@runlot/api 0.1.0-rc.53 → 0.1.0-rc.55

package/dist/schema.d.ts

@@ -28,6 +28,118 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/password/sign-up": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a dashboard sign-up by email
+         * @description For a new email, queues a verification message. This does not create a session:
+         *     the account becomes usable when the recipient calls `/v1/auth/email/verify`.
+         *     An existing verified account instead receives an "already registered" message at its
+         *     own mailbox, pointing at password reset. The public response is deliberately identical
+         *     in both cases, so it does not disclose account existence — only the mailbox owner can
+         *     tell the two apart, which is the point.
+         *
+         *     **There is no password here by design.** Whoever sends this request is not yet
+         *     known to own the mailbox, so a password taken now would be an unproven visitor's
+         *     credential waiting on someone else's address. The recipient of the link chooses
+         *     the password at `/v1/auth/email/verify`.
+         */
+        post: operations["passwordSignUp"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/password/sign-in": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Sign in to the dashboard with email and password */
+        post: operations["passwordSignIn"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/password/forgot": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Request a dashboard password reset
+         * @description Queues a reset email. The response is deliberately the same whether or not an account
+         *     exists for the email address.
+         */
+        post: operations["passwordForgot"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/password/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reset a dashboard password
+         * @description Consumes a one-hour reset token, changes the password, invalidates sessions issued
+         *     before the change, and returns a new session.
+         */
+        post: operations["passwordReset"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/email/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify a dashboard email address and choose its password
+         * @description Consumes a 24-hour verification token, creates the account with the password chosen
+         *     here, and returns the account's first session. The password arrives with the proof of
+         *     mailbox access rather than before it, so a sign-up request for someone else's address
+         *     never leaves a credential behind.
+         */
+        post: operations["verifyEmail"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/github/start": {
         parameters: {
             query?: never;
@@ -77,6 +189,50 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/google/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Start Google OAuth
+         * @description `redirect` is the client callback to return to, with the token carried as a fragment,
+         *     after login finishes. The redirect must match the server allowlist. This sends a 302
+         *     to Google and uses PKCE for the authorization-code exchange.
+         */
+        get: operations["googleStart"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/google/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Google OAuth callback
+         * @description This path is the Google OAuth client's callback URL. It exchanges the authorization
+         *     code and PKCE verifier for a session, then redirects to the client callback with the
+         *     result in the URL fragment, using the same shape as the GitHub callback.
+         */
+        get: operations["googleCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/hooks/ses": {
         parameters: {
             query?: never;
@@ -3022,11 +3178,20 @@ export interface components {
             expiresAt?: string;
             user: components["schemas"]["User"];
         };
+        AuthEmailAccepted: {
+            /** @constant */
+            accepted: true;
+        };
         User: {
             /** Format: uuid */
             userId: string;
-            /** @enum {string} */
-            provider: "dev" | "github";
+            /**
+             * @description The oldest linked identity; retained as the primary provider contract
+             * @enum {string}
+             */
+            provider: "dev" | "github" | "google" | "password";
+            /** @description All login methods linked to this user, oldest first */
+            providers: ("dev" | "github" | "google" | "password")[];
             subject: string;
             email?: string | null;
             name?: string | null;
@@ -4620,6 +4785,208 @@ export interface operations {
             400: components["responses"]["BadRequest"];
         };
     };
+    passwordSignUp: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** Format: email */
+                    email: string;
+                    name?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Sign-up request accepted without disclosing whether mail was queued */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuthEmailAccepted"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Too many attempts; retry after the number of seconds in `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    passwordSignIn: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** Format: email */
+                    email: string;
+                    /** Format: password */
+                    password: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Session token */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Session"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Email or password is invalid (`invalid_credentials`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description The email address has not been verified (`email_unverified`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Too many attempts; retry after the number of seconds in `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    passwordForgot: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** Format: email */
+                    email: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Password reset email accepted for delivery */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuthEmailAccepted"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description Too many attempts; retry after the number of seconds in `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    passwordReset: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    token: string;
+                    /** Format: password */
+                    password: string;
+                };
+            };
+        };
+        responses: {
+            /** @description New session token */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Session"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description Too many attempts; retry after the number of seconds in `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    verifyEmail: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    token: string;
+                    /** Format: password */
+                    password: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Session token */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Session"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            /** @description A verified account appeared after sign-up; use password reset (`account_exists`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     githubStart: {
         parameters: {
             query: {
@@ -4664,6 +5031,50 @@ export interface operations {
             400: components["responses"]["BadRequest"];
         };
     };
+    googleStart: {
+        parameters: {
+            query: {
+                redirect: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description to Google authorize */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
+    googleCallback: {
+        parameters: {
+            query: {
+                code?: string;
+                state: string;
+                error?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description to the client callback */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+        };
+    };
     sesHook: {
         parameters: {
             query?: never;
@@ -5733,7 +6144,19 @@ export interface operations {
                 };
             };
             403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
+            /**
+             * @description `code` is `not_found` when the organization or project does not exist, and
+             *     `no_deployment` when the project exists but has never been deployed — there is
+             *     nothing to stream until the first deploy.
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /**
              * @description No process is available to stream right now. `code` is either `no_home_node` (cold,
              *     or no placement) or `suspended`.