${dbPath(org, name)}/endpoint`);
     }
-    /** 단기 기계 자격 발급. 비밀번호는 이 응답에만 실린다. */
+    /** Issues a short-lived machine credential. The password is carried in this response and nowhere else. */
     createDatabaseToken(org, name, ttlSeconds) {
         return this.json("POST", `${dbPath(org, name)}/tokens`, ttlSeconds === undefined ? {} : { ttlSeconds });
     }
@@ -150,59 +1360,123 @@ export class Client {
         return this.json("DELETE", `${dbPath(org, name)}/tokens/${encodeURIComponent(user)}`);
     }
     /**
-     * 진단 이미지를 하나 만든다.
+     * Makes one diagnostic image.
      *
-     * **멱등이 아니다** — 부를 때마다 이미지가 하나 생긴다. 그리고 느리다:
-     * 응답은 덤프가 끝난 뒤에 오고, 그동안 그 프로젝트의 액터는 붙잡혀 있다
-     * (proto/openapi.yaml).
+     * **Not idempotent** — every call makes another image. And it is slow: the
+     * response comes after the dump finishes, and that project's actor is held
+     * for the whole of it (proto/openapi.yaml).
      */
     exportDatabase(org, name) {
-        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database/export`);
+        return this.json("POST", `${dbPath(org, name)}/export`);
     }
     /**
-     * 복원이 고를 수 있는 세대 전부. 최신 순이고, `lastCheckedAt` 은 무변경
-     * 스킵의 하트비트다 — 세대가 늘지 않는 것과 백업이 죽은 것을 가른다.
+     * Every generation a restore can choose, newest first. `lastCheckedAt` is the
+     * heartbeat of the no-change skip — it is what tells "no new generations"
+     * apart from "the backup is dead".
      */
     listGenerations(org, name) {
         return this.json("GET", `${this.dbPath(org, name)}/generations`);
     }
     /**
-     * 세대로 되돌린다. **그 사이의 쓰기는 사라진다.**
+     * Runs one statement in a database (the dashboard console).
+     *
+     * `readOnly` is **omitted, not sent as false**, when the caller wants the safe
+     * mode: the server treats an absent field as read-only, so leaving it out is the
+     * one spelling that cannot be misread. Sending `false` is the explicit ask for
+     * write mode, and only then does the server run outside a transaction.
+     *
+     * SQL failures arrive as an `ApiError` whose body carries `details.sqlstate` —
+     * PostgreSQL's own code, which is what the error panel shows.
+     */
+    executeSQL(org, name, sql, opts = {}) {
+        const body = { sql };
+        if (opts.readOnly === false)
+            body.readOnly = false;
+        if (opts.params !== undefined && opts.params.length > 0)
+            body.params = opts.params;
+        return this.json("POST", `${this.dbPath(org, name)}/execute`, body);
+    }
+    /**
+     * Rolls back to a generation. **Writes made since then are lost.**
      *
-     * 202 로 끝난다 — 돌아오는 것은 연산 id 이고, 진행은
-     * `getDatabaseOperation` 으로 본다. `latest` 는 서버가 풀지 않는다:
-     * 목록에서 고른 `(epoch, seq)` 를 그대로 싣는다 (proto/openapi.yaml).
+     * It ends at 202 — what comes back is an operation id, and progress is read
+     * through `getDatabaseOperation`. The server does not resolve `latest`: the
+     * `(epoch, seq)` chosen from the list is carried as-is (proto/openapi.yaml).
      */
     restoreDatabase(org, name, epoch, seq) {
         return this.json("POST", `${this.dbPath(org, name)}/restore`, { epoch, seq });
     }
     /**
-     * 데이터베이스를 없앤다. `confirm` 은 프로젝트 이름과 **정확히** 같아야
-     * 하고, 다르면 서버가 400 `confirm_mismatch` 로 거절한다.
+     * Rolls back to a restore point **inside** a backup (pg-feather docs/37):
+     * `txnId` is that commit, `at` is the last commit at or before that time. One
+     * backup carries the commits in between in order, so the place you can roll
+     * back to is not tied to a backup boundary. Everything else is as in
+     * restoreDatabase — 202, an operation id, and one safety backup before the
+     * rollback.
      */
-    deleteDatabase(org, name, confirm) {
-        return this.json("POST", `${this.dbPath(org, name)}/delete`, { confirm });
+    restoreDatabaseTo(org, name, target) {
+        return this.json("POST", `${this.dbPath(org, name)}/restore`, target);
     }
-    /** 연산 하나의 진행. 연산 id 는 자격이 아니라 프로젝트 경로 아래에 있다. */
+    /**
+     * Removes a database (admin). `confirm` has to match the database name
+     * **exactly**; if it does not, the server refuses with 400 `confirm_mismatch`.
+     * A bound database answers 409 `database_bound` unless `unbindAll` is set.
+     */
+    deleteDatabase(org, name, confirm, opts = {}) {
+        return this.json("POST", `${this.dbPath(org, name)}/delete`, opts.unbindAll === true ? { confirm, unbindAll: true } : { confirm });
+    }
+    /**
+     * Removes one project's binding to a database (admin), for a project nobody will
+     * redeploy — a deploy otherwise reconciles bindings from runlot.json. 204.
+     */
+    unbindDatabase(org, database, project) {
+        return this.json("DELETE", `${this.dbPath(org, database)}/bindings/${encodeURIComponent(project)}`);
+    }
+    /** Every database in the org with the projects that bind it. Viewer and above. */
+    listOrgDatabases(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/databases`);
+    }
+    /** The progress of one operation. The operation id is not a credential; it lives under the database path. */
     getDatabaseOperation(org, name, opId) {
         return this.json("GET", `${this.dbPath(org, name)}/operations/${encodeURIComponent(opId)}`);
     }
-    /** 되돌릴 수 없는 phase 앞의 연산을 중단한다. */
+    /** Aborts an operation that has not yet reached a phase it cannot come back from. */
     abortDatabaseOperation(org, name, opId) {
         return this.json("POST", `${this.dbPath(org, name)}/operations/${encodeURIComponent(opId)}/abort`);
     }
     // ---- Phase 6 (docs/phase6.md) ----
     /**
-     * 로그 라이브 테일. **JSON 이 아니라 스트림**이라 `request` 를 안 지난다 —
-     * 돌려주는 것은 줄 단위 `LogEvent` 의 async iterable 이고, `signal` 을 abort
-     * 하면 연결이 끊긴다. 오류 응답(4xx/5xx)은 다른 메서드와 같은 `ApiError` 다.
+     * A live tail of the logs. It is **a stream, not JSON**, so it does not go
+     * through `request` — what comes back is an async iterable of line-by-line
+     * `LogEvent`, and aborting `signal` closes the connection. An error response
+     * (4xx/5xx) is the same `ApiError` as in every other method.
      */
     async *tailLogs(org, name, opts = {}) {
+        yield* this.tailStream(org, name, opts, undefined);
+    }
+    /**
+     * The live tail as `LogRecord`s — the stored event's shape (`--format json`).
+     * Pings and the end event still arrive as `LogEvent`s.
+     */
+    async *tailLogRecords(org, name, opts = {}) {
+        yield* this.tailStream(org, name, opts, "json");
+    }
+    async *tailStream(org, name, opts, format) {
         const q = new URLSearchParams();
         if (opts.tail !== undefined)
             q.set("tail", String(opts.tail));
         if (opts.follow !== undefined)
             q.set("follow", String(opts.follow));
+        if (opts.level)
+            q.set("level", opts.level);
+        if (opts.source)
+            q.set("source", opts.source);
+        if (opts.q)
+            q.set("q", opts.q);
+        if (opts.requestId)
+            q.set("requestId", opts.requestId);
+        if (format)
+            q.set("format", format);
         const path = `${this.projectPath(org, name)}/logs${q.size ? `?${q}` : ""}`;
         const res = await fetch(new URL(path, this.opts.baseUrl), {
             method: "GET",
@@ -215,7 +1489,7 @@ export class Client {
                 body = (await res.json());
             }
             catch {
-                // 위의 request 와 같은 이유.
+                // The same reason as in request above.
             }
             throw new ApiError(res.status, body, `GET ${path} → ${res.status}`);
         }
@@ -243,14 +1517,35 @@ export class Client {
                 yield JSON.parse(rest);
         }
         finally {
-            // 소비자가 일찍 끝내면(break) 서버 쪽 follow 도 끝나야 한다.
+            // If the consumer ends early (break), the server's follow has to end too.
             await reader.cancel().catch(() => { });
         }
     }
+    /**
+     * The stored lane (0062). It is a plain JSON page, not a stream: the history
+     * does not reach a node, so it answers for a project that is cold, parked, or
+     * has moved since the lines were written — every one of which is a 409 on
+     * `tailLogs`.
+     *
+     * `q` is a plain substring, matched case-insensitively. It is not a regular
+     * expression — `%` and `_` match themselves.
+     *
+     * Paging is keyset: pass the `cursor` from a page back to get the next, older
+     * one. A page with no `cursor` is the end of what is kept.
+     */
+    getLogHistory(org, name, opts = {}) {
+        const params = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts)) {
+            if (v !== undefined && v !== "")
+                params.set(k, String(v));
+        }
+        const qs = params.size ? `?${params}` : "";
+        return this.json("GET", `${this.projectPath(org, name)}/logs/history${qs}`);
+    }
     listSecrets(org, name) {
         return this.json("GET", `${this.projectPath(org, name)}/secrets`);
     }
-    /** 값은 이 호출로만 나간다. 어떤 응답에도 값은 없다. */
+    /** The value travels in this call only. It is in no response at all. */
     setSecret(org, name, secret, value) {
         return this.json("PUT", `${this.projectPath(org, name)}/secrets/${encodeURIComponent(secret)}`, { value });
     }
@@ -261,111 +1556,438 @@ export class Client {
         const q = hours === undefined ? "" : `?hours=${hours}`;
         return this.json("GET", `${this.projectPath(org, name)}/usage${q}`);
     }
-    // ---- 오브젝트 스토리지 (docs/storage.md §8) ----
-    /** 부여 여부·접두·쿼터·사용량. `usedBytes` 는 노드 보고 주기만큼 늦다. */
+    // ---- Object storage (docs/storage.md §8) ----
+    /** Grant, prefix, quota, usage. `usedBytes` lags by the node's reporting interval. */
     getStorage(org, name) {
         return this.json("GET", `${this.projectPath(org, name)}/storage`);
     }
     /**
-     * 스토리지를 부여한다. 멱등이라 두 번 눌러도 접두는 그대로다. 접두·쿼터를
-     * 인자로 받지 않는 것이 요점이다 — 접두는 격리의 경계이고 쿼터는 요금제가
-     * 정한다 (proto/openapi.yaml).
+     * Grants storage. It is idempotent, so pressing twice leaves the prefix as it
+     * was. Taking neither the prefix nor the quota as an argument is the point —
+     * the prefix is the isolation boundary and the quota is set by the plan
+     * (proto/openapi.yaml).
      */
     grantStorage(org, name) {
         return this.json("POST", `${this.projectPath(org, name)}/storage`);
     }
-    /** 부여를 뗀다. **객체는 지워지지 않는다** (docs/storage.md §7). */
+    /** Removes the grant. **The objects are not deleted** (docs/storage.md §7). */
     revokeStorage(org, name) {
         return this.json("DELETE", `${this.projectPath(org, name)}/storage`);
     }
-    // ---- 최종 사용자 인증 (docs/auth.md §9) ----
     /**
-     * 부여 여부·설정·프로바이더·호스트. **가입자는 안 온다** — 그 표는 프로젝트
-     * DB 안이고 (docs/auth.md §6) 워커의 `env.auth` 만 본다.
+     * The key prefixes this project serves unsigned (docs/storage.md §4.7).
+     *
+     * A prefix is stored normalized — `assets` becomes `assets/`, and `/` becomes
+     * the empty string, which means every key. The value that comes back is the
+     * value that governs, so a screen must render the response rather than what
+     * the user typed.
+     */
+    listStoragePublic(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/storage/public`);
+    }
+    /** Publishes a prefix. Idempotent. All three verbs answer with the whole list. */
+    addStoragePublic(org, name, prefix) {
+        return this.json("POST", `${this.projectPath(org, name)}/storage/public`, { prefix });
+    }
+    /**
+     * Unpublishes a prefix. Idempotent.
+     *
+     * **The world keeps reading for up to a minute.** The object front caches the
+     * list, so this call is not a revocation that takes effect at the instant it
+     * returns — a screen that says "no longer public" the moment this resolves is
+     * telling a small lie.
+     */
+    removeStoragePublic(org, name, prefix) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/storage/public`, { prefix });
+    }
+    /**
+     * One page of objects grouped by `/` (`runlot storage ls`). `prefixes` are the
+     * folders one level down; feed `cursor` back unchanged, its absence is the end.
+     */
+    listStorageObjects(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.prefix)
+            q.set("prefix", opts.prefix);
+        if (opts.cursor)
+            q.set("cursor", opts.cursor);
+        if (opts.limit)
+            q.set("limit", String(opts.limit));
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/storage/objects${qs ? "?" + qs : ""}`);
+    }
+    /**
+     * A five-minute signed GET for one object (`runlot storage download`). The key's
+     * `/` segments stay in the path; each segment is encoded on its own.
+     */
+    signStorageObject(org, name, key) {
+        const path = key.split("/").map(encodeURIComponent).join("/");
+        return this.json("GET", `${this.projectPath(org, name)}/storage/objects/${path}`);
+    }
+    // ---- Email (docs/email.md §5) ----
+    /** Grant, address, sender, limits, recent counts. The address comes back as a preview even without a grant. */
+    getEmail(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/email`);
+    }
+    /** Turns it on. **Idempotent** — we choose the address. The deploy reads `"email": true` and calls this. */
+    grantEmail(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/email`);
+    }
+    /** Turns it off. Mail arriving at that address now gets a 550. */
+    revokeEmail(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/email`);
+    }
+    // ---- Custom sending domains (docs/email.md §2.4) ----
+    /** The project's own sending domains, each with the records to publish. */
+    listEmailDomains(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/email/domains`);
+    }
+    /**
+     * Creates the provider identity and answers with the records to publish.
+     * `publish` writes them into the zone when we host one covering the domain.
+     */
+    addEmailDomain(org, name, domain, publish = false) {
+        return this.json("POST", `${this.projectPath(org, name)}/email/domains`, { domain, publish });
+    }
+    /** Re-checks now. The background loop does the same once a minute while pending. */
+    verifyEmailDomain(org, name, domain) {
+        return this.json("POST", `${this.projectPath(org, name)}/email/domains/${encodeURIComponent(domain)}/verify`);
+    }
+    /** Deletes the identity and the row. Sending from it is refused from the next convergence. */
+    removeEmailDomain(org, name, domain) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/email/domains/${encodeURIComponent(domain)}`);
+    }
+    // ---- AI (docs/ai.md §6) ----
+    /**
+     * The model catalogue. **Being logged in is enough to see it** — what you can
+     * buy is not an organization's secret, and this list is the price table.
+     *
+     * Prices are integer **micro-cents** per million tokens (1 µ¢ = 1e-8 USD).
+     * Not letting the server pick the decimal place is the point — a small call
+     * rounded to cents becomes 0.
+     */
+    listAIModels() {
+        return this.json("GET", "/v1/ai/models");
+    }
+    /** Grant, limits, the org balance, 24 h usage. The limits come back as a preview even without a grant. */
+    getAI(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/ai`);
+    }
+    /** Turns it on. **Idempotent.** The deploy reads `"ai": true` and calls this. */
+    grantAI(org, name) {
+        return this.json("POST", `${this.projectPath(org, name)}/ai`);
+    }
+    /**
+     * Lends the org's own Claude/Codex subscriptions to this project's
+     * `anthropic/*` and `openai/*` calls (docs/studio-byos-ai.md §3.1).
+     *
+     * **Omitting a field leaves it as it was**, so turning lending on does not
+     * clear a fallback that was already set. Admin only: the subscription that
+     * carries the vendor-terms risk belongs to a person, not to the org.
+     */
+    patchAI(org, name, body) {
+        return this.json("PATCH", `${this.projectPath(org, name)}/ai`, body);
+    }
+    /** Turns it off. **The ledger and the balance are untouched** — the balance belongs to the org and the grant belongs to the project. */
+    revokeAI(org, name) {
+        return this.json("DELETE", `${this.projectPath(org, name)}/ai`);
+    }
+    /** The org's credit balance and its automatic top-up settings. The balance is in micro-cents and can be negative. */
+    getAICredit(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/ai/credit`);
+    }
+    /**
+     * One page of this project's AI calls, newest first (docs/ai-observability.md §6.1).
+     * `before` is the previous page's opaque `nextBefore`.
+     */
+    listAICalls(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts)) {
+            if (v !== undefined && v !== "")
+                q.set(k, String(v));
+        }
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/ai/calls${qs ? "?" + qs : ""}`);
+    }
+    /** One AI call; the input and output ride only for a reader with observability:pii. */
+    getAICall(org, name, callId) {
+        return this.json("GET", `${this.projectPath(org, name)}/ai/calls/${encodeURIComponent(callId)}`);
+    }
+    /** AI calls over time, by model, and the reasons lending did not serve (§6.3). */
+    getAISummary(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.from)
+            q.set("from", opts.from);
+        if (opts.to)
+            q.set("to", opts.to);
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/ai/summary${qs ? "?" + qs : ""}`);
+    }
+    /** AI calls grouped by the app's `metadata.sessionId` (§6.4). */
+    listAISessions(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts)) {
+            if (v !== undefined && v !== "")
+                q.set(k, String(v));
+        }
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/ai/sessions${qs ? "?" + qs : ""}`);
+    }
+    /** The org members' desktops that can lend to this project right now (§6.5). */
+    getAILenders(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/ai/lenders`);
+    }
+    /** Whether this project records prompts and answers (§5). */
+    getAICapture(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/ai/capture`);
+    }
+    /** Turns prompt capture on or off. observability:admin; audited. */
+    setAICapture(org, name, captureBodies) {
+        return this.json("PUT", `${this.projectPath(org, name)}/ai/capture`, { captureBodies });
+    }
+    /** One page of the org ledger. The cursor is `ledger_id` — cutting on time splits the same millisecond. */
+    listAILedger(org, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.limit)
+            q.set("limit", String(opts.limit));
+        if (opts.before)
+            q.set("before", String(opts.before));
+        if (opts.kind)
+            q.set("kind", opts.kind);
+        if (opts.since)
+            q.set("since", opts.since);
+        const qs = q.toString();
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/ai/ledger${qs ? "?" + qs : ""}`);
+    }
+    /**
+     * The credit top-up checkout. **A browser coming back is not evidence** — the
+     * one thing that raises the balance is the `order.paid` webhook, and the
+     * screen polls the balance after the success event.
+     */
+    createAICreditCheckout(org, microCents, returnTo) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/ai/credit/checkout`, { microCents, returnTo });
+    }
+    /**
+     * Turns automatic top-up on or off. **Turning it on is explicit consent**
+     * (docs/ai.md §3.5) — the screen shows the charging terms verbatim and calls
+     * this only after the box is checked.
+     */
+    setAIAutoTopup(org, body) {
+        return this.json("PUT", `/v1/orgs/${encodeURIComponent(org)}/ai/autotopup`, body);
+    }
+    /** One page of the mail log (docs/email.md §6.1). Newest first, cursor-paged. */
+    listMailLog(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.direction)
+            q.set("direction", opts.direction);
+        if (opts.cursor)
+            q.set("cursor", opts.cursor);
+        if (opts.limit)
+            q.set("limit", String(opts.limit));
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/email/log${qs ? "?" + qs : ""}`);
+    }
+    /** The metadata of one message. */
+    getMailLog(org, name, mailId) {
+        return this.json("GET", `${this.projectPath(org, name)}/email/log/${encodeURIComponent(mailId)}`);
+    }
+    /** The URL of the raw message — the screen uses it as a download link (.eml). */
+    mailLogRawURL(org, name, mailId) {
+        return new URL(`${this.projectPath(org, name)}/email/log/${encodeURIComponent(mailId)}/raw`, this.opts.baseUrl).toString();
+    }
+    /** The raw text. What the detail view draws the headers and body from. */
+    getMailLogRaw(org, name, mailId) {
+        return this.text("GET", `${this.projectPath(org, name)}/email/log/${encodeURIComponent(mailId)}/raw`);
+    }
+    // ---- End-user authentication (docs/auth.md §9) ----
+    /**
+     * Grant, settings, providers, hosts. **The signed-up users do not come** —
+     * that table is inside the project DB (docs/auth.md §6) and only the worker's
+     * `env.auth` sees it.
      *
-     * `providers` 에는 client id 만 있다. 클라이언트 시크릿은 봉인돼 어느
-     * 응답에도 안 나온다.
+     * `providers` carries the client id only. The client secret is sealed and
+     * appears in no response.
      */
     getAuth(org, name) {
         return this.json("GET", `${this.projectPath(org, name)}/auth`);
     }
     /**
-     * 인증을 켠다 (member). 멱등이다.
+     * Turns auth on (member). Idempotent.
      *
-     * **데이터베이스가 없으면 409 `database_required`** 다 — 가입자 표가
-     * 프로젝트 DB 안이라 부여만 세우면 워커가 뜨는 순간 표가 없다. 부르는 쪽은
-     * 그 코드를 잡아 `runlot pg create` 를 안내한다.
+     * **With no database it is 409 `database_required`** — the user table lives
+     * inside the project DB, so standing up the grant alone leaves no table the
+     * moment the worker starts. The caller catches that code and points at the
+     * `"database": true` declaration — the deploy never sees this code, because
+     * its ordering rules it out.
      */
     grantAuth(org, name) {
         return this.json("POST", `${this.projectPath(org, name)}/auth`);
     }
     /**
-     * 설정을 바꾼다 (member). **부분 갱신이다** — 준 칸만 바뀐다. 스위치 하나에
-     * 전체를 실어 보내면 두 사람이 같은 카드를 만질 때 나중 저장이 앞 저장을
-     * 덮는다. 부여가 없으면 404 `not_granted`.
+     * The app's end users, newest first (`runlot auth users`). Read-only, and read
+     * from the project's own database — a parked or unreachable one answers 502/504.
+     * Feed `cursor` back unchanged; its absence is the end.
+     */
+    listAppUsers(org, name, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.search)
+            q.set("search", opts.search);
+        if (opts.cursor)
+            q.set("cursor", opts.cursor);
+        if (opts.limit)
+            q.set("limit", String(opts.limit));
+        const qs = q.toString();
+        return this.json("GET", `${this.projectPath(org, name)}/auth/users${qs ? "?" + qs : ""}`);
+    }
+    /**
+     * One `env.ai.run` on the development lane: catalog models, the free plan's caps,
+     * the org's credit, recorded as `lane = dev`. One JSON answer, no streaming.
+     */
+    devAIRun(org, name, body) {
+        return this.json("POST", `${this.projectPath(org, name)}/ai/dev/run`, body);
+    }
+    /**
+     * Changes the settings (member). **A partial update** — only the fields given
+     * change. Sending the whole thing on one switch means that when two people
+     * touch the same card, the later save overwrites the earlier one. With no
+     * grant it is 404 `not_granted`.
      */
     updateAuthSettings(org, name, settings) {
         return this.json("PATCH", `${this.projectPath(org, name)}/auth`, { settings });
     }
     /**
-     * 인증을 해제한다 (admin). **가입자는 안 지워진다** — `runlot_auth` 의 표는
-     * 프로젝트 DB 에 남고, 다시 켜면 같은 사람들이 그대로 로그인한다.
+     * Turns auth off (admin). **The signed-up users are not deleted** — the
+     * `runlot_auth` tables stay in the project DB, and turning it back on lets the
+     * same people log in unchanged.
      */
     revokeAuth(org, name) {
         return this.json("DELETE", `${this.projectPath(org, name)}/auth`);
     }
     /**
-     * 소셜 프로바이더를 등록하거나 교체한다 (admin). 같은 PUT 이라 멱등이다.
+     * Registers or replaces a social provider (admin). It is the same PUT, so it
+     * is idempotent.
      *
-     * **`clientSecret` 은 다시 볼 수 없다.** 콜백 URL 은 호스트마다
-     * `https://<host>/__runlot/auth/callback/<provider>` 이고, 호스트 목록은
-     * 응답의 `hosts` 에 있다.
+     * **`clientSecret` cannot be read back.** The callback URL is
+     * `https://<host>/__runlot/auth/callback/<provider>` for each host, and the
+     * list of hosts is in the response's `hosts`.
+     *
+     * `issuer` is the base URL of your own GitHub Enterprise Server installation,
+     * and only `github` takes one. **This PUT is the whole row** — the same reason
+     * `clientSecret` has to be sent every time — so an empty string clears it and
+     * puts that provider back on github.com. The key is left out entirely when the
+     * argument is omitted, so a caller that does not know about issuers sends the
+     * body it always sent.
      */
-    setAuthProvider(org, name, provider, clientId, clientSecret) {
-        return this.json("PUT", `${this.projectPath(org, name)}/auth/providers/${encodeURIComponent(provider)}`, { clientId, clientSecret });
+    setAuthProvider(org, name, provider, clientId, clientSecret, issuer) {
+        return this.json("PUT", `${this.projectPath(org, name)}/auth/providers/${encodeURIComponent(provider)}`, { clientId, clientSecret, ...(issuer === undefined ? {} : { issuer }) });
     }
     /**
-     * 프로바이더를 뗀다 (admin). 그 프로바이더로만 가입한 사람은 로그인할 길을
-     * 잃지만 사용자 행은 남는다 — 다시 등록하면 같은 계정으로 돌아온다.
+     * Turns on the Runlot provider (admin): "Continue with Runlot", with email,
+     * Google and GitHub at Runlot behind it and nothing to register. 409
+     * `runlot_unavailable` when this deployment has no sign-in broker.
+     */
+    setRunlotAuthProvider(org, name) {
+        return this.json("PUT", `${this.projectPath(org, name)}/auth/providers/runlot`, { kind: "runlot" });
+    }
+    /**
+     * Registers or replaces a generic OIDC provider under a project-chosen id
+     * (admin). The CP reads `<issuer>/.well-known/openid-configuration` when
+     * saving; a failure is 400 `oidc_discovery_failed` quoting the provider.
+     */
+    setOidcAuthProvider(org, name, id, body) {
+        return this.json("PUT", `${this.projectPath(org, name)}/auth/providers/${encodeURIComponent(id)}`, { kind: "oidc", ...body });
+    }
+    /**
+     * The statements that create the `runlot_auth` schema (member). 404 when
+     * login is not turned on for the project.
+     */
+    getAuthSchema(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/auth/schema`);
+    }
+    /** The project's sign-in branding with defaults filled (docs/custom-sign-in.md §12.3). */
+    getAuthBranding(org, name) {
+        return this.getAuthBrandingAnswer(org, name).then((a) => a.brand);
+    }
+    /** The GET answer whole: the filled brand plus the methods the chooser would draw now. */
+    getAuthBrandingAnswer(org, name) {
+        return this.json("GET", `${this.projectPath(org, name)}/auth/branding`);
+    }
+    /**
+     * Replaces the whole branding object (member). Validated server-side; a bad
+     * field is 400 `invalid_branding` with `fields: [{path, message}]`.
+     */
+    putAuthBranding(org, name, branding) {
+        return this.json("PUT", `${this.projectPath(org, name)}/auth/branding`, branding)
+            .then((a) => a.brand);
+    }
+    /**
+     * The URL of the rendered chooser with (draft) branding (§12.4). A page, not
+     * JSON: the dashboard puts it in an iframe and the CLI opens it in a browser.
+     * `draft` travels as base64url JSON.
+     */
+    authBrandingPreviewUrl(org, name, opts = {}) {
+        const u = new URL(`${this.projectPath(org, name)}/auth/branding/preview`, this.opts.baseUrl);
+        if (opts.lang)
+            u.searchParams.set("lang", opts.lang);
+        if (opts.theme)
+            u.searchParams.set("theme", opts.theme);
+        if (opts.state)
+            u.searchParams.set("state", opts.state);
+        if (opts.draft)
+            u.searchParams.set("draft", base64urlJson(opts.draft));
+        return u.toString();
+    }
+    /** Sign-in funnel counters for the last `days` days (§9.4). No per-person data. */
+    getAuthFunnel(org, name, days = 30) {
+        return this.json("GET", `${this.projectPath(org, name)}/auth/funnel?days=${encodeURIComponent(String(days))}`);
+    }
+    /**
+     * Removes a provider (admin). Someone who signed up only through that provider
+     * loses their way in, but the user row stays — register it again and they come
+     * back to the same account.
      */
     deleteAuthProvider(org, name, provider) {
         return this.json("DELETE", `${this.projectPath(org, name)}/auth/providers/${encodeURIComponent(provider)}`);
     }
-    // ---- 배포 접근 제어 (docs/access.md §7) ----
+    // ---- Deployment access control (docs/access.md §7) ----
     /**
-     * 이 배포에 누가 닿을 수 있는가. **값은 없다** — 비밀번호도 우회 시크릿도
-     * 해시로만 살고, 여기 오는 것은 `hasPassword`·`hasBypass` 라는 사실이다.
+     * Who can reach this deployment. **No values** — both the password and the
+     * bypass secret live only as hashes, and what comes back here is the fact that
+     * there is one: `hasPassword` and `hasBypass`.
      *
-     * 정책을 한 번도 안 정한 프로젝트는 `mode: "public"` 에 `updatedAt` 이
-     * 없다. 화면이 그 둘을 가르는 이유는 §7 — 빈 상태 대신 상태 문장이다.
+     * A project that has never set a policy is `mode: "public"` with no
+     * `updatedAt`. The screen tells those two apart for the reason in §7 — a
+     * sentence about the state instead of an empty state.
      */
     getAccess(org, name) {
         return this.json("GET", `${this.projectPath(org, name)}/access`);
     }
     /**
-     * 정책을 바꾼다 (admin). `password` 를 안 보내면 **있던 비밀번호가 남는다** —
-     * 모드만 바꾸는 저장이 비밀번호를 지우면 되돌아왔을 때 다시 정해야 한다.
+     * Changes the policy (admin). Without a `password`, **the existing password
+     * stays** — if a save that only changes the mode wiped the password, coming
+     * back to that mode would mean setting it again.
      */
     setAccess(org, name, mode, password) {
         return this.json("PUT", `${this.projectPath(org, name)}/access`, { mode, password });
     }
     /**
-     * 자동화 우회 시크릿을 만든다 (admin). **값은 이 답에만 있다** — 화면은
-     * 받은 즉시 한 번 보여주고 다시 못 가져온다. 다시 부르면 옛 값이 죽는다.
+     * Makes a bypass secret for automation (admin). **The value is in this answer
+     * and nowhere else** — the screen shows it once on arrival and can never fetch
+     * it again. Calling again kills the old value.
      */
     newAccessBypass(org, name) {
         return this.json("POST", `${this.projectPath(org, name)}/access/bypass`);
     }
-    /** 우회를 뗀다 (admin). 없는 우회를 떼는 것도 성공이다. */
+    /** Removes the bypass (admin). Removing one that does not exist also succeeds. */
     revokeAccessBypass(org, name) {
         return this.json("DELETE", `${this.projectPath(org, name)}/access/bypass`);
     }
     /**
-     * 보호된 배포로 돌아가는 1 회용 주소를 받는다 (docs/access.md §3.4-3).
+     * Gets a one-time address back into a protected deployment (docs/access.md §3.4-3).
      *
-     * 프로젝트 경로 아래가 **아니다**: 부르는 화면이 아는 것은 호스트네임뿐이고
-     * (원 요청이 그리로 갔다), org·프로젝트 이름은 서버가 그것에서 유도한다.
-     * 받은 `redirect` 로 `location.replace` 하는 것이 호출부의 일이다.
+     * It is **not** under the project path: all the calling screen knows is the
+     * hostname (the original request went there), and the server derives the org
+     * and project names from it. Doing `location.replace` with the `redirect` that
+     * comes back is the caller's job.
      */
     authorizeAccess(to, next) {
         return this.json("POST", "/v1/access/authorize", { to, next });
@@ -373,44 +1995,79 @@ export class Client {
     listMembers(org) {
         return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/members`);
     }
-    /** 초대가 아니다 — 사용자는 이미 한 번 로그인해 있어야 한다 (404 `user_not_found`). */
+    /** This is not an invite — the user must already have logged in once (404 `user_not_found`). */
     addMember(org, provider, subject, role) {
         return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/members`, { provider, subject, role });
     }
     setMemberRole(org, userId, role) {
         return this.json("PUT", `/v1/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(userId)}`, { role });
     }
+    /**
+     * Removing someone else is admin; **removing yourself is leaving**, which
+     * anyone can do (docs/members.md). The last admin can do neither
+     * (409 `last_admin`).
+     */
     removeMember(org, userId) {
         return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}/members/${encodeURIComponent(userId)}`);
     }
+    // --- Invites (docs/members.md) ---
+    /** Pending and expired invites (admin). Accepted and revoked ones are history, so they do not come. */
+    listInvites(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/invites`);
+    }
+    /**
+     * Invites by email (admin). **Calling again with the same address is a
+     * resend** — the same row is updated rather than a new one created, and the
+     * server gives 200 instead of 201.
+     */
+    createInvite(org, email, role) {
+        return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/invites`, { email, role });
+    }
+    /** Revokes an invite (admin). Mail that has not gone out yet does not go out. */
+    revokeInvite(org, inviteId) {
+        return this.json("DELETE", `/v1/orgs/${encodeURIComponent(org)}/invites/${encodeURIComponent(inviteId)}`);
+    }
+    /**
+     * A preview of the invite. **No session needed** — whoever got the link has
+     * not logged in yet, and they need to know what they are accepting before
+     * they do.
+     */
+    getInvite(token) {
+        return this.json("GET", `/v1/invites/${encodeURIComponent(token)}`);
+    }
+    /** Accepts (login required). If they are already a member the role does not change. */
+    acceptInvite(token) {
+        return this.json("POST", `/v1/invites/${encodeURIComponent(token)}/accept`);
+    }
     // --- domains: D1 hostnames methods ---
-    /** 기본 호스트네임과 커스텀 도메인이 함께 온다 (viewer). */
+    /** The default hostname and the custom domains come together (viewer). */
     listHostnames(org, name) {
         return this.json("GET", `${this.projectPath(org, name)}/hostnames`);
     }
     /**
-     * 커스텀 도메인을 건다 (member).
+     * Attaches a custom domain (member).
      *
-     * 멱등이다 — 같은 이름을 다시 보내면 있던 행이 그대로 온다. 응답의 `verify`
-     * 가 고객이 넣어야 하는 CNAME·TXT 다.
+     * Idempotent — sending the same name again returns the existing row
+     * unchanged. The response's `verify` is the CNAME and TXT the customer has to
+     * add.
      */
-    addHostname(org, name, hostname) {
-        return this.json("POST", `${this.projectPath(org, name)}/hostnames`, { hostname });
+    addHostname(org, name, hostname, role) {
+        return this.json("POST", `${this.projectPath(org, name)}/hostnames`, role === undefined ? { hostname } : { hostname, role });
     }
-    /** 배경 검증과 같은 판정을 즉시 부른다 (member). */
+    /** Runs the same check the background verifier makes, right now (member). */
     verifyHostname(org, name, host) {
         return this.json("POST", `${this.projectPath(org, name)}/hostnames/${encodeURIComponent(host)}/verify`);
     }
-    /** 커스텀 도메인을 뗀다 (member). 기본 호스트네임은 400 이다. */
+    /** Detaches a custom domain (member). The default hostname gives a 400. */
     deleteHostname(org, name, host) {
         return this.json("DELETE", `${this.projectPath(org, name)}/hostnames/${encodeURIComponent(host)}`);
     }
     // --- domains: D2 dns methods ---
-    /** 이 조직의 존 목록. `rrsets` 는 없다 — 단건 조회에만 실려요. */
+    /** The organization's zones. No `rrsets` — those ride only on a single-zone lookup. */
     listZones(org) {
         return this.json("GET", this.dnsPath(org));
     }
-    /** 멱등이에요. 이미 있는 존은 그대로 돌아와요. */
+    /** Idempotent. A zone that already exists comes back unchanged. */
     createZone(org, name) {
         return this.json("POST", this.dnsPath(org), { name });
     }
@@ -421,8 +2078,9 @@ export class Client {
         return this.json("DELETE", `${this.dnsPath(org)}/${encodeURIComponent(zone)}`);
     }
     /**
-     * rrset 하나를 **통째로** 바꿔요. `records` 가 그 (이름, 타입) 의 새 전부라,
-     * 값 하나를 더하려면 지금 값을 함께 보내야 해요.
+     * Replaces one rrset **whole**. `records` is the complete new set for that
+     * (name, type), so adding a single value means sending the current ones with
+     * it.
      */
     putRRset(org, zone, name, type, ttl, records) {
         return this.json("PUT", this.rrsetPath(org, zone, name, type), { ttl, records });
@@ -438,39 +2096,49 @@ export class Client {
     setZoneDS(org, zone, ds) {
         return this.json("PUT", `${this.dnsPath(org)}/${encodeURIComponent(zone)}/dnssec/ds`, { ds });
     }
-    /** DNS 표면의 공통 접두. */
+    /** The shared prefix of the DNS surface. */
     dnsPath(org) {
         return `/v1/orgs/${encodeURIComponent(org)}/dns/zones`;
     }
-    /** `@` 도 `*` 도 이름으로 와요. 네 군데에 같은 문자열을 적지 않아요. */
+    /** Both `@` and `*` arrive as a name. Keeps the same string out of four places. */
     rrsetPath(org, zone, name, type) {
         return (`${this.dnsPath(org)}/${encodeURIComponent(zone)}` +
             `/rrsets/${encodeURIComponent(name)}/${encodeURIComponent(type)}`);
     }
     // --- domains: D3 domains methods ---
     /**
-     * 이름을 찾아본다 (member 이상).
+     * Looks a name up (member or above).
      *
-     * `priceCents` 는 첫 등록 1 년, `renewalCents` 는 갱신 1 년이다. 둘이
-     * 나뉘어 있는 이유는 첫해 할인이 흔해서다 — 하나로 접으면 "1 달러에 사서
-     * 다음 해 15 달러" 를 화면이 말할 수 없다.
+     * `priceCents` is the first year of registration; `renewalCents` is one year
+     * of renewal. They are separate because a first-year discount is common —
+     * folded into one, the screen cannot say "buy it for $1, then $15 next year".
      */
     checkDomains(org, names) {
         return this.json("POST", `${this.domainsPath(org)}/check`, { names });
     }
     /**
-     * 도메인을 산다 (admin — 돈을 써요).
+     * Buys a domain (admin — this spends money).
      *
-     * **ICANN 검증 메일이 `contact.email` 로 가요.** 화면은 사기 전에 그
-     * 사실을 알려야 해요 (docs/domains.md §5.5).
+     * **Payment comes first** (docs/domains.md §5.8). With a saved payment method
+     * the answer is the registered domain; otherwise a `DomainCharge` whose
+     * `checkoutUrl` is where to pay — follow it with `getDomainCharge`. Paying also
+     * agrees to the automatic yearly renewal charge.
      *
-     * 같은 요청을 다시 보내는 것이 안전해요 — 끝난 도메인이면 그대로 오고,
-     * 중간에 멈춘 구매면 그 자리에서 이어 가요.
+     * **The ICANN verification mail goes to `contact.email`.** The screen has to
+     * say so before the purchase (docs/domains.md §5.5).
      */
     purchaseDomain(org, body) {
         return this.json("POST", this.domainsPath(org), body);
     }
-    /** 이미 가진 도메인을 가져와요 (admin). 등록기관을 부르지 않고 존만 만들어요. */
+    /** One domain payment — how a `DomainCharge` from purchase or renewal is followed. */
+    getDomainCharge(org, chargeId) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/domain-charges/${encodeURIComponent(chargeId)}`);
+    }
+    /** Domain payments, newest first. */
+    listDomainCharges(org) {
+        return this.json("GET", `/v1/orgs/${encodeURIComponent(org)}/domain-charges`);
+    }
+    /** Imports a domain you already own (admin). Creates the zone only; the registrar is not called. */
     importDomain(org, name) {
         return this.json("POST", `${this.domainsPath(org)}/import`, { name });
     }
@@ -480,15 +2148,13 @@ export class Client {
     getDomain(org, name) {
         return this.json("GET", this.domainPath(org, name));
     }
-    renewDomain(org, name, years) {
-        return this.json("POST", `${this.domainPath(org, name)}/renew`, { years });
+    /** Renews now, paid the same way as a purchase. */
+    renewDomain(org, name, years, pay = {}) {
+        return this.json("POST", `${this.domainPath(org, name)}/renew`, { years, ...pay });
     }
     /**
-     * 자동 갱신 **의사**만 바꿔요.
-     *
-     * 등록기관 쪽 자동 갱신은 그대로 켜져 있어요 — 도메인은 하루 늦으면 잃는
-     * 자산이라 우리가 먼저 갱신하고 뒤에 청구해요. 화면은 이 사실을 함께
-     * 말해야 해요.
+     * Turns automatic renewal on or off. On: one year is charged 30 days before
+     * expiry. Off: nothing is charged and the domain lapses at expiry.
      */
     setDomainAutoRenew(org, name, enabled) {
         return this.json("POST", `${this.domainPath(org, name)}/auto-renew`, { enabled });
@@ -496,37 +2162,37 @@ export class Client {
     setDomainLock(org, name, locked) {
         return this.json("POST", `${this.domainPath(org, name)}/lock`, { locked });
     }
-    /** 이전 코드예요. 감사에 발급 사실이 남고 **코드는 남지 않아요**. */
+    /** The transfer auth code. The audit records that one was issued and **not the code itself**. */
     domainAuthCode(org, name) {
         return this.json("POST", `${this.domainPath(org, name)}/auth-code`);
     }
-    /** 지금 등록기관에서 다시 읽어요 (member). */
+    /** Re-reads from the registrar right now (member). */
     syncDomain(org, name) {
         return this.json("POST", `${this.domainPath(org, name)}/sync`);
     }
-    /** 도메인 표면의 공통 접두. 열 군데에 같은 문자열을 적지 않아요. */
+    /** The shared prefix of the domain surface. Keeps the same string out of ten places. */
     domainsPath(org) {
         return `/v1/orgs/${encodeURIComponent(org)}/domains`;
     }
     domainPath(org, name) {
         return `${this.domainsPath(org)}/${encodeURIComponent(name)}`;
     }
-    /** 프로젝트 표면의 공통 접두다. */
+    /** The shared prefix of the project surface. */
     projectPath(org, name) {
         return `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}`;
     }
-    /** 데이터베이스 표면의 공통 접두다. 다섯 군데에 같은 문자열을 적지 않는다. */
+    /** The shared prefix of the database surface. Keeps the same string out of five places. */
     dbPath(org, name) {
-        return `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/database`;
+        return dbPath(org, name);
     }
-    // ---- 자체 Git 호스팅 (docs/git-hosting.md §12.1, §19) ----
+    // ---- Self-hosted Git (docs/git-hosting.md §12.1, §19) ----
     //
-    // **저장소 조작은 git 이 하고 우리는 메타데이터만 다룬다.** `pushRepo` 같은
-    // 것이 여기 없는 이유다 — git 을 감싸는 API 는 git 의 모든 플래그를 다시
-    // 구현하거나 사용자를 가둔다.
+    // **git does the repository work and we handle only the metadata.** That is
+    // why there is nothing like `pushRepo` here — an API that wraps git either
+    // reimplements every one of git's flags or boxes the user in.
     //
-    // 저장소는 **프로젝트의 것**이다. 그래서 모든 메서드가 (org, project) 로
-    // 시작한다 — 데이터베이스·시크릿과 같은 모양이다.
+    // A repository **belongs to a project**. That is why every method starts with
+    // (org, project) — the same shape as the database and the secrets.
     listRepos(org, project) {
         return this.json("GET", this.repoPath(org, project));
     }
@@ -542,10 +2208,43 @@ export class Client {
     deleteRepo(org, project, name) {
         return this.json("DELETE", `${this.repoPath(org, project)}/${encodeURIComponent(name)}`);
     }
-    /** ref 이력. force-push 로 잃은 커밋을 되찾는 단서가 여기 있다. */
+    /** The ref history. The lead for recovering a commit lost to a force-push is here. */
     listRefUpdates(org, project, name) {
         return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/ref-updates`);
     }
+    // Push-to-deploy (docs/code/push-to-deploy). The hook hangs off the
+    // repository and the builds off the **project**, because a build outlives the
+    // repository it came from.
+    getDeployHook(org, project, name) {
+        return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy-hook`);
+    }
+    setDeployHook(org, project, name, body) {
+        return this.json("PUT", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy-hook`, body);
+    }
+    deleteDeployHook(org, project, name) {
+        return this.json("DELETE", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy-hook`);
+    }
+    /** Build a commit without pushing. Omit `commitSha` for the hooked branch's tip. */
+    deployRepoNow(org, project, name, commitSha) {
+        return this.json("POST", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/deploy`, commitSha === undefined ? {} : { commitSha });
+    }
+    listBuilds(org, project, limit) {
+        const q = limit === undefined ? "" : `?limit=${limit}`;
+        return this.json("GET", `${this.projectPath(org, project)}/builds${q}`);
+    }
+    getBuild(org, project, buildId) {
+        return this.json("GET", `${this.projectPath(org, project)}/builds/${encodeURIComponent(buildId)}`);
+    }
+    /**
+     * A build's output. It comes back as **text**, not JSON — see the endpoint's
+     * description. `json()` would try to parse it and fail on the first line.
+     */
+    getBuildLog(org, project, buildId) {
+        return this.text("GET", `${this.projectPath(org, project)}/builds/${encodeURIComponent(buildId)}/log`);
+    }
+    cancelBuild(org, project, buildId) {
+        return this.json("POST", `${this.projectPath(org, project)}/builds/${encodeURIComponent(buildId)}/cancel`);
+    }
     listSSHKeys() {
         return this.json("GET", "/v1/me/ssh-keys");
     }
@@ -558,14 +2257,14 @@ export class Client {
     listAccessTokens() {
         return this.json("GET", "/v1/me/tokens");
     }
-    /** 평문은 이 응답에 **한 번만** 실린다. */
+    /** The plaintext is carried in this response **once** and never again. */
     createAccessToken(body) {
         return this.json("POST", "/v1/me/tokens", body);
     }
     revokeAccessToken(tokenId) {
         return this.json("DELETE", `/v1/me/tokens/${encodeURIComponent(tokenId)}`);
     }
-    // ---- 브라우즈 (docs/git-hosting.md §12.2) ----
+    // ---- Browsing (docs/git-hosting.md §12.2) ----
     getRepoRefs(org, project, name) {
         return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/refs`);
     }
@@ -584,7 +2283,7 @@ export class Client {
         const qs = q.size > 0 ? `?${q.toString()}` : "";
         return this.json("GET", `${this.repoPath(org, project)}/${encodeURIComponent(name)}/commits${qs}`);
     }
-    /** 저장소 표면의 공통 접두다. 프로젝트 아래에 있다 (§19). */
+    /** The shared prefix of the repository surface. It sits under the project (§19). */
     repoPath(org, project) {
         return `${this.projectPath(org, project)}/repos`;
     }
@@ -592,4 +2291,12 @@ export class Client {
         return this.json("POST", `/v1/orgs/${encodeURIComponent(org)}/projects/${encodeURIComponent(name)}/rollback`, { version });
     }
 }
+/** A query string from the defined, non-empty options. */
+function obsQS(opts) {
+    const q = new URLSearchParams();
+    for (const [k, v] of Object.entries(opts))
+        if (v)
+            q.set(k, v);
+    return q.size ? `?${q}` : "";
+}
 //# sourceMappingURL=index.js.map