@runlot/api 0.1.0-rc.96 → 0.1.0-rc.98

package/dist/schema.d.ts

@@ -336,6 +336,183 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/.well-known/oauth-authorization-server": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Authorization server metadata (RFC 8414)
+         * @description What a client reads before it has any credential, so it is open by definition.
+         *
+         *     `authorization_endpoint` points at the **dashboard**, not at this API: the
+         *     authorization step has to see the user's login session, which lives in the browser
+         *     (docs/studio.md §8.1). `runlot_access_token_audience` is not in RFC 8414 — it is here
+         *     so a resource server learns the `aud` it must require from the issuer rather than from
+         *     a second configured value that can disagree.
+         */
+        get: operations["oauthMetadata"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/.well-known/jwks.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The access tokens' public keys
+         * @description Every non-retired signing key. **Two are published during a rotation**, which is the
+         *     whole reason this is a set: a verifier that cached one key would refuse tokens minted
+         *     with the other. Cacheable for a minute, and no longer — a stale copy refuses fresh
+         *     tokens.
+         */
+        get: operations["oauthJwks"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/oauth/authorize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Approve a connected app and mint an authorization code
+         * @description Called by the dashboard's `/oauth/authorize` screen with the **user's login session**.
+         *     A personal access token is refused whatever its scopes: a credential must never be
+         *     able to widen itself into a longer-lived one.
+         *
+         *     The parameters carry OAuth's own names rather than this document's camelCase, because
+         *     the screen forwards the query string it was handed.
+         */
+        post: operations["oauthAuthorize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/oauth/token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Exchange a code, or refresh (RFC 6749)
+         * @description Form-encoded, not JSON — RFC 6749 §4.1.3, and what every client library sends.
+         *
+         *     **The failures are RFC 6749 §5.2's body, not this document's error envelope**, because
+         *     these two endpoints are read by generic OAuth clients that cannot parse ours.
+         *
+         *     Refresh tokens rotate: using one invalidates it and returns the next. Rate limited per
+         *     client and per address (`429`).
+         */
+        post: operations["oauthToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/oauth/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Sign a connected app out (RFC 7009)
+         * @description Form-encoded. **It answers 200 for a token it does not know** — RFC 7009 §2.2 requires
+         *     it, and the reason is that any other answer turns the endpoint into an oracle for which
+         *     tokens exist.
+         *
+         *     Revoking a refresh token revokes **the whole grant**, not one rotation generation:
+         *     "sign out in Studio" means the device is gone from Connected apps too (docs/studio.md
+         *     §8.4). Rate limited per client and per address (`429`).
+         */
+        post: operations["oauthRevoke"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/oauth/grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Connected apps
+         * @description What can reach this account right now (docs/studio.md §8.4). Revoked grants are not
+         *     listed: a list that keeps dead rows makes the answer a filter the reader has to apply.
+         *
+         *     Session only, for `POST /v1/oauth/authorize`'s reason.
+         */
+        get: operations["listOAuthGrants"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/oauth/grants/{sid}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The grant's session id, as `GET /v1/oauth/grants` returned it. */
+                sid: string;
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a connected app
+         * @description Its refresh tokens die with it, its access token dies on the next request through the
+         *     `sid` check, and the revocation reaches the Studio service through cp-core's feed — so
+         *     a lent model drops at once rather than within the access token's fifteen minutes.
+         *
+         *     A grant that is not this user's is a **404**, not a 403: telling a caller that somebody
+         *     else's grant id exists is a probe for grant ids.
+         */
+        delete: operations["revokeOAuthGrant"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/me": {
         parameters: {
             query?: never;
@@ -692,6 +869,41 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/deployments/{deploymentId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                deploymentId: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * One deployment, with the status of any migrations the CP applied
+         * @description The same object the history lists, plus `migrations` — which only a deployment the
+         *     control plane migrates for you carries.
+         *
+         *     Normally `migrations/` is applied by the **client**: `runlot deploy` connects over the
+         *     wire and runs the files, watched by the person who typed the command. A **preview**
+         *     deploy is the exception, because the CLI can only name the parent project's database
+         *     and running a preview's migrations there is the accident `db=branch` exists to
+         *     prevent. For those the control plane applies them to the branch instead, after the
+         *     branch finishes pouring, and this is where the outcome is read.
+         *
+         *     A preview whose id was returned by `createDeployment` is readable **under its parent
+         *     project's name** — the name the caller deployed through.
+         */
+        get: operations["getDeployment"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/cron": {
         parameters: {
             query?: never;
@@ -1050,8 +1262,10 @@ export interface paths {
         get: operations["getDatabase"];
         put?: never;
         /**
-         * Create a database (called by `runlot deploy` when it reads a `\"database\": true` declaration)
-         * @description Creates the project's database and returns its connection details. Shortly afterwards
+         * Creates a new database after the previous one was deleted
+         * @description Every project has a database from the start; this creates a new, empty one after a
+         *     delete, and clears the turn-off so later deploys keep it. It returns the connection
+         *     details. Shortly afterwards
          *     the running worker picks up a connected `env.db`. No redeploy is needed.
          *
          *     **It is idempotent and never rotates the password.** A second call returns the same
@@ -1202,6 +1416,12 @@ export interface paths {
          *     to your statement**, so `rowCount` still reports what the statement actually did and
          *     `truncated` tells you the listing was cut.
          *
+         *     **Write mode belongs to a dashboard session.** A personal access token reaches this
+         *     route with `db:read` and runs read-only statements; asking for `readOnly: false`
+         *     with a token is 403 `console_write_needs_session`. No scope opens it — a credential
+         *     that has to write goes through `…/database/connect` or `…/database/tokens` and
+         *     connects, where the power it carries is named on the token.
+         *
          *     Requires member or higher. A write leaves a `db.execute` audit event; a read leaves
          *     none.
          */
@@ -1631,7 +1851,7 @@ export interface paths {
         get: operations["getStorage"];
         put?: never;
         /**
-         * Grant storage (called by `runlot deploy` when it reads a `\"storage\": true` declaration)
+         * Turns storage back on after it was turned off
          * @description **This is idempotent** — calling it twice leaves the prefix unchanged, so a retry can
          *     never move objects out of view.
          *
@@ -1717,6 +1937,81 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/storage/objects": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * List objects (`runlot storage ls`)
+         * @description One page of the project's objects, **grouped by `/`** the way a file browser groups
+         *     them: `entries` are the objects directly under `prefix`, and `prefixes` are the
+         *     directories one level down.
+         *
+         *     Keys are the ones the worker writes — `env.storage.put(key, …)` — never the
+         *     internal `p/<projectId>/` prefix, which is an isolation boundary and not part of
+         *     any address.
+         *
+         *     `public` is true when the key sits under a prefix this project has published
+         *     (`…/storage/public`), and `url` is then the unsigned address anyone can read. A
+         *     private object carries no `url`: this field means "anyone can read this", and a
+         *     signed URL in it would show a private object as a public one. For those, ask
+         *     `…/storage/objects/{key}`.
+         *
+         *     **Paging is by `cursor`, and the boundary lands between groups** — no directory is
+         *     listed twice and none is skipped. Feed `cursor` back unchanged; its absence is the
+         *     end.
+         *
+         *     Requires viewer or higher.
+         */
+        get: operations["listStorageObjects"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/storage/objects/{key}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                /** @description The object key. It may contain `/`; the segments are part of the path. */
+                key: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * A short-lived signed URL for one object (`runlot storage download`)
+         * @description A **GET** URL valid for five minutes, which the browser or the CLI then fetches
+         *     directly from the object front. The bytes never pass through this API.
+         *
+         *     The object is looked up before it is signed, so a key that holds nothing is a 404
+         *     here rather than a URL that 404s minutes later somewhere you cannot correlate it.
+         *
+         *     Only GET is signed. Uploading and deleting are not on this surface — write through
+         *     `env.storage` from the worker.
+         *
+         *     Requires viewer or higher.
+         */
+        get: operations["signStorageObject"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/ai/models": {
         parameters: {
             query?: never;
@@ -1773,12 +2068,12 @@ export interface paths {
         get: operations["getAI"];
         put?: never;
         /**
-         * Turns on AI (a deployment calls this after reading `"ai": true`)
+         * Turns AI back on after it was turned off
          * @description **This is idempotent.** There is no request body — neither the limits nor the model list is a
          *     value you set.
          *
-         *     Once it is on, `env.ai` is connected to the worker shortly afterwards. **Your project must
-         *     also declare `"ai": true`** in `runlot.json`, which is what makes the binding appear.
+         *     Every project has AI from the start; this is the way back after `DELETE`, and it clears the
+         *     turn-off so later deploys keep it. `env.ai` is attached from the next deployment.
          *
          *     Requires member or higher. Audited as `ai.grant`.
          */
@@ -1936,7 +2231,7 @@ export interface paths {
         get: operations["getEmail"];
         put?: never;
         /**
-         * Turns on email (a deployment calls this after reading `"email": true`)
+         * Turns email back on after it was turned off
          * @description **This is idempotent.** There is no request body — the address is derived
          *     (`<project>.<org>.<mail-domain>`), and the plan determines the limit. The address is
          *     fixed to the project name at the time of the grant.
@@ -2167,14 +2462,13 @@ export interface paths {
         get: operations["getAuth"];
         put?: never;
         /**
-         * Turns on auth (`runlot deploy` calls this after reading the `"auth": true` declaration)
+         * Turns login back on after it was turned off
          * @description **This is idempotent** — calling it twice leaves the settings and login providers
          *     unchanged. Auth is either on or off; there is no "on but disabled" state.
          *
          *     **A database is required.** Without one this returns 409 `database_required`, because
-         *     the end-user tables live inside the project's database. Declaring `"auth": true` also
-         *     enables the database, and a deploy grants them in that order, so you will not normally
-         *     see this error.
+         *     the end-user tables live inside the project's database. Every project has one unless it
+         *     was deleted, so you will see this only after a database delete.
          *
          *     Once enabled, the built-in login endpoints start serving shortly afterwards. As with
          *     `env.db` and `env.storage`, no redeploy is needed. Table initialization is idempotent,
@@ -2268,6 +2562,70 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/auth/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * The app's end users (`runlot auth users`)
+         * @description The people who signed up to **your app** — not the members of your organization.
+         *     They live in the project's own database, under the `runlot_auth` schema, and this
+         *     route reads them over the same connection `…/database/connect` hands you for psql.
+         *     Everything here is also visible through `env.db` and `psql`; this is a convenience,
+         *     not a second source.
+         *
+         *     **It is read-only.** Blocking a user, deleting one, or resetting a password is not
+         *     on this surface — write through `env.db`.
+         *
+         *     An app whose login has never been used has no schema yet (it is created on the
+         *     first call), and that answers an **empty list** rather than an error.
+         *
+         *     Paging is by `cursor`, newest first. Feed it back unchanged; its absence is the
+         *     end.
+         *
+         *     Requires member or higher, and `db:read` on a token — the subscriber list is the
+         *     project's data, the same class as the SQL console.
+         */
+        get: operations["listAppUsers"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/orgs/{orgSlug}/projects/{projectName}/auth/users/{userId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                userId: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * One end user
+         * @description The same record as the list, for one id. Requires member or higher, and `db:read`
+         *     on a token.
+         */
+        get: operations["getAppUser"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/{orgSlug}/projects/{projectName}/access": {
         parameters: {
             query?: never;
@@ -3841,29 +4199,80 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-}
-export type webhooks = Record<string, never>;
-export interface components {
-    schemas: {
-        RepoRefs: {
-            /**
-             * @description The repository's current default branch. If this ever disagrees with
-             *     `Repo.defaultBranch`, this value is the correct one.
-             */
-            defaultBranch: string;
-            refs: {
-                name: string;
-                /**
-                 * @description The **commit** oid this ref points to. Annotated tags are peeled, so this is
-                 *     always a commit and never a tag object.
-                 */
-                target: string;
-                /** @enum {string} */
-                kind: "branch" | "tag";
-            }[];
-        };
-        RepoTreeEntry: {
-            name: string;
+    "/v1/orgs/{orgSlug}/projects/{projectName}/share": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        /**
+         * The project's share link
+         * @description Requires viewer or higher. **404 when the project has never been shared** — a link is
+         *     minted by `putShareLink`, never as a side effect of reading.
+         */
+        get: operations["getShareLink"];
+        /**
+         * Point the share link at a preview, minting it if there is none
+         * @description Requires member or higher: handing out a public address for the app is publishing, not
+         *     reading.
+         *
+         *     **Idempotent.** The label is minted once and kept, so somebody who already has the
+         *     link keeps working — calling this again with the same preview changes nothing. What it
+         *     does change is *which* preview the link resolves to, so a share from another branch
+         *     moves the same address rather than issuing a second one.
+         *
+         *     `rotate: true` mints a new label and detaches the old name in the same request ("링크
+         *     재발급"), so there is never a moment with two live links. Anyone holding the old link
+         *     stops being able to open it, which is the point.
+         *
+         *     The named preview has to exist. Studio deploys it first
+         *     (`createDeployment?preview=studio&db=branch`) and shares it second.
+         */
+        put: operations["putShareLink"];
+        post?: never;
+        /**
+         * Stop the share link answering
+         * @description Requires member or higher. The name stops resolving and the label is forgotten; a
+         *     later share mints a different one.
+         *
+         *     **The preview is not deleted.** Sharing and running are separate decisions, and a link
+         *     that also destroyed a database branch would be a surprising amount of destruction.
+         *
+         *     A project that is not shared answers 204 — the caller is turning something off.
+         */
+        delete: operations["deleteShareLink"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        RepoRefs: {
+            /**
+             * @description The repository's current default branch. If this ever disagrees with
+             *     `Repo.defaultBranch`, this value is the correct one.
+             */
+            defaultBranch: string;
+            refs: {
+                name: string;
+                /**
+                 * @description The **commit** oid this ref points to. Annotated tags are peeled, so this is
+                 *     always a commit and never a tag object.
+                 */
+                target: string;
+                /** @enum {string} */
+                kind: "branch" | "tag";
+            }[];
+        };
+        RepoTreeEntry: {
+            name: string;
             /** @description Path relative to the repository root */
             path: string;
             /** @enum {string} */
@@ -3927,6 +4336,54 @@ export interface components {
          * @enum {string}
          */
         TokenScope: "repo:read" | "repo:write" | "repo:none";
+        /** @description RFC 6749 §5.1. */
+        OAuthTokenResponse: {
+            /** @description An Ed25519 JWT (RFC 9068). Fifteen minutes. */
+            access_token: string;
+            /** @example Bearer */
+            token_type: string;
+            /**
+             * @description Seconds. It is present so a client refreshes ahead of time instead of discovering
+             *     expiry as a 401 in the middle of something.
+             * @example 900
+             */
+            expires_in: number;
+            /** @description Rotated: using one invalidates it and returns the next. */
+            refresh_token: string;
+            /** @example project:read deploy repo:read repo:write db:read */
+            scope: string;
+        };
+        /**
+         * @description RFC 6749 §5.2. **Not this document's error envelope**: `/oauth/token` and
+         *     `/oauth/revoke` are read by generic OAuth clients that cannot parse ours.
+         */
+        OAuthError: {
+            /** @example invalid_grant */
+            error: string;
+            error_description?: string;
+        };
+        /** @description One connected app, as `/account/apps` lists it (docs/studio.md §8.4). */
+        OAuthGrant: {
+            /** @description The grant's session id. It is the `sid` claim in every access token it minted, and what revocation is keyed by. */
+            sid: string;
+            /** @example studio-desktop */
+            clientId: string;
+            /** @example runlot Studio */
+            clientName: string;
+            /**
+             * @description What the device called itself when it connected. Null for a client that did not say.
+             * @example Ryan의 MacBook Pro
+             */
+            deviceName: string | null;
+            scopes: components["schemas"]["ApiScope"][];
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Null when the grant has never been used — a sign-in that was never followed by a call.
+             */
+            lastUsedAt: string | null;
+        };
         /**
          * @description One permission a personal access token carries. Scopes are checked on **every** route:
          *     the token acts as its owner, subject to that person's organization role, and the scope
@@ -4282,7 +4739,7 @@ export interface components {
              *     human-readable wording is produced separately by the dashboard and by email.
              * @enum {string}
              */
-            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "overage_charge_failed" | "disabled_project_deletion" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled";
+            kind: "project_limit" | "db_near_cap" | "storage_near_quota" | "storage_quota_hit" | "backup_failed" | "cron_failed" | "queue_failed" | "queue_ops_cap" | "build_failed" | "restore_done" | "dns_publish_stalled" | "billing_past_due" | "overage_charge_failed" | "disabled_project_deletion" | "backup_stalled" | "backup_no_restore_point" | "backup_chain_broken" | "backup_always_full" | "budget_exhausted" | "ai_credit_low" | "ai_credit_exhausted" | "ai_autotopup_failed" | "ai_autotopup_disabled" | "new_device";
             /** @description If this is a project-related notification, the name of that project. Absent for org-level notifications (`project_limit`) */
             projectName?: string;
             /**
@@ -4294,8 +4751,9 @@ export interface components {
              * @description Extra values, which differ by kind. `project_limit` is `{limit, count}`,
              *     a usage alert is `{bytes, capBytes}`, an operation alert is
              *     `{opId, opKind, reason?}`, `cron_failed` is
-             *     `{cron, reason, scheduledAt}`, `queue_failed` is `{queue, reason, runs}` and
-             *     `queue_ops_cap` is `{used, limit, plan}`.
+             *     `{cron, reason, scheduledAt}`, `queue_failed` is `{queue, reason, runs}`,
+             *     `queue_ops_cap` is `{used, limit, plan}` and `new_device` is
+             *     `{app, clientId, device}`.
              */
             detail: {
                 [key: string]: unknown;
@@ -4394,7 +4852,7 @@ export interface components {
         /** @description A deployment in the overview. Same shape as `Deployment`, including `actor`. */
         OverviewDeployment: components["schemas"]["Deployment"];
         OverviewDatabase: {
-            /** @description Whether `"database": true` is set in `runlot.json` */
+            /** @description Whether the project has a database. Every project has one unless it was deleted. */
             granted: boolean;
             /**
              * Format: date-time
@@ -4414,7 +4872,7 @@ export interface components {
              */
             generations: number;
         };
-        /** @description Which resources declared in `runlot.json` are enabled for this project. */
+        /** @description Which of the project's resources are on. Every one is on unless somebody turned it off. */
         OverviewFeatures: {
             database: boolean;
             storage: boolean;
@@ -4458,6 +4916,83 @@ export interface components {
              */
             gitDirty?: boolean;
         };
+        /**
+         * @description The one address Studio hands to a person who is not a developer
+         *     (`docs/studio.md §6.9`).
+         *
+         *     A preview's own hostname is `<preview>--<project>.<org>.<app-domain>`. The `--` is what
+         *     keeps a preview name from colliding with a project name and it is right for a CLI user,
+         *     but it is not a link to send to somebody — and it carries the project's name, which the
+         *     author of a half-finished app may not want published. So a shared preview gets a second
+         *     hostname, and this is it.
+         *
+         *     The label is 12 characters of lowercase base32 (`[a-z2-7]`, 60 bits). **It contains no
+         *     hyphen** — that is why the project name is not in it, since a slug may contain one — and
+         *     it is the only thing between the link and the app, so it is minted from a CSPRNG.
+         *
+         *     It lives under `share.<app-domain>`, not under an org, so it cannot collide with a
+         *     project or preview name. `share` is a reserved org slug for that reason.
+         */
+        ShareLink: {
+            /** @description The 12-character label. Minted once and kept across shares. */
+            label: string;
+            /** @description `<label>.share.<app-domain>`. */
+            hostname: string;
+            /**
+             * Format: uri
+             * @description The address to hand out. Built by the server — the scheme and port are a deployment matter.
+             */
+            url: string;
+            /**
+             * @description The preview the link currently resolves to (`studio`, or `studio-<branch>`).
+             *     Present so that "the link works but shows the wrong branch" is diagnosable.
+             */
+            preview?: components["schemas"]["Slug"];
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description When the label was last re-minted. Absent if it never was.
+             */
+            rotatedAt?: string;
+        };
+        /**
+         * @description Whether the control plane applied this deployment's `migrations/`, and how far it got.
+         *
+         *     Present only on deployments the control plane migrates — today that is a preview
+         *     deployed with `db=branch`. Absent means the schema is the client's to apply, which is
+         *     what `runlot deploy` does.
+         *
+         *     `applied` with `total: 0` is the answer for a bundle that carries no migrations at
+         *     all; it is a state rather than an absence so that a caller waiting on this can tell
+         *     "not started yet" from "there is nothing to run".
+         */
+        DeploymentMigrations: {
+            /**
+             * @description `pending` — not started, or waiting for the preview's database branch to finish
+             *     being poured. A database that could not be reached also returns here, so that the
+             *     next sweep retries: an unreachable node is not a failed migration.
+             *
+             *     `failed` — one file threw, and it is named in `failedName`. Nothing after it ran.
+             * @enum {string}
+             */
+            state: "pending" | "running" | "applied" | "failed";
+            /** @description How many migration files the bundle carries. */
+            total: number;
+            /** @description How many of them went through. */
+            applied: number;
+            /** @description The file that threw, as `0003_posts`. Only on `failed`. */
+            failedName?: string;
+            /** @description The database's own message, truncated. Only on `failed`. */
+            detail?: string;
+            /** Format: date-time */
+            startedAt: string;
+            /**
+             * Format: date-time
+             * @description Absent while `pending` or `running`.
+             */
+            finishedAt?: string;
+        };
         /**
          * @description One preview of a project. A preview behaves like a project of its own — it has its
          *     own hostname, deployments, access policy and usage — and this schema carries what is
@@ -5923,9 +6458,98 @@ export interface components {
             /** @description the most automatic top-ups that can run in one day */
             autoTopupPerDay: number;
         };
+        StorageObject: {
+            /**
+             * @description The key as the worker writes it, without the internal project prefix.
+             * @example avatars/a.png
+             */
+            key: string;
+            /** Format: int64 */
+            size: number;
+            /**
+             * @description the stored content type
+             * @example image/png
+             */
+            type: string;
+            /** Format: date-time */
+            modified: string;
+            /** @description Whether this key sits under one of the project's published prefixes. */
+            public: boolean;
+            /**
+             * @description The unsigned public address, present only when `public` is true and this
+             *     installation has a public object front. It is never a signed URL.
+             * @example https://objects.runlot.io/acme/app/avatars/a.png
+             */
+            url?: string;
+        };
+        StorageObjectPage: {
+            entries: components["schemas"]["StorageObject"][];
+            /**
+             * @description The directories one level under the requested prefix, each ending in `/`. Pass one back as `prefix`.
+             * @example [
+             *       "avatars/",
+             *       "uploads/"
+             *     ]
+             */
+            prefixes: string[];
+            /** @description Pass it back to get the next page. Absent means the end. */
+            cursor?: string;
+            /** @description The project's published prefixes, carried on every page so a client can explain the `public` marks without a second call. */
+            publicPrefixes: string[];
+            /** @description `https://<objects host>/<org>/<project>`. Absent when this installation has no public object front. */
+            publicBase?: string;
+        };
+        StorageObjectSigned: {
+            key: string;
+            /** @description A signed GET. Fetch it directly; the bytes do not pass through this API. */
+            url: string;
+            /**
+             * Format: date-time
+             * @description When the signature stops working. It travels with the URL so a client does not learn the lifetime from documentation and then cache past it.
+             */
+            expiresAt: string;
+            /** Format: int64 */
+            size: number;
+            type: string;
+            /** Format: date-time */
+            modified: string;
+            public: boolean;
+        };
+        /** @description One end user of the app (`runlot_auth.users`, docs/auth.md §6). */
+        AppUser: {
+            /** Format: uuid */
+            id: string;
+            /** @description Lowercased. Empty for an account that has only a social identity. */
+            email: string;
+            name?: string;
+            /** @description `password`, `github`, `google`, `kakao` … sorted, from the linked identities. */
+            providers: string[];
+            /** Format: date-time */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Absent for somebody who has never signed in.
+             */
+            lastSignIn?: string;
+            /** @description `banned_at` is set. Changing it is not on this surface. */
+            blocked: boolean;
+            /** @description **Live** sessions only. Expired rows stay until the sweeper runs and counting them would show a signed-out person as signed in. */
+            sessions: number;
+        };
+        AppUserPage: {
+            users: components["schemas"]["AppUser"][];
+            /** @description Pass it back to get the next page. Absent means the end. */
+            cursor?: string;
+        };
         AILedgerRow: {
             /** @enum {string} */
             kind: "call" | "topup" | "adjust";
+            /**
+             * @description Which caller spent it. It is present on every row including a top-up, where it
+             *     is `app` and means nothing.
+             * @enum {string}
+             */
+            lane: "app" | "dev" | "studio";
             model?: string;
             project?: string;
             /** Format: int64 */
@@ -7177,6 +7801,327 @@ export interface operations {
             };
         };
     };
+    oauthMetadata: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The metadata document */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @example https://api.runlot.io */
+                        issuer: string;
+                        /** @example https://api.runlot.io/oauth/authorize */
+                        authorization_endpoint: string;
+                        /** @example https://api.runlot.io/oauth/token */
+                        token_endpoint: string;
+                        /** @example https://api.runlot.io/oauth/revoke */
+                        revocation_endpoint?: string;
+                        /** @example https://api.runlot.io/.well-known/jwks.json */
+                        jwks_uri: string;
+                        /**
+                         * @example [
+                         *       "code"
+                         *     ]
+                         */
+                        response_types_supported?: string[];
+                        /**
+                         * @example [
+                         *       "authorization_code",
+                         *       "refresh_token"
+                         *     ]
+                         */
+                        grant_types_supported?: string[];
+                        /**
+                         * @description `S256` only. `plain` is not accepted and so is not advertised.
+                         * @example [
+                         *       "S256"
+                         *     ]
+                         */
+                        code_challenge_methods_supported?: string[];
+                        /**
+                         * @description `none`: the clients are public and PKCE takes the secret's place.
+                         * @example [
+                         *       "none"
+                         *     ]
+                         */
+                        token_endpoint_auth_methods_supported?: string[];
+                        scopes_supported?: components["schemas"]["ApiScope"][];
+                        /**
+                         * @example [
+                         *       "EdDSA"
+                         *     ]
+                         */
+                        access_token_signing_alg_values_supported?: string[];
+                        /** @description The `aud` every access token carries, and the one a resource server must require. */
+                        runlot_access_token_audience?: string;
+                    } & {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            /** @description Connected-app sign-in is not configured on this deployment */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    oauthJwks: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The key set */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        keys: ({
+                            kid?: string;
+                            /** @example OKP */
+                            kty?: string;
+                            /** @example Ed25519 */
+                            crv?: string;
+                            /** @example EdDSA */
+                            alg?: string;
+                            /** @example sig */
+                            use?: string;
+                            /** @description base64url of the public key */
+                            x?: string;
+                        } & {
+                            [key: string]: unknown;
+                        })[];
+                    };
+                };
+            };
+        };
+    };
+    oauthAuthorize: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @example studio-desktop */
+                    client_id: string;
+                    /** @description Must be registered for the client. It is **not** echoed in a refusal — that would make the endpoint a probe for accepted redirects. */
+                    redirect_uri: string;
+                    /** @enum {string} */
+                    response_type?: "code";
+                    /**
+                     * @description Space-separated. Empty means the client's whole set. A scope the client does not carry is an error, never a silent drop.
+                     * @example project:read deploy repo:read repo:write db:read
+                     */
+                    scope?: string;
+                    state?: string;
+                    code_challenge: string;
+                    /** @enum {string} */
+                    code_challenge_method: "S256";
+                    /**
+                     * @description Ours, not OAuth's: what Connected apps shows beside the client (docs/studio.md §8.1).
+                     * @example Ryan의 MacBook Pro
+                     */
+                    device_name?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Approved. The browser is sent to `redirect`. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description `redirect_uri` with `code` and `state`. */
+                        redirect: string;
+                    };
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    oauthToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": {
+                    /** @enum {string} */
+                    grant_type: "authorization_code" | "refresh_token";
+                    client_id: string;
+                    /** @description `authorization_code` only. */
+                    code?: string;
+                    /** @description `authorization_code` only. PKCE, S256. */
+                    code_verifier?: string;
+                    /** @description `authorization_code` only. Must match the one the code was issued for. */
+                    redirect_uri?: string;
+                    /** @description `refresh_token` only. */
+                    refresh_token?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description A new access token, and the next refresh token */
+            200: {
+                headers: {
+                    "Cache-Control"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthTokenResponse"];
+                };
+            };
+            /** @description RFC 6749 §5.2 */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthError"];
+                };
+            };
+            /** @description Too many attempts from this client or this address */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthError"];
+                };
+            };
+            /** @description Connected-app sign-in is not configured on this deployment */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthError"];
+                };
+            };
+        };
+    };
+    oauthRevoke: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": {
+                    /** @description A refresh token or an access token. */
+                    token: string;
+                    /** @enum {string} */
+                    token_type_hint?: "refresh_token" | "access_token";
+                    client_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Revoked, or the token was unknown — the two are deliberately the same answer */
+            200: {
+                headers: {
+                    "Cache-Control"?: string;
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description RFC 6749 §5.2 */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthError"];
+                };
+            };
+            /** @description Too many attempts from this client or this address */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthError"];
+                };
+            };
+        };
+    };
+    listOAuthGrants: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The grants */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        grants: components["schemas"]["OAuthGrant"][];
+                    };
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    revokeOAuthGrant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The grant's session id, as `GET /v1/oauth/grants` returned it. */
+                sid: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     getMe: {
         parameters: {
             query?: never;
@@ -7848,6 +8793,34 @@ export interface operations {
             };
         };
     };
+    getDeployment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                deploymentId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The deployment */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Deployment"] & {
+                        migrations?: components["schemas"]["DeploymentMigrations"];
+                    };
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     getProjectCron: {
         parameters: {
             query?: {
@@ -8488,7 +9461,19 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            403: components["responses"]["Forbidden"];
+            /**
+             * @description `insufficient_scope` — the token carries neither `db:read` nor a wider scope; or
+             *     `console_write_needs_session` — `readOnly: false` from something other than a
+             *     dashboard session.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             404: components["responses"]["NotFound"];
             /** @description could not reach this project's database (`console_unreachable`) */
             502: {
@@ -9129,10 +10114,100 @@ export interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` — the service is temporarily unavailable */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    listStoragePublic: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StoragePublicList"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `no_core` — the service is temporarily unavailable */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    addStoragePublic: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StoragePublicRequest"];
+            };
+        };
+        responses: {
+            /** @description The list after the change */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["StoragePublicList"];
+                };
+            };
+            /** @description The prefix is empty, not normalizable, or would leave the project's slice */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description `storage_not_granted`, or `too_many_public_prefixes` */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
             };
-            403: components["responses"]["Forbidden"];
-            404: components["responses"]["NotFound"];
             /** @description `no_core` — the service is temporarily unavailable */
             503: {
                 headers: {
@@ -9144,7 +10219,7 @@ export interface operations {
             };
         };
     };
-    listStoragePublic: {
+    removeStoragePublic: {
         parameters: {
             query?: never;
             header?: never;
@@ -9154,9 +10229,13 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StoragePublicRequest"];
+            };
+        };
         responses: {
-            /** @description The list */
+            /** @description The list after the change */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -9165,6 +10244,15 @@ export interface operations {
                     "application/json": components["schemas"]["StoragePublicList"];
                 };
             };
+            /** @description The prefix is empty or not normalizable */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
             /** @description `no_core` — the service is temporarily unavailable */
@@ -9178,9 +10266,16 @@ export interface operations {
             };
         };
     };
-    addStoragePublic: {
+    listStorageObjects: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Key prefix to list under. It is normalized the same way a published prefix is: `assets` becomes `assets/`, and empty means the project root. */
+                prefix?: string;
+                /** @description the `cursor` of the previous page */
+                cursor?: string;
+                /** @description entries plus prefixes on one page */
+                limit?: number;
+            };
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
@@ -9188,22 +10283,18 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["StoragePublicRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description The list after the change */
+            /** @description One page */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["StoragePublicList"];
+                    "application/json": components["schemas"]["StorageObjectPage"];
                 };
             };
-            /** @description The prefix is empty, not normalizable, or would leave the project's slice */
+            /** @description `prefix` is not normalizable, or `limit` is out of range */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -9214,7 +10305,7 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            /** @description `storage_not_granted`, or `too_many_public_prefixes` */
+            /** @description `storage_not_granted` — this project has no file storage */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -9223,7 +10314,16 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description `no_core` — the service is temporarily unavailable */
+            /** @description `objects_unreachable` — the object store did not answer */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description `objects_unavailable` — this installation has no object store; or `no_core` */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -9234,32 +10334,30 @@ export interface operations {
             };
         };
     };
-    removeStoragePublic: {
+    signStorageObject: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 orgSlug: components["parameters"]["OrgSlug"];
                 projectName: components["parameters"]["ProjectName"];
+                /** @description The object key. It may contain `/`; the segments are part of the path. */
+                key: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["StoragePublicRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description The list after the change */
+            /** @description The signed URL and the object's metadata */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["StoragePublicList"];
+                    "application/json": components["schemas"]["StorageObjectSigned"];
                 };
             };
-            /** @description The prefix is empty or not normalizable */
+            /** @description the key is empty, escapes the project prefix, or is over 1024 bytes */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -9270,7 +10368,16 @@ export interface operations {
             };
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            /** @description `no_core` — the service is temporarily unavailable */
+            /** @description `storage_not_granted` — this project has no file storage */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description `objects_unavailable` — this installation has no object store; or `no_core` */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -9443,6 +10550,25 @@ export interface operations {
                 limit?: number;
                 /** @description rows before this ledger_id */
                 before?: number;
+                /**
+                 * @description Only rows spent by this lane. `app` is the deployed worker's `env.ai`, `dev` is
+                 *     the same app running on a developer's machine or tab, and `studio` is Studio's
+                 *     own agent turns. Absent means every lane; an unknown value is a 400 rather than
+                 *     an empty page.
+                 */
+                lane?: "app" | "dev" | "studio";
+                /**
+                 * @description Only rows of this kind. `kind=topup&limit=1` is the last top-up, which is
+                 *     otherwise an unbounded walk backwards through a busy day's calls. An unknown
+                 *     value is a 400.
+                 */
+                kind?: "call" | "topup" | "adjust";
+                /**
+                 * @description Only rows at or after this instant (RFC 3339). It is an instant and not a
+                 *     date on purpose: the day boundary belongs to the caller, whose midnight is
+                 *     their own zone's. A value that is not RFC 3339 is a 400.
+                 */
+                since?: string;
             };
             header?: never;
             path: {
@@ -10000,8 +11126,8 @@ export interface operations {
             403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
             /**
-             * @description `database_required` — this project has no database.
-             *     Set `"database": true` in runlot.json and deploy.
+             * @description `database_required` — this project's database was deleted.
+             *     Create a new one with `POST …/database` (`runlot pg on`).
              */
             409: {
                 headers: {
@@ -10196,6 +11322,110 @@ export interface operations {
             };
         };
     };
+    listAppUsers: {
+        parameters: {
+            query?: {
+                /** @description matches the email or the name, case-insensitively */
+                search?: string;
+                /** @description the `cursor` of the previous page */
+                cursor?: string;
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AppUserPage"];
+                };
+            };
+            /** @description `cursor` is not one this endpoint issued, or `limit` is out of range */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            /** @description no such project, or the project has no database (so it can have no users) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description could not reach this project's database (`console_unreachable`) */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description the database did not answer within the round-trip deadline (`console_timeout`) */
+            504: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    getAppUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The user */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AppUser"];
+                };
+            };
+            /** @description `userId` is not a uuid */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description could not reach this project's database (`console_unreachable`) */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     getAccess: {
         parameters: {
             query?: never;
@@ -12772,5 +14002,103 @@ export interface operations {
             };
         };
     };
+    getShareLink: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The share link */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ShareLink"];
+                };
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    putShareLink: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Which preview the link resolves to. Default `studio` — the single slug
+                     *     Studio shares `main` from, which is what makes every share of main count
+                     *     as one preview against the plan.
+                     */
+                    preview?: components["schemas"]["Slug"];
+                    /**
+                     * @description Mint a new label and retire the old one.
+                     * @default false
+                     */
+                    rotate?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description The share link */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ShareLink"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            403: components["responses"]["Forbidden"];
+            /** @description The project, or the named preview, does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    deleteShareLink: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                orgSlug: components["parameters"]["OrgSlug"];
+                projectName: components["parameters"]["ProjectName"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No longer shared */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
 }
 //# sourceMappingURL=schema.d.ts.map