@runlot/api 0.1.0-rc.78 → 0.1.0-rc.80

package/dist/schema.d.ts

@@ -75,6 +75,35 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/totp": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Finish a sign-in with the second factor
+         * @description Takes the `pending` token a first factor handed back, plus either the six-digit
+         *     code from the authenticator app or one recovery code. Success mints the real
+         *     session.
+         *
+         *     The pending token carries the account's session revision, so a password reset
+         *     landing between the two steps kills the half-finished login too.
+         *
+         *     A code is refused if its RFC 6238 step is at or below the last one already spent:
+         *     one code is valid across three 30-second steps, so "it verified" is not "it may be
+         *     spent" (migration 0066, `user_totp.last_used_step`).
+         */
+        post: operations["completeTotpLogin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/password/forgot": {
         parameters: {
             query?: never;
@@ -335,6 +364,83 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/me/totp": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** This account's two-factor state */
+        get: operations["getTotp"];
+        put?: never;
+        post?: never;
+        /**
+         * Turn two-factor authentication off
+         * @description Costs a current code or one recovery code. **A session alone is not enough** — a
+         *     stolen session removing the second factor would make the factor a formality.
+         *
+         *     The recovery codes go with it, in the same transaction. Left behind they would
+         *     open the *next* enrollment with codes printed for a device that is no longer the
+         *     factor.
+         */
+        delete: operations["disableTotp"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/me/totp/enroll": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Generate an authenticator secret
+         * @description Draws a fresh 20-byte secret and returns it with the `otpauth://` URI to scan.
+         *
+         *     **It does not turn the factor on.** `POST /v1/me/totp/confirm` does, and only after
+         *     the app has proved it can produce a code — enabling here would let a scan that
+         *     failed halfway lock the account out of its own dashboard.
+         *
+         *     Re-enrolling over a *confirmed* authenticator is refused with 409: turn it off
+         *     first, which itself costs a code.
+         */
+        post: operations["enrollTotp"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/me/totp/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm the authenticator and turn the factor on
+         * @description Verifies one code against the secret from `enroll` (RFC 6238, SHA-1, six digits,
+         *     a 30-second step, ±1 step), turns the factor on, and issues ten recovery codes.
+         *
+         *     **The recovery codes are readable only in this response.** They are argon2id in
+         *     the table, so there is no endpoint that lists them later.
+         */
+        post: operations["confirmTotp"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs": {
         parameters: {
             query?: never;
@@ -620,6 +726,13 @@ export interface paths {
          *         200 chars)
          *         X-Runlot-Git-Branch branch name, percent-encoded
          *         X-Runlot-Git-Dirty `true`|`false` — whether there were uncommitted changes
+         *
+         *     **With `?preview=<name>`** (docs/preview.md) this deploys to a preview and **the
+         *     deployment does not become production's live pointer** — production keeps serving
+         *     whatever it was serving, and the version numbers are the preview's own. The 201 body
+         *     is the same `Deployment` with one field added, `preview`, holding the `Preview` this
+         *     went to; it is the only place the new hostname is reported, because the caller that
+         *     just created a preview is the one caller that cannot list it yet.
          */
         post: operations["createDeployment"];
         delete?: never;
@@ -663,6 +776,239 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/queues": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Queues: what is declared, how deep each is, what happened (`runlot queue list`)
+         * @description Requires viewer or higher. One call, for the same reason as `getProjectCron`
+         *     (docs/queues.md §6): the declaration, the depth and the last verdict are only useful
+         *     together.
+         *
+         *     `queues` comes from the **live** deployment's manifest, one row per distinct name
+         *     across producers, consumers and dead-letter queues, in declaration order. The
+         *     consumer's numbers are already folded to their defaults (`maxBatchSize` 10,
+         *     `maxBatchTimeout` 5 s, `maxRetries` 3).
+         *
+         *     **The depth is read from the project's own database** — the messages live in the
+         *     `runlot_queue` schema there, not on the control plane. A queue nothing has ever sent
+         *     to reads as empty (the schema is installed on the first send). If the project's
+         *     database cannot be reached, `depthError` says so and `depth` is absent on every
+         *     row; the declarations and the history are still answered.
+         *
+         *     History is one row per **batch**, kept for `keepDays` (30 days free, 365 pro) and
+         *     then pruned. `opsToday` and `opsCap` are the project's daily operation count and
+         *     its plan's cap (free 10,000, pro 1,000,000; a send is one, a delivery is one).
+         */
+        get: operations["getProjectQueues"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/vectors": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Vector store: namespaces, counts, widths and the plan's bounds (`runlot vectors list`)
+         * @description Requires viewer or higher. What `env.vectors` holds, namespace by namespace, read
+         *     from the project's own database (`runlot_vector.items`, docs/vectors.md §4) over
+         *     the same road the SQL console takes. A project that has never written a vector
+         *     reads as empty — the schema is installed on the first write. If the project's
+         *     database cannot be reached, `readError` says so and the bounds are still answered.
+         *
+         *     `limit` and `dimensionsMax` are the plan's bounds (free 5,000 vectors and 3,072
+         *     dimensions, pro 25,000). `exact` is always true: search is exact k-NN in the
+         *     worker, there is no approximate index, and a caller porting from Vectorize should
+         *     be able to read that off the object.
+         */
+        get: operations["getProjectVectors"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/vectors/{namespace}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                namespace: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Empties one namespace (`runlot vectors delete`)
+         * @description Requires member. Deletes every vector in the namespace and answers with the count.
+         *     **Irreversible, and there is no confirmation on the server** — the CLI asks for one
+         *     (or `--yes`), and a member can already run the same `DELETE` from psql. Audited as
+         *     `vectors.delete` with the count. A namespace that does not exist answers 0.
+         */
+        delete: operations["deleteVectorNamespace"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/durable-objects": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Durable Objects: how many this project has placed, against the two caps
+         * @description Requires viewer or higher — the same role as the `vectors` and `queues` overviews
+         *     next to it, for the same reason: this is a reading of the project's own usage, and
+         *     the placement rows it counts are already readable by `runlot_public`.
+         *
+         *     **It reports how much, never which.** There is no actor id and no owner id in the
+         *     answer, and none is coming: those name individual objects, and an endpoint that
+         *     listed them would be an object enumeration wearing a quota's name. A viewer asking
+         *     "am I near my limit" is answered by the counts and the per-node breakdown; a viewer
+         *     asking "what objects exist" is asking the application, which is the only thing that
+         *     knows what its ids mean.
+         *
+         *     A project that has placed nothing answers `count: 0` and an empty `nodes` object.
+         *     That is the answer, not an error.
+         *
+         *     Placing a **new** object once `count` has reached `limit` is refused with 409 and
+         *     the code `object_capacity`; objects that already exist go on resolving and being
+         *     served. **It is a limit on growth, not an outage.**
+         */
+        get: operations["getProjectDurableObjects"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/queues/{queue}/runs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * One queue's batch history
+         * @description Requires viewer or higher. Newest first. The same rows `getProjectQueues` returns,
+         *     narrowed to one queue — for a project whose busy queue would otherwise fill the page.
+         */
+        get: operations["listQueueRuns"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/queues/{queue}/messages": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * The next messages, without leasing them (`runlot queue peek`)
+         * @description Requires member. Reads the head of the queue in delivery order and **takes no
+         *     lease**, so looking cannot delay a delivery. Each row carries a `preview` — the
+         *     body clipped to 200 characters, or `<n bytes>` for a binary body — never the body
+         *     itself. A queue whose schema is not installed yet answers an empty list.
+         */
+        get: operations["peekQueue"];
+        put?: never;
+        post?: never;
+        /**
+         * Empties the queue (`runlot queue purge`)
+         * @description Requires member. Deletes every message in the queue — visible, delayed and in
+         *     flight — and answers with the count. **It is irreversible and there is no
+         *     confirmation on the server**: the CLI asks for one (or `--yes`) and the dashboard
+         *     asks for the queue's name typed back. A member can already run the same `DELETE`
+         *     from psql with the credential `…/database/connect` hands out, so a server-side
+         *     guard would protect nothing. The purge is audited with the count.
+         */
+        delete: operations["purgeQueue"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/queues/{queue}/redrive": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Moves a dead-letter queue's messages back (`runlot queue redrive`)
+         * @description Requires member. `{queue}` is the **dead-letter queue**. Every message in it that
+         *     is not in flight moves to the destination with `attempts` reset to 0 — a redriven
+         *     message gets the full retry budget of the queue it goes back to, which is the
+         *     intended cost: redriving is a decision a person makes after fixing something.
+         *
+         *     The destination is the consumer whose `deadLetterQueue` this is, read from the live
+         *     manifest. When two consumers share one dead-letter queue, or the queue is nobody's
+         *     dead-letter queue, `to` is required (`400`). The redrive is audited with the count.
+         */
+        post: operations["redriveQueue"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/rollback": {
         parameters: {
             query?: never;
@@ -832,6 +1178,55 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/database/execute": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Run one statement (the dashboard's SQL console)
+         * @description **This is not a second Postgres surface.** `runlot pg execute` deliberately does not
+         *     go through the control plane — SQL rides the wire, so the path we test is the path the
+         *     customer uses (`web/apps/cli/src/pg.ts`). A browser cannot speak the wire protocol, so
+         *     this route exists for the dashboard console, and it is itself **a wire client**: it
+         *     dials the same hostname, port and `sslmode` that `…/database/connect` hands a member
+         *     for psql, using that same credential. Every rule that lives on the wire — the SNI pin,
+         *     the epoch check, the commit gate, the 10 s statement ceiling — applies because the
+         *     statement goes through them, not around them. Nothing here sets `statement_timeout`.
+         *
+         *     `readOnly` defaults to **true**, and absent means true: a plain boolean would make
+         *     "the client forgot the field" and "the user asked for write mode" the same request.
+         *     Read-only mode runs inside `BEGIN … READ ONLY` and **rolls back unconditionally** —
+         *     there is no branch where it commits. The mode is enforced here rather than in the
+         *     browser, because a toggle that only exists in a tab is one a stale tab has lost.
+         *
+         *     Values come back as **strings or null**, never JSON numbers: a bigint past 2^53 would
+         *     arrive rounded, and a console that silently changes the digits of an id is worse than
+         *     one that shows them as text. `NULL` is `null` and the empty string is `""`.
+         *
+         *     At most 500 rows are listed. The cap is on the response, **not appended to the
+         *     statement** — a console that runs something other than what is in the editor is worse
+         *     than one that truncates — so `rowCount` still reports what the statement did and
+         *     `truncated` says the listing was cut.
+         *
+         *     member or above, the same as `…/database/connect`: that route already hands a member
+         *     the password for psql, so this one opens no power the role did not have. A write
+         *     leaves a `db.execute` audit line; a read leaves none.
+         */
+        post: operations["executeSQL"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/database/export": {
         parameters: {
             query?: never;
@@ -899,6 +1294,29 @@ export interface paths {
          *
          *     **Does not require the database to be enabled.** Because a final safety generation
          *     remains even after `pg delete`, you can still see it in this list after deletion.
+         *
+         *     **`objects` is the Durable Object half of the same history** (0078,
+         *     docs/durable-objects.md §3, §5 O4). It is in this response rather than behind a
+         *     second endpoint because a project's restorable state is the **union** of the two, and
+         *     a caller that has to discover the object half separately is a caller that ships a
+         *     restore screen showing only the database and calls it the backup.
+         *
+         *     **The two halves share no clock and `objects.atomic` is always `false`.** The
+         *     database's generations and each node's object components are timed independently and
+         *     nothing coordinates them (docs/durable-objects.md §7: "no atomic backup across objects
+         *     and the database"). `objects.restorable` is `objects.available && objects.complete`:
+         *     the restore fan-out's own preflight refuses outright when `missing` or `gaps` is
+         *     non-empty, so `restorable=false` means that refusal. `restorable=true` means only that
+         *     the catalog is eligible — it is checked ahead of paying for a restore's drain and seal,
+         *     not a promise that the restore will succeed: the call can still fail afterward on the
+         *     environment or on a holder's own local store (unreachable node, a lost or corrupted
+         *     on-disk archive, a digest mismatch found only when the file is read).
+         *
+         *     **`objects` here is selected at one `at` for the whole project (default now), not per
+         *     generation.** A restore targets one specific `(epoch, seq)` generation with its own
+         *     `lastAt`; to know whether the object half is eligible **for that generation**, query
+         *     this endpoint again with `?at=<that generation's lastAt>` rather than reading the
+         *     default response — the two can disagree.
          */
         get: operations["listGenerations"];
         put?: never;
@@ -932,6 +1350,22 @@ export interface paths {
          *     **Writes made in between are lost.** That is why this requires admin or higher, and the
          *     CLI asks you to re-enter the project name.
          *
+         *     **If the project has Durable Objects, the same operation restores them too.** Every
+         *     affected holder is fenced, its own way back is archived, its exact selected component
+         *     is installed (or, for placements that postdate the restore target, cleared and the
+         *     placement removed) — all before the database side commits. An uncovered or missing
+         *     object component refuses the whole restore, database included, rather than rolling
+         *     back only part of the project.
+         *
+         *     **Check `objects.restorable` before calling this — but for the generation you are
+         *     about to pass, not at whatever `at` the list happened to return.** Query
+         *     `…/database/generations?at=<the chosen generation's lastAt>` first: the object half
+         *     is selected on its own `at`, independent of which `(epoch, seq)` you send here, and a
+         *     `restorable=true` read at the wrong instant answers a different question than the one
+         *     this call is about to act on. Even a correctly-timed `restorable=true` is catalog
+         *     eligibility, not a guarantee — the operation itself can still fail on the environment
+         *     or on a holder's own local store after it starts.
+         *
          *     **The server never resolves `latest`.** You must pass the exact `(epoch, seq)` you saw
          *     in the list — if the server picked "the most recent" itself, a scheduled generation
          *     created in the meantime could send you to a different generation than the one you saw.
@@ -1076,8 +1510,11 @@ export interface paths {
          *     until the client disconnects. A `ping` arrives every 15 seconds — this keeps proxies
          *     from closing an idle connection, and lets the client tell whether the stream is dead.
          *
-         *     **Not stored logs.** Only the most recent lines in node memory; if the process is
-         *     replaced, the `runlot` stream records that fact in a single line (prod-gap).
+         *     **This endpoint is the live lane and reads node memory only.** The lines are also
+         *     shipped to the control plane and kept there — ask `…/logs/history` for anything
+         *     older than the ring (2,000 lines / 1 MiB, cleared when the node-agent restarts).
+         *     The two lanes are independent on purpose: a tail must not wait on a database
+         *     write, and a history must not disappear when a process is replaced.
          *
          *     Requires member or higher. Read-only, so it does not leave an audit event.
          */
@@ -1090,6 +1527,47 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/logs/history": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Stored worker output (`runlot logs --since`)
+         * @description Searches the lines the node shipped to the control plane (0062,
+         *     docs/plan-parity.md §11). Unlike the live tail this does not reach a node at all,
+         *     so it answers for a project that is cold, parked, or has moved since the lines
+         *     were written.
+         *
+         *     **Retention is by plan: Free keeps 3 days, Pro keeps 7 days.** Past that the
+         *     sweep deletes the rows, and there is no way to get them back — ship anything you
+         *     need to keep to your own store from the worker.
+         *
+         *     **There is a daily cap per project: Free 200,000 lines/day, Pro 2,000,000
+         *     lines/day**, counted on the UTC day. Past it the live tail carries on unchanged
+         *     and storing stops, with one `runlot`-stream line saying so:
+         *     `runlot: daily log cap reached (200000 lines); further lines today are dropped`.
+         *
+         *     Newest first, keyset-paginated: pass the `cursor` from a response back to get the
+         *     next page. An absent `cursor` in the response means there is nothing older.
+         *
+         *     Requires member or higher — the same role as the live tail, because these are the
+         *     same lines. Read-only, so it does not leave an audit event.
+         */
+        get: operations["getLogHistory"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/secrets": {
         parameters: {
             query?: never;
@@ -1235,7 +1713,68 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/ai/models": {
+    "/v1/orgs/{orgSlug}/projects/{projectName}/storage/public": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * The published key prefixes (`runlot storage public list`)
+         * @description The key prefixes this project serves **unsigned** at
+         *     `https://objects.runlot.io/<org>/<project>/<key>` (docs/storage.md §4.7).
+         *
+         *     A stored prefix is normalized: `assets` becomes `assets/`, and `/` becomes the empty
+         *     string, which means every key in the project's slice. Matching is a plain string prefix
+         *     test, so the trailing slash is what keeps `assets` from also opening
+         *     `assets-private/`.
+         *
+         *     viewer or above — somebody who cannot see which of their files are public cannot audit
+         *     their own project.
+         */
+        get: operations["listStoragePublic"];
+        put?: never;
+        /**
+         * Publish a key prefix (`runlot storage public add`)
+         * @description Makes every key under this prefix readable by anyone, with no signature, over HTTPS.
+         *     The bucket itself stays private — the front reads with our credentials **after**
+         *     checking this list, so a change to the storage backend's own policy cannot widen it.
+         *
+         *     It is idempotent, and it answers with the whole list so that a screen never has to guess
+         *     what the list became.
+         *
+         *     At most 20 prefixes per project. The bound is there because this is a security list and
+         *     a list nobody reads whole is where the accidental entry survives.
+         *
+         *     **admin and above.** Publishing makes a project's bytes readable by the internet, which
+         *     belongs in the same column as a revoke rather than a deploy. Audited as
+         *     `storage.public.add` — and the audit line records what was typed as well as what was
+         *     stored, because normalization means the two differ.
+         */
+        post: operations["addStoragePublic"];
+        /**
+         * Unpublish a key prefix (`runlot storage public rm`)
+         * @description The prefix travels in the body rather than the path because a prefix contains slashes,
+         *     and a path segment would need encoding that half the clients get wrong.
+         *
+         *     Idempotent — removing one that is not there is a 200 with the unchanged list.
+         *
+         *     **The world keeps reading for up to 60 seconds.** The object front caches the list with
+         *     that TTL, so this call is not a revocation that takes effect the instant it returns.
+         *
+         *     admin and above. Audited as `storage.public.remove`.
+         */
+        delete: operations["removeStoragePublic"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ai/models": {
         parameters: {
             query?: never;
             header?: never;
@@ -1491,6 +2030,107 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/email/domains": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Custom sending domains (`runlot email domain list`)
+         * @description The project's own sending domains and their verification state (docs/email.md §2.4).
+         *     Each row carries the DNS records to publish — they are computed and served so the
+         *     dashboard, the CLI, and the docs cannot drift apart.
+         *
+         *     viewer or above.
+         */
+        get: operations["listEmailDomains"];
+        put?: never;
+        /**
+         * Adds a custom sending domain (`runlot email domain add`)
+         * @description Creates the mail provider's identity for the domain with Easy DKIM and answers with the
+         *     records to publish: three `<token>._domainkey.<domain>` CNAMEs (required), an SPF `TXT`
+         *     and a DMARC `TXT` (both advisory). The domain becomes usable in
+         *     `env.email.send({ from })` only once it reads `verified`.
+         *
+         *     `publish: true` writes the records straight into the zone when we host one covering the
+         *     domain and it belongs to the same organization. Records the customer wrote themselves
+         *     are never overwritten.
+         *
+         *     A repeat call is not an error and does not change the tokens — records already published
+         *     stay correct. Requires member or higher. Audited as `email.domain.add`.
+         */
+        post: operations["addEmailDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/email/domains/{domain}/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                domain: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Re-checks a sending domain now (`runlot email domain verify`)
+         * @description Asks the mail provider for the identity's DKIM state and moves the row. A background
+         *     loop does the same once a minute while a domain is pending; this is the button for
+         *     somebody who just published the records and does not want to wait.
+         *
+         *     A provider outage leaves the state where it is and puts the reason in `lastError` — an
+         *     outage on our side must not fail a customer's domain.
+         *
+         *     Requires member or higher.
+         */
+        post: operations["verifyEmailDomain"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/email/domains/{domain}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                domain: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Removes a sending domain (`runlot email domain rm`)
+         * @description Deletes the provider identity and the row, and removes any records we wrote into a zone
+         *     we host. From the next convergence every `env.email.send({ from })` naming this domain
+         *     is refused with `from_not_verified`.
+         *
+         *     Removing one that is not there is also a 204. Requires admin or higher. Audited as
+         *     `email.domain.remove`.
+         */
+        delete: operations["removeEmailDomain"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/email/log": {
         parameters: {
             query?: never;
@@ -2807,6 +3447,188 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/repos/{repoName}/deploy-hook": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Push-to-deploy settings (`runlot repo hook status`)
+         * @description Requires viewer or higher.
+         *
+         *     `configured` is false when no hook has ever been set. It is separate from `enabled`
+         *     because "never set up" and "set up and switched off" are different sentences — when
+         *     no hook exists, `branch` carries the repository's default branch as the value a form
+         *     should offer.
+         */
+        get: operations["getDeployHook"];
+        /**
+         * Turn push-to-deploy on or change it (`runlot repo hook set`)
+         * @description Requires **admin**, unlike deploying, which is member.
+         *
+         *     Turning the hook on converts every future push to `branch`, by anyone with write
+         *     access, into a production deploy — and it does so under the identity of whoever
+         *     turned it on. That is a standing grant, which is why a `deploy`-scoped token cannot
+         *     make one.
+         *
+         *     An omitted field keeps its current value, so a screen can send the switch and the
+         *     branch separately without one resetting the other.
+         */
+        put: operations["setDeployHook"];
+        post?: never;
+        /**
+         * Turn push-to-deploy off entirely (`runlot repo hook unset`)
+         * @description Requires admin. Removes the row. Past builds are kept — they produced the
+         *     deployments that are still serving.
+         */
+        delete: operations["deleteDeployHook"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/repos/{repoName}/deploy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Build and deploy a commit without pushing
+         * @description Requires member. Queues a build of `commitSha`, or of the hooked branch's tip when
+         *     it is omitted.
+         *
+         *     It admits through the same gate a push does, so a repository whose hook is off or
+         *     missing answers `409 deploy_hook_off` rather than building anyway — a build with no
+         *     hook has no root directory and no owner to deploy as, and inventing defaults for
+         *     both would be a second, undocumented configuration.
+         */
+        post: operations["deployRepoNow"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/builds": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Build history (`runlot builds list`)
+         * @description Requires viewer or higher. Newest first, queued builds at the top.
+         *
+         *     The month's build minutes ride along because the screen that draws the list is the
+         *     screen that has to say how many are left — a second request for one number is a
+         *     second thing that can fail on a page that already has the data one join away.
+         *
+         *     **The log is not in the rows.** A log is up to 1 MiB and a page draws twenty of
+         *     them; `/builds/{buildId}/log` is where it lives.
+         */
+        get: operations["listBuilds"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/builds/{buildId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                buildId: string;
+            };
+            cookie?: never;
+        };
+        /** One build (`runlot builds show`) */
+        get: operations["getBuild"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/builds/{buildId}/log": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                buildId: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * A build's output (`runlot builds log`)
+         * @description Requires viewer or higher. **`text/plain`, not JSON** — it is subprocess output with
+         *     newlines, and wrapping a megabyte of it in a JSON string doubles its size in escapes
+         *     and forces the client to parse before it can show the first line.
+         *
+         *     Capped at 1 MiB with the **tail** kept, because the end of a failed build is where
+         *     the error is. When the cap bit, the first line says so.
+         */
+        get: operations["getBuildLog"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/builds/{buildId}/cancel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                buildId: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Cancel a queued build (`runlot builds cancel`)
+         * @description Requires member. **Only a queued build can be cancelled.** A running one holds a
+         *     subprocess this API cannot reach, and answering "cancelled" while npm keeps running
+         *     would be the worst of the three possible answers. It stops on its own at 20 minutes.
+         */
+        post: operations["cancelBuild"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/me/ssh-keys": {
         parameters: {
             query?: never;
@@ -2877,6 +3699,14 @@ export interface paths {
          *     git sends Basic auth over HTTPS, and we ignore the username and only look at the token
          *     in the password field (§5.2). The prefix `runlot_pat_` is fixed — it needs to be
          *     mechanically detectable in repositories, logs, and pastes for leak scanning to work.
+         *
+         *     The token is narrowed on three axes, and they are separate because they fail separately:
+         *     a `scopes` set, an org/project restriction, and an expiry. The default expiry is
+         *     **90 days** and the ceiling is 365; `noExpiry` is the only way to get a credential with
+         *     no deadline, spelled out so that one cannot be created by leaving a field off.
+         *
+         *     The restriction is resolved through the same membership gate every other route uses, so
+         *     a token cannot be pinned to an org its issuer is not a member of.
          */
         post: operations["createAccessToken"];
         delete?: never;
@@ -3053,33 +3883,126 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-}
-export type webhooks = Record<string, never>;
-export interface components {
-    schemas: {
-        RepoRefs: {
-            /**
-             * @description **The HEAD on disk is authoritative.** `Repo.defaultBranch` is a copy of it, and if
-             *     they diverge, this value is correct (0032_repos.sql).
-             */
-            defaultBranch: string;
-            refs: {
-                name: string;
-                /**
-                 * @description The **commit** oid it points to. Annotated tags are peeled — returning the tag
-                 *     object's oid would make the screen fail when it tries to open it as a commit.
-                 */
-                target: string;
-                /** @enum {string} */
-                kind: "branch" | "tag";
-            }[];
+    "/v1/orgs/{orgSlug}/projects/{projectName}/previews": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
         };
-        RepoTreeEntry: {
-            name: string;
-            /** @description path relative to the repository root */
-            path: string;
-            /** @enum {string} */
-            kind: "dir" | "file" | "symlink" | "submodule";
+        /**
+         * The project's live previews
+         * @description Requires viewer or higher. `projectName` is the **parent**; a preview is not
+         *     addressable as a project here, which is the same rule that keeps it out of
+         *     `listProjects` (docs/preview.md §3.3).
+         *
+         *     Deleted previews are not listed. A preview that expired is gone, and saying so
+         *     with a row a caller then has to filter out only moves the filter.
+         */
+        get: operations["listPreviews"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/previews/{previewName}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                previewName: components["schemas"]["Slug"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete a preview and its branch
+         * @description Requires member or higher. This runs the **project delete operation** on the child
+         *     project rather than a teardown of its own, so the store, the placement, the
+         *     hostname, the artifacts and the DEK all go by the path that already knows how to
+         *     take them down (docs/preview.md §8).
+         *
+         *     It answers 204 as soon as the teardown is under way. Unlike `deleteProject` there
+         *     is no confirmation string: a preview is a copy taken at a moment, and nothing in it
+         *     is the only copy of anything.
+         */
+        delete: operations["deletePreview"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/previews/{previewName}/promote": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                previewName: components["schemas"]["Slug"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Make the preview's code production's live deployment
+         * @description Requires member or higher. Takes the preview's **artifact** and commits it as a new
+         *     deployment of the parent — a new version number, the same bundle sha. It is the
+         *     deploy path minus the upload.
+         *
+         *     **It does not touch either database, in either direction** (docs/preview.md §7).
+         *     The branch is not merged into production and production is not replaced by the
+         *     branch. Someone who wants the branch's data uses `getExport` or a restore; neither
+         *     of those hides inside a command whose name is about deployment.
+         *
+         *     The preview stays alive afterwards — deleting it would erase the thing the caller
+         *     is looking at at the moment they decide it was right.
+         */
+        post: operations["promotePreview"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        RepoRefs: {
+            /**
+             * @description **The HEAD on disk is authoritative.** `Repo.defaultBranch` is a copy of it, and if
+             *     they diverge, this value is correct (0032_repos.sql).
+             */
+            defaultBranch: string;
+            refs: {
+                name: string;
+                /**
+                 * @description The **commit** oid it points to. Annotated tags are peeled — returning the tag
+                 *     object's oid would make the screen fail when it tries to open it as a commit.
+                 */
+                target: string;
+                /** @enum {string} */
+                kind: "branch" | "tag";
+            }[];
+        };
+        RepoTreeEntry: {
+            name: string;
+            /** @description path relative to the repository root */
+            path: string;
+            /** @enum {string} */
+            kind: "dir" | "file" | "symlink" | "submodule";
             /**
              * Format: int64
              * @description files only. directories are 0
@@ -3132,12 +4055,42 @@ export interface components {
          */
         RepoVisibility: "private" | "public";
         /**
-         * @description A token **inherits the user's permissions but can only lower them** (§5.2). There is no
+         * @description The **git** verdict for a token, derived from `scopes` when it is issued (0067). A token
+         *     **inherits the user's permissions but can only lower them** (§5.2). There is no
          *     arithmetic in the raising direction.
+         *
+         *     `repo:none` is a token carrying no repository scope at all — a deploy-only CI
+         *     credential. It clones nothing private and pushes nothing.
          * @default repo:write
          * @enum {string}
          */
-        TokenScope: "repo:read" | "repo:write";
+        TokenScope: "repo:read" | "repo:write" | "repo:none";
+        /**
+         * @description One permission a personal access token carries. The set is checked on **every** route:
+         *     the token acts as its owner, so the org role is read exactly as it is for a browser
+         *     session, and the scope then narrows what that person may do with this particular
+         *     credential.
+         *
+         *     | scope | what it opens |
+         *     |---|---|
+         *     | `project:read` | projects, deployments, logs, usage, secret *names*, cron, queues (overview, history, peek), hostnames, the deployment access policy |
+         *     | `deploy` | deploy, rollback, create a project, write and delete secrets, purge and redrive a queue |
+         *     | `db:read` | the connection string, the wire credentials list, generations, operations |
+         *     | `db:write` | issue a wire credential, export, restore, drop the database. Implies `db:read` |
+         *     | `repo:read` | clone and fetch over HTTPS, and the repository browse routes |
+         *     | `repo:write` | push, and create, rename or delete a repository. Implies `repo:read` |
+         *     | `org:admin` | everything the person can do — members, billing, domains, DNS, granting storage/email/AI |
+         *
+         *     A route that carries no entry in the table requires `org:admin`. That is deliberate: a
+         *     route nobody mapped must not be silently reachable by the narrowest token in the system.
+         *
+         *     **`deploy` does not carry `project:read`.** `project:read` opens the worker's logs, and
+         *     logs are where a printed secret ends up — a credential left in a CI runner should not
+         *     also read them unless that was asked for. A CI token names both:
+         *     `--scope deploy --scope project:read`.
+         * @enum {string}
+         */
+        ApiScope: "project:read" | "deploy" | "db:read" | "db:write" | "repo:read" | "repo:write" | "org:admin";
         Repo: {
             /** Format: uuid */
             repoId: string;
@@ -3190,6 +4143,61 @@ export interface components {
             /** Format: date-time */
             createdAt: string;
         };
+        DeployHook: {
+            enabled: boolean;
+            /**
+             * @description The branch a push has to update for a build to start. When `configured` is
+             *     false this is the repository's default branch — the value a form should offer,
+             *     not a setting that exists.
+             * @example main
+             */
+            branch: string;
+            /**
+             * @description The subdirectory the build runs in. Empty is the repository root.
+             * @example apps/web
+             */
+            rootDir: string;
+            /** @description False when no hook row exists. `enabled: false` with `configured: true` is a hook that was set up and switched off. */
+            configured: boolean;
+            /** Format: date-time */
+            updatedAt?: string | null;
+        };
+        Build: {
+            /** Format: uuid */
+            buildId: string;
+            /** @example 9f2c1ab4e7d05c3b8a6f14d29e0b7c5a3d81f6e2 */
+            commitSha: string;
+            /** @example main */
+            branch: string;
+            /**
+             * @description `cancelled` is deliberately not `failed`: a person stopped it, or a newer push
+             *     for the same branch superseded it while it was still queued. Writing a designed
+             *     outcome down as a failure is how a healthy system reads as a broken one.
+             * @enum {string}
+             */
+            state: "queued" | "building" | "succeeded" | "failed" | "cancelled";
+            /**
+             * @description A **code**, empty on success — `timeout`, `clone_failed`, `no_build_script`,
+             *     `install_failed`, `build_failed`, `deploy_failed`, `minutes_exhausted`,
+             *     `toolchain_missing`, `superseded`, `cancelled`, `internal`. It is a code and not
+             *     a sentence because the screen that renders it is trilingual. The sentence is in
+             *     the log.
+             */
+            error: string;
+            /** @description Wall-clock minutes of a builder slot — not CPU. What the control plane spends is a slot for a duration. */
+            minutes: number;
+            /** Format: date-time */
+            startedAt?: string | null;
+            /** Format: date-time */
+            finishedAt?: string | null;
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: uuid
+             * @description Set only on success, and it is the success marker — a build that produced a deployment has it.
+             */
+            deploymentId?: string | null;
+        };
         SSHKey: {
             /** Format: uuid */
             keyId: string;
@@ -3216,11 +4224,26 @@ export interface components {
             tokenId: string;
             name: string;
             scope: components["schemas"]["TokenScope"];
+            /** @description The authoritative permission set. `scope` above is the git projection of it. */
+            scopes: components["schemas"]["ApiScope"][];
+            /**
+             * @description The org this token is restricted to, as a **slug**. `null` means no restriction.
+             *     The list answers with names rather than ids because it is read by a person deciding
+             *     whether to revoke, and an id is not a fact that person can act on.
+             */
+            org?: string | null;
+            /** @description The project this token is restricted to. Implies `org`. */
+            project?: string | null;
             /** Format: date-time */
             createdAt: string;
             /** Format: date-time */
             expiresAt?: string | null;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description Written at most **once per minute per token**. A pipeline polling an operation every
+             *     second must not put a row write on the path of a read, so this value can lag real
+             *     use by up to a minute.
+             */
             lastUsedAt?: string | null;
             /** Format: date-time */
             revokedAt?: string | null;
@@ -3230,6 +4253,9 @@ export interface components {
             tokenId: string;
             name: string;
             scope: components["schemas"]["TokenScope"];
+            scopes: components["schemas"]["ApiScope"][];
+            org?: string;
+            project?: string;
             /**
              * @description **Plaintext. Carried in this response only once.** The server stores only the
              *     SHA-256 hash, so it cannot be recreated.
@@ -3258,16 +4284,71 @@ export interface components {
                 };
             };
         };
+        /**
+         * @description A finished login **or half of one**.
+         *
+         *     When the account has a confirmed authenticator (docs/dashboard-auth.md §10) the
+         *     first factor does not mint a session: `token` and `user` are absent, and `mfa`
+         *     and `pending` are present instead. Carry `pending` to `POST /v1/auth/totp` with
+         *     the six-digit code to get the real session.
+         *
+         *     The two shapes never appear together — a body holding both a token and an `mfa`
+         *     marker would let a careless client take the token and skip the factor.
+         */
         Session: {
-            token: string;
-            /** Format: date-time */
+            token?: string;
+            /**
+             * Format: date-time
+             * @description When the session expires — or, on an `mfa` response, when `pending` does
+             */
             expiresAt?: string;
-            user: components["schemas"]["User"];
+            user?: components["schemas"]["User"];
+            /**
+             * @description The second factor this account owes. Present only on a half-finished login
+             * @enum {string}
+             */
+            mfa?: "totp";
+            /**
+             * @description A five-minute token that stands for the completed first factor. It is **not** a
+             *     session: no other endpoint accepts it.
+             */
+            pending?: string;
         };
         AuthEmailAccepted: {
             /** @constant */
             accepted: true;
         };
+        TotpStatus: {
+            /** @description A confirmed authenticator stands in front of every login to this account */
+            enabled: boolean;
+            /**
+             * @description A secret was generated and never confirmed. The screen says so rather than
+             *     silently offering a fresh QR, which would invalidate the one already scanned.
+             */
+            enrollmentPending: boolean;
+            /** Format: date-time */
+            enabledAt?: string;
+            /** @description Unused recovery codes. They are argon2id-hashed, so there is no endpoint that lists them again */
+            recoveryCodesLeft: number;
+            /** @description Slugs of this person's organizations that require the second factor */
+            orgsRequiring: components["schemas"]["Slug"][];
+        };
+        TotpEnrollment: {
+            /** @description The base32 shared secret, for an app that cannot scan. It is readable here and nowhere else */
+            secret: string;
+            /**
+             * @description `otpauth://totp/runlot:<email>?secret=…&issuer=runlot` — the string the QR encodes
+             * @example otpauth://totp/runlot:ryan@example.com?algorithm=SHA1&digits=6&issuer=runlot&period=30&secret=JBSWY3DPEHPK3PXP
+             */
+            uri: string;
+        };
+        TotpRecoveryCodes: {
+            /**
+             * @description Ten one-time codes, **shown once**. They are stored as argon2id hashes, so this
+             *     response is the only place they are ever readable.
+             */
+            recoveryCodes: string[];
+        };
         User: {
             /** Format: uuid */
             userId: string;
@@ -3292,6 +4373,22 @@ export interface components {
         OrgMembership: components["schemas"]["Org"] & {
             /** @enum {string} */
             role: "admin" | "member" | "viewer";
+            /**
+             * Format: int64
+             * @description This plan's daily request budget (Free 100,000). The overview's request chart
+             *     draws it as the dashed cap line — the same derived-value reasoning as
+             *     `projectLimit`: the table belongs to the CP.
+             *
+             *     **0 means there is no daily budget**, which is what the paid plans answer. It is
+             *     not "the budget is zero", and a chart that drew a line at 0 would paint every
+             *     paid project as permanently over.
+             */
+            requestsPerDay: number;
+            /**
+             * Format: int64
+             * @description This plan's daily CPU budget in milliseconds (Free 1,000,000). 0 means no daily budget.
+             */
+            cpuMsPerDay: number;
             /**
              * @description This org's plan (docs/limits.md §1)
              * @enum {string}
@@ -3314,6 +4411,13 @@ export interface components {
              *     Nothing rejects a write at the cap; see `/docs/data/database/size-cap`.
              */
             dbCapBytes: number;
+            /**
+             * @description This organization requires two-factor authentication of its members
+             *     (migration 0066). It rides here for the same reason as `projectLimit`: the
+             *     banner that tells a member to enroll is drawn by a screen already holding
+             *     this response.
+             */
+            requireTotp?: boolean;
         };
         Notification: {
             /** Format: int64 */
@@ -3324,7 +4428,7 @@ export interface components {
              *     email templates.
              * @enum {string}
              */
-            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "backup_failed" | "cron_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled";
+            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled";
             /** @description If this is a project-related notification, the name of that project. Absent for org-level notifications (`project_limit`) */
             projectName?: string;
             /** @description A deduplication key per kind. Only one is created per (kind, key) in 24 hours. */
@@ -3332,8 +4436,9 @@ export interface components {
             /**
              * @description A few numbers that differ by kind. `project_limit` is `{limit, count}`,
              *     a usage alert is `{bytes, capBytes}`, an operation alert is
-             *     `{opId, opKind, reason?}`, and `cron_failed` is
-             *     `{cron, reason, scheduledAt}`.
+             *     `{opId, opKind, reason?}`, `cron_failed` is
+             *     `{cron, reason, scheduledAt}`, `queue_failed` is `{queue, reason, runs}` and
+             *     `queue_ops_cap` is `{used, limit, plan}`.
              */
             detail: {
                 [key: string]: unknown;
@@ -3473,6 +4578,73 @@ export interface components {
             /** @description Whether the deployment shipped with uncommitted changes. If true, `gitCommit` is not exactly the code. */
             gitDirty?: boolean;
         };
+        /**
+         * @description One preview of a project (docs/preview.md). A preview is a **child project row**,
+         *     so placement, routing, parking, the access policy and usage metering all treat it
+         *     as a project; this schema carries only what is *about being a preview* — which
+         *     parent, which database mode, when it expires.
+         *
+         *     Creating one over the plan's per-project limit answers **409 `preview_limit`**.
+         */
+        Preview: {
+            /** Format: uuid */
+            previewId: string;
+            /** @description What the user called it (`--preview feat-42`). */
+            name: components["schemas"]["Slug"];
+            /**
+             * @description `<preview>--<project>.<org>.<app-domain>`. One label under the org, because the
+             *     per-org certificate is the wildcard `*.<org>.<app-domain>` and a wildcard covers
+             *     exactly one label — a third label would sit outside its own org's certificate
+             *     (docs/preview.md §3.2).
+             * @example feat-42--shop.wickedev.runlot.app
+             */
+            hostname: string;
+            /** @description `https://` + `hostname`. Built by the CP so the local shape cannot leak into a client. */
+            url?: string;
+            /**
+             * @description `branch` is its own store poured from the parent's generation; `shared` runs
+             *     against **production's** database, so a destructive statement in the preview is
+             *     destructive in production; `none` has no `env.db`.
+             * @enum {string}
+             */
+            dbMode: "branch" | "shared" | "none";
+            /**
+             * @description `creating` is not cosmetic — pouring a chain takes as long as a restore, and a
+             *     hostname answering 503 with nothing to read during it is the shape of every "is
+             *     it broken" question. Render this rather than guessing from whether the hostname
+             *     answers.
+             * @enum {string}
+             */
+            state: "creating" | "ready" | "failed" | "deleted";
+            /**
+             * Format: uuid
+             * @description What is serving on the preview. Null between creating the row and committing the first deployment.
+             */
+            deploymentId?: string | null;
+            /** @description The preview's own version counter. It is not the parent's, and promoting does not carry it over. */
+            version?: number | null;
+            /**
+             * @description The generation the branch was poured from. Null for `shared` and `none`, and for
+             *     a branch of a project that had taken no generation yet — an empty store is a
+             *     legitimate branch of a database nobody has written to.
+             */
+            sourceGeneration?: string | null;
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Derived from `lastRequestAt` and the org's **current** plan and recomputed on
+             *     every touch, so upgrading the plan extends previews that already exist.
+             */
+            expiresAt?: string | null;
+            /**
+             * Format: date-time
+             * @description The TTL runs from here, not from `createdAt` — the difference between "your
+             *     preview vanished while you were using it" and "your preview vanished because you
+             *     stopped". It starts at `createdAt`, so one that was never opened still expires.
+             */
+            lastRequestAt?: string;
+        };
         /**
          * @description One round of one schedule (docs/cron.md §8). A round that never started — an
          *     overlap, or one that came up past the grace period — is recorded too, with
@@ -3552,6 +4724,215 @@ export interface components {
              */
             keepDays: number;
         };
+        /**
+         * @description One delivered **batch** of one queue (docs/queues.md §5). One row per batch, not
+         *     per message: the four counters add up to the batch, and a batch that never reached
+         *     the handler has `delivered > 0` with zeros across the rest — which is what says the
+         *     messages went back to the queue untouched.
+         */
+        QueueRun: {
+            /** @example jobs */
+            queue: string;
+            /** Format: date-time */
+            startedAt: string;
+            /**
+             * Format: date-time
+             * @description Absent for a batch that never began (`outcome: skipped`).
+             */
+            finishedAt?: string;
+            /** @description Wall clock, wake included. null when nothing ran. */
+            durationMs?: number | null;
+            /** @description How many messages were leased into this batch. */
+            delivered: number;
+            acked: number;
+            retried: number;
+            /** @description How many left for the dead-letter queue, or were dropped because there is none. */
+            dead: number;
+            /**
+             * @description Split by who has to act, the same four as `CronRun.outcome`. `failed` is the
+             *     worker's code — it threw, or exports no `queue` handler. `error` never reached
+             *     the handler (no socket, a project that would not wake, a transport failure,
+             *     the wall-clock bound) and is ours. `skipped` is the poller deciding not to
+             *     deliver on purpose.
+             * @enum {string}
+             */
+            outcome: "ok" | "failed" | "error" | "skipped";
+            /**
+             * @description A code, never a sentence. For `failed` it is workerd's own outcome, untranslated
+             *     (`exception`, `canceled`). Ours are `no_socket`, `wake_failed`, `drive_failed`,
+             *     `timeout`, `consumers_changed`.
+             */
+            reason?: string;
+            /** @description One line of human-readable context when there is one. May be empty. */
+            detail?: string;
+        };
+        /** @description A consumer's declaration as the screen shows it — the manifest's numbers, defaults folded. */
+        QueueConsumer: {
+            /** @description 1–100, default 10. */
+            maxBatchSize: number;
+            /** @description Seconds, 1–60, default 5. */
+            maxBatchTimeout: number;
+            /** @description 0–10, default 3. */
+            maxRetries: number;
+            /** @description Where a message goes once it is out of retries. Absent means it is deleted instead. */
+            deadLetterQueue?: string;
+        };
+        /**
+         * @description Three numbers and not one total: a queue that is all `delayed` is working, and a
+         *     queue that is all `inflight` is stuck. A single depth cannot tell those apart.
+         */
+        QueueDepth: {
+            /**
+             * Format: int64
+             * @description Could be delivered right now.
+             */
+            visible: number;
+            /**
+             * Format: int64
+             * @description Waiting on its own delay or backoff.
+             */
+            delayed: number;
+            /**
+             * Format: int64
+             * @description Leased to a handler that has not answered yet.
+             */
+            inflight: number;
+        };
+        QueueStatus: {
+            /** @example jobs */
+            queue: string;
+            /** @description The binding names (`env.<BINDING>`) that send into this queue. */
+            producers: string[];
+            /** @description Absent for a queue nothing drains — a fan-out target, or a dead-letter queue nobody consumes. */
+            consumer?: components["schemas"]["QueueConsumer"];
+            /** @description The queues whose dead-letter queue this one is. Non-empty is what makes redrive apply to this row. */
+            deadLetterFor?: string[];
+            /** @description Absent when the project's database could not be read (`QueueOverview.depthError`). */
+            depth?: components["schemas"]["QueueDepth"];
+            /**
+             * Format: int64
+             * @description How many messages sit in this queue's dead-letter queue. Absent without one, or when the depth is unknown.
+             */
+            deadLetters?: number;
+            /** @description The most recent batch of this queue, taken from the whole history and not just the page below it. */
+            lastRun?: components["schemas"]["QueueRun"];
+        };
+        /** @description How the last `windowHours` went, counted by outcome. */
+        QueueSummary: {
+            /** @example 24 */
+            windowHours: number;
+            ok: number;
+            failed: number;
+            errored: number;
+            skipped: number;
+        };
+        QueueOverview: {
+            /** @description What the live deployment declares, in declaration order. Empty means no queues, not unknown. */
+            queues: components["schemas"]["QueueStatus"][];
+            /** @description Newest first, across every queue. */
+            runs: components["schemas"]["QueueRun"][];
+            summary: components["schemas"]["QueueSummary"];
+            /** @description How far back the history goes on this org's plan, in days (30 free, 365 pro). */
+            keepDays: number;
+            /**
+             * Format: int64
+             * @description The project's queue operations today (UTC). A send is one, a delivery is one. 0 when the depth could not be read.
+             */
+            opsToday: number;
+            /** @description The plan's daily bound (free 10,000, pro 1,000,000). Past it, `send` throws `QueueLimitError` until 00:00 UTC. */
+            opsCap: number;
+            /** @description Present when the project's database could not be read. The declarations and the history are still answered. */
+            depthError?: string;
+        };
+        /** @description One row as `peekQueue` shows it. `preview` is a clipped rendering of the body, never the body. */
+        QueueMessage: {
+            /** @description The row id, as a string. It names the row only while the row exists. */
+            id: string;
+            /** @description Deliveries so far in this queue. */
+            attempts: number;
+            /** @enum {string} */
+            contentType: "json" | "text" | "bytes";
+            /** Format: date-time */
+            enqueuedAt: string;
+            /**
+             * Format: date-time
+             * @description When it becomes deliverable. In the past for a visible message.
+             */
+            visibleAt: string;
+            /** @description Leased to a handler right now. */
+            inflight: boolean;
+            /** @description The first 200 characters of the body, or `<n bytes>` for a binary one. */
+            preview: string;
+        };
+        VectorNamespace: {
+            /** @example docs */
+            namespace: string;
+            /** Format: int64 */
+            count: number;
+            /** @description The width every vector in the namespace has. Absent when the namespace holds more than one width — a state the worker refuses to search. */
+            dimensions?: number;
+        };
+        /** @description Counts and sizes come from different places, and that difference is the shape of this schema. `count` is read from the placement map, which the control plane owns and which is always right. `bytes` and `files` are summed from reports the holding nodes push, which the control plane cannot compute and which can be missing or old. **That is why `complete` and `measuredAt` exist**, and why they are not decoration. */
+        DurableObjectUsage: {
+            /** @description How many Durable Objects this project has placed, across every node. */
+            count: number;
+            /** @description The project-wide cap. **It is an initial product cap**: nothing has been benchmarked to it, it is not a measured ceiling and not a competitive claim, and it is expected to move. */
+            limit: number;
+            /**
+             * Format: int64
+             * @description The stores' size, summed over the nodes that have reported. **Read it with `complete`.** When `complete` is false this is a lower bound over part of the fleet, not the project's size, and a screen showing it as a total shows a number that is wrong by an unknown amount in one direction.
+             */
+            bytes: number;
+            /** @description Store files counted, summed the same way and under the same caveat. It is **not** the object count — an object that has never written has no file — and both are kept because the two disagreeing is a fact worth being able to see. */
+            files: number;
+            /**
+             * @description Whether every node holding this project's objects has reported.
+             *     **A node that has never reported has an unknown size, not an empty one.** Summing its absence as zero would tell a user they are using nothing while their disk fills, so any holder without a report makes this false, and the answer then sums what is known and is a lower bound rather than a total.
+             *     A project with no objects at all is `true` with zero — there is nothing unmeasured. That case has to stay distinguishable from the one above.
+             */
+            complete: boolean;
+            /**
+             * Format: date-time
+             * @description The **oldest** measurement in the sum, and absent when nothing has been reported.
+             *     The oldest rather than the newest, because it is the one that bounds how stale the total is. Reporting the newest would let one node's fresh sweep make a total look current while another node's month-old number sat inside it.
+             */
+            measuredAt?: string;
+            /** @description The per-node breakdown, keyed by node id. It is here because `nodeLimit` is a separate bound that can refuse a placement while the project-wide cap still has room, and because a missing or stale measurement is a property of one node — a total alone cannot say which. */
+            nodes: {
+                [key: string]: {
+                    /** @description From the placement map, and always present. */
+                    count: number;
+                    /** Format: int64 */
+                    bytes: number;
+                    files: number;
+                    /**
+                     * Format: date-time
+                     * @description When that node took its measurement. **Absent means the node has not reported**, and then its `bytes` and `files` are zero because there is nothing to put there — not because the node holds nothing. The missing timestamp is what tells those two apart.
+                     */
+                    measuredAt?: string;
+                };
+            };
+            /** @description The per-node bound. Separate from `limit` on purpose: it protects one authority snapshot's owner mapping, and it stays where it is even when the product cap moves. */
+            nodeLimit: number;
+        };
+        VectorOverview: {
+            /** @description Every namespace with vectors in it, sorted by name. Empty means nothing stored, not unknown. */
+            namespaces: components["schemas"]["VectorNamespace"][];
+            /**
+             * Format: int64
+             * @description Vectors across every namespace. 0 when the store could not be read.
+             */
+            count: number;
+            /** @description The plan's bound on vectors per project (free 5,000, pro 25,000). Past it, `upsert` throws `VectorsError` with code `vector_limit`. */
+            limit: number;
+            /** @description The widest vector the store accepts (3,072). */
+            dimensionsMax: number;
+            plan: string;
+            /** @description Always true — search is exact k-NN in the worker; there is no approximate index. */
+            exact: boolean;
+            /** @description Present when the project's database could not be read. The bounds are still answered. */
+            readError?: string;
+        };
         DatabaseEndpoint: {
             host: string;
             port: number;
@@ -3682,16 +5063,81 @@ export interface components {
             lastCheckedAt?: string;
             /** @description Newest first. An empty array is an array, not `null` */
             generations: components["schemas"]["GenerationRow"][];
+            objects?: components["schemas"]["ObjectBackupSet"];
         };
         /**
-         * @description A single backup generation. The field names are **the same** as `GenerationRow` in
-         *     `internal/backupproto`. The actor metadata, the generation the node reports to the CP,
-         *     and the records included in this API must use the same names, so that a change in one
-         *     place is not silently interpreted as 0 elsewhere.
+         * @description What an object restore would select, beside the database generations it is **not**
+         *     consistent with (0078, docs/durable-objects.md §3, §5 O4).
+         *
+         *     **Unavailable is not empty.** If the control plane cannot be asked, `available` is
+         *     false, `complete` is false, and the lists are empty — the same distinction the Durable
+         *     Object usage view draws between unreported and zero. An empty list rendered as "no
+         *     object backups" when the truth is "we could not ask" tells a user their data is
+         *     unprotected, or lets them believe a restore would be complete. The database listing
+         *     still answers: a person asking what generations exist is not served by a 502 because a
+         *     second query failed.
          */
-        GenerationRow: {
-            /** Format: int64 */
-            epoch: number;
+        ObjectBackupSet: {
+            /** @description Whether the object half could be read at all. */
+            available: boolean;
+            /** @description **Always `false`.** A field rather than a sentence in a document, because a client that renders one restore time for the database and the objects is wrong and the only way to stop it being wrong by default is to hand it the disclaimer in the payload it is already parsing. */
+            atomic: boolean;
+            /** @description `available && complete` — catalog eligibility, not a success guarantee. The restore fan-out (`POST /orgs/{orgSlug}/projects/{projectName}/database/restore`) refuses outright when `missing` or `gaps` is non-empty, so `false` here means that refusal and the call is not worth attempting. `true` means only that the preflight would pass; the operation can still fail afterward on the environment (lifecycle disabled, no enforcement path) or on a holder's own local store (unreachable node, a lost or corrupted archive, a digest mismatch found only when the file is read). Also computed at this response's `at`, which is one instant for the whole project — a restore targets one generation's own `lastAt`, so re-query with `?at=<that generation's lastAt>` before trusting this field for that restore. */
+            restorable: boolean;
+            /** Format: date-time */
+            at?: string;
+            /** @description Every node holding an initialized object of this project. */
+            holders: string[];
+            /** @description The newest component at or before `at`, one per node. */
+            components: {
+                nodeId: string;
+                objectKey: string;
+                /**
+                 * Format: date-time
+                 * @description **This component's own time.** A surface above this one is required to show it: docs/durable-objects.md §5 O4 asks that "a project restored to 14:00 shows which hour each node's objects came from", which is only answerable if the time survives to the screen.
+                 */
+                takenAt: string;
+                /** Format: int64 */
+                bytes: number;
+                files: number;
+                manifestDigest: string;
+                required: boolean;
+            }[];
+            /** @description Initialized holders with nothing at or before `at`. **Their current bytes are not substituted** — a restore that quietly took live bytes for a historical component would return a combination that never existed. */
+            missing: string[];
+            /**
+             * @description Holders with an object initialized strictly after their selected component but
+             *     **at or before `at`** — the object existed at the restore target and the archive
+             *     has no file for it. An object initialized *after* `at` is not a gap: it did not
+             *     exist at the target, and a restore removes its placement through a controlled
+             *     delete instead of needing it covered.
+             *
+             *     It is separate from `missing` because the two mean different things to the person
+             *     reading the screen: `missing` is "this node has no backup", and this is "this
+             *     node's backup is from before some of its objects existed, and still are as of the
+             *     restore target". A restore to this point would leave those objects unopenable, and
+             *     the system has no way to withdraw their initialization.
+             */
+            gaps: {
+                nodeId: string;
+                objects: number;
+                /** Format: date-time */
+                since: string;
+            }[];
+            /** @description `available` with neither `missing` nor `gaps`. It means the pieces are identified and cover every object that existed at `at` — see `restorable` for whether the restore fan-out's preflight would accept them; neither field promises the restore itself will succeed. */
+            complete: boolean;
+            /** @description The retention window in days, from the org plan's value. */
+            keepDays: number;
+        };
+        /**
+         * @description A single backup generation. The field names are **the same** as `GenerationRow` in
+         *     `internal/backupproto`. The actor metadata, the generation the node reports to the CP,
+         *     and the records included in this API must use the same names, so that a change in one
+         *     place is not silently interpreted as 0 elsewhere.
+         */
+        GenerationRow: {
+            /** Format: int64 */
+            epoch: number;
             /**
              * Format: int64
              * @description Increases monotonically within an epoch. Restore identifies a generation by `(epoch, seq)`.
@@ -3929,6 +5375,28 @@ export interface components {
              */
             framework?: "next";
             triggers?: components["schemas"]["ManifestTriggers"];
+            queues?: components["schemas"]["ManifestQueues"];
+            durable_objects?: components["schemas"]["ManifestDurableObjects"];
+            /**
+             * @description The append-only history that creates this project's Durable Object classes
+             *     (docs/durable-objects.md §2.1). It is top-level, as in wrangler, because it
+             *     outlives the bindings: a class stays created after the binding that reached
+             *     it is deleted.
+             *
+             *     The array **is** the history and its order is the order it happened in.
+             *     Nothing sorts it and nothing rewrites a tag. A tag is unique across the
+             *     history, every step has to create at least one class no earlier step created,
+             *     and the per-project bound is 32 distinct classes
+             *     (`bundle.MaxDurableObjectClasses`). Every binding's `class_name` has to appear
+             *     in one of these steps or the deployment is refused; a class no binding reaches
+             *     is accepted with a warning.
+             *
+             *     Only `new_classes` and `new_sqlite_classes` are supported. `renamed_classes`,
+             *     `deleted_classes` and `transferred_classes` are refused **by name** rather
+             *     than ignored — a dropped migration key is a deployment that reports success
+             *     while the class the worker now exports has no objects under it.
+             */
+            migrations?: components["schemas"]["ManifestDurableObjectMigration"][];
             /**
              * @description Declares email sending and receiving (docs/email.md). When `true`, the worker
              *     receives `env.email`, and `export default { email() }` becomes the receiving
@@ -3943,6 +5411,28 @@ export interface components {
              *     code requested the binding.
              */
             ai?: boolean;
+            /**
+             * @description PEM files inside the bundle whose certificates are added to the trust store used
+             *     for **outbound** TLS by this project's worker (docs/outbound-tls.md).
+             *
+             *     It exists because an origin that omits its intermediate certificate cannot be
+             *     reached from a worker at all: kj-tls does not chase AIA, so the handshake fails
+             *     before any JavaScript runs and nothing in the app can repair it.
+             *
+             *     Unlike `email` and `ai` this is not a declaration the control plane grants
+             *     against — it is a path into the bundle, so it is validated like `main` and
+             *     `assets`. Every entry must sit under `certs/`, which is what lets the
+             *     certificate be parsed while the bundle is read rather than trusted on sight.
+             *     Each file is parsed at deploy time and an expired certificate is rejected; one
+             *     inside its last 90 days is accepted with a warning.
+             *
+             *     The system trust store is always kept (`trustBrowserCas`), so this adds trust
+             *     and never replaces it. Requires `main`.
+             * @example [
+             *       "certs/sectigo-rsa-dv.pem"
+             *     ]
+             */
+            trustedCertificates?: string[];
         };
         /**
          * @description Scheduled execution (docs/cron.md). It ships in the bundle exactly as the user wrote it
@@ -3973,6 +5463,124 @@ export interface components {
              */
             crons?: string[];
         };
+        /**
+         * @description Queues (docs/queues.md §2). Two lists, exactly as wrangler names them, because a
+         *     project moving off Cloudflare copies those lines across unchanged. A project may
+         *     produce into a queue it does not consume, and consume a queue it never produces
+         *     into — the dead-letter queue is that case — so neither list implies the other.
+         *
+         *     Every distinct name across both lists, dead-letter queues included, counts against
+         *     the per-project bound of 5 (`bundle.MaxQueuesPerProject`); the org-wide bound is the
+         *     plan's (`plan.QueueLimitFor`: free 5, pro 25) and a deployment past it is refused
+         *     with `400 queue_limit`. Requires `main` and `database`: the messages are rows in the
+         *     project's own database.
+         */
+        ManifestQueues: {
+            producers?: {
+                /**
+                 * @description The name the worker reads it as — `env.JOBS`. `^[A-Z][A-Z0-9_]{0,63}$`; `DB`, `ASSETS`, `STORAGE`, `AUTH`, `AI`, `EMAIL`, `MAIN` and the `RUNLOT_` prefix are reserved.
+                 * @example JOBS
+                 */
+                binding: string;
+                /**
+                 * @description The queue's name, `^[a-z0-9-]{1,63}$`. Two bindings may point at one queue.
+                 * @example jobs
+                 */
+                queue: string;
+            }[];
+            consumers?: {
+                /** @example jobs */
+                queue: string;
+                /** @description 1–100. Default 10. */
+                maxBatchSize?: number;
+                /** @description Seconds a partial batch waits for more messages, 1–60. Default 5. */
+                maxBatchTimeout?: number;
+                /**
+                 * @description 0–10. Default 3. `0` folds to the default — "deliver once, then it is dead"
+                 *     is written as `maxRetries: 0` plus a `deadLetterQueue`, the shape that
+                 *     actually keeps the message.
+                 */
+                maxRetries?: number;
+                /** @description Where a message goes once it is out of retries. Omitted means it is **deleted** instead. Cannot be the queue itself. */
+                deadLetterQueue?: string;
+            }[];
+        };
+        /**
+         * @description Durable Objects (docs/durable-objects.md §2.1). One list of bindings, exactly as
+         *     wrangler names them — **including the snake_case keys**, which the rest of this
+         *     manifest does not use. A `durable_objects` block is copied across as a whole
+         *     rather than typed a key at a time, and renaming the keys would make that copy
+         *     silently wrong.
+         *
+         *     It rides in the bundle for `triggers`' reason and one of its own: which namespaces
+         *     a node stands up has to be answerable from the bundle alone, and the class a
+         *     binding points at is a property of the code, not of any grant. Requires `main` —
+         *     a Durable Object is a class the worker exports, and static-only deployments
+         *     export none.
+         */
+        ManifestDurableObjects: {
+            bindings?: {
+                /**
+                 * @description The name the worker reads it as — `env.ROOMS`. Any JavaScript identifier
+                 *     of at most 64 characters, in any case, because Cloudflare permits any
+                 *     identifier here and a project carries whatever case it already chose.
+                 *     `db`, `auth`, `storage`, `email`, `ai`, `vectors`, `assets`, `ASSETS`,
+                 *     the JavaScript reserved words and the `RUNLOT_` prefix are reserved. A
+                 *     name already taken by a queue producer is refused.
+                 * @example ROOMS
+                 */
+                name: string;
+                /**
+                 * @description The class the worker exports. It is not the binding: two bindings may
+                 *     point at one class. It has to be created by one of the `migrations`
+                 *     steps, and it cannot be a JavaScript reserved word — the generated entry
+                 *     module re-exports the worker's names explicitly, and a class called
+                 *     `default` produces a module that does not parse.
+                 * @example Room
+                 */
+                class_name: string;
+                /**
+                 * @description wrangler's cross-script binding — a namespace defined by another Worker.
+                 *     It is **accepted into the schema and refused with a value**, which is
+                 *     not the same as leaving it out: a project that has one copies the whole
+                 *     block across, and dropping the key quietly would bind `env.ROOMS` to a
+                 *     class this worker does not export.
+                 */
+                script_name?: string;
+            }[];
+        };
+        /**
+         * @description One step of the Durable Object migration history.
+         *
+         *     **The two kinds are not the same class.** Both are stored on SQLite, but
+         *     `enableSql` is false for a class created as `new_classes`, and that is the upstream
+         *     compatibility contract: a class created as a KV class never gains a SQL surface.
+         *     The split therefore survives into the generated configuration rather than being
+         *     folded here.
+         */
+        ManifestDurableObjectMigration: {
+            /**
+             * @description Names this step, `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`, unique across the
+             *     history. It is what an operator compares between two deployments to see what
+             *     moved, so it has to be printable in a log line without quoting.
+             * @example v1
+             */
+            tag: string;
+            /**
+             * @description Classes created **without** `ctx.storage.sql` (`enableSql = false`).
+             * @example [
+             *       "Counter"
+             *     ]
+             */
+            new_classes?: string[];
+            /**
+             * @description Classes created with `ctx.storage.sql`.
+             * @example [
+             *       "Room"
+             *     ]
+             */
+            new_sqlite_classes?: string[];
+        };
         ManifestModule: {
             /**
              * @description The specifier the worker imports. Alphanumeric and `._-`, slash-separated, does not start with `.`. `worker` cannot be used because it is the entry module.
@@ -4121,6 +5729,54 @@ export interface components {
             /** @description Reason for `end`: `process_exited`, `client_gone`, `node_shutdown` */
             reason?: string;
         };
+        /**
+         * @description One stored line (0062). It is not a `LogEvent`: there is no `type`, because a
+         *     stored line is never a heartbeat or an end-of-stream, and there is a `seq`,
+         *     because the cursor needs a tiebreaker for lines that share a timestamp.
+         */
+        LogHistoryLine: {
+            /**
+             * Format: date-time
+             * @description When the **node** received the line, not when it was stored.
+             */
+            ts: string;
+            /**
+             * Format: int64
+             * @description Monotonic insert order. With `ts` it forms the page cursor.
+             */
+            seq: number;
+            /** Format: int64 */
+            epoch?: number;
+            /** @description The process generation within the node. Increments on replacement. */
+            generation?: number;
+            /**
+             * @description `runlot` is a line written by us, not the worker — startup, exit code,
+             *     dropped-line counts, and the daily-cap marker.
+             * @enum {string}
+             */
+            stream: "stdout" | "stderr" | "runlot";
+            line: string;
+        };
+        LogHistoryPage: {
+            /** @description Newest first. */
+            lines: components["schemas"]["LogHistoryLine"][];
+            /**
+             * @description Pass back as `cursor` for the next (older) page. **Absent means there is
+             *     nothing older** — an empty `lines` with a cursor present never happens.
+             */
+            cursor?: string;
+            /**
+             * @description This org's retention in days (Free 3, Pro 7). A client needs it to say how far
+             *     back there is anything to ask for: without it an empty page reads as "nothing
+             *     happened" when it means "that is older than we keep".
+             */
+            keepDays: number;
+            /**
+             * Format: int64
+             * @description This org's daily stored-line cap (Free 200000, Pro 2000000).
+             */
+            linesPerDay: number;
+        };
         Usage: {
             /** Format: uuid */
             projectId: string;
@@ -4131,6 +5787,37 @@ export interface components {
                 requests: number;
                 /** Format: int64 */
                 cpuMs: number;
+                /**
+                 * Format: int64
+                 * @description Requests that answered 5xx (migration 0063). Cumulative, and **a subset of
+                 *     `requests`** — the two are counted on the same line of node-front's serve, so
+                 *     `errors5xx / requests` is the window's error rate with no denominator mismatch.
+                 */
+                errors5xx: number;
+                /**
+                 * Format: int64
+                 * @description The median request duration over the whole window, in milliseconds. It is derived
+                 *     from the folded fixed-bucket histogram of every row — **not** the mean of the
+                 *     rows' medians, which would move when an idle hour joined the window. Percentiles
+                 *     are never stored: a stored percentile cannot be added, and an hour is the sum of
+                 *     every report that landed in it.
+                 */
+                p50Ms: number;
+                /**
+                 * Format: int64
+                 * @description The 99th percentile, same derivation. A sample past the histogram's last edge
+                 *     (10,000 ms) reports that edge — the overflow bucket has no upper bound to
+                 *     interpolate towards, and inventing one would put a number on screen that no
+                 *     measurement supports.
+                 */
+                p99Ms: number;
+                /**
+                 * Format: int64
+                 * @description How many durations the window's histogram holds. **0 means there is no percentile
+                 *     at all**, which is a different fact from "the percentile is 0 ms" — every row
+                 *     written before 0063 is the first case, and the two are otherwise the same zero.
+                 */
+                latSamples: number;
                 /**
                  * Format: int64
                  * @description The number of object operations. It is a cumulative value, so it is included in the total
@@ -4175,6 +5862,49 @@ export interface components {
              */
             objBytes: number;
         };
+        ExecuteRequest: {
+            /** @description The statement, exactly as typed. Nothing is appended to it. */
+            sql: string;
+            /**
+             * @description **Absent means true.** Read-only runs inside `BEGIN … READ ONLY` and rolls back
+             *     unconditionally; write mode runs outside a transaction so the statement commits on
+             *     its own.
+             * @default true
+             */
+            readOnly: boolean;
+            /**
+             * @description Values for `$1`, `$2`, … They are sent separately rather than pasted into the text.
+             *     The console's own table listing uses one, because a console that interpolates its
+             *     own strings teaches the habit that ends in an injection.
+             */
+            params?: unknown[];
+        };
+        ExecuteResult: {
+            /** @description Column names in the order the server returned them. Empty for a statement with no result set. */
+            columns: string[];
+            /**
+             * @description One entry per listed row, each an array parallel to `columns`. **Every value is a
+             *     string or null** — JSON numbers are IEEE doubles, so a bigint past 2^53 would arrive
+             *     rounded. `null` is SQL NULL; `""` is the empty string.
+             */
+            rows: (string | null)[][];
+            /**
+             * Format: int64
+             * @description What the statement reported — rows produced or rows touched. Not `rows.length`: with truncation the two differ, and that difference is what `truncated` is about.
+             */
+            rowCount: number;
+            /** @description the 500-row listing cap cut the response */
+            truncated: boolean;
+            /** @description the server's command tag (SELECT, UPDATE, CREATE TABLE …) */
+            command: string;
+            /** @description which mode actually ran — the server saying what it did, which can differ from what was asked (absent is read-only) */
+            readOnly: boolean;
+            /**
+             * Format: int64
+             * @description The round trip as the control plane measured it. It includes the dial, so it is not the statement's own time.
+             */
+            elapsedMs: number;
+        };
         UsageRow: {
             /**
              * Format: date-time
@@ -4222,11 +5952,44 @@ export interface components {
              * @description cumulative (sum of deltas)
              */
             aiTokensOut: number;
+            /**
+             * Format: int64
+             * @description cumulative; a subset of `requests` (0063)
+             */
+            errors5xx: number;
+            /**
+             * Format: int64
+             * @description this hour's median duration, derived from its histogram at read time
+             */
+            p50Ms: number;
+            /**
+             * Format: int64
+             * @description this hour's 99th percentile, same derivation
+             */
+            p99Ms: number;
+            /**
+             * Format: int64
+             * @description How many durations this hour's histogram holds. 0 means the hour has **no**
+             *     percentile — rows written before 0063 are exactly that, and a chart that cannot
+             *     tell them from "0 ms" draws a flat floor that never happened.
+             */
+            latSamples: number;
         };
         /** @description One row of the catalog (docs/ai.md §2.3). */
         AIModel: {
-            /** @description The string you write in `env.ai.run()`. Frontier models are `<provider>/<model>`, value models are `@runlot/<model>` */
+            /** @description The string you write in `env.ai.run()` or `env.ai.embed()`. Frontier models are `<provider>/<model>`, value models are `@runlot/<model>` */
             id: string;
+            /**
+             * @description What the model does (docs/vectors.md §2). `chat` is `env.ai.run` — tokens in, tokens out.
+             *     `embedding` is `env.ai.embed` — text in, a vector out: `maxOutputTokens` and `outPerMTok` are 0,
+             *     and `dimensions` says how wide the vector is.
+             * @enum {string}
+             */
+            kind: "chat" | "embedding";
+            /** @description Embedding models only: the width of the vector the model answers by default. */
+            dimensions?: number;
+            /** @description Embedding models only: every width `env.ai.embed(model, input, { dimensions })` may ask for. Absent when only the default is answered. */
+            dimensionOptions?: number[];
             /** @enum {string} */
             lane: "frontier" | "value";
             display: string;
@@ -4380,6 +6143,57 @@ export interface components {
             /** @description The mail domain suffix for this installation. Email cannot be enabled if it is empty. */
             mailDomain: string;
         };
+        /**
+         * @description One line the customer publishes in their own DNS (docs/email.md §2.4). The values are
+         *     computed by the server so that the dashboard, the CLI, and the docs cannot disagree.
+         */
+        EmailDNSRecord: {
+            /** @enum {string} */
+            type: "CNAME" | "TXT";
+            /** @example 4x7z…._domainkey.acme.com */
+            name: string;
+            /** @example 4x7z….dkim.amazonses.com */
+            value: string;
+            /**
+             * @description `true` for the three DKIM CNAMEs — verification does not pass without them. `false`
+             *     for SPF and DMARC: they improve alignment and do not gate anything, and a customer
+             *     who already has their own SPF record should keep it.
+             */
+            required: boolean;
+        };
+        /** @description One custom sending domain and its verification state (docs/email.md §2.4). */
+        EmailDomain: {
+            /** @example acme.com */
+            domain: string;
+            /**
+             * @description `pending` — the identity exists and DKIM is not signing yet. `verified` — the only
+             *     state `env.email.send({ from })` accepts. `failed` — the provider gave up, or the
+             *     records were not visible within 72 hours.
+             * @enum {string}
+             */
+            state: "pending" | "verified" | "failed";
+            /** @description At most one per project. */
+            isDefault: boolean;
+            /** @description The fact `state` is computed from. */
+            dkimOk: boolean;
+            /** @description Measured and never gating — a missing SPF record does not stop delivery. */
+            spfOk: boolean;
+            /** @description The sentence the customer reads. Empty once verified — a stale sentence reads as a live fault. */
+            lastError?: string;
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Stamped once; it does not move on re-verification.
+             */
+            verifiedAt?: string;
+            /** Format: date-time */
+            lastCheckedAt?: string;
+            /** @description Served in every state — a customer debugging a failed domain compares what they published against this. */
+            records: components["schemas"]["EmailDNSRecord"][];
+            /** @description We wrote the records into a zone we host, so there is nothing for the customer to publish. */
+            published: boolean;
+        };
         /** @description One line of the email log (docs/email.md §6.1). */
         MailLogEntry: {
             /** Format: uuid */
@@ -4491,6 +6305,47 @@ export interface components {
              */
             usedBytes: number;
         };
+        /** @description One key prefix to publish or unpublish (docs/storage.md §4.7). */
+        StoragePublicRequest: {
+            /**
+             * @description The prefix, relative to the project's slice — `assets`, `assets/`, or `avatars/img`.
+             *     It is stored normalized with a trailing slash, because matching is a plain string
+             *     prefix test and `assets` without the slash would also open `assets-private/`.
+             *
+             *     `/` means **every key in the project's slice**. The empty string is refused: the
+             *     spelling exists so that an accidentally empty argument cannot publish a whole
+             *     bucket by looking like the default.
+             * @example assets/
+             */
+            prefix: string;
+        };
+        /**
+         * @description The prefixes this project serves unsigned. All three verbs answer with it, so a screen
+         *     never has to guess what the list became after a change.
+         */
+        StoragePublicList: {
+            prefixes: {
+                /**
+                 * @description The normalized value — it ends with `/`, or is empty for every key.
+                 * @example assets/
+                 */
+                prefix: string;
+                /**
+                 * Format: date-time
+                 * @description When it was published. This is the answer to "when did this become public".
+                 */
+                createdAt: string;
+            }[];
+            /**
+             * @description `https://<objects host>/<org>/<project>` — the address every prefix in the list is
+             *     readable under (a key `assets/logo.png` is at `<publicBase>/assets/logo.png`). It is
+             *     the same value `env.storage.publicUrl` builds on. **Absent when the deployment has
+             *     no public object front**, in which case nothing is served unsigned and `publicUrl`
+             *     answers null everywhere.
+             * @example https://objects.runlot.io/acme/shop
+             */
+            publicBase?: string;
+        };
         /**
          * @description Deployment access policy (docs/access.md §3.1). **Provides only non-secret state.**
          *     Passwords and bypass keys are stored only as hashes, and the read API does not return
@@ -4897,6 +6752,13 @@ export interface components {
         };
         DomainList: {
             domains: components["schemas"]["Domain"][];
+            /**
+             * @description If true, the registrar is a sandbox (OTE) — nothing on this list was
+             *     really registered. It rides the listing as well as the search because
+             *     a screen that only ever lists never calls the search, and without it
+             *     that screen shows names that look bought and are not.
+             */
+            sandbox: boolean;
         };
     };
     responses: {
@@ -4918,7 +6780,15 @@ export interface components {
                 "application/json": components["schemas"]["Error"];
             };
         };
-        /** @description Insufficient permissions */
+        /**
+         * @description Insufficient permissions.
+         *
+         *     Two codes arrive with this status and they have different fixes. `forbidden` is the org
+         *     role — ask an admin. `insufficient_scope` is the credential — reissue the token, and
+         *     `error.details.requiredScope` names what it needs. A token restricted to another org or
+         *     project answers `insufficient_scope` with no `requiredScope`, because no scope would
+         *     have helped.
+         */
         Forbidden: {
             headers: {
                 [name: string]: unknown;
@@ -4949,6 +6819,8 @@ export interface components {
     parameters: {
         OrgSlug: components["schemas"]["Slug"];
         ProjectName: components["schemas"]["Slug"];
+        /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+        QueueName: string;
         /**
          * @description The operation id. **Not a credential** — the server checks whether the operation with
          *     this id belongs to the project in the path, and returns 404 otherwise.
@@ -5066,7 +6938,11 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Session token */
+            /**
+             * @description A session token — or, for an account with two-factor authentication on, a
+             *     `{"mfa":"totp","pending":…}` body carrying no token. Finish with
+             *     `POST /v1/auth/totp`.
+             */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -5103,6 +6979,70 @@ export interface operations {
             };
         };
     };
+    completeTotpLogin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    pending: string;
+                    code?: string;
+                    /** @description One recovery code. Dashes, spaces and case are ignored. Spent whether or not it is the right one */
+                    recovery?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Session token */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Session"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description The code did not match (`invalid_code`), or the pending token expired (`mfa_expired`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description This account has no authenticator (`totp_disabled`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Too many attempts (5 per 5 minutes per account); retry after `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description This deployment cannot read the account's secret (`totp_unreadable`, `no_totp_key`) — use a recovery code */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     passwordForgot: {
         parameters: {
             query?: never;
@@ -5463,13 +7403,20 @@ export interface operations {
                     "application/json": {
                         user: components["schemas"]["User"];
                         orgs: components["schemas"]["OrgMembership"][];
+                        /**
+                         * @description Whether this account has a confirmed authenticator (migration 0066).
+                         *     It is answered here rather than on `User` because `User` is loaded on
+                         *     every authenticated request and this value is read by one screen — the
+                         *     banner an organization's `requireTotp` draws.
+                         */
+                        totpEnabled: boolean;
                     };
                 };
             };
             401: components["responses"]["Unauthorized"];
         };
     };
-    listOrgs: {
+    getTotp: {
         parameters: {
             query?: never;
             header?: never;
@@ -5478,21 +7425,19 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description The owning organization */
+            /** @description Status */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        orgs: components["schemas"]["OrgMembership"][];
-                    };
+                    "application/json": components["schemas"]["TotpStatus"];
                 };
             };
             401: components["responses"]["Unauthorized"];
         };
     };
-    createOrg: {
+    disableTotp: {
         parameters: {
             query?: never;
             header?: never;
@@ -5502,22 +7447,187 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    slug: components["schemas"]["Slug"];
-                    name: string;
+                    code?: string;
+                    recovery?: string;
                 };
             };
         };
         responses: {
-            /** @description The created organization */
-            201: {
+            /** @description Two-factor authentication is off */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["Org"];
-                };
+                content?: never;
             };
-            401: components["responses"]["Unauthorized"];
+            400: components["responses"]["BadRequest"];
+            /** @description The code did not match (`invalid_code`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description This account has no authenticator (`totp_disabled`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Too many attempts; retry after `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    enrollTotp: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The secret and the URI to scan */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TotpEnrollment"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Two-factor authentication is already on (`totp_enabled`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description This deployment has no sealing key (`no_totp_key`) */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    confirmTotp: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    code: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Two-factor authentication is on; here are the recovery codes */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TotpRecoveryCodes"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description The code did not match (`invalid_code`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description There is nothing to confirm (`no_enrollment`), or it is already on (`totp_enabled`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Too many attempts; retry after `Retry-After` */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listOrgs: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The owning organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        orgs: components["schemas"]["OrgMembership"][];
+                    };
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    createOrg: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    slug: components["schemas"]["Slug"];
+                    name: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The created organization */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Org"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
             409: components["responses"]["Conflict"];
         };
     };
@@ -5575,6 +7685,19 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
+                    /**
+                     * @description Require two-factor authentication of every member (migration 0066).
+                     *     Audited separately as `org.require_totp`.
+                     *
+                     *     **Omitting the field leaves the setting alone.** A plain boolean would
+                     *     mean every rename by an older client silently switched the requirement
+                     *     off, and a security setting must never be changed by omission.
+                     *
+                     *     While it is on, a member with no authenticator can still *read* the
+                     *     org — the banner telling them to enroll is drawn by a screen they have
+                     *     to be able to load — and every write answers 403 `totp_required`.
+                     */
+                    requireTotp?: boolean;
                 };
             };
         };
@@ -5857,7 +7980,33 @@ export interface operations {
     };
     createDeployment: {
         parameters: {
-            query?: never;
+            query?: {
+                /**
+                 * @description Deploy to the named preview instead of production. Slug rules, at most 30
+                 *     characters — it becomes half of the DNS label `<preview>--<project>`.
+                 *
+                 *     Creates the preview if it does not exist. Exceeding the plan's per-project
+                 *     preview count answers **409 `preview_limit`**.
+                 */
+                preview?: components["schemas"]["Slug"];
+                /**
+                 * @description What the preview's `env.db` points at (docs/preview.md §3.1). Ignored without
+                 *     `preview`.
+                 *
+                 *     - `branch` — its own store, poured from the parent's newest generation. The
+                 *       default, and a **full copy** of the parent's pages at the moment it was taken.
+                 *     - `shared` — the preview runs against **production's** database. A destructive
+                 *       statement in the preview is destructive in production.
+                 *     - `none` — no `env.db` at all.
+                 */
+                db?: "branch" | "shared" | "none";
+                /**
+                 * @description Pour the branch from this generation instead of the newest one — any key
+                 *     `getGenerations` lists for the parent. Only meaningful with `db=branch`; a
+                 *     chain that is not whole answers **409 `chain_broken`**, the same as a restore.
+                 */
+                from?: string;
+            };
             header?: {
                 "X-Runlot-Git-Commit"?: string;
                 "X-Runlot-Git-Message"?: string;
@@ -5927,9 +8076,12 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
-    rollback: {
+    getProjectQueues: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description How many history rows. Default 50, capped at 200. */
+                limit?: number;
+            };
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
@@ -5937,28 +8089,22 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    version: number;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Rolled-back deployment */
+            /** @description The declared queues with their depth, and the recent history */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Deployment"];
+                    "application/json": components["schemas"]["QueueOverview"];
                 };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    getDatabase: {
+    getProjectVectors: {
         parameters: {
             query?: never;
             header?: never;
@@ -5970,47 +8116,63 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Whether the database is available */
+            /** @description The namespaces and the bounds */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        db: boolean;
-                    };
+                    "application/json": components["schemas"]["VectorOverview"];
                 };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    createDatabase: {
+    deleteVectorNamespace: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                namespace: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Credentials and connection info */
+            /** @description Deleted */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["DatabaseConnect"];
+                    "application/json": {
+                        namespace: string;
+                        /**
+                         * Format: int64
+                         * @description How many vectors were deleted.
+                         */
+                        deleted: number;
+                    };
                 };
             };
+            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /** @description `console_unreachable` — the project's database could not be reached */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
         };
     };
-    getDatabaseConnect: {
+    getProjectDurableObjects: {
         parameters: {
             query?: never;
             header?: never;
@@ -6022,96 +8184,367 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Connection info */
+            /** @description The counts and the two caps */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["DatabaseConnect"];
+                    "application/json": components["schemas"]["DurableObjectUsage"];
                 };
             };
             403: components["responses"]["Forbidden"];
-            /** @description The project does not exist, or its database has not been created yet */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["Error"];
-                };
-            };
+            404: components["responses"]["NotFound"];
         };
     };
-    getDatabaseEndpoint: {
+    listQueueRuns: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Default 50, capped at 200. */
+                limit?: number;
+            };
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Endpoint */
+            /** @description Batches of this queue */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        db: boolean;
-                        endpoint: components["schemas"]["DatabaseEndpoint"];
+                        queue: string;
+                        runs: components["schemas"]["QueueRun"][];
                     };
                 };
             };
+            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    listDatabaseTokens: {
+    peekQueue: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Default 10, capped at 100. */
+                limit?: number;
+            };
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description List */
+            /** @description The head of the queue */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        tokens: components["schemas"]["DatabaseTokenMeta"][];
+                        queue: string;
+                        messages: components["schemas"]["QueueMessage"][];
                     };
                 };
             };
+            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
+            /** @description No such project, or the project has no database (`not_found`) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description `console_unreachable` — the project's database could not be reached */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
         };
     };
-    createDatabaseToken: {
+    purgeQueue: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
             };
             cookie?: never;
         };
-        requestBody?: {
-            content: {
-                "application/json": {
-                    /** @description Default 3600, maximum 86400. */
+        requestBody?: never;
+        responses: {
+            /** @description Purged */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        queue: string;
+                        /**
+                         * Format: int64
+                         * @description How many messages were deleted.
+                         */
+                        purged: number;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    redriveQueue: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                /** @description A queue name as the manifest wrote it (`^[a-z0-9-]{1,63}$`). */
+                queue: components["parameters"]["QueueName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description The destination queue. Optional when exactly one consumer names `{queue}` as its dead-letter queue. */
+                    to?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Redriven */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        from: string;
+                        to: string;
+                        /**
+                         * Format: int64
+                         * @description How many messages moved.
+                         */
+                        moved: number;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    rollback: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    version: number;
+                };
+            };
+        };
+        responses: {
+            /** @description Rolled-back deployment */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Deployment"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getDatabase: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Whether the database is available */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        db: boolean;
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    createDatabase: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Credentials and connection info */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DatabaseConnect"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getDatabaseConnect: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Connection info */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DatabaseConnect"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            /** @description The project does not exist, or its database has not been created yet */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getDatabaseEndpoint: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Endpoint */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        db: boolean;
+                        endpoint: components["schemas"]["DatabaseEndpoint"];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    listDatabaseTokens: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        tokens: components["schemas"]["DatabaseTokenMeta"][];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    createDatabaseToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Default 3600, maximum 86400. */
                     ttlSeconds?: number;
                 };
             };
@@ -6155,6 +8588,64 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    executeSQL: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ExecuteRequest"];
+            };
+        };
+        responses: {
+            /** @description The statement ran */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ExecuteResult"];
+                };
+            };
+            /**
+             * @description The statement was refused. `code` is `sql_error` and `details.sqlstate` carries
+             *     PostgreSQL's own five-character code — the string every manual and every answer is
+             *     indexed by. `details` may also hold `detail`, `hint` and `position`. It is a 400
+             *     and not a 500 because a statement the database refused is the user's statement
+             *     being wrong.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description could not reach this project's database (`console_unreachable`) */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description the database did not answer within the round-trip deadline (`console_timeout`) */
+            504: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     exportDatabase: {
         parameters: {
             query?: never;
@@ -6224,7 +8715,10 @@ export interface operations {
     };
     listGenerations: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Narrows the **object half only**, to the newest component at or before this instant per holder. The database generations are listed in full and the user picks among them; an object restore takes one component per holder, so the only question there is which instant. */
+                at?: string;
+            };
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
@@ -6512,6 +9006,64 @@ export interface operations {
             };
         };
     };
+    getLogHistory: {
+        parameters: {
+            query?: {
+                /** @description Oldest line to return (RFC3339). Omit for everything still kept */
+                since?: string;
+                /** @description Newest line to return (RFC3339) */
+                until?: string;
+                /**
+                 * @description Plain substring, matched case-insensitively against the line. It is not a
+                 *     regular expression — `%` and `_` match themselves.
+                 */
+                q?: string;
+                /** @description Narrow to one stream. Omit for all three */
+                stream?: "stdout" | "stderr" | "runlot";
+                /** @description Lines per page. Capped at 1000 */
+                limit?: number;
+                /** @description The `cursor` of the previous page */
+                cursor?: string;
+            };
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page, newest first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LogHistoryPage"];
+                };
+            };
+            /** @description `since`/`until` is not RFC3339, `stream` is not one of the three, or the cursor is unreadable */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            /** @description The organization or project does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     listSecrets: {
         parameters: {
             query?: never;
@@ -6530,47 +9082,168 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SecretList"];
+                    "application/json": components["schemas"]["SecretList"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setSecret: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                secretName: components["parameters"]["SecretName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    value: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Stored name and version */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SecretMeta"];
+                };
+            };
+            /**
+             * @description The name does not follow the rules (`bad_request`) or is a reserved name
+             *     (`reserved_name`: `DB`, `ASSETS`, `RUNLOT_*` — the uppercase counterparts of
+             *     the `env.db` and `env.assets` bindings, and the node prefix)
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deleteSecret: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                secretName: components["parameters"]["SecretName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getUsage: {
+        parameters: {
+            query?: {
+                hours?: number;
+            };
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Usage */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Usage"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getStorage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Storage status */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StorageStatus"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` — no connection to cp-core */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
                 };
             };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    setSecret: {
+    grantStorage: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
-                secretName: components["parameters"]["SecretName"];
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    value: string;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Stored name and version */
+            /** @description Grant status (existing value if it was already there) */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SecretMeta"];
+                    "application/json": components["schemas"]["StorageStatus"];
                 };
             };
-            /**
-             * @description The name does not follow the rules (`bad_request`) or is a reserved name
-             *     (`reserved_name`: `DB`, `ASSETS`, `RUNLOT_*` — the uppercase counterparts of
-             *     the `env.db` and `env.assets` bindings, and the node prefix)
-             */
-            400: {
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` */
+            503: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -6578,24 +9251,21 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    deleteSecret: {
+    revokeStorage: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
-                secretName: components["parameters"]["SecretName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description deleted */
+            /** @description detached */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -6604,36 +9274,18 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-        };
-    };
-    getUsage: {
-        parameters: {
-            query?: {
-                hours?: number;
-            };
-            header?: never;
-            path: {
-                orgSlug: components["parameters"]["OrgSlug"];
-                projectName: components["parameters"]["ProjectName"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Usage */
-            200: {
+            /** @description `no_core` */
+            503: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Usage"];
+                    "application/json": components["schemas"]["Error"];
                 };
             };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    getStorage: {
+    listStoragePublic: {
         parameters: {
             query?: never;
             header?: never;
@@ -6645,18 +9297,18 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Storage status */
+            /** @description The list */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["StorageStatus"];
+                    "application/json": components["schemas"]["StoragePublicList"];
                 };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            /** @description `no_core` — no connection to cp-core */
+            /** @description `no_core` */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -6667,7 +9319,7 @@ export interface operations {
             };
         };
     };
-    grantStorage: {
+    addStoragePublic: {
         parameters: {
             query?: never;
             header?: never;
@@ -6677,19 +9329,41 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StoragePublicRequest"];
+            };
+        };
         responses: {
-            /** @description Grant status (existing value if it was already there) */
+            /** @description The list after the change */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["StorageStatus"];
+                    "application/json": components["schemas"]["StoragePublicList"];
+                };
+            };
+            /** @description The prefix is empty, not normalizable, or would leave the project's slice */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
                 };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /** @description `storage_not_granted`, or `too_many_public_prefixes` */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` */
             503: {
                 headers: {
@@ -6701,7 +9375,7 @@ export interface operations {
             };
         };
     };
-    revokeStorage: {
+    removeStoragePublic: {
         parameters: {
             query?: never;
             header?: never;
@@ -6711,14 +9385,29 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StoragePublicRequest"];
+            };
+        };
         responses: {
-            /** @description detached */
-            204: {
+            /** @description The list after the change */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["StoragePublicList"];
+                };
+            };
+            /** @description The prefix is empty or not normalizable */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
@@ -7121,7 +9810,168 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description turned off */
+            /** @description turned off */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    listEmailDomains: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The sending domains */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        domains: components["schemas"]["EmailDomain"][];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    addEmailDomain: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The domain itself, not an address (`acme.com`) */
+                    domain: string;
+                    /** @description Write the records into a zone we host */
+                    publish?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The domain and the records to publish */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["EmailDomain"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /**
+             * @description `email_not_granted` — this project does not have email. `email_domains_unavailable` —
+             *     this deployment has no mail provider credentials. `email_domain_taken` — another
+             *     project already proved this domain. `email_domain_provider` — the provider refused
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description `no_core` */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    verifyEmailDomain: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The domain after the check */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["EmailDomain"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    removeEmailDomain: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                domain: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description removed */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -7130,6 +9980,15 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /** @description `email_domain_provider` — the provider would not delete the identity, so the row is kept and the call can be retried */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description `no_core` */
             503: {
                 headers: {
@@ -8318,7 +11177,18 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            /** @description A name already in use by another project. `code` is `hostname_taken` */
+            /**
+             * @description Two refusals share this status.
+             *
+             *     `hostname_taken` — the name already belongs to another project.
+             *
+             *     `hostname_limit` — the project is already at its plan's ceiling on
+             *     custom domains (Free 1, Pro 50 per project; docs/limits.md §1).
+             *     `details` carries `limit`, `count` and `plan`, so a client builds its
+             *     sentence from the numbers rather than by reading the message back
+             *     with a regex. The idempotent re-POST of a name the project already
+             *     owns is **not** refused this way — it still answers 200.
+             */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -9055,197 +11925,456 @@ export interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["Domain"];
-                };
+                content: {
+                    "application/json": components["schemas"]["Domain"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setDomainAutoRenew: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                /** @description Domain name (punycode, lowercase) */
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The domain that changed */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Domain"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setDomainLock: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                /** @description Domain name (punycode, lowercase) */
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    locked: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The domain that changed */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Domain"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getDomainAuthCode: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                /** @description Domain name (punycode, lowercase) */
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Code */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        name: string;
+                        authCode: string;
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    syncDomain: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                /** @description Domain name (punycode, lowercase) */
+                name: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The matched domain */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Domain"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    listRepos: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of repositories */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        repos: components["schemas"]["Repo"][];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    createRepo: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    name: components["schemas"]["RepoName"];
+                    visibility?: components["schemas"]["RepoVisibility"];
+                    /** @default main */
+                    defaultBranch?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The repository that was created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Repo"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description This project has a repository with the same name (`repo_exists`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getRepo: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Repository */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Repo"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deleteRepo: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
             };
-            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    setDomainAutoRenew: {
+    updateRepo: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                /** @description Domain name (punycode, lowercase) */
-                name: string;
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
         requestBody: {
             content: {
                 "application/json": {
-                    enabled: boolean;
+                    name?: components["schemas"]["RepoName"];
+                    visibility?: components["schemas"]["RepoVisibility"];
+                    defaultBranch?: string;
                 };
             };
         };
         responses: {
-            /** @description The domain that changed */
-            200: {
+            /** @description changed */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["Domain"];
-                };
+                content?: never;
             };
             400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /** @description A repository with that name already exists (`repo_exists`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
         };
     };
-    setDomainLock: {
+    listRefUpdates: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                /** @description Domain name (punycode, lowercase) */
-                name: string;
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    locked: boolean;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description The domain that changed */
+            /** @description Ref history */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Domain"];
+                    "application/json": {
+                        refUpdates: components["schemas"]["RefUpdate"][];
+                    };
                 };
             };
-            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    getDomainAuthCode: {
+    getDeployHook: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                /** @description Domain name (punycode, lowercase) */
-                name: string;
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Code */
+            /** @description The hook */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        name: string;
-                        authCode: string;
-                    };
+                    "application/json": components["schemas"]["DeployHook"];
                 };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    syncDomain: {
+    setDeployHook: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
-                /** @description Domain name (punycode, lowercase) */
-                name: string;
+                projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled?: boolean;
+                    /**
+                     * @description One branch, not a pattern — a pattern makes "why did my push not deploy" a question about glob semantics.
+                     * @example main
+                     */
+                    branch?: string;
+                    /**
+                     * @description The subdirectory the build runs in. Empty is the repository root.
+                     * @example apps/web
+                     */
+                    rootDir?: string;
+                };
+            };
+        };
         responses: {
-            /** @description The matched domain */
+            /** @description The hook as it now stands */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Domain"];
+                    "application/json": components["schemas"]["DeployHook"];
                 };
             };
+            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    listRepos: {
+    deleteDeployHook: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description List of repositories */
-            200: {
+            /** @description Removed */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        repos: components["schemas"]["Repo"][];
-                    };
-                };
+                content?: never;
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    createRepo: {
+    deployRepoNow: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
-        requestBody: {
+        requestBody?: {
             content: {
                 "application/json": {
-                    name: components["schemas"]["RepoName"];
-                    visibility?: components["schemas"]["RepoVisibility"];
-                    /** @default main */
-                    defaultBranch?: string;
+                    /** @description Omit to build the hooked branch's tip. */
+                    commitSha?: string;
                 };
             };
         };
         responses: {
-            /** @description The repository that was created */
-            201: {
+            /** @description Queued */
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Repo"];
+                    "application/json": {
+                        /** Format: uuid */
+                        buildId: string;
+                    };
                 };
             };
             400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            /** @description This project has a repository with the same name (`repo_exists`) */
+            /** @description `deploy_hook_off` — push-to-deploy is not on for this repository */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -9256,124 +12385,122 @@ export interface operations {
             };
         };
     };
-    getRepo: {
+    listBuilds: {
         parameters: {
-            query?: never;
+            query?: {
+                limit?: number;
+            };
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
-                repoName: components["parameters"]["RepoName"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Repository */
+            /** @description Builds */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Repo"];
+                    "application/json": {
+                        builds: components["schemas"]["Build"][];
+                        /** @description Wall-clock build minutes this organization has used this month. */
+                        minutesUsed: number;
+                        /** @description The monthly allowance for this organization's plan (free 300, pro 3000). */
+                        minutesLimit: number;
+                    };
                 };
             };
+            400: components["responses"]["BadRequest"];
             403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
         };
     };
-    deleteRepo: {
+    getBuild: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
-                repoName: components["parameters"]["RepoName"];
+                buildId: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description deleted */
-            204: {
+            /** @description The build */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["Build"];
+                };
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    updateRepo: {
+    getBuildLog: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
-                repoName: components["parameters"]["RepoName"];
+                buildId: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    name?: components["schemas"]["RepoName"];
-                    visibility?: components["schemas"]["RepoVisibility"];
-                    defaultBranch?: string;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description changed */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            400: components["responses"]["BadRequest"];
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
-            /** @description A repository with that name already exists (`repo_exists`) */
-            409: {
+            /** @description The log */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Error"];
+                    "text/plain": string;
                 };
             };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
         };
     };
-    listRefUpdates: {
+    cancelBuild: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
-                repoName: components["parameters"]["RepoName"];
+                buildId: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Ref history */
-            200: {
+            /** @description Cancelled */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        refUpdates: components["schemas"]["RefUpdate"][];
-                    };
-                };
+                content?: never;
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
+            /** @description `build_not_queued` — it is already building, or already over */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
         };
     };
     listSSHKeys: {
@@ -9490,9 +12617,23 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
+                    /**
+                     * @description 0032's single-valued field, still accepted. It means the same as a
+                     *     one-element `scopes`, and `scopes` wins when both are sent.
+                     */
                     scope?: components["schemas"]["TokenScope"];
-                    /** @description 0 means no expiration */
+                    /** @description Defaults to `[repo:write]` — what a caller from before scopes meant. */
+                    scopes?: components["schemas"]["ApiScope"][];
+                    /** @description Restrict the token to one org, by slug. */
+                    org?: string;
+                    /** @description Restrict it further to one project. Requires `org`. */
+                    project?: string;
+                    /** @description 0032's field. Capped at 365 days. */
                     ttlHours?: number;
+                    /** @description 1–365. Defaults to 90. */
+                    expiresInDays?: number;
+                    /** @description A token with no deadline. Explicit on purpose. */
+                    noExpiry?: boolean;
                 };
             };
         };
@@ -9693,5 +12834,91 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    listPreviews: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of previews */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        previews: components["schemas"]["Preview"][];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deletePreview: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                previewName: components["schemas"]["Slug"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Teardown started */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    promotePreview: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                previewName: components["schemas"]["Slug"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The parent's new live deployment */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Deployment"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description The preview has no deployment to promote, or is not `ready` */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
 }
 //# sourceMappingURL=schema.d.ts.map