@walkeros/cli 4.5.0 → 4.6.0-next-1788817472881

package/dist/index.d.ts

@@ -331,8 +331,31 @@ declare function bundle(configOrPath: unknown, options?: {
  */
 type Platform = 'web' | 'server';
 
-declare function getToken(): string | undefined;
-declare function getAuthHeaders(): Record<string, string>;
+/**
+ * Resolve a bearer for an API call, refreshing the stored session when needed.
+ *
+ * Priority: `WALKEROS_TOKEN`, then a legacy static token, then the OAuth
+ * session. Returns null when nothing can be resolved, which callers render as
+ * "run `walkeros login`".
+ *
+ * Throws when a refresh was needed but could not be carried out, which is a
+ * different problem from having no session and must not be reported as one.
+ */
+declare function resolveAccessToken(opts?: {
+    fetch?: typeof fetch;
+    now?: () => number;
+}): Promise<string | null>;
+/**
+ * Authorization header for the resolved credential, or an empty object when
+ * there is none. Async because resolving may have to refresh the session.
+ */
+declare function getAuthHeaders(): Promise<Record<string, string>>;
+/**
+ * Where a credential would come from, without resolving or refreshing it.
+ * For commands that want to send someone to `walkeros login` before spending
+ * a network round trip.
+ */
+declare function credentialSource(): 'env' | 'config' | null;
 declare function requireProjectId(): string;
 
 /**
@@ -725,64 +748,87 @@ interface LoginCommandOptions extends GlobalOptions {
     url?: string;
     json?: boolean;
 }
-interface DeviceCodeResult {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete?: string;
-    expiresIn: number;
-    interval: number;
-}
-interface DeviceCodeOptions {
-    url?: string;
-    fetch?: typeof globalThis.fetch;
+interface LoginResult {
+    success: boolean;
+    email?: string;
+    configPath?: string;
+    error?: string;
 }
-interface PollOptions {
+interface LoginOptions {
     url?: string;
+    /** Override browser opener for testing */
+    openUrl?: (url: string) => Promise<void>;
+    /** Override fetch for testing */
     fetch?: typeof globalThis.fetch;
-    /** Timeout in milliseconds. Defaults to 60000 (60s). */
-    timeoutMs?: number;
-    /** Poll interval in milliseconds. Defaults to 5000. */
-    intervalMs?: number;
+    /** Max poll attempts before giving up (for testing) */
+    maxPollAttempts?: number;
+    /** Poll interval, replacing the server's stated one (for testing) */
+    pollIntervalMs?: number;
 }
-type PollResult = {
-    success: true;
-    status: 'authenticated';
-    email: string;
-    configPath: string;
+/**
+ * The outcome of finishing a device authorization.
+ *
+ * It carries no token material. `completeDeviceLogin` stores the session
+ * itself, so the credential file keeps exactly one writer and a caller can
+ * neither persist nor leak what came back.
+ *
+ * `pending` and `slow_down` both mean the window closed with the approval
+ * still outstanding: the device code is untouched, so the same code can be
+ * handed back in. `slow_down` is that same situation with the server asking
+ * for a wider gap before the next attempt.
+ */
+type DeviceLoginResult = {
+    status: 'ok';
 } | {
-    success: false;
     status: 'pending';
 } | {
-    success: false;
+    status: 'slow_down';
+} | {
+    status: 'denied';
+} | {
+    status: 'expired';
+} | {
     status: 'error';
     error: string;
 };
+interface CompleteDeviceLoginOptions {
+    /** App to poll. Defaults to the resolved app URL. */
+    url?: string;
+    /** Stop polling after this long. */
+    timeoutMs?: number;
+    /** Wait between polls, before any `slow_down` widens it. */
+    intervalMs?: number;
+    /** Override fetch for testing */
+    fetch?: typeof globalThis.fetch;
+    /** Max poll attempts before giving up (for testing) */
+    maxPollAttempts?: number;
+}
 declare function loginCommand(options: LoginCommandOptions): Promise<void>;
 /**
- * Request a device code from the auth server.
- * First step of the device code flow — returns data needed to show
- * the user a code and URL, then poll for the token.
- */
-declare function requestDeviceCode(options?: DeviceCodeOptions): Promise<DeviceCodeResult>;
-/**
- * Poll the auth server until the device code is authorized, times out, or fails.
- * Second step of the device code flow.
- *
- * On success: writes config and returns authenticated result.
- * On timeout: returns pending (NOT an error — caller can retry).
- * On real error (denied, expired): returns error result.
+ * Poll a device authorization to its end and store the session it yields.
  *
- * In-flight fetch requests are bounded by the remaining time to the deadline
- * via AbortController, so a hanging fetch cannot exceed the configured timeout.
- * Malformed JSON responses return an error result instead of throwing.
+ * Split out from `login` so a caller holding only a device code can finish an
+ * authorization that is already under way. `login` cannot serve that: it
+ * starts a fresh authorization on every call, which would strand the code the
+ * person is looking at.
  */
-declare function pollForToken(deviceCode: string, options?: PollOptions): Promise<PollResult>;
+declare function completeDeviceLogin(deviceCode: string, options?: CompleteDeviceLoginOptions): Promise<DeviceLoginResult>;
+declare function login(options?: LoginOptions): Promise<LoginResult>;
 
 interface LogoutCommandOptions extends GlobalOptions {
     json?: boolean;
 }
 declare function logoutCommand(options: LogoutCommandOptions): Promise<void>;
+/**
+ * Revoke the stored refresh token, then drop the local config.
+ *
+ * Revocation first, because deleting the file alone would leave a credential
+ * alive on the server that nothing can ever reach to retire. It is best
+ * effort: a logout on a plane still has to clear the machine.
+ */
+declare function logout(): Promise<{
+    deleted: boolean;
+}>;
 
 declare function whoami(): Promise<{
     userId: string;
@@ -3693,7 +3739,7 @@ interface paths {
     put?: never;
     /**
      * Deploy settings
-     * @description Start a deployment for a specific settings entry. Detects platform from the settings.
+     * @description Start a deployment for a specific settings entry. Detects platform from the settings. The body is optional and carries only `humanText`, the reason for the change, which becomes the description of the release this deploy produces; it is ignored when the release already has one.
      */
     post: {
       parameters: {
@@ -3706,7 +3752,11 @@ interface paths {
         };
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['DeploySettingsRequest'];
+        };
+      };
       responses: {
         /** @description Deployment started */
         201: {
@@ -6845,8 +6895,9 @@ interface paths {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['BillingDetailsResponse'] &
-              (Record<string, never> | null);
+            'application/json':
+              | components['schemas']['BillingDetailsResponse']
+              | null;
           };
         };
         /** @description Unauthorized */
@@ -7434,13 +7485,14 @@ interface paths {
     };
     /**
      * List flow releases
-     * @description List the release history for a flow across all of its deployment lineages, newest first, paginated. Each entry is a deployed version joined to its parent deployment (slug and type). Requires member role.
+     * @description List the release history for a flow across all of its deployment lineages, newest first, paginated. Each entry is a deployed version joined to its parent deployment (slug and type). `rationale=true` joins each row's stored rationale summary on, which requires the `hub` feature; without it the `rationale` key is absent from every row rather than null, and no feature beyond member role is needed. Requires member role.
      */
     get: {
       parameters: {
         query?: {
           limit?: number;
           offset?: number | null;
+          rationale?: 'true' | 'false';
         };
         header?: never;
         path: {
@@ -7506,6 +7558,184 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  '/api/projects/{projectId}/flows/{flowId}/releases/{versionId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Read one release in full
+     * @description One release of this flow with its rationale and its diff. The path segment is either the spine version id (`ver_...`) or the flow-unique spine number, and the route decides which it was, so a caller holding only the number needs no lookup first. The diff is computed server-side from the two stored snapshots and is never accepted from a caller; its predecessor is the next LOWER spine number, not the previous row by time, because spine rows are reused across redeploys of identical content. `diff.text` is rendered from masked content, so an empty string can still mean the releases differ inside an inline secret: `diff.contentIdentical`, compared over the unmasked hashes, is the trustworthy answer. `diff` is null for the flow's oldest release. An unknown address, a sibling flow's version, and an autosave revision all answer 404 alike. Requires member role and the `hub` feature.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+          /** @description Spine version id of the release (ver_...) or its spine number */
+          versionId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The release, its rationale, and its diff */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ReleaseDetailResponse'];
+          };
+        };
+        /** @description Invalid release reference */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/releases/{versionId}/content': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Read a release snapshot
+     * @description The flow config one release of this flow froze, addressed by its spine version id. This is the only route that serves a release snapshot: the positional `/versions/{versionNumber}` route numbers the autosave revisions, a disjoint set of rows, so a release number handed to it addresses an unrelated revision or nothing. Inline secret literals are masked. An unknown id, a sibling flow's version, and an autosave revision all answer 404 alike. Requires member role and the `hub` feature.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+          /** @description Spine version ID of the release (ver_...) */
+          versionId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The release snapshot */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ReleaseContentResponse'];
+          };
+        };
+        /** @description Invalid version id */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/api/projects/{projectId}/flows/{flowId}/releases/annotations': {
     parameters: {
       query?: never;
@@ -8057,7 +8287,7 @@ interface paths {
     };
     trace?: never;
   };
-  '/api/projects/{projectId}/flows/{flowId}/releases/step-history': {
+  '/api/projects/{projectId}/knowledge': {
     parameters: {
       query?: never;
       header?: never;
@@ -8065,35 +8295,36 @@ interface paths {
       cookie?: never;
     };
     /**
-     * List the releases that touched one step
-     * @description The releases of this flow that added, changed, or removed one step, newest first, each carrying the rationale stored for it. `step` is a `type.name` key over source, transformer, destination, store, and contract. `flow` narrows the scan to one named flow inside the config and is ignored for a contract key. `limit` bounds the releases scanned, not the entries returned. When nothing matched, `knownSteps` lists the addressable keys of the newest scanned release. Requires member role.
+     * List knowledge captured in this project
+     * @description What people wrote on the frames of a page, most recently active first. Two kinds come back together and `kind` separates them: a `thread` carries its text in messages, a `description` carries one body and cannot be replied to. `pageKey` narrows to a whole page, resolved server-side to every frame that page holds at any depth; `frameId` narrows to one frame; `markId` narrows to one mark within it and is refused without `frameId`, since a mark id alone addresses nothing. `includeMessages=true` attaches message bodies and holds the page to a much smaller ceiling, so `hasMoreEntries` is what separates a complete answer from a truncated one. `validity` says when an entry was true and `freshness` compares that against the flow’s newest release; neither is a verdict. Requires member role.
      */
     get: {
       parameters: {
-        query: {
-          step: string;
-          flow?: string;
-          limit?: number | null;
+        query?: {
+          pageKey?: string;
+          frameId?: string;
+          markId?: string;
+          includeMessages?: 'true' | 'false';
+          limit?: number;
         };
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description The releases that touched the step */
+        /** @description Knowledge in this project */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['StepHistoryResponse'];
+            'application/json': components['schemas']['ListKnowledgeResponse'];
           };
         };
-        /** @description Invalid step key or query */
+        /** @description Invalid query, or a mark filter with no frame */
         400: {
           headers: {
             [name: string]: unknown;
@@ -8141,25 +8372,9 @@ interface paths {
       };
     };
     put?: never;
-    post?: never;
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/projects/{projectId}/flows/{flowId}/releases/summarize': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
     /**
-     * Summarize or check a release
-     * @description Describe what one release of this flow changed against an earlier release, or check a written note against that same change. In `draft` mode the generated text is stored as the release's generated summary; in `check` mode nothing is stored and the response says whether the note matches. The diff is always recomputed from the two stored snapshots, with secret literals masked, and is never taken from the request. Both versions must be numbered releases of this flow, and `prevVersionId` must be the earlier of the two. Requires member role and the `hub` feature.
+     * Open a thread on a mark or a frame
+     * @description Open a thread on one mark of one frame, or on the frame itself with `anchorType` `page` and no `markId`, with its first message. A thread never exists empty, so `text` is required and may not be blank. `clientThreadId` and `clientMessageId` are minted by the client at compose time and are what make a replay idempotent: repeating a known `clientThreadId` hands back the existing thread and writes nothing, so an offline queue can drain repeatedly without duplicating what a person wrote once. `flowId` binds the capture to a flow or is explicitly null; a flow this project cannot see answers 404, never 403. A frame this project does not hold answers 404 with `FRAME_NOT_FOUND`, which a draining client waits on and retries, because the frame’s own write may not have landed yet. The server decides the composed anchor key, the born release, the author and the source: a client cannot assert any of them. Requires member role.
      */
     post: {
       parameters: {
@@ -8167,34 +8382,43 @@ interface paths {
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
         };
         cookie?: never;
       };
       requestBody?: {
         content: {
           'application/json': {
-            /** @example ver_a1b2c3d4 */
-            versionId: string;
-            /** @example ver_a1b2c3d4 */
-            prevVersionId: string;
-            /** @enum {string} */
-            mode: 'draft' | 'check';
-            currentText?: string;
+            /**
+             * @example tag
+             * @enum {string}
+             */
+            anchorType: 'tag' | 'page';
+            /** @example frm_V1StGXR8Z5jdHi6BmyT7K */
+            frameId: string;
+            markId?: string;
+            anchorLabel?: string;
+            flowId: string | null;
+            subjectKey?: string;
+            spatial?: components['schemas']['KnowledgeSpatial'];
+            /** @example ct_7f3a91 */
+            clientThreadId: string;
+            text: string;
+            /** @example ct_7f3a91 */
+            clientMessageId: string;
           };
         };
       };
       responses: {
-        /** @description The generated summary or the check verdict */
-        200: {
+        /** @description The thread, with its first message */
+        201: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['SummarizeReleaseResponse'];
+            'application/json': components['schemas']['KnowledgeThreadResponse'];
           };
         };
-        /** @description Invalid body, a target is not a release, the pair is out of order, or no LLM provider is configured */
+        /** @description Invalid body */
         400: {
           headers: {
             [name: string]: unknown;
@@ -8221,7 +8445,7 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Not found */
+        /** @description The named flow or frame is not in this project */
         404: {
           headers: {
             [name: string]: unknown;
@@ -8239,15 +8463,6 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description The model call failed or returned no usable text */
-        502: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
       };
     };
     delete?: never;
@@ -8256,36 +8471,56 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/deployments/{deploymentId}/versions/current/content': {
+  '/api/projects/{projectId}/knowledge/{threadId}/messages': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
+    get?: never;
+    put?: never;
     /**
-     * Get current deployed content
-     * @description Get the active deployed per-setting content for a deployment, used to diff changes since deploy. Content is masked and display-only; every field is null when there is no deployed baseline. Requires member role.
+     * Reply to a knowledge thread
+     * @description Append a message to a thread and get the whole thread back, so a surface renders the new exchange without a second read. `text` may not be blank: a message cannot be cleared, so empty is invalid rather than a way to erase one. Repeating a `clientMessageId` already on the thread appends nothing and leaves `updatedAt` alone, so a retrying drain never keeps bumping a thread to the top of every list. A description has no conversation and cannot be replied to; addressing one answers 404. Requires member role.
      */
-    get: {
+    post: {
       parameters: {
         query?: never;
         header?: never;
         path: {
           projectId: string;
-          deploymentId: string;
+          /** @description Thread ID (thr_...) */
+          threadId: string;
         };
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': {
+            text: string;
+            /** @example ct_7f3a91 */
+            clientMessageId: string;
+          };
+        };
+      };
       responses: {
-        /** @description Deployed content (or a null baseline) */
-        200: {
+        /** @description The thread, with the new message */
+        201: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['DeployedContentResponse'];
+            'application/json': components['schemas']['KnowledgeThreadResponse'];
+          };
+        };
+        /** @description Invalid body */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
           };
         };
         /** @description Unauthorized */
@@ -8326,51 +8561,69 @@ interface paths {
         };
       };
     };
-    put?: never;
-    post?: never;
     delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/deployments/{deploymentId}/heartbeats': {
+  '/api/projects/{projectId}/knowledge/description': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
+    get?: never;
     /**
-     * List deployment heartbeats
-     * @description List heartbeat records for a deployment with optional from/to time-range filtering and pagination. Requires member role.
+     * Write the description of a mark or a frame
+     * @description Write the one description of one anchor, a mark or the frame itself, replacing whatever it said before. There is no id to mint: the anchor is the key, so a replayed write lands on the same row by construction, which is why this is a PUT. An empty `body` is refused rather than stored, so a drain that arrives with nothing to say can never erase what a person wrote. The response is 200 whether the description was opened or replaced. Requires member role.
      */
-    get: {
+    put: {
       parameters: {
-        query?: {
-          /** @description ISO start of the time range. */
-          from?: string;
-          /** @description ISO end of the time range. */
-          to?: string;
-          limit?: number;
-          offset?: number | null;
-        };
+        query?: never;
         header?: never;
         path: {
           projectId: string;
-          deploymentId: string;
         };
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': {
+            /**
+             * @example tag
+             * @enum {string}
+             */
+            anchorType: 'tag' | 'page';
+            /** @example frm_V1StGXR8Z5jdHi6BmyT7K */
+            frameId: string;
+            markId?: string;
+            anchorLabel?: string;
+            flowId: string | null;
+            subjectKey?: string;
+            spatial?: components['schemas']['KnowledgeSpatial'];
+            body: string;
+          };
+        };
+      };
       responses: {
-        /** @description Heartbeat history */
+        /** @description The stored description */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ListHeartbeatsResponse'];
+            'application/json': components['schemas']['KnowledgeDescriptionResponse'];
+          };
+        };
+        /** @description Invalid body */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
           };
         };
         /** @description Unauthorized */
@@ -8391,7 +8644,7 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Not found */
+        /** @description The named flow or frame is not in this project */
         404: {
           headers: {
             [name: string]: unknown;
@@ -8400,9 +8653,17 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
-    put?: never;
     post?: never;
     delete?: never;
     options?: never;
@@ -8410,38 +8671,48 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/deployments/{deploymentId}/rotate-ingest-token': {
+  '/api/projects/{projectId}/frames': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
-    get?: never;
-    put?: never;
     /**
-     * Rotate ingest token
-     * @description Rotate the ingest token for a deployment. Owner-only. No grace window: the previous token is immediately invalidated and the new token is returned once.
+     * List the frames of a page, or of the whole project
+     * @description A frame is a named rectangle with marks inside it, the spatial unit of a measurement plan. Naming a `pageKey` returns that page’s frames at any depth, marks and all, newest updated first: the walk starts at the page’s top-level frames and descends containment, so a child is reachable through its parent rather than by carrying a page of its own. Naming no page returns every live frame of the project WITHOUT its marks, which is what makes that read cheap enough to answer "what does this project have": the marks are the bulk of a frame and a listing never renders them. That lean read asks nothing about containment, so a frame whose parent cannot be resolved still appears. Requires member role.
      */
-    post: {
+    get: {
       parameters: {
-        query?: never;
+        query?: {
+          pageKey?: string;
+        };
         header?: never;
         path: {
           projectId: string;
-          deploymentId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description New ingest token */
+        /** @description The page’s frames with their marks, or the project’s frames without them */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['RotateIngestTokenResponse'];
+            'application/json':
+              | components['schemas']['FrameListResponse']
+              | components['schemas']['FrameLeanListResponse'];
+          };
+        };
+        /** @description Validation error */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
           };
         };
         /** @description Unauthorized */
@@ -8471,15 +8742,26 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
+    put?: never;
+    post?: never;
     delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/deployments/{deploymentId}/usage': {
+  '/api/projects/{projectId}/frames/{frameId}': {
     parameters: {
       query?: never;
       header?: never;
@@ -8487,34 +8769,32 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Deployment usage
-     * @description Aggregate usage summary plus bucketed chart data for a deployment over the requested period. Requires member role.
+     * Read one frame
+     * @description One frame with its marks. A frame of another project reads back as nothing and answers 404, never 403, so this route cannot become an oracle for what exists elsewhere. A deleted frame is gone to every read. Requires member role.
      */
     get: {
       parameters: {
-        query?: {
-          /** @description Time window for the usage summary. */
-          period?: '1h' | '24h' | '7d' | '30d';
-        };
+        query?: never;
         header?: never;
         path: {
           projectId: string;
-          deploymentId: string;
+          /** @description Frame ID (frm_...) */
+          frameId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Usage summary and chart buckets */
+        /** @description The frame */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['DeploymentUsageResponse'];
+            'application/json': components['schemas']['Frame'];
           };
         };
-        /** @description Validation error */
+        /** @description The path segment does not address a frame */
         400: {
           headers: {
             [name: string]: unknown;
@@ -8550,46 +8830,58 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
-    put?: never;
-    post?: never;
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/projects/{projectId}/flows/{flowId}/custom-domains': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
     /**
-     * List custom domains
-     * @description List custom domains attached to any deployment of this flow. Requires member role and the customDomains feature.
+     * Create or replace one frame
+     * @description The path is the identity, so the body carries no id: a create is a write to an absent row at `baseVersion` 0 and everything else is a replace. `clientWriteId` is minted at compose time and is what makes a replayed drain exact: a write whose id already produced the stored version landed once and is answered with that version, writing nothing, so an offline queue drains repeatedly without turning one edit into two versions. A write against a version someone else has moved past answers 409 `FRAME_VERSION_CONFLICT` carrying the head, which is what lets a client raise keep-mine against load-theirs on the one frame that conflicted instead of dropping what a person drew. A name another live frame already holds is a distinct 409 `FRAME_NAME_EXISTS`. A relation naming a frame this project does not hold, or one that would place a frame inside itself, is 400 `INVALID_FRAME`. The screenshot is never touched here: a frame write carries no capture. Requires member role.
      */
-    get: {
+    put: {
       parameters: {
         query?: never;
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
+          /** @description Frame ID (frm_...) */
+          frameId: string;
         };
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': {
+            frame: components['schemas']['FrameInput'];
+            baseVersion: number;
+            clientWriteId: string;
+          };
+        };
+      };
       responses: {
-        /** @description Custom domains for the flow */
+        /** @description The stored version */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ListCustomDomainsResponse'];
+            'application/json': components['schemas']['PutFrameResponse'];
+          };
+        };
+        /** @description Invalid body, a bad relation, or a path segment that addresses no frame */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
           };
         };
         /** @description Unauthorized */
@@ -8610,39 +8902,63 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description A stale base version, carrying the head, or a name another live frame already holds. Only the version conflict carries `head`: a name clash needs no frame to resolve, since the client already knows the name it sent. */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json':
+              | components['schemas']['FrameConflictResponse']
+              | components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
-    put?: never;
+    post?: never;
     /**
-     * Attach custom domain
-     * @description Attach a custom domain to the flow's latest server deployment, or to an explicit deployment supplied in the body. Requires member role and the customDomains feature.
+     * Delete one frame
+     * @description Soft-delete the frame and, transitively, every variation of what this delete removes. Children are not variations and survive: each live frame under a removed one is re-parented to its nearest live ancestor in the same transaction, and one left with no live ancestor becomes top-level and inherits the page it hung under, so nothing is left unreachable. Those re-parents are server writes that bump their own versions, so a client still holding a pre-delete version meets a conflict carrying the new parent. A frame this project does not hold answers 404: a delete that removed nothing is not a delete that succeeded. Requires member role.
      */
-    post: {
+    delete: {
       parameters: {
         query?: never;
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
+          /** @description Frame ID (frm_...) */
+          frameId: string;
         };
         cookie?: never;
       };
-      requestBody?: {
-        content: {
-          'application/json': components['schemas']['CreateCustomDomainRequest'];
-        };
-      };
+      requestBody?: never;
       responses: {
-        /** @description Custom domain attached */
-        201: {
+        /** @description The frame is deleted */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            'application/json': components['schemas']['CustomDomain'];
-          };
+          content?: never;
         };
-        /** @description Validation error */
+        /** @description The path segment does not address a frame */
         400: {
           headers: {
             [name: string]: unknown;
@@ -8678,8 +8994,8 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Conflict */
-        409: {
+        /** @description Rate limited */
+        429: {
           headers: {
             [name: string]: unknown;
           };
@@ -8689,13 +9005,12 @@ interface paths {
         };
       };
     };
-    delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/flows/{flowId}/custom-domains/{domainId}': {
+  '/api/projects/{projectId}/frames/{frameId}/screenshot': {
     parameters: {
       query?: never;
       header?: never;
@@ -8704,30 +9019,47 @@ interface paths {
     };
     get?: never;
     put?: never;
-    post?: never;
     /**
-     * Detach custom domain
-     * @description Detach a custom domain from its deployment and remove the Scaleway record. Idempotent: a missing domain still returns 204.
+     * Store the capture of one frame
+     * @description Store one screenshot and set it on its frame. The image arrives as base64 rather than multipart, because the extension relay carries string bodies only. The server decides everything about the bytes: it decodes them, counts the DECODED length against a 4 MB cap, reads the type from the file’s own magic bytes, and hashes them, so nothing the client claims about size or type is consulted. Captures are deduplicated by content within a project: identical pixels resolve to one asset and one upload, and `reused` says whether that happened, which is the common answer rather than the rare one because re-capturing an unchanged frame produces identical bytes. A body past the cap is 413 `PAYLOAD_TOO_LARGE` and one that is not a PNG is 415 `UNSUPPORTED_MEDIA_TYPE`. The capture bumps no frame version: it is not an edit, so an upload never conflicts with the frame write the client queued beside it. Requires member role.
      */
-    delete: {
+    post: {
       parameters: {
         query?: never;
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
-          domainId: string;
+          /** @description Frame ID (frm_...) */
+          frameId: string;
         };
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': {
+            imageBase64: string;
+            meta: components['schemas']['FrameScreenshotMeta'];
+          };
+        };
+      };
       responses: {
-        /** @description Custom domain detached */
-        204: {
+        /** @description The asset the bytes resolved to, and whether it already existed */
+        200: {
           headers: {
             [name: string]: unknown;
           };
-          content?: never;
+          content: {
+            'application/json': components['schemas']['ScreenshotUploadResponse'];
+          };
+        };
+        /** @description Invalid body, or a path segment that addresses no frame */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
         };
         /** @description Unauthorized */
         401: {
@@ -8747,14 +9079,51 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description This project does not hold the named frame */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description The decoded image is past the 4 MB cap */
+        413: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description The bytes are not a PNG */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
+    delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/flows/{flowId}/settings/{settingsId}/deploy-token': {
+  '/api/projects/{projectId}/assets/{assetId}': {
     parameters: {
       query?: never;
       header?: never;
@@ -8762,29 +9131,230 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Self-hosted deploy-token status
-     * @description Report whether a self-hosted deploy token exists for this config, plus the deployment health summary when present. Requires member role.
+     * Read one stored capture
+     * @description The bytes of one frame screenshot, for the app canvas. The extension keeps its own capture locally and never reads assets back. Same-origin and session-authenticated: the response carries `Cross-Origin-Resource-Policy: same-origin`, so no other site can embed a tenant capture off the reader’s session. The bytes are immutable by construction, since the object key is their own content hash, which is why they are cacheable for a year, and `private` keeps a shared cache from serving one tenant’s capture to the next request for the same URL. An asset another project holds answers 404, never 403. Requires member role.
      */
     get: {
       parameters: {
         query?: never;
         header?: never;
+        path: {
+          projectId: string;
+          /** @description Asset ID (fas_...) */
+          assetId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The image bytes */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'image/png': string;
+          };
+        };
+        /** @description The path segment does not address an asset */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/releases/step-history': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the releases that touched one step
+     * @description The releases of this flow that added, changed, or removed one step, newest first, each carrying the rationale stored for it. `step` is a `type.name` key over source, transformer, destination, store, and contract. `flow` narrows the scan to one named flow inside the config and is ignored for a contract key. `limit` bounds the releases scanned, not the entries returned. When nothing matched, `knownSteps` lists the addressable keys of the newest scanned release. Requires member role.
+     */
+    get: {
+      parameters: {
+        query: {
+          step: string;
+          flow?: string;
+          limit?: number | null;
+        };
+        header?: never;
         path: {
           projectId: string;
           flowId: string;
-          settingsId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Deploy-token status */
+        /** @description The releases that touched the step */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['DeployTokenStatusResponse'];
+            'application/json': components['schemas']['StepHistoryResponse'];
+          };
+        };
+        /** @description Invalid step key or query */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/releases/summarize': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Summarize or check a release
+     * @description Describe what one release of this flow changed against an earlier release, or check a written note against that same change. In `draft` mode the generated text is stored as the release's generated summary; in `check` mode nothing is stored and the response says whether the note matches. The diff is always recomputed from the two stored snapshots, with secret literals masked, and is never taken from the request. Both versions must be numbered releases of this flow, and `prevVersionId` must be the earlier of the two. Requires member role and the `hub` feature.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': {
+            /** @example ver_a1b2c3d4 */
+            versionId: string;
+            /** @example ver_a1b2c3d4 */
+            prevVersionId: string;
+            /** @enum {string} */
+            mode: 'draft' | 'check';
+            currentText?: string;
+          };
+        };
+      };
+      responses: {
+        /** @description The generated summary or the check verdict */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['SummarizeReleaseResponse'];
+          };
+        };
+        /** @description Invalid body, a target is not a release, the pair is out of order, or no LLM provider is configured */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
           };
         };
         /** @description Unauthorized */
@@ -8814,46 +9384,1127 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description The model call failed or returned no usable text */
+        502: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/deployments/{deploymentId}/versions/current/content': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get current deployed content
+     * @description Get the active deployed per-setting content for a deployment, used to diff changes since deploy. Content is masked and display-only; every field is null when there is no deployed baseline. Requires member role.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          deploymentId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deployed content (or a null baseline) */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['DeployedContentResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/deployments/{deploymentId}/heartbeats': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List deployment heartbeats
+     * @description List heartbeat records for a deployment with optional from/to time-range filtering and pagination. Requires member role.
+     */
+    get: {
+      parameters: {
+        query?: {
+          /** @description ISO start of the time range. */
+          from?: string;
+          /** @description ISO end of the time range. */
+          to?: string;
+          limit?: number;
+          offset?: number | null;
+        };
+        header?: never;
+        path: {
+          projectId: string;
+          deploymentId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Heartbeat history */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ListHeartbeatsResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/deployments/{deploymentId}/rotate-ingest-token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Rotate ingest token
+     * @description Rotate the ingest token for a deployment. Owner-only. No grace window: the previous token is immediately invalidated and the new token is returned once.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          deploymentId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description New ingest token */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['RotateIngestTokenResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/deployments/{deploymentId}/usage': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Deployment usage
+     * @description Aggregate usage summary plus bucketed chart data for a deployment over the requested period. Requires member role.
+     */
+    get: {
+      parameters: {
+        query?: {
+          /** @description Time window for the usage summary. */
+          period?: '1h' | '24h' | '7d' | '30d';
+        };
+        header?: never;
+        path: {
+          projectId: string;
+          deploymentId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Usage summary and chart buckets */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['DeploymentUsageResponse'];
+          };
+        };
+        /** @description Validation error */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/custom-domains': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List custom domains
+     * @description List custom domains attached to any deployment of this flow. Requires member role and the customDomains feature.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Custom domains for the flow */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ListCustomDomainsResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    /**
+     * Attach custom domain
+     * @description Attach a custom domain to the flow's latest server deployment, or to an explicit deployment supplied in the body. Requires member role and the customDomains feature.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['CreateCustomDomainRequest'];
+        };
+      };
+      responses: {
+        /** @description Custom domain attached */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['CustomDomain'];
+          };
+        };
+        /** @description Validation error */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Conflict */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/custom-domains/{domainId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Detach custom domain
+     * @description Detach a custom domain from its deployment and remove the Scaleway record. Idempotent: a missing domain still returns 204.
+     */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+          domainId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Custom domain detached */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/settings/{settingsId}/deploy-token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Self-hosted deploy-token status
+     * @description Report whether a self-hosted deploy token exists for this config, plus the deployment health summary when present. Requires member role.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+          settingsId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deploy-token status */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['DeployTokenStatusResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    /**
+     * Mint self-hosted deploy token
+     * @description Create a self-hosted deployment (if none exists) and mint a flow+deployment-bound runner token. Admin-only. The raw token is returned once and never stored in plaintext.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+          settingsId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deploy token minted */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['CreateDeployTokenResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/entitlements': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Resolved entitlements
+     * @description Return resolved feature entitlements for the authenticated user and project. Used by CLI/API clients; the web UI uses SSR-resolved entitlements. Requires viewer role.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Resolved entitlements */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['EntitlementsResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/settings/llm': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Active LLM provider
+     * @description Report which LLM provider is currently active for the project and where billing is sourced. Never returns the apiKey. Requires member role and the chat feature.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Active LLM provider status */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['LlmConfigStatusResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description No platform LLM provider configured */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['LlmConfigStatusResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    /**
+     * Set LLM provider
+     * @description Set or clear the project LLM provider override. Admin-only, gated by the chat feature. The apiKey is write-only: it is encrypted and never returned.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['SetLlmConfigRequest'];
+        };
+      };
+      responses: {
+        /** @description LLM config saved or cleared */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['SetLlmConfigResponse'];
+          };
+        };
+        /** @description Validation error */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/chat/sessions': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List chat sessions
+     * @description List the caller's recent chat sessions for a project, ordered by last activity. Requires member role and the chat feature.
+     */
+    get: {
+      parameters: {
+        query?: {
+          limit?: number;
+          offset?: number | null;
+        };
+        header?: never;
+        path: {
+          projectId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Chat session list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ListChatSessionsResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/chat/sessions/{sessionId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get chat session
+     * @description Return a chat session and its full message history when the caller owns it. Foreign or unknown sessions return 404 (never 403) so existence is not leaked. Requires member role and the chat feature.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          sessionId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Chat session with messages */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ChatSessionDetailResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/chat/elicit': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Answer elicitation prompt
+     * @description Answer a pending MCP elicitation prompt (accept, decline, or cancel), unblocking the waiting tool invocation. Requires member role and the chat feature.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['ElicitRequest'];
+        };
+      };
+      responses: {
+        /** @description Elicitation resolved */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ElicitResponse'];
+          };
+        };
+        /** @description Validation error */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/mcp/tokens': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List MCP tokens
+     * @description List the authenticated user's personal MCP tokens. No secret material is returned.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description MCP token list */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ListMcpTokensResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
     put?: never;
     /**
-     * Mint self-hosted deploy token
-     * @description Create a self-hosted deployment (if none exists) and mint a flow+deployment-bound runner token. Admin-only. The raw token is returned once and never stored in plaintext.
+     * Issue MCP token
+     * @description Issue a personal MCP token. The raw token is returned exactly once and is never retrievable afterwards.
      */
     post: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          projectId: string;
-          flowId: string;
-          settingsId: string;
-        };
+        path?: never;
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['CreateMcpTokenRequest'];
+        };
+      };
       responses: {
-        /** @description Deploy token minted */
+        /** @description MCP token issued */
         201: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['CreateDeployTokenResponse'];
-          };
-        };
-        /** @description Unauthorized */
-        401: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['CreateMcpTokenResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
+        /** @description Validation error */
+        400: {
           headers: {
             [name: string]: unknown;
           };
@@ -8861,8 +10512,8 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Not found */
-        404: {
+        /** @description Unauthorized */
+        401: {
           headers: {
             [name: string]: unknown;
           };
@@ -8878,36 +10529,37 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/entitlements': {
+  '/api/mcp/tokens/{tokenId}': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
+    get?: never;
+    put?: never;
+    post?: never;
     /**
-     * Resolved entitlements
-     * @description Return resolved feature entitlements for the authenticated user and project. Used by CLI/API clients; the web UI uses SSR-resolved entitlements. Requires viewer role.
+     * Revoke MCP token
+     * @description Revoke a personal MCP token by id.
      */
-    get: {
+    delete: {
       parameters: {
         query?: never;
         header?: never;
         path: {
-          projectId: string;
+          tokenId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Resolved entitlements */
-        200: {
+        /** @description MCP token revoked */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            'application/json': components['schemas']['EntitlementsResponse'];
-          };
+          content?: never;
         };
         /** @description Unauthorized */
         401: {
@@ -8918,26 +10570,14 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
       };
     };
-    put?: never;
-    post?: never;
-    delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/settings/llm': {
+  '/api/projects/{projectId}/runners': {
     parameters: {
       query?: never;
       header?: never;
@@ -8945,8 +10585,8 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Active LLM provider
-     * @description Report which LLM provider is currently active for the project and where billing is sourced. Never returns the apiKey. Requires member role and the chat feature.
+     * List runners (deprecated)
+     * @description Deprecated: runners migrated to deployments (origin=self-hosted). Always returns an empty list for backward compatibility. Requires member role.
      */
     get: {
       parameters: {
@@ -8959,13 +10599,13 @@ interface paths {
       };
       requestBody?: never;
       responses: {
-        /** @description Active LLM provider status */
+        /** @description Empty runner list */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['LlmConfigStatusResponse'];
+            'application/json': components['schemas']['ListRunnersResponse'];
           };
         };
         /** @description Unauthorized */
@@ -8986,21 +10626,28 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description No platform LLM provider configured */
-        503: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['LlmConfigStatusResponse'];
-          };
-        };
       };
     };
     put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/runners/heartbeat': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
     /**
-     * Set LLM provider
-     * @description Set or clear the project LLM provider override. Admin-only, gated by the chat feature. The apiKey is write-only: it is encrypted and never returned.
+     * Runner heartbeat
+     * @description Accept a self-hosted runner heartbeat with usage counters. Authenticated by a flow+deployment-bound runner token. Updates deployment liveness and records an immutable usage row.
      */
     post: {
       parameters: {
@@ -9013,17 +10660,17 @@ interface paths {
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['SetLlmConfigRequest'];
+          'application/json': components['schemas']['HeartbeatRequest'];
         };
       };
       responses: {
-        /** @description LLM config saved or cleared */
+        /** @description Heartbeat accepted */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['SetLlmConfigResponse'];
+            'application/json': components['schemas']['RunnerHeartbeatResponse'];
           };
         };
         /** @description Validation error */
@@ -9044,15 +10691,6 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
         /** @description Not found */
         404: {
           headers: {
@@ -9070,7 +10708,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/chat/sessions': {
+  '/api/packages': {
     parameters: {
       query?: never;
       header?: never;
@@ -9078,34 +10716,34 @@ interface paths {
       cookie?: never;
     };
     /**
-     * List chat sessions
-     * @description List the caller's recent chat sessions for a project, ordered by last activity. Requires member role and the chat feature.
+     * Package catalog
+     * @description Resolved `@walkeros/*` package catalog for the add-step picker, optionally filtered by type and platform.
      */
     get: {
       parameters: {
         query?: {
-          limit?: number;
-          offset?: number | null;
+          /** @description Filter by package type. */
+          type?: string;
+          /** @description Filter by platform. */
+          platform?: string;
         };
         header?: never;
-        path: {
-          projectId: string;
-        };
+        path?: never;
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Chat session list */
+        /** @description Package catalog */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ListChatSessionsResponse'];
+            'application/json': components['schemas']['PackageCatalogResponse'];
           };
         };
-        /** @description Unauthorized */
-        401: {
+        /** @description Validation error */
+        400: {
           headers: {
             [name: string]: unknown;
           };
@@ -9113,8 +10751,8 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
+        /** @description Package catalog unavailable */
+        502: {
           headers: {
             [name: string]: unknown;
           };
@@ -9132,7 +10770,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/chat/sessions/{sessionId}': {
+  '/api/packages/search': {
     parameters: {
       query?: never;
       header?: never;
@@ -9140,32 +10778,29 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Get chat session
-     * @description Return a chat session and its full message history when the caller owns it. Foreign or unknown sessions return 404 (never 403) so existence is not leaked. Requires member role and the chat feature.
+     * Search packages
+     * @description Returns the full @walkeros/* package catalog; clients filter locally.
      */
     get: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          projectId: string;
-          sessionId: string;
-        };
+        path?: never;
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Chat session with messages */
+        /** @description Search results */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ChatSessionDetailResponse'];
+            'application/json': components['schemas']['PackageSearchResponse'];
           };
         };
-        /** @description Unauthorized */
-        401: {
+        /** @description Package search unavailable */
+        502: {
           headers: {
             [name: string]: unknown;
           };
@@ -9173,17 +10808,35 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
+      };
+    };
+    put?: never;
+    /**
+     * Log a settled search
+     * @description Records one settled search outcome (the term the user paused on and whether the catalog matched it). Fire-and-forget; returns 204.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['PackageSearchLogRequest'];
+        };
+      };
+      responses: {
+        /** @description Search logged */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
+          content?: never;
         };
-        /** @description Not found */
-        404: {
+        /** @description Validation error */
+        400: {
           headers: {
             [name: string]: unknown;
           };
@@ -9193,15 +10846,13 @@ interface paths {
         };
       };
     };
-    put?: never;
-    post?: never;
     delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/chat/elicit': {
+  '/api/observe/timing': {
     parameters: {
       query?: never;
       header?: never;
@@ -9211,32 +10862,28 @@ interface paths {
     get?: never;
     put?: never;
     /**
-     * Answer elicitation prompt
-     * @description Answer a pending MCP elicitation prompt (accept, decline, or cancel), unblocking the waiting tool invocation. Requires member role and the chat feature.
+     * Report connect timing
+     * @description Fire-and-forget beacon for client-side connect timing SLIs. No auth required; carries no secrets. Returns 204.
      */
     post: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          projectId: string;
-        };
+        path?: never;
         cookie?: never;
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['ElicitRequest'];
+          'application/json': components['schemas']['ObserveTimingRequest'];
         };
       };
       responses: {
-        /** @description Elicitation resolved */
-        200: {
+        /** @description Timing recorded */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            'application/json': components['schemas']['ElicitResponse'];
-          };
+          content?: never;
         };
         /** @description Validation error */
         400: {
@@ -9247,26 +10894,60 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Unauthorized */
-        401: {
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/register': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Register a client
+     * @description RFC 7591 dynamic client registration. Unauthenticated: a client registers itself before it holds any credential. Issues public clients only (`token_endpoint_auth_method: none`), which prove themselves with PKCE. Errors use the RFC 7591 section 3.2.2 shape, not the standard error envelope.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['OAuthClientRegistrationRequest'];
+        };
+      };
+      responses: {
+        /** @description Client registered */
+        201: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['OAuthClientRegistrationResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
+        /** @description Invalid client metadata or redirect URI */
+        400: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['OAuthRegistrationError'];
           };
         };
-        /** @description Not found */
-        404: {
+        /** @description Registration ceiling reached (Retry-After header) */
+        429: {
           headers: {
             [name: string]: unknown;
           };
@@ -9282,50 +10963,79 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/mcp/tokens': {
+  '/api/oauth/device_authorization': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
+    get?: never;
+    put?: never;
     /**
-     * List MCP tokens
-     * @description List the authenticated user's personal MCP tokens. No secret material is returned.
+     * Start a device authorization
+     * @description RFC 8628 section 3.1. A client that cannot host a browser redirect asks for a device code and a user code here, then polls the token endpoint while the person approves the user code at `/oauth/device`. Unauthenticated, and public clients only: the code is worth nothing until a signed-in person approves it. Body is `application/x-www-form-urlencoded`; errors use the RFC 6749 section 5.2 shape, not the standard error envelope.
      */
-    get: {
+    post: {
       parameters: {
         query?: never;
         header?: never;
         path?: never;
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/x-www-form-urlencoded': components['schemas']['DeviceAuthorizationRequest'];
+        };
+      };
       responses: {
-        /** @description MCP token list */
+        /** @description Device authorization opened */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ListMcpTokensResponse'];
+            'application/json': components['schemas']['DeviceAuthorizationResponse'];
           };
         };
-        /** @description Unauthorized */
+        /** @description invalid_request, unauthorized_client, invalid_scope or invalid_target */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['OAuthError'];
+          };
+        };
+        /** @description invalid_client: unknown, revoked or confidential client */
         401: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['OAuthError'];
           };
         };
       };
     };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
     put?: never;
     /**
-     * Issue MCP token
-     * @description Issue a personal MCP token. The raw token is returned exactly once and is never retrievable afterwards.
+     * Exchange a grant for tokens
+     * @description RFC 6749 section 3.2. Runs the authorization code, refresh token and device code grants. The client authenticates here: a public client with PKCE, a confidential one with HTTP Basic or a form secret. Body is `application/x-www-form-urlencoded` only; errors use the RFC 6749 section 5.2 shape, not the standard error envelope, and a failed Basic authentication is answered with a `WWW-Authenticate: Basic` challenge. Responses are never cacheable. Rate limited per `client_id`.
      */
     post: {
       parameters: {
@@ -9336,30 +11046,39 @@ interface paths {
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['CreateMcpTokenRequest'];
+          'application/x-www-form-urlencoded': components['schemas']['TokenRequest'];
         };
       };
       responses: {
-        /** @description MCP token issued */
-        201: {
+        /** @description Tokens issued */
+        200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['CreateMcpTokenResponse'];
+            'application/json': components['schemas']['TokenResponse'];
           };
         };
-        /** @description Validation error */
+        /** @description invalid_request, invalid_grant, invalid_scope, invalid_target, unsupported_grant_type, or a device grant status (authorization_pending, slow_down, access_denied, expired_token) */
         400: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['OAuthError'];
           };
         };
-        /** @description Unauthorized */
+        /** @description invalid_client: unknown, revoked, or bad credentials */
         401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['OAuthError'];
+          };
+        };
+        /** @description Per-client token budget reached (Retry-After header) */
+        429: {
           headers: {
             [name: string]: unknown;
           };
@@ -9375,7 +11094,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/mcp/tokens/{tokenId}': {
+  '/api/oauth/revoke': {
     parameters: {
       query?: never;
       header?: never;
@@ -9384,74 +11103,98 @@ interface paths {
     };
     get?: never;
     put?: never;
-    post?: never;
     /**
-     * Revoke MCP token
-     * @description Revoke a personal MCP token by id.
+     * Revoke a token
+     * @description RFC 7009. Client authentication is the same as at the token endpoint. A refresh token revokes its whole rotation family, an access token only itself. An authenticated request always answers 200 with an empty body, unknown tokens included: a distinguishable answer would be an oracle. Body is `application/x-www-form-urlencoded`.
      */
-    delete: {
+    post: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          tokenId: string;
-        };
+        path?: never;
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/x-www-form-urlencoded': components['schemas']['RevocationRequest'];
+        };
+      };
       responses: {
-        /** @description MCP token revoked */
-        204: {
+        /** @description Revoked, or nothing matched */
+        200: {
           headers: {
             [name: string]: unknown;
           };
           content?: never;
         };
-        /** @description Unauthorized */
+        /** @description invalid_request or unsupported_token_type */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['OAuthError'];
+          };
+        };
+        /** @description invalid_client: unknown, revoked, or bad credentials */
         401: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['OAuthError'];
           };
         };
       };
     };
+    delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/runners': {
+  '/api/oauth/device/approve': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
+    get?: never;
+    put?: never;
     /**
-     * List runners (deprecated)
-     * @description Deprecated: runners migrated to deployments (origin=self-hosted). Always returns an empty list for backward compatibility. Requires member role.
+     * Decide a device authorization
+     * @description The person's approve or deny decision on a pending device authorization. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`, so a machine token can never approve its own device. Requires the `X-CSRF-Token` minted with the consent page, bound to this user code.
      */
-    get: {
+    post: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          projectId: string;
-        };
+        path?: never;
         cookie?: never;
       };
-      requestBody?: never;
+      requestBody?: {
+        content: {
+          'application/json': components['schemas']['DeviceApprovalRequest'];
+        };
+      };
       responses: {
-        /** @description Empty runner list */
+        /** @description Decision recorded */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ListRunnersResponse'];
+            'application/json': components['schemas']['DeviceApprovalResponse'];
+          };
+        };
+        /** @description Validation error */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
           };
         };
         /** @description Unauthorized */
@@ -9472,17 +11215,24 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
-    put?: never;
-    post?: never;
     delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/runners/heartbeat': {
+  '/api/oauth/authorize': {
     parameters: {
       query?: never;
       header?: never;
@@ -9492,31 +11242,29 @@ interface paths {
     get?: never;
     put?: never;
     /**
-     * Runner heartbeat
-     * @description Accept a self-hosted runner heartbeat with usage counters. Authenticated by a flow+deployment-bound runner token. Updates deployment liveness and records an immutable usage row.
+     * Decide a consent request
+     * @description The person's allow or deny decision on the consent screen at `/oauth/authorize`. The ticket is the HMAC-signed authorization request that screen was rendered from, so the decision cannot alter what was validated, and it is bound to the person it was minted for. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`, so a machine token can never approve a consent. The response says where to send the browser: the client's registered redirect URI, carrying `code` on allow and `error=access_denied` on deny.
      */
     post: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          projectId: string;
-        };
+        path?: never;
         cookie?: never;
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['HeartbeatRequest'];
+          'application/json': components['schemas']['OAuthConsentDecisionRequest'];
         };
       };
       responses: {
-        /** @description Heartbeat accepted */
+        /** @description Decision recorded */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['RunnerHeartbeatResponse'];
+            'application/json': components['schemas']['OAuthConsentDecisionResponse'];
           };
         };
         /** @description Validation error */
@@ -9537,15 +11285,6 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Not found */
-        404: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
       };
     };
     delete?: never;
@@ -9554,7 +11293,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/packages': {
+  '/api/oauth/grants': {
     parameters: {
       query?: never;
       header?: never;
@@ -9562,34 +11301,29 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Package catalog
-     * @description Resolved `@walkeros/*` package catalog for the add-step picker, optionally filtered by type and platform.
+     * List connected apps
+     * @description The apps the signed-in person has consented to, as the Connected apps page renders them. Revoked grants are absent. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`, so a machine token cannot read the connections its owner holds.
      */
     get: {
       parameters: {
-        query?: {
-          /** @description Filter by package type. */
-          type?: string;
-          /** @description Filter by platform. */
-          platform?: string;
-        };
+        query?: never;
         header?: never;
         path?: never;
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Package catalog */
+        /** @description Connected apps */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['PackageCatalogResponse'];
+            'application/json': components['schemas']['ListOAuthGrantsResponse'];
           };
         };
-        /** @description Validation error */
-        400: {
+        /** @description Unauthorized */
+        401: {
           headers: {
             [name: string]: unknown;
           };
@@ -9597,8 +11331,32 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Package catalog unavailable */
-        502: {
+      };
+    };
+    put?: never;
+    post?: never;
+    /**
+     * Disconnect every app
+     * @description Revoke every grant this person holds and the tokens hanging from them. Automation tokens hang from no grant and survive. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`, so a read-scoped machine token cannot disconnect everything its owner has connected.
+     */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Apps disconnected */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Unauthorized */
+        401: {
           headers: {
             [name: string]: unknown;
           };
@@ -9608,15 +11366,60 @@ interface paths {
         };
       };
     };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/oauth/grants/{grantId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
     put?: never;
     post?: never;
-    delete?: never;
+    /**
+     * Disconnect one app
+     * @description Revoke one grant and the tokens hanging from it. Idempotent: an unknown grant, another person's grant and an already revoked one all answer 204, and the token sweep runs either way, so pressing Disconnect twice cleans up a token minted inside the first press's window. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`.
+     */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          grantId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description App disconnected */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/packages/search': {
+  '/api/admin/oauth/clients': {
     parameters: {
       query?: never;
       header?: never;
@@ -9624,8 +11427,8 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Search packages
-     * @description Returns the full @walkeros/* package catalog; clients filter locally.
+     * List OAuth clients
+     * @description Every registered OAuth client, revoked ones included. No secret material is returned. Admin only: a non-admin caller gets 404, not 403, so the endpoint does not confirm its own existence.
      */
     get: {
       parameters: {
@@ -9636,17 +11439,26 @@ interface paths {
       };
       requestBody?: never;
       responses: {
-        /** @description Search results */
+        /** @description OAuth client list */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['PackageSearchResponse'];
+            'application/json': components['schemas']['ListOAuthClientsResponse'];
           };
         };
-        /** @description Package search unavailable */
-        502: {
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -9658,8 +11470,8 @@ interface paths {
     };
     put?: never;
     /**
-     * Log a settled search
-     * @description Records one settled search outcome (the term the user paused on and whether the catalog matched it). Fire-and-forget; returns 204.
+     * Create a confidential OAuth client
+     * @description Create an OAuth client that authenticates with a secret. The raw secret is returned exactly once and is never retrievable afterwards. Admin only: a non-admin caller gets 404, not 403.
      */
     post: {
       parameters: {
@@ -9670,16 +11482,18 @@ interface paths {
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['PackageSearchLogRequest'];
+          'application/json': components['schemas']['CreateOAuthClientRequest'];
         };
       };
-      responses: {
-        /** @description Search logged */
-        204: {
+      responses: {
+        /** @description Client created */
+        201: {
           headers: {
             [name: string]: unknown;
           };
-          content?: never;
+          content: {
+            'application/json': components['schemas']['CreateOAuthClientResponse'];
+          };
         };
         /** @description Validation error */
         400: {
@@ -9690,6 +11504,24 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
       };
     };
     delete?: never;
@@ -9698,7 +11530,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/observe/timing': {
+  '/api/admin/oauth/clients/{clientId}': {
     parameters: {
       query?: never;
       header?: never;
@@ -9707,32 +11539,40 @@ interface paths {
     };
     get?: never;
     put?: never;
+    post?: never;
     /**
-     * Report connect timing
-     * @description Fire-and-forget beacon for client-side connect timing SLIs. No auth required; carries no secrets. Returns 204.
+     * Revoke an OAuth client
+     * @description Revoke a client together with the grants consented to it and the tokens minted under them. Admin only: a non-admin caller gets 404, not 403, the same answer an unknown client id gets.
      */
-    post: {
+    delete: {
       parameters: {
         query?: never;
         header?: never;
-        path?: never;
-        cookie?: never;
-      };
-      requestBody?: {
-        content: {
-          'application/json': components['schemas']['ObserveTimingRequest'];
+        path: {
+          clientId: string;
         };
+        cookie?: never;
       };
+      requestBody?: never;
       responses: {
-        /** @description Timing recorded */
+        /** @description Client revoked */
         204: {
           headers: {
             [name: string]: unknown;
           };
           content?: never;
         };
-        /** @description Validation error */
-        400: {
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -9742,7 +11582,6 @@ interface paths {
         };
       };
     };
-    delete?: never;
     options?: never;
     head?: never;
     patch?: never;
@@ -10127,6 +11966,10 @@ interface components {
        */
       updatedAt: string;
     };
+    DeploySettingsRequest: {
+      flow?: string;
+      humanText?: string;
+    };
     DeploySettingsResponse: {
       deploymentId: string;
       /** @example cfg_a1b2c3d4 */
@@ -10295,9 +12138,9 @@ interface components {
         | 'active'
         | 'stopped'
         | 'failed';
-      currentVersion: components['schemas']['DeploymentVersionDetail'];
+      currentVersion: components['schemas']['DeploymentVersionDetail'] | null;
       versions: components['schemas']['DeploymentVersionHistoryEntry'][];
-      error: components['schemas']['DeploymentError'];
+      error: components['schemas']['DeploymentError'] | null;
       recentErrors?:
         | {
             message: string;
@@ -10342,7 +12185,7 @@ interface components {
       /** Format: date-time */
       publishedAt: string;
       publishedBy: string | null;
-    } | null;
+    };
     DeploymentVersionHistoryEntry: {
       versionNumber: number;
       status: string;
@@ -10363,7 +12206,7 @@ interface components {
        */
       phase: 'preflight' | 'deploy' | 'bundle' | 'publish' | 'provision';
       detail?: string;
-    } | null;
+    };
     CreateDeploymentResponse: {
       /** @example dep_a1b2c3d4 */
       id: string;
@@ -10568,9 +12411,48 @@ interface components {
       /** Format: date-time */
       createdAt: string;
       createdBy: string | null;
+      createdByLabel: string | null;
+      rationale?: components['schemas']['ReleaseRationaleSummary'] | null;
     };
-    ListVersionAnnotationsResponse: {
-      annotations: components['schemas']['VersionAnnotation'][];
+    ReleaseRationaleSummary: {
+      hasHumanText: boolean;
+      hasGeneratedSummary: boolean;
+      firstLine: string | null;
+    };
+    ReleaseContentResponse: {
+      /** @example ver_a1b2c3d4 */
+      versionId: string;
+      /** @example 22 */
+      versionNumber: number;
+      content: components['schemas']['FlowConfig'];
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      /** @enum {string} */
+      createdBy: 'user' | 'auto_save' | 'restore' | 'deploy' | 'preview';
+    };
+    ReleaseDiff: {
+      /** @example ver_a1b2c3d4 */
+      prevVersionId: string;
+      prevVersionNumber: number;
+      text: string;
+      contentIdentical: boolean;
+    };
+    ReleaseDetailResponse: {
+      /** @example ver_a1b2c3d4 */
+      versionId: string;
+      versionNumber: number;
+      contentHash: string | null;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      createdBy: string;
+      rationale: components['schemas']['VersionAnnotation'] | null;
+      diff: components['schemas']['ReleaseDiff'] | null;
     };
     VersionAnnotation: {
       /** @example ver_a1b2c3d4 */
@@ -10590,6 +12472,9 @@ interface components {
        */
       updatedAt: string;
     };
+    ListVersionAnnotationsResponse: {
+      annotations: components['schemas']['VersionAnnotation'][];
+    };
     UpsertVersionAnnotationResponse: {
       /** @example ver_a1b2c3d4 */
       versionId: string;
@@ -10616,75 +12501,414 @@ interface components {
       /** @example thr_a1b2c3d4 */
       id: string;
       /**
-       * @example release
+       * @example release
+       * @enum {string}
+       */
+      anchorType: 'step' | 'entity_action' | 'release' | 'contract' | 'tag';
+      anchorKey: string;
+      anchorLabel: string;
+      /**
+       * @example open
+       * @enum {string}
+       */
+      status: 'open' | 'resolved';
+      resolvedByVersionId: string | null;
+      resolvedByVersionNumber: number | null;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      resolvedAt: string | null;
+      resolvedBy: string | null;
+      createdBy: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      messageCount: number;
+      messages?: components['schemas']['HubMessage'][];
+      hasMoreMessages?: boolean;
+    };
+    HubMessage: {
+      id: string;
+      /** @example user_a1b2c3d4 */
+      author: string;
+      text: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+    };
+    HubThreadResponse: {
+      /** @example thr_a1b2c3d4 */
+      id: string;
+      /**
+       * @example release
+       * @enum {string}
+       */
+      anchorType: 'step' | 'entity_action' | 'release' | 'contract' | 'tag';
+      anchorKey: string;
+      anchorLabel: string;
+      /**
+       * @example open
+       * @enum {string}
+       */
+      status: 'open' | 'resolved';
+      resolvedByVersionId: string | null;
+      resolvedByVersionNumber: number | null;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      resolvedAt: string | null;
+      resolvedBy: string | null;
+      createdBy: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      messageCount: number;
+      messages?: components['schemas']['HubMessage'][];
+      hasMoreMessages?: boolean;
+    };
+    ListKnowledgeResponse: {
+      entries: components['schemas']['KnowledgeEntry'][];
+      hasMoreEntries: boolean;
+    };
+    KnowledgeEntry:
+      | components['schemas']['KnowledgeThread']
+      | components['schemas']['KnowledgeDescription'];
+    KnowledgeThread: {
+      id: string;
+      anchorKey: string;
+      anchorLabel: string;
+      frameId: string | null;
+      frameName: string | null;
+      flowId: string | null;
+      subjectKey: string | null;
+      spatial: components['schemas']['KnowledgeSpatial'] | null;
+      validity: components['schemas']['KnowledgeValidity'];
+      /** @enum {string} */
+      freshness: 'current' | 'subject_changed' | 'unknown';
+      author: components['schemas']['KnowledgeAuthor'];
+      /** @enum {string} */
+      source: 'tag_mode' | 'hub' | 'mcp';
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      kind: 'thread';
+      /**
+       * @example tag
+       * @enum {string}
+       */
+      anchorType:
+        | 'step'
+        | 'entity_action'
+        | 'release'
+        | 'contract'
+        | 'tag'
+        | 'page';
+      /**
+       * @example open
+       * @enum {string}
+       */
+      status: 'open' | 'resolved';
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      messageCount: number;
+      messages?: components['schemas']['KnowledgeMessage'][];
+      hasMoreMessages?: boolean;
+    };
+    KnowledgeSpatial: {
+      at: {
+        x: number;
+        y: number;
+      };
+      element?: {
+        [key: string]: unknown;
+      };
+    };
+    KnowledgeValidity:
+      | {
+          /** @enum {string} */
+          tier: 'release';
+          versionId: string;
+          versionNumber: number;
+          promoted: boolean;
+        }
+      | {
+          /** @enum {string} */
+          tier: 'draft';
+          versionId?: string;
+        }
+      | {
+          /** @enum {string} */
+          tier: 'none';
+        };
+    KnowledgeAuthor: {
+      /** @enum {string} */
+      kind: 'user' | 'preview' | 'agent';
+      id: string | null;
+      label: string;
+    };
+    KnowledgeMessage: {
+      id: string;
+      /** @example user_a1b2c3d4 */
+      author: string;
+      /** @example ayla@elbwalker.com */
+      authorLabel: string;
+      text: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      clientMessageId: string | null;
+    };
+    KnowledgeDescription: {
+      id: string;
+      anchorKey: string;
+      anchorLabel: string;
+      frameId: string | null;
+      frameName: string | null;
+      flowId: string | null;
+      subjectKey: string | null;
+      spatial: components['schemas']['KnowledgeSpatial'] | null;
+      validity: components['schemas']['KnowledgeValidity'];
+      /** @enum {string} */
+      freshness: 'current' | 'subject_changed' | 'unknown';
+      author: components['schemas']['KnowledgeAuthor'];
+      /** @enum {string} */
+      source: 'tag_mode' | 'hub' | 'mcp';
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      /**
+       * @description discriminator enum property added by openapi-typescript
+       * @enum {string}
+       */
+      kind: 'description';
+      /**
+       * @example tag
+       * @enum {string}
+       */
+      anchorType: 'tag' | 'page';
+      body: string;
+    };
+    KnowledgeThreadResponse: {
+      id: string;
+      anchorKey: string;
+      anchorLabel: string;
+      frameId: string | null;
+      frameName: string | null;
+      flowId: string | null;
+      subjectKey: string | null;
+      spatial: components['schemas']['KnowledgeSpatial'] | null;
+      validity: components['schemas']['KnowledgeValidity'];
+      /** @enum {string} */
+      freshness: 'current' | 'subject_changed' | 'unknown';
+      author: components['schemas']['KnowledgeAuthor'];
+      /** @enum {string} */
+      source: 'tag_mode' | 'hub' | 'mcp';
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      /** @enum {string} */
+      kind: 'thread';
+      /**
+       * @example tag
        * @enum {string}
        */
-      anchorType: 'step' | 'entity_action' | 'release' | 'contract' | 'tag';
-      anchorKey: string;
-      anchorLabel: string;
+      anchorType:
+        | 'step'
+        | 'entity_action'
+        | 'release'
+        | 'contract'
+        | 'tag'
+        | 'page';
       /**
        * @example open
        * @enum {string}
        */
       status: 'open' | 'resolved';
-      resolvedByVersionId: string | null;
-      resolvedByVersionNumber: number | null;
-      /**
-       * Format: date-time
-       * @example 2026-01-26T14:30:00.000Z
-       */
-      resolvedAt: string | null;
-      resolvedBy: string | null;
-      createdBy: string;
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
        */
       createdAt: string;
+      messageCount: number;
+      messages?: components['schemas']['KnowledgeMessage'][];
+      hasMoreMessages?: boolean;
+    };
+    KnowledgeDescriptionResponse: {
+      id: string;
+      anchorKey: string;
+      anchorLabel: string;
+      frameId: string | null;
+      frameName: string | null;
+      flowId: string | null;
+      subjectKey: string | null;
+      spatial: components['schemas']['KnowledgeSpatial'] | null;
+      validity: components['schemas']['KnowledgeValidity'];
+      /** @enum {string} */
+      freshness: 'current' | 'subject_changed' | 'unknown';
+      author: components['schemas']['KnowledgeAuthor'];
+      /** @enum {string} */
+      source: 'tag_mode' | 'hub' | 'mcp';
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
        */
       updatedAt: string;
-      messageCount: number;
-      messages?: components['schemas']['HubMessage'][];
-      hasMoreMessages?: boolean;
+      /** @enum {string} */
+      kind: 'description';
+      /**
+       * @example tag
+       * @enum {string}
+       */
+      anchorType: 'tag' | 'page';
+      body: string;
     };
-    HubMessage: {
+    FrameInput: {
+      name: string;
+      /** @example frm_V1StGXR8Z5jdHi6BmyT7K */
+      parentId: string | null;
+      placements: components['schemas']['FramePlacement'][];
+      size: components['schemas']['PlanSize'];
+      marks: {
+        [key: string]: unknown;
+      };
+      /** @example frm_V1StGXR8Z5jdHi6BmyT7K */
+      extends: string | null;
+      source: components['schemas']['FrameSource'];
+      /** @enum {string} */
+      origin: 'drawn' | 'imported' | 'observed';
+      flowId: string | null;
+    };
+    FramePlacement: {
       id: string;
-      /** @example user_a1b2c3d4 */
-      author: string;
-      text: string;
+      rect: components['schemas']['PlanRect'];
+      selector?: string;
+      anchor?: {
+        [key: string]: unknown;
+      };
+    };
+    PlanRect: {
+      x: number;
+      y: number;
+      w: number;
+      h: number;
+    };
+    PlanSize: {
+      width: number;
+      height: number;
+    };
+    FrameSource:
+      | {
+          /** @enum {string} */
+          kind: 'page';
+          key: string;
+          url: string;
+        }
+      | {
+          /** @enum {string} */
+          kind: 'figma';
+          fileKey: string;
+          nodeId: string;
+        }
+      | {
+          /** @enum {string} */
+          kind: 'image';
+        }
+      | null;
+    Frame: {
+      /** @example frm_V1StGXR8Z5jdHi6BmyT7K */
+      id: string;
+      projectId: string;
+      name: string;
+      parentId: string | null;
+      placements: components['schemas']['FramePlacement'][];
+      size: components['schemas']['PlanSize'];
+      marks: {
+        [key: string]: unknown;
+      };
+      extends: string | null;
+      source: components['schemas']['FrameSource'];
+      /** @enum {string} */
+      origin: 'drawn' | 'imported' | 'observed';
+      flowId: string | null;
+      screenshot: components['schemas']['FrameScreenshot'] | null;
+      version: number;
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
        */
       createdAt: string;
-    };
-    HubThreadResponse: {
-      /** @example thr_a1b2c3d4 */
-      id: string;
       /**
-       * @example release
-       * @enum {string}
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
        */
-      anchorType: 'step' | 'entity_action' | 'release' | 'contract' | 'tag';
-      anchorKey: string;
-      anchorLabel: string;
+      updatedAt: string;
+      createdBy: string;
+      updatedBy: string;
       /**
-       * @example open
-       * @enum {string}
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
        */
-      status: 'open' | 'resolved';
-      resolvedByVersionId: string | null;
-      resolvedByVersionNumber: number | null;
+      deletedAt: string | null;
+    };
+    FrameScreenshot: {
+      assetId: string;
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
        */
-      resolvedAt: string | null;
-      resolvedBy: string | null;
-      createdBy: string;
+      capturedAt: string;
+      size: components['schemas']['PlanSize'];
+      dpr: number;
+      capturedRect: components['schemas']['PlanRect'];
+    };
+    FrameLean: {
+      /** @example frm_V1StGXR8Z5jdHi6BmyT7K */
+      id: string;
+      projectId: string;
+      name: string;
+      parentId: string | null;
+      placements: components['schemas']['FramePlacement'][];
+      size: components['schemas']['PlanSize'];
+      extends: string | null;
+      source: components['schemas']['FrameSource'];
+      /** @enum {string} */
+      origin: 'drawn' | 'imported' | 'observed';
+      flowId: string | null;
+      screenshot: components['schemas']['FrameScreenshot'] | null;
+      version: number;
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
@@ -10695,9 +12919,30 @@ interface components {
        * @example 2026-01-26T14:30:00.000Z
        */
       updatedAt: string;
-      messageCount: number;
-      messages?: components['schemas']['HubMessage'][];
-      hasMoreMessages?: boolean;
+      createdBy: string;
+      updatedBy: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      deletedAt: string | null;
+    };
+    FrameListResponse: {
+      frames: components['schemas']['Frame'][];
+    };
+    FrameLeanListResponse: {
+      frames: components['schemas']['FrameLean'][];
+    };
+    PutFrameResponse: {
+      version: number;
+    };
+    FrameConflictResponse: {
+      error: {
+        /** @enum {string} */
+        code: 'FRAME_VERSION_CONFLICT';
+        message: string;
+      };
+      head: components['schemas']['Frame'];
     };
     SummarizeReleaseResponse: {
       /** @enum {string} */
@@ -10822,8 +13067,8 @@ interface components {
       observedFlowName: string | null;
       serverFlowName: string | null;
       serverEndpoint: string | null;
-      web: components['schemas']['ObserveSessionWeb'];
-      server: components['schemas']['ObserveSessionServer'];
+      web: components['schemas']['ObserveSessionWeb'] | null;
+      server: components['schemas']['ObserveSessionServer'] | null;
       /** Format: date-time */
       expiresAt: string;
       recordsReceived: number;
@@ -10841,12 +13086,12 @@ interface components {
       /** Format: uri */
       url?: string;
       binding?: string;
-    } | null;
+    };
     ObserveSessionServer: {
       /** Format: uri */
       endpoint: string | null;
       env: components['schemas']['ObserveSessionServerEnv'];
-    } | null;
+    };
     ObserveSessionServerEnv: {
       /** Format: uri */
       WALKEROS_OBSERVER_URL: string;
@@ -11936,6 +14181,21 @@ interface components {
     DeclineInvitationResponse: {
       message: string;
     };
+    ScreenshotUploadResponse: {
+      /** @example fas_V1StGXR8Z5jdHi6BmyT7K */
+      assetId: string;
+      reused: boolean;
+    };
+    FrameScreenshotMeta: {
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      capturedAt: string;
+      size: components['schemas']['PlanSize'];
+      dpr: number;
+      capturedRect: components['schemas']['PlanRect'];
+    };
     HeartbeatRequest: {
       /** @example a1b2c3d4e5f6 */
       instanceId: string;
@@ -11982,6 +14242,211 @@ interface components {
         message: string;
       }[];
     };
+    OAuthClientRegistrationResponse: {
+      /** @example client_abc */
+      client_id: string;
+      /** @example 1725400000 */
+      client_id_issued_at: number;
+      client_name: string;
+      redirect_uris: string[];
+      /** @enum {string} */
+      token_endpoint_auth_method: 'none';
+      grant_types: string[];
+      response_types: string[];
+    };
+    OAuthRegistrationError: {
+      /** @enum {string} */
+      error: 'invalid_client_metadata' | 'invalid_redirect_uri';
+      error_description: string;
+    };
+    OAuthClientRegistrationRequest: {
+      /**
+       * @example [
+       *       "https://claude.ai/api/mcp/auth_callback"
+       *     ]
+       */
+      redirect_uris: string[];
+      client_name?: string;
+      /** @enum {string} */
+      token_endpoint_auth_method?: 'none';
+      grant_types?: ('authorization_code' | 'refresh_token')[];
+      response_types?: 'code'[];
+      /** Format: uri */
+      client_uri?: string;
+      /** Format: uri */
+      logo_uri?: string;
+      scope?: string;
+      software_id?: string;
+      software_version?: string;
+    };
+    DeviceAuthorizationResponse: {
+      device_code: string;
+      /** @example WDJB-MJHT */
+      user_code: string;
+      verification_uri: string;
+      verification_uri_complete: string;
+      /** @example 900 */
+      expires_in: number;
+      /** @example 5 */
+      interval: number;
+    };
+    OAuthError: {
+      /** @example invalid_client */
+      error: string;
+      error_description: string;
+    };
+    DeviceAuthorizationRequest: {
+      /** @example walkeros-cli */
+      client_id: string;
+      /** @example read write offline_access */
+      scope?: string;
+      /** @example https://app.walkeros.io/api */
+      resource?: string;
+    };
+    TokenResponse: {
+      access_token: string;
+      /** @enum {string} */
+      token_type: 'Bearer';
+      /** @example 3600 */
+      expires_in: number;
+      refresh_token?: string;
+      /** @example read write offline_access */
+      scope: string;
+    };
+    TokenRequest: {
+      /**
+       * @example authorization_code
+       * @enum {string}
+       */
+      grant_type:
+        | 'authorization_code'
+        | 'refresh_token'
+        | 'urn:ietf:params:oauth:grant-type:device_code';
+      /** @example walkeros-cli */
+      client_id?: string;
+      client_secret?: string;
+      code?: string;
+      redirect_uri?: string;
+      code_verifier?: string;
+      refresh_token?: string;
+      device_code?: string;
+      /** @example read offline_access */
+      scope?: string;
+      /** @example https://app.walkeros.io/api */
+      resource?: string;
+    };
+    RevocationRequest: {
+      token: string;
+      /** @enum {string} */
+      token_type_hint?: 'access_token' | 'refresh_token';
+      client_id?: string;
+      client_secret?: string;
+    };
+    DeviceApprovalResponse: {
+      /** @enum {boolean} */
+      success: true;
+      /** @enum {string} */
+      decision: 'approve' | 'deny';
+    };
+    DeviceApprovalRequest: {
+      /** @example WDJB-MJHT */
+      userCode: string;
+      /** @enum {string} */
+      decision: 'approve' | 'deny';
+    };
+    OAuthConsentDecisionResponse: {
+      /** @example https://claude.ai/api/mcp/auth_callback?code=abc&state=xyz */
+      redirectTo: string;
+    };
+    OAuthConsentDecisionRequest: {
+      ticket: string;
+      /** @enum {string} */
+      decision: 'allow' | 'deny';
+    };
+    ListOAuthGrantsResponse: {
+      grants: components['schemas']['OAuthGrantSummary'][];
+    };
+    OAuthGrantSummary: {
+      id: string;
+      clientId: string;
+      clientName: string;
+      scope: string[];
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      lastUsedAt: string | null;
+    };
+    ListOAuthClientsResponse: {
+      clients: components['schemas']['OAuthClientSummary'][];
+    };
+    OAuthClientSummary: {
+      clientId: string;
+      /** @enum {string} */
+      kind: 'dcr' | 'cimd' | 'confidential' | 'builtin';
+      name: string;
+      redirectUris: string[];
+      grantTypes: string[];
+      /** @enum {string} */
+      tokenEndpointAuthMethod:
+        | 'none'
+        | 'client_secret_basic'
+        | 'client_secret_post';
+      allowedResources: ('mcp' | 'api')[];
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      revokedAt: string | null;
+    };
+    CreateOAuthClientResponse: {
+      clientId: string;
+      /** @enum {string} */
+      kind: 'dcr' | 'cimd' | 'confidential' | 'builtin';
+      name: string;
+      redirectUris: string[];
+      grantTypes: string[];
+      /** @enum {string} */
+      tokenEndpointAuthMethod:
+        | 'none'
+        | 'client_secret_basic'
+        | 'client_secret_post';
+      allowedResources: ('mcp' | 'api')[];
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      revokedAt: string | null;
+      clientSecret: string;
+    };
+    CreateOAuthClientRequest: {
+      name: string;
+      redirectUris: string[];
+      /**
+       * @default [
+       *       "authorization_code",
+       *       "refresh_token"
+       *     ]
+       */
+      grantTypes: ('authorization_code' | 'refresh_token')[];
+      /**
+       * @default [
+       *       "mcp",
+       *       "api"
+       *     ]
+       */
+      allowedResources: ('mcp' | 'api')[];
+      /**
+       * @default client_secret_basic
+       * @enum {string}
+       */
+      authMethod: 'client_secret_basic' | 'client_secret_post';
+    };
   };
   responses: never;
   parameters: never;
@@ -12492,6 +14957,20 @@ interface WrapSkeletonOptions {
 }
 declare function wrapSkeleton(options: WrapSkeletonOptions): Promise<void>;
 
+interface DeviceAuthorization {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+}
+/**
+ * RFC 8628 section 3.1. Ask for a device code and the URL to send the person
+ * to. Unauthenticated: the code is worth nothing until somebody approves it.
+ */
+declare function startDeviceAuthorization(appUrl: string, fetchFn?: typeof fetch): Promise<DeviceAuthorization>;
+
 declare function createApiClient(): openapi_fetch.Client<paths, `${string}/${string}`>;
 
 /**
@@ -12523,8 +15002,8 @@ interface HealthResult {
 }
 /**
  * Tokenless reachability + contract probe of the app's PUBLIC `/api/health`
- * route. Uses a plain `fetch` (never `createApiClient`, which throws logged
- * out) and defensively parses the JSON body. Resolves `{ reachable: false }`
+ * route. Uses a plain `fetch` (never `createApiClient`, whose every request
+ * rejects without a credential) and defensively parses the JSON body. Resolves `{ reachable: false }`
  * only on a real network/timeout failure; a non-2xx status still counts as
  * reachable.
  */
@@ -12731,6 +15210,117 @@ interface EndObserveSessionOptions {
  */
 declare function endObserveSession(options: EndObserveSessionOptions): Promise<void>;
 
+type VersionAnnotation = components['schemas']['VersionAnnotation'];
+type StepHistoryResponse = components['schemas']['StepHistoryResponse'];
+type ListHubThreadsResponse = components['schemas']['ListHubThreadsResponse'];
+type HubThreadResponse = components['schemas']['HubThreadResponse'];
+type ListKnowledgeResponse = components['schemas']['ListKnowledgeResponse'];
+/** The rationale summary a release index row carries when asked for one. */
+type ReleaseRationaleSummary = components['schemas']['ReleaseRationaleSummary'];
+/** The release index. Each row carries `rationale` when one was asked for. */
+type ReleaseIndexResponse = components['schemas']['ListFlowReleasesResponse'];
+/** The diff a release carries against its spine predecessor. */
+type ReleaseDiffResponse = components['schemas']['ReleaseDiff'];
+/** One release in full: rationale plus the diff the server computed. */
+type ReleaseDetailResponse = components['schemas']['ReleaseDetailResponse'];
+interface ListReleasesOptions {
+    projectId?: string;
+    flowId: string;
+    limit?: number;
+    offset?: number;
+}
+/** The release index WITH its rationale summary. Requires the hub feature. */
+declare function listReleases(options: ListReleasesOptions): Promise<ReleaseIndexResponse>;
+/** How a release is addressed: by spine id, or by spine number. */
+type ReleaseRef = {
+    versionId: string;
+} | {
+    versionNumber: number;
+};
+interface GetReleaseOptions {
+    projectId?: string;
+    flowId: string;
+    ref: ReleaseRef;
+}
+/**
+ * One release in full: rationale plus the diff the SERVER computed against the
+ * spine predecessor. The path segment is the id or the number; the app decides
+ * which it was.
+ */
+declare function getRelease(options: GetReleaseOptions): Promise<ReleaseDetailResponse>;
+interface ListStepHistoryOptions {
+    projectId?: string;
+    flowId: string;
+    step: string;
+    flow?: string;
+    limit?: number;
+}
+declare function listStepHistory(options: ListStepHistoryOptions): Promise<StepHistoryResponse>;
+interface SetReleaseRationaleOptions {
+    projectId?: string;
+    flowId: string;
+    versionId: string;
+    text: string;
+}
+declare function setReleaseRationale(options: SetReleaseRationaleOptions): Promise<VersionAnnotation>;
+type ThreadAnchorType = 'step' | 'entity_action' | 'release' | 'contract' | 'tag';
+type ThreadStatus = 'open' | 'resolved';
+interface ListThreadsOptions {
+    projectId?: string;
+    flowId: string;
+    anchorType?: ThreadAnchorType;
+    anchorKey?: string;
+    status?: ThreadStatus;
+    includeMessages: boolean;
+    limit?: number;
+}
+declare function listThreads(options: ListThreadsOptions): Promise<ListHubThreadsResponse>;
+interface CreateThreadOptions {
+    projectId?: string;
+    flowId: string;
+    anchorType: ThreadAnchorType;
+    anchorKey: string;
+    anchorLabel?: string;
+    text: string;
+}
+declare function createThread(options: CreateThreadOptions): Promise<HubThreadResponse>;
+interface AddThreadMessageOptions {
+    projectId?: string;
+    flowId: string;
+    threadId: string;
+    text: string;
+}
+declare function addThreadMessage(options: AddThreadMessageOptions): Promise<HubThreadResponse>;
+interface ListKnowledgeOptions {
+    projectId?: string;
+    pageKey?: string;
+    frameId?: string;
+    markId?: string;
+    includeMessages: boolean;
+    limit?: number;
+}
+declare function listKnowledge(options: ListKnowledgeOptions): Promise<ListKnowledgeResponse>;
+
+type FrameResponse = components['schemas']['Frame'];
+type FrameListResponse = components['schemas']['FrameListResponse'];
+type FrameLeanListResponse = components['schemas']['FrameLeanListResponse'];
+interface ListFramesOptions {
+    projectId?: string;
+}
+/** Every live frame of the project, without marks. Requires the frames feature. */
+declare function listFrames(options?: ListFramesOptions): Promise<FrameLeanListResponse>;
+interface ListPageFramesOptions {
+    projectId?: string;
+    pageKey: string;
+}
+/** The frames of one page at any depth, with their marks. */
+declare function listPageFrames(options: ListPageFramesOptions): Promise<FrameListResponse>;
+interface GetFrameOptions {
+    projectId?: string;
+    frameId: string;
+}
+declare function getFrame(options: GetFrameOptions): Promise<FrameResponse>;
+
 interface ListSecretsOptions {
     projectId?: string;
     flowId: string;
@@ -12760,7 +15350,18 @@ declare function deleteSecret(options: DeleteSecretOptions): Promise<{
 }>;
 
 interface WalkerOSConfig {
+    /**
+     * Static bearer written by the pre-OAuth CLI. Honored until it expires, and
+     * the first use in a process prints a one-line notice naming
+     * `walkeros login`, which replaces it with a refreshable session.
+     */
     token?: string;
+    /** Short-lived bearer from the device authorization grant. */
+    accessToken?: string;
+    /** ISO 8601 instant at which `accessToken` stops being accepted. */
+    accessTokenExpiresAt?: string;
+    /** Single-use credential that buys a new `accessToken`. */
+    refreshToken?: string;
     email?: string;
     appUrl?: string;
     anonymousFeedback?: boolean;
@@ -12783,9 +15384,24 @@ interface WalkerOSConfig {
  */
 declare function readConfig(): WalkerOSConfig | null;
 /**
- * Write config to disk with 0600 permissions
+ * Merge `config` into the stored config and write the result.
+ *
+ * Merging rather than replacing, because the file holds fields owned by
+ * unrelated commands: a writer that knows only about tokens would otherwise
+ * drop `defaultProjectId`, `installationId`, `telemetryEnabled` and
+ * `anonymousFeedback` every time somebody logs in.
+ *
+ * A key passed explicitly as `undefined` is removed from the written file,
+ * which is how login drops the legacy static token it replaces.
  */
 declare function writeConfig(config: WalkerOSConfig): void;
+/**
+ * Remove every credential field, keeping the rest of the config.
+ *
+ * Used when the stored session is known to be dead, so the next command can
+ * say "run `walkeros login`" instead of failing against the API.
+ */
+declare function clearAuthFields(): void;
 /**
  * Delete the config file (logout)
  */
@@ -13076,4 +15692,4 @@ declare module '@walkeros/core' {
     }
 }
 
-export { ApiError, type ApiErrorDetail, type BuildOptions, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type CompareContractInput, type ContractComparison, type ContractVerdict, type CreatePreviewOptions, type CreateSecretOptions, type DeletePreviewOptions, type DeleteSecretOptions, type DeployOptions, DeploymentAmbiguityError, type DeploymentSummaryForFlow, type DeviceCodeOptions, type DeviceCodeResult, type EndObserveSessionOptions, type ExampleLookupResult, type FeedbackOptions, type GetObserveSessionOptions, type GetPreviewOptions, type GlobalOptions, type HealthResult, type ListDeploymentsOptions, type ListFlowsOptions, type ListJourneysOptions, type ListPreviewsOptions, type ListProjectsOptions, type ListSecretsOptions, type MinifyOptions, type PollOptions, type PollResult, type PrepareInput, type PreparedFlow, type ProjectFlows, type PushResult, type RegrantPreviewOptions, type RunCommandOptions, type RunOptions, type RunResult, type SSEEvent, type SSEParseResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, type StartObserveSessionOptions, type UpdateSecretOptions, VERSION, type ValidateResult, type ValidationError, type ValidationType, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, annotateErrorWithDrift, apiFetch, bakedContractHash, bakedContractVersion, buildDataPayload, bundle, bundleCommand, canonicalContractHash, classifyStepProperties, clientContextHeaders, compareContract, compareOutput, containsCodeMarkers, createApiClient, createDeployCommand, createDeployment, createDeploymentCommand, createFlow, createFlowCommand, createPreview, createProject, createProjectCommand, createSecret, deleteConfig, deleteDeployment, deleteDeploymentByFlowId, deleteDeploymentCommand, deleteFlow, deleteFlowCommand, deletePreview, deleteProject, deleteProjectCommand, deleteSecret, deploy, deployCommand, deployFetch, duplicateFlow, duplicateFlowCommand, endObserveSession, feedback, feedbackCommand, fetchHealth, findExample, getAuthHeaders, getClientContext, getDefaultProject, getDeployment, getDeploymentBySlug, getDeploymentBySlugCommand, getDeploymentCommand, getFeedbackPreference, getFlow, getFlowCommand, getObserveSession, getPreview, getProject, getProjectCommand, getToken, listAllFlows, listDeployments, listDeploymentsCommand, listFlows, listFlowsCommand, listJourneys, listPreviews, listProjects, listProjectsCommand, listSecrets, loadConfig, loadJsonConfig, loginCommand, logoutCommand, mergeAuthHeaders, parseSSEEvents, pollForToken, publicFetch, push, pushCommand, readConfig, regrantPreview, requestDeviceCode, requireProjectId, resetClientContext, resolveAppUrl, resolveToken, run, runCommand, setClientContext, setDefaultProject, setFeedbackPreference, simulateCollector, simulateDestination, simulateSource, simulateTransformer, startObserveSession, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, throwApiError, updateFlow, updateFlowCommand, updateProject, updateProjectCommand, updateSecret, validate, validateCommand, validateFlowStructure, whoami, whoamiCommand, wrapSkeleton, writeConfig };
+export { type AddThreadMessageOptions, ApiError, type ApiErrorDetail, type BuildOptions, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type CompareContractInput, type CompleteDeviceLoginOptions, type ContractComparison, type ContractVerdict, type CreatePreviewOptions, type CreateSecretOptions, type CreateThreadOptions, type DeletePreviewOptions, type DeleteSecretOptions, type DeployOptions, DeploymentAmbiguityError, type DeploymentSummaryForFlow, type DeviceAuthorization, type DeviceLoginResult, type EndObserveSessionOptions, type ExampleLookupResult, type FeedbackOptions, type GetFrameOptions, type GetObserveSessionOptions, type GetPreviewOptions, type GetReleaseOptions, type GlobalOptions, type HealthResult, type ListDeploymentsOptions, type ListFlowsOptions, type ListFramesOptions, type ListJourneysOptions, type ListKnowledgeOptions, type ListPageFramesOptions, type ListPreviewsOptions, type ListProjectsOptions, type ListReleasesOptions, type ListSecretsOptions, type ListStepHistoryOptions, type ListThreadsOptions, type LoginOptions, type LoginResult, type MinifyOptions, type PrepareInput, type PreparedFlow, type ProjectFlows, type PushResult, type RegrantPreviewOptions, type ReleaseDetailResponse, type ReleaseDiffResponse, type ReleaseIndexResponse, type ReleaseRationaleSummary, type ReleaseRef, type RunCommandOptions, type RunOptions, type RunResult, type SSEEvent, type SSEParseResult, type SetReleaseRationaleOptions, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, type StartObserveSessionOptions, type ThreadAnchorType, type ThreadStatus, type UpdateSecretOptions, VERSION, type ValidateResult, type ValidationError, type ValidationType, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, addThreadMessage, annotateErrorWithDrift, apiFetch, bakedContractHash, bakedContractVersion, buildDataPayload, bundle, bundleCommand, canonicalContractHash, classifyStepProperties, clearAuthFields, clientContextHeaders, compareContract, compareOutput, completeDeviceLogin, containsCodeMarkers, createApiClient, createDeployCommand, createDeployment, createDeploymentCommand, createFlow, createFlowCommand, createPreview, createProject, createProjectCommand, createSecret, createThread, credentialSource, deleteConfig, deleteDeployment, deleteDeploymentByFlowId, deleteDeploymentCommand, deleteFlow, deleteFlowCommand, deletePreview, deleteProject, deleteProjectCommand, deleteSecret, deploy, deployCommand, deployFetch, duplicateFlow, duplicateFlowCommand, endObserveSession, feedback, feedbackCommand, fetchHealth, findExample, getAuthHeaders, getClientContext, getDefaultProject, getDeployment, getDeploymentBySlug, getDeploymentBySlugCommand, getDeploymentCommand, getFeedbackPreference, getFlow, getFlowCommand, getFrame, getObserveSession, getPreview, getProject, getProjectCommand, getRelease, listAllFlows, listDeployments, listDeploymentsCommand, listFlows, listFlowsCommand, listFrames, listJourneys, listKnowledge, listPageFrames, listPreviews, listProjects, listProjectsCommand, listReleases, listSecrets, listStepHistory, listThreads, loadConfig, loadJsonConfig, login, loginCommand, logout, logoutCommand, mergeAuthHeaders, parseSSEEvents, publicFetch, push, pushCommand, readConfig, regrantPreview, requireProjectId, resetClientContext, resolveAccessToken, resolveAppUrl, resolveToken, run, runCommand, setClientContext, setDefaultProject, setFeedbackPreference, setReleaseRationale, simulateCollector, simulateDestination, simulateSource, simulateTransformer, startDeviceAuthorization, startObserveSession, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, throwApiError, updateFlow, updateFlowCommand, updateProject, updateProjectCommand, updateSecret, validate, validateCommand, validateFlowStructure, whoami, whoamiCommand, wrapSkeleton, writeConfig };