CLI

npm i -g runlot
runlot login

  runlot login                     log in via browser (GitHub, and so on)
  runlot login <name>              log in for local development (dev server only)
  runlot whoami                    show the current user

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)

  runlot org create <slug> [name]  create an org (uses slug if name is omitted)
  runlot org list                  list orgs you belong to
  runlot org rename <new-name>     rename the display name (admin, address unchanged)
  runlot org delete                delete the org (admin, retype slug, --confirm)
  runlot org members               list org members (requires --org)
  runlot org add-member <p>:<s>    add an existing user to an org (requires --role, --org)
  runlot org set-role <uid> <role> change a member's role (requires --org)
  runlot org remove-member <uid>   remove a member from an org (requires --org)

  You cannot change the org slug — deployment addresses, certificates, git remotes, and runlot.json use that value.
  `org delete` requires typing the slug directly. You cannot skip this with -y; scripts use --confirm.

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --role <r>       admin | member | viewer (member invite·org add-member)
  --confirm <value>  Replaces retyping the slug for org delete or the project name for project delete
                   (used when not a terminal; not available with -y)

  runlot project create <name>     create a project (requires --org)
  runlot project list              list projects (requires --org)
  runlot project rename <old> <new> rename a project (admin)
  runlot project delete <name>     delete the whole project (admin, retype name, --confirm)

  `project rename` changes the default address too. There is no alias, so update runlot.json, git remotes, and connection strings.
  `project delete` permanently deletes deployments, the database, backup generations, objects, email, storage, and secrets.
  This does not leave a recovery backup, so export first with `runlot pg export` if you need one.
  Give the target as an argument (runlot.json is not used), and type the name to confirm.
  You cannot skip that with -y — scripts use --confirm <name>. `rm` is the same command.

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --confirm <value>  Replaces retyping the slug for org delete or the project name for project delete
                   (used when not a terminal; not available with -y)

  runlot deploy [dir]              build a bundle and deploy it
  runlot deploy --preview <name>   deploy to a second address with its own database

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --preview <name> deploy to that preview instead of production (deploy)
  --db <mode>      the preview's database: branch (default) | shared | none
                   shared points the preview at the production database; writes there are real
  --from <gen>     pour the branch from this generation instead of the newest (with --db branch)
                   (the keys `runlot pg generations` lists)

  runlot pg connect [dir]          show connection info (includes password)
  runlot pg execute [dir]          run SQL (-c <sql> or -f <file>)
  runlot pg migrate [dir]          apply migrations/NNNN_*.sql
  runlot pg shell [dir] [-- ...]   connect via psql (args after -- pass through to psql)
  runlot pg export [dir]           create a diagnostic dump (not a backup)

  runlot pg generations [dir]      list backups (--json for raw output)
  runlot pg restore <e>/<s> [dir]  restore to that backup (latest works, admin)
  runlot pg delete [dir]           delete the database (admin)
  runlot pg on [dir]               create a new database after a delete
  runlot pg abort <opId> [dir]     abort a running operation (admin)

  runlot pg token [dir]            issue a time-limited connection token (--ttl, --json)
  runlot pg token list [dir]       list issued connection tokens
  runlot pg token revoke <user>    revoke a connection token

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -c, --command    SQL to run (pg execute)
  -f, --file       SQL file to run (pg execute)
  --migrations <d> migrations directory (default <dir>/migrations)
  --ca-dir <path>  local CA directory (verifies TLS with verify-full if set)
                   (default $RUNLOT_CA_DIR)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --ttl <duration> record TTL for dns set, or validity period for pg token (default 1h; 30s, 30m, 12h, 7d)

  runlot storage [status] [dir]    show storage capacity and usage limit (--json for raw output)
  runlot storage delete [dir]      release storage (admin)
  runlot storage on [dir]          turn it back on
  runlot storage public list [dir]         which key prefixes are served without a signature
  runlot storage public add <prefix> [dir] serve that prefix to anyone, unsigned (admin)
  runlot storage public rm <prefix> [dir]  stop serving it (admin; readers may lag up to a minute)

  A published prefix is read at https://objects.runlot.io/<org>/<project>/<key>.
  `assets` is stored as `assets/`, so it never opens `assets-private/`. Use `/` for every key.

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,

  runlot auth [status] [dir]       config, providers, callback URL (--json for raw output)
  runlot auth provider runlot on|off  "Continue with Runlot": email, Google, GitHub at Runlot (admin)
  runlot auth provider set <p>     your own github·google OAuth app (--client-id, --client-secret, --issuer, admin)
  runlot auth provider oidc add <id>  any OIDC provider (--issuer, --client-id, --name, --icon, --scopes, admin)
  runlot auth provider oidc rm <id>   remove an OIDC provider (admin)
  runlot auth provider rm <p>      remove a github·google provider (admin)
  runlot auth set <key> <value>    password, magic-link, allow-signup, require-verified, rls on|off, session-days <n>,
                                   link-by-email on|off, brand-name·brand-color·brand-logo·brand-logo-dark <value>,
                                   brand-copy <ko|en|ja>.<title|subtitle|footer> <text>, brand-layout centered|split|minimal,
                                   brand-theme light|dark|system, brand-button rounded|pill|square,
                                   brand-background <none|color|gradient|image> <value>, brand-link <terms|privacy|support> <url>,
                                   brand-lang ko|en|ja|auto, brand-methods <password,google,github,passkey|all>
  runlot auth brand get [dir]      the whole sign-in branding as JSON
  runlot auth brand apply <file>   replace the whole branding from a JSON file
  runlot auth preview [dir]        open the Runlot sign-in page with this branding (--lang, --theme, --state)
  runlot auth funnel [dir]         sign-in funnel counters (--days N, default 30)
  runlot auth users merge <from> <into>  move from's identities onto into, then delete from (admin)
  runlot auth delete [dir]         turn off auth (the user table stays in the DB, admin)
  runlot auth on [dir]             turn it back on

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --client-id <id> provider's public id for auth provider set / oidc add
  --client-secret <value> client secret for auth provider set / oidc add (prompts if omitted)
  --issuer <url>   GitHub Enterprise Server base URL (provider set github), or the OIDC issuer (oidc add)
  --name, --icon, --scopes  OIDC button label, icon URL and scopes (oidc add)
  --json           prints the raw server response JSON (all list commands, usage,

  runlot access [dir]              who can view this deployment (--json)
  runlot access set <mode> [dir]   public | org | password | app (--password, admin)
  runlot access bypass --new|--revoke  bypass secret for CI (Runlot-Access-Bypass header, admin)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --json           prints the raw server response JSON (all list commands, usage,

  runlot secret set <NAME> [value]  save a secret (reads from stdin if value is omitted)
  runlot secret list [dir]         list secret names and versions (does not show values)
  runlot secret delete <NAME> [d]  delete a secret

  `secret set` does not take a directory argument (the second argument is the value).
  For a project in another directory, specify --org/--project.

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)

  runlot domain add <host> [dir]   connect a custom domain (shows the CNAME and TXT records to add)
                                   (--login makes it the project's sign-in page domain, Pro plan)
  runlot domain list [dir]         connected domains and their status
  runlot domain verify <h> [dir]   checks the DNS setup (auto-check runs every minute)
  runlot domain rm <host> [dir]    disconnects a domain

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)

  runlot dns zones                 list DNS zones managed by runlot (requires --org)
  runlot dns create <zone>         create a zone (requires --org)
  runlot dns records <zone>        lists a zone's records
  runlot dns set <z> <n> <t> <value…> creates or updates a record (--ttl, give the full value)
  runlot dns rm <zone> <n> <t>     deletes a record
  runlot dns delete <zone>         deletes a zone

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --ttl <duration> record TTL for dns set, or validity period for pg token (default 1h; 30s, 30m, 12h, 7d)

  runlot domains check <name...>    checks availability and price (requires --org)
  runlot domains buy <name>        buy a domain (--years, --contact-json, --sandbox, -y)
  runlot domains list              lists domains you own
  runlot domains show <name>       domain details and recent operation history
  runlot domains import <name>     adds a domain you already own to the managed list
  runlot domains renew <name>      renew a domain (--years)
  runlot domains lock|unlock <name> turns transfer lock on or off
  runlot domains auth-code <name>  get the code to transfer to another registrar

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --years <n>      registration or renewal period in years for domains buy, renew (1-10, default 1)
  --contact-json <f> registrant contact JSON file for domains buy (prompts if omitted)
  --sandbox        proceeds with domains buy even though the registrar is a sandbox and registers nothing

  runlot logs [dir]                stream worker logs live (Ctrl-C to stop)
  runlot logs --since 2h [dir]     search stored logs (Free keeps 3 days, Pro 7)
  runlot logs query --file q.json  run an observability query and print a table (--json for raw)
  runlot logs request <id> [dir]   one request: outcome, logs, a span waterfall, related issues

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --tail <n>       lines logs fetches at first (default 200, max 2000)
  --no-follow      prints recent logs only and exits (default streams live)
  --since <when>   read stored logs from this point (2h, 24h, 3d, or 2026-09-20T10:00 UTC)
  --until <when>   stop stored logs at this point (same forms as --since)
                   an absolute time is UTC unless it names a zone (Z, +09:00)
  --grep <text>    keep only lines containing this text (plain substring); alone it searches
                   stored logs, with --tail or --no-follow it filters the live tail
  --level <l>      keep lines at or above debug | log | info | warn | error
  --source <s>     keep one stream: stdout | stderr | runlot (stored also console | exception)
  --request <id>   keep the lines of one request (32 hex characters, the Runlot-Request-Id)
  --format <f>     text (default) | json: live, one stored-event object per line; stored, the page
  --cursor <c>     continue a stored search from the cursor the last page printed
  --limit <n>      stored lines per page (default 200)
  -f, --file <path>  logs query: the query JSON (view, timeframe, filters, calculations, groupBy)
  --json           logs: the stored page, query result or request as JSON

  runlot usage [dir]               show usage by hour (--json for raw output)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --hours <n>      time range for usage to show (default 24, max 720)

  runlot port-forward [dir]        authenticate via the login session and forward a local port to the database
                                   (--port 15432, --listen 127.0.0.1, press Ctrl-C to stop)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --ca-dir <path>  local CA directory (verifies TLS with verify-full if set)
                   (default $RUNLOT_CA_DIR)
  --port <n>       local port for port-forward to open (default 15432), or for dev (default 8787)
  --listen <addr>  local address for port-forward to accept connections (default 127.0.0.1)

  runlot rollback <version> [dir]  roll back to a previous version

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)

  runlot versions [dir]            show deployment history

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)

  runlot member [ls]               list org members (requires --org, --json)
  runlot member invite <email>     invite by email (--role, default member, admin)
  runlot member role <member> <role> change a member's role (admin)
  runlot member rm <member>        remove a member from the org (admin)
  runlot member leave              leave this org
  runlot member invites            list pending and expired invites (admin, --json)
  runlot member uninvite <email>   revoke the invite for that address (admin)

  <member> is a uuid, email, or login name. If it matches more than one, the command is rejected.

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,
                   pg generations·pg token)
  --role <r>       admin | member | viewer (member invite·org add-member)

  runlot email [status] [dir]      mail address and sent/received counts (--json for raw output)
  runlot email log [dir]           sent and received mail (--direction in|out, --cursor, --limit, --json)
  runlot email raw <mailId> [dir]  print the raw message (.eml) to stdout
  runlot email delete [dir]        turn off email (admin)
  runlot email on [dir]            turn it back on
  runlot email domain add <domain> [dir]     send from your own domain (--publish writes the records into a zone we host)
  runlot email domain list [dir]            sending domains and their verification state
  runlot email domain verify <domain> [dir]  check the DNS records now instead of waiting for the automatic check
  runlot email domain rm <domain> [dir]     remove a sending domain (admin)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,

  runlot ai models                 model catalogue and per-1M-token prices (--json for raw output)
  runlot ai [usage] [dir]          calls, tokens, spend, and limits (--json for raw output)
  runlot ai credit [dir]           org credit balance and automatic top-up (--org)
  runlot ai --byos on|off [dir]    serve anthropic/* and openai/* from a team member's Studio subscription, at no credit (admin; --byos-fallback on|off decides what happens when none is free)
  runlot ai delete [dir]           turn off AI (admin)
  runlot ai on [dir]               turn it back on
                                   (there is no model-call command: env.ai is worker-only)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  -y, --yes        skips the confirmation prompt (rollback, secret delete, domain rm,
                   dns rm·dns delete·pg restore·pg delete·domains buy·storage delete·
                   email delete·ai delete·auth delete·auth provider rm·member rm·
                   member leave·member uninvite)
  --json           prints the raw server response JSON (all list commands, usage,

  runlot bug-report                send Runlot a problem report with references to the evidence
                                   (asks for a description; uses the linked project and the last hour)
  runlot bug-report --last         attach this machine's most recent failed runlot command

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --request <id>   bug-report: a request to attach (repeatable, up to 20)
  --since <win>    bug-report: the window for failing invocations, exits and issues (default 1h, max 24h)
  --message <text> bug-report: the description (asked for in a terminal when omitted)
  --last           bug-report: attach the most recent failed runlot command (argv values removed)
  --no-logs        bug-report: attach invocation skeletons and worker exits, no log lines
  --dry-run        bug-report: print exactly what would be sent and stop
  -y, --yes        bug-report: send without asking

  runlot deploy --preview <name>   deploy to a second address with its own database
  runlot preview ls [dir]          list previews: address, database mode, status, expiry (--json)
  runlot preview rm <name> [dir]   delete a preview and its database branch
  runlot preview promote <n> [dir] make the preview's code production's live version

  `promote` promotes the code. Neither database is touched and there is no merge —
  a branch is a copy taken at a moment, and production has moved since.
  A preview expires after it has been idle (Free 24h, Pro 7 days), counted from its last request.

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --json           prints the raw server response JSON (all list commands, usage,
  --preview <name> deploy to that preview instead of production (deploy)
  --db <mode>      the preview's database: branch (default) | shared | none
                   shared points the preview at the production database; writes there are real
  --from <gen>     pour the branch from this generation instead of the newest (with --db branch)
                   (the keys `runlot pg generations` lists)

  runlot open [dir]                open this project's address in the browser

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot repo create <name> [dir]  create a repository in this project and set origin (--public)
  runlot repo [list]               list repositories in this project (--json)
  runlot repo rename <old> <new>   rename a repository (admin)
  runlot repo visibility <n> <v>   public | private (admin)
  runlot repo delete <name>        delete a repository (admin)
  runlot repo history <name>       push history (who moved which ref, and how)
  runlot repo hook set <name>      deploy on every push (--branch main, --root-dir apps/web) (admin)
  runlot repo hook status <name>   is push-to-deploy on, and for which branch
  runlot repo hook unset <name>    turn push-to-deploy off (admin)
  runlot repo deploy <name>        build and deploy the hooked branch now, without pushing

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot builds [list]             build history (--limit, --json)
  runlot builds show <buildId>     one build
  runlot builds log <buildId>      that build's output
  runlot builds cancel <buildId>   cancel a queued build

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot queue [list]              declared queues: depth, dead letters, last batch (--json)
  runlot queue peek <queue>        the next messages, without taking them (--limit)
  runlot queue purge <queue>       delete every message in the queue (-y)
  runlot queue redrive <dlq>       move dead letters back to their queue (--to <queue>, -y)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot vectors [list]            env.vectors namespaces: count, dimensions, the plan's bound (--json)
  runlot vectors describe <ns>     one namespace
  runlot vectors delete <ns>       delete every vector in the namespace (-y)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot cron [list]               declared schedules, the last 24 hours, and recent runs (--limit, --json)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot errors [list]             error issues: status, events, users, last seen (--status, --query, --limit)
  runlot errors show <id>          one issue (ERR-xxxx or issue id): stack, breadcrumbs, request, user
  runlot errors resolve <id>       mark it fixed (--in next-release or commit:<full-id>)
  runlot errors unresolve <id>     reopen it
  runlot errors archive <id>       hide it until it escalates (--until 24h: for a while instead)
  runlot errors alerts [list|deliveries|mail on/off|put-rule|put-destination|delete-rule|delete-destination] (writes confirm; --file for private JSON)
  runlot errors uptime [list | add <https-url> [1|5|15] | put <id> --file <json> | rm <id> | runs <id>]  synthetic checks of your own addresses
  runlot errors capture-policy [policy.json]  read/replace capture and privacy policy (admin; explicit confirmation)
  runlot errors erase-user <app-user-id>     erase user error material (admin; explicit confirmation)
  runlot errors delete <issue-id>            permanently delete an issue (admin; explicit confirmation)
  runlot errors settings           monthly cap and usage (--cap <n|off|default>, --span-cap <n|off|default> per day, --response-errors on|off, --browser on|off, --auto-assign on|off, --perf key=value,…|default; ownership default off) (admin)
  runlot errors fix [propose|show|apply|preview|status|verify]  explicit AI proposal, branch and private HTTP approvals
  runlot errors diagnose <id> --model <m>  ask an AI model what caused it; charged to AI credit (member)
  runlot errors assign <id> <who>  assign to an org member (email, name or user id); none clears (member)
  runlot errors comment <id> <text>  add a comment; secrets are masked (member)
  runlot errors comments <id>      the issue's comments
  runlot errors merge <target> <source...>  fold up to 10 issues into one; asks first (-y) (member)
  runlot errors unmerge <id>       take a merged issue back out; asks first (-y) (member)
  runlot errors similar <id>       shared stack hints: issues whose stack overlaps; merges nothing
  runlot errors rules [-f rules.json]  show, or replace, the project's fingerprint rules; asks first (member)

  --org <slug>     org (overrides "org" in runlot.json)
  --project <name> project (overrides "name" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --status <s>     errors list: unresolved (default) | resolved | archived | all
  --query <text>   errors list: text, plus is:<state> release:latest|<n> origin:<o> route:/api/* tag.<k>:<v>
  --in <when>       errors resolve: next-release, or commit:<full-40-lowercase-id>
  --until <when>   errors archive: escalating (default), 30m/24h/7d, events:<n> or users:<n>
  --model <id>     errors diagnose: the chat model (runlot ai models lists them)
  --idempotency-key <k>  errors diagnose: reuse to fetch an earlier answer without a second charge
  --json           errors: prints the raw server response JSON

  runlot key add [path]            add an SSH public key (uses the default key if omitted)
  runlot key [list]                list registered public keys
  runlot key rm <keyId>            remove a public key

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot token create <name>       issue an API token (--scope, --org, --project, --expires)
                                   --scope repeats: project:read deploy db:read db:write
                                            repo:read repo:write org:admin
                                   --expires 30d (default 90d, max 365d) or --no-expiry
                                   --read-only is the old spelling of --scope repo:read
  runlot token [list]              list issued tokens: scopes, where, expiry, last used
  runlot token revoke <tokenId>    revoke a token
                                   CI: RUNLOT_TOKEN=<token> runlot deploy — no login needed

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot mcp                       run an MCP server on stdio so an AI agent can use runlot
                                   (--read-only publishes the read tools only)
  runlot mcp install <client>      print the setup snippet (claude-code, cursor, claude-desktop)

  The MCP server uses your login session, or RUNLOT_TOKEN when the client has its own environment.

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot license                   this installation's licence: state, term, counts (--json)

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)

  runlot apply -f projects.yaml    create or update the projects a file declares
                                   (idempotent; --prune to delete the rest)
                                   the file is apiVersion: runlot/v1, kind: ProjectSet, an org,
                                   and projects: each a name with optional secrets, hostnames, access

  A secret value of ${VAR} reads that variable from this environment; anything else is a literal.
  An unset variable stops the run by name. --prune never runs on -y: the org slug is retyped.

  --org <slug>     org (overrides "org" in runlot.json)
  --api <url>      API server address (default https://dash.runlot.io, local uses RUNLOT_API_URL)
  RUNLOT_TOKEN     use a personal access token instead of a stored login (CI)
  RUNLOT_TELEMETRY=0  turns off anonymous crash reports (on by default)
  --confirm <value>  Replaces retyping the slug for org delete or the project name for project delete
                   (used when not a terminal; not available with -y)
  -f, --file <path>  the ProjectSet file to apply (.yaml or .json)
  --prune          delete the org's projects the file does not declare (needs --confirm <org>)
  --dry-run        print the plan and change nothing
  --json           prints the plan as one JSON object instead of a line per action