@leaflow/sdk 0.0.0-dev.49.g6065fbb → 0.0.0-dev.496.g35e57c5

package/dist/account/v1/generated/models.js

@@ -0,0 +1,79 @@
+export const SettingsResourceProjectCreationMode = {
+    OPEN: "OPEN",
+    VERIFIED_ONLY: "VERIFIED_ONLY",
+    CLOSED: "CLOSED",
+};
+export const SettingsResourceRegistrationMode = {
+    OPEN: "OPEN",
+    INVITE_ONLY: "INVITE_ONLY",
+    CLOSED: "CLOSED",
+};
+export const AgreementResourceType = {
+    TERMS: "TERMS",
+    PRIVACY: "PRIVACY",
+    DPA: "DPA",
+};
+export const ConsentResourceMethod = {
+    CLICKWRAP: "CLICKWRAP",
+    OFFLINE: "OFFLINE",
+};
+export const ConsentResourceType = {
+    TERMS: "TERMS",
+    PRIVACY: "PRIVACY",
+    DPA: "DPA",
+};
+export const ConsentBodyType = {
+    TERMS: "TERMS",
+    PRIVACY: "PRIVACY",
+    DPA: "DPA",
+};
+export const AccountResourceStatus = {
+    ACTIVE: "ACTIVE",
+    SUSPENDED: "SUSPENDED",
+    BANNED: "BANNED",
+    DELETING: "DELETING",
+};
+export const AccountDeletionState = {
+    none: "none",
+    checking: "checking",
+    scheduled: "scheduled",
+    executing: "executing",
+};
+export const ProjectTraitResourceEffect = {
+    NoWrite: "NoWrite",
+    NoAccess: "NoAccess",
+};
+export const ProjectStatus = {
+    active: "active",
+    deleting: "deleting",
+    deleted: "deleted",
+};
+export const Locale = {
+    "zh-Hans": "zh-Hans",
+    "zh-Hant-HK": "zh-Hant-HK",
+    en: "en",
+};
+export const IdentityVerificationResourceStatus = {
+    UNVERIFIED: "UNVERIFIED",
+    PENDING: "PENDING",
+    PERSONAL: "PERSONAL",
+    ENTERPRISE: "ENTERPRISE",
+    REJECTED: "REJECTED",
+};
+export const SSHKeyResourceStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};
+export const RuleResourceEffect = {
+    allow: "allow",
+    deny: "deny",
+};
+export const ProjectSlugAvailabilityResourceStatus = {
+    available: "available",
+    reserved: "reserved",
+    taken: "taken",
+};
+export const ListSshKeysStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};

package/dist/account/v1/generated/schemas.zod.d.ts

@@ -0,0 +1,278 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+/**
+ * Call this once a new version is published, which is whenever `pending_agreements` on `GET /account/v1/me` is not empty.
+ *
+ * Only the version currently in force is accepted; consenting to an earlier one answers 409. Submitting the same version twice is not an error and leaves the first record in place.
+ * @summary Consent to the current agreements
+ */
+export declare const AcceptAgreementsBody: zod.ZodObject<{
+    consents: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        type: zod.ZodEnum<{
+            TERMS: "TERMS";
+            PRIVACY: "PRIVACY";
+            DPA: "DPA";
+        }>;
+        version: zod.ZodString;
+    }, zod.z.core.$strict>>>;
+}, zod.z.core.$strict>;
+/**
+ * Call this after signing in at auth.leaflow.net, carrying the access token. The name and email address are taken from the sign-in claims and are not read from the request body.
+ *
+ * `consents` must cover every agreement returned by `GET /account/v1/agreements`, at the same versions. A missing agreement answers 400 and a stale version answers 409, in which case fetch the list again. An account that already exists answers 409, and one that has been deleted answers 410 `USER_DELETED`: the same sign-in cannot register again.
+ * @summary Register an account
+ */
+export declare const RegisterBody: zod.ZodObject<{
+    consents: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        type: zod.ZodEnum<{
+            TERMS: "TERMS";
+            PRIVACY: "PRIVACY";
+            DPA: "DPA";
+        }>;
+        version: zod.ZodString;
+    }, zod.z.core.$strict>>>;
+    country: zod.ZodString;
+    locale: zod.ZodEnum<{
+        "zh-Hans": "zh-Hans";
+        "zh-Hant-HK": "zh-Hant-HK";
+        en: "en";
+    }>;
+}, zod.z.core.$strict>;
+/**
+ * The name and email address cannot be changed here. They come from the identity provider, and a change would be overwritten at the next sign-in.
+ * @summary Update the country and language of the current account
+ */
+export declare const UpdateAccountBody: zod.ZodObject<{
+    country: zod.ZodOptional<zod.ZodString>;
+    locale: zod.ZodOptional<zod.ZodEnum<{
+        "zh-Hans": "zh-Hans";
+        "zh-Hant-HK": "zh-Hant-HK";
+        en: "en";
+    }>>;
+}, zod.z.core.$strict>;
+/**
+ * The account is frozen at once: it can no longer enter a project or change anything in one. The answer is 202 with `state` `checking` while the services holding data for the account are asked whether it can be closed. Poll `GET /account/v1/me/deletion` until `state` leaves `checking`, which normally takes a few seconds.
+ *
+ * - If any service refuses, the account returns to use, `state` becomes `none`, and `rejected_at` and `objections` say why.
+ * - Otherwise `state` becomes `scheduled`, and the account is deleted at `scheduled_at`, fifteen days after the request. The conditions are checked once more at that time.
+ *
+ * The deletion can be cancelled with `POST /account/v1/me:undelete` until `scheduled_at`, and not after. Once carried out it cannot be undone, and the same sign-in cannot register again. Any remaining balance and prepaid benefits are forfeited, which `acknowledge_forfeiture` confirms.
+ *
+ * Requesting again while a deletion is open returns it unchanged. Fails with 412 `USER_OWNS_PROJECTS` while `blocking_projects` is not empty, and with 401 `INSUFFICIENT_USER_AUTHENTICATION` unless the caller signed in within the last `meta.max_age` seconds; sign in again with that `max_age` and retry.
+ * @summary Request deletion of the current account
+ */
+export declare const RequestAccountDeletionQueryParams: zod.ZodObject<{
+    acknowledge_forfeiture: zod.ZodLiteral<true>;
+}, zod.z.core.$strict>;
+/**
+ * A submission awaiting review, and an account already verified, are both refused. A rejected submission may be corrected and sent again.
+ * @summary Submit identity verification
+ */
+export declare const SubmitIdentityVerificationBody: zod.ZodObject<{
+    id_number: zod.ZodString;
+    real_name: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Most recent first.
+ * @summary List the SSH keys of the current account
+ */
+export declare const listSshKeysQueryLimitDefault = 50;
+export declare const listSshKeysQueryLimitMax = 200;
+export declare const listSshKeysQueryOffsetDefault = 0;
+export declare const listSshKeysQueryOffsetMin = 0;
+export declare const listSshKeysQueryOffsetMax = 10000;
+export declare const ListSshKeysQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+    status: zod.ZodOptional<zod.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        REVOKED: "REVOKED";
+    }>>;
+}, zod.z.core.$strict>;
+/**
+ * Fails with 409 `SSH_KEY_ALREADY_EXISTS` while the same key is active on any account, this one included, and with 412 `SSH_KEY_QUOTA_EXCEEDED` while the account already holds 50 active keys.
+ * @summary Add an SSH key to the current account
+ */
+export declare const CreateSshKeyBody: zod.ZodObject<{
+    name: zod.ZodString;
+    public_key: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * @summary Get an SSH key of the current account
+ */
+export declare const GetSshKeyParams: zod.ZodObject<{
+    keyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * @summary Rename an SSH key of the current account
+ */
+export declare const RenameSshKeyParams: zod.ZodObject<{
+    keyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+export declare const RenameSshKeyBody: zod.ZodObject<{
+    name: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ *
+ * The same key can then be added again, to this account or another.
+ * @summary Revoke an SSH key of the current account
+ */
+export declare const RevokeSshKeyParams: zod.ZodObject<{
+    keyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Matched against the email address of the current account.
+ * @summary List invitations addressed to the caller
+ */
+export declare const listMyInvitationsQueryLimitDefault = 50;
+export declare const listMyInvitationsQueryLimitMax = 200;
+export declare const listMyInvitationsQueryOffsetDefault = 0;
+export declare const listMyInvitationsQueryOffsetMin = 0;
+export declare const listMyInvitationsQueryOffsetMax = 10000;
+export declare const ListMyInvitationsQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+}, zod.z.core.$strict>;
+/**
+ * No token required: whoever follows the link in an invitation email has usually not signed in, and may hold no account at all.
+ *
+ * The recipient address is masked (`t***@example.com`).
+ *
+ * A token that does not exist, one already redeemed, one revoked and one expired all answer the same 404.
+ * @summary Preview an invitation by its token
+ */
+export declare const previewInvitationByTokenQueryTokenMax = 128;
+export declare const PreviewInvitationByTokenQueryParams: zod.ZodObject<{
+    token: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * A token that does not match, and an invitation that no longer stands, answer the same way.
+ * @summary Accept an invitation by its token
+ */
+export declare const AcceptInvitationByTokenBody: zod.ZodObject<{
+    token: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * No token is required; the invitation is addressed to the email address of the current account.
+ * @summary Accept an invitation listed against the caller
+ */
+export declare const AcceptInvitationParams: zod.ZodObject<{
+    invitationId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Superseded by `QUERY /account/v1/projects`, which filters by status and pages by page number. Projects whose deletion has finished are excluded unless `include_deleted` is true; projects being deleted are included.
+ * @deprecated
+ * @summary List the projects the caller belongs to
+ */
+export declare const listProjectsQueryLimitDefault = 50;
+export declare const listProjectsQueryLimitMax = 200;
+export declare const listProjectsQueryOffsetDefault = 0;
+export declare const listProjectsQueryOffsetMin = 0;
+export declare const listProjectsQueryOffsetMax = 10000;
+export declare const listProjectsQueryKeywordMax = 128;
+export declare const listProjectsQueryIncludeDeletedDefault = false;
+export declare const ListProjectsQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+    keyword: zod.ZodOptional<zod.ZodString>;
+    include_deleted: zod.ZodDefault<zod.ZodBoolean>;
+}, zod.z.core.$strict>;
+/**
+ * The caller becomes its owner. The project is created with the built-in `OWNER` and `ADMIN` roles and a `member` role carrying no permissions.
+ *
+ * A custom `slug` may be chosen here; without one the slug is the new project's `id`. A custom slug is refused with:
+ *
+ * - 400 `PROJECT_SLUG_INVALID` when it does not follow the format described on `slug`;
+ * - 422 `PROJECT_SLUG_RESERVED` when the name is reserved;
+ * - 409 `PROJECT_SLUG_TAKEN` when another project, including a deleted one, holds it;
+ * - 429 `PROJECT_SLUG_CLAIM_RATE_LIMITED` when the account has attempted to claim custom slugs too often. Attempts count whether or not they succeed; creating a project without a custom slug does not count.
+ * @summary Create a project
+ */
+export declare const CreateProjectBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    name: zod.ZodString;
+    slug: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+/**
+ * Returns a project the caller belongs to, found by an address label: a custom slug is compared exactly, and a label in the form of a project id finds the project with that id, whether or not it has since chosen a custom slug.
+ *
+ * A deleted project is returned, answering that it is gone. Fails with:
+ *
+ * - 400 `PROJECT_SLUG_INVALID` when the value cannot be a slug;
+ * - 404 `PROJECT_NOT_FOUND` when no project holds the slug;
+ * - 403 `PROJECT_MEMBERSHIP_REQUIRED` when the caller is not a member of the project;
+ * - 429 `PROJECT_SLUG_LOOKUP_RATE_LIMITED` when the account has looked up slugs too often. This operation shares its limit with `GET /account/v1/project-slugs/{slug}/availability`.
+ * @summary Get a project by its slug
+ */
+export declare const getProjectBySlugPathSlugMax = 63;
+export declare const GetProjectBySlugParams: zod.ZodObject<{
+    slug: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Returns a project the caller belongs to. A deleted project is returned, answering that it is gone. Fails with:
+ *
+ * - 404 `PROJECT_NOT_FOUND` when no project has the id;
+ * - 403 `PROJECT_MEMBERSHIP_REQUIRED` when the caller is not a member of the project.
+ * @summary Get a project
+ */
+export declare const GetProjectParams: zod.ZodObject<{
+    projectId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Reports whether a custom slug can be chosen now. Nothing is reserved by asking: the slug is claimed only by creating a project with it or by setting it, either of which may still fail with 409 `PROJECT_SLUG_TAKEN`.
+ *
+ * Fails with:
+ *
+ * - 400 `PROJECT_SLUG_INVALID` when the value does not follow the format of a custom slug;
+ * - 429 `PROJECT_SLUG_LOOKUP_RATE_LIMITED` when the account has looked up slugs too often. This operation shares its limit with `GET /account/v1/projects/by-slug/{slug}`.
+ * @summary Check whether a custom slug can be chosen
+ */
+export declare const getProjectSlugAvailabilityPathSlugMax = 63;
+export declare const GetProjectSlugAvailabilityParams: zod.ZodObject<{
+    slug: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Once a project has been chosen, exchange the access token for a scoped token for that project.
+ *
+ * **Only an access token issued by auth.leaflow.net is accepted; a scoped token is not.** Once a scoped token has expired, obtain a fresh access token at auth.leaflow.net and call this endpoint again.
+ *
+ * The exchange confirms that the account is usable, that the project exists, and that the caller is a member of it. A caller who is not a member obtains no token.
+ *
+ * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
+ *
+ * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ * @summary Exchange the access token for a scoped token
+ */
+export declare const CreateScopedTokenParams: zod.ZodObject<{
+    projectId: zod.ZodUUID;
+}, zod.z.core.$strict>;

package/dist/account/v1/generated/schemas.zod.js

@@ -0,0 +1,281 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { AcceptConsentsRequestBody } from "./validators/acceptConsentsRequestBody.zod.js";
+import { AcceptInvitationByTokenRequestBody } from "./validators/acceptInvitationByTokenRequestBody.zod.js";
+import { CreateProjectRequestBody } from "./validators/createProjectRequestBody.zod.js";
+import { CreateSSHKeyRequestBody } from "./validators/createSSHKeyRequestBody.zod.js";
+import { RegisterRequestBody } from "./validators/registerRequestBody.zod.js";
+import { RenameSSHKeyRequestBody } from "./validators/renameSSHKeyRequestBody.zod.js";
+import { SubmitIdentityVerificationRequestBody } from "./validators/submitIdentityVerificationRequestBody.zod.js";
+import { UpdateAccountRequestBody } from "./validators/updateAccountRequestBody.zod.js";
+/**
+ * Call this once a new version is published, which is whenever `pending_agreements` on `GET /account/v1/me` is not empty.
+ *
+ * Only the version currently in force is accepted; consenting to an earlier one answers 409. Submitting the same version twice is not an error and leaves the first record in place.
+ * @summary Consent to the current agreements
+ */
+export const AcceptAgreementsBody = AcceptConsentsRequestBody;
+/**
+ * Call this after signing in at auth.leaflow.net, carrying the access token. The name and email address are taken from the sign-in claims and are not read from the request body.
+ *
+ * `consents` must cover every agreement returned by `GET /account/v1/agreements`, at the same versions. A missing agreement answers 400 and a stale version answers 409, in which case fetch the list again. An account that already exists answers 409, and one that has been deleted answers 410 `USER_DELETED`: the same sign-in cannot register again.
+ * @summary Register an account
+ */
+export const RegisterBody = RegisterRequestBody;
+/**
+ * The name and email address cannot be changed here. They come from the identity provider, and a change would be overwritten at the next sign-in.
+ * @summary Update the country and language of the current account
+ */
+export const UpdateAccountBody = UpdateAccountRequestBody;
+/**
+ * The account is frozen at once: it can no longer enter a project or change anything in one. The answer is 202 with `state` `checking` while the services holding data for the account are asked whether it can be closed. Poll `GET /account/v1/me/deletion` until `state` leaves `checking`, which normally takes a few seconds.
+ *
+ * - If any service refuses, the account returns to use, `state` becomes `none`, and `rejected_at` and `objections` say why.
+ * - Otherwise `state` becomes `scheduled`, and the account is deleted at `scheduled_at`, fifteen days after the request. The conditions are checked once more at that time.
+ *
+ * The deletion can be cancelled with `POST /account/v1/me:undelete` until `scheduled_at`, and not after. Once carried out it cannot be undone, and the same sign-in cannot register again. Any remaining balance and prepaid benefits are forfeited, which `acknowledge_forfeiture` confirms.
+ *
+ * Requesting again while a deletion is open returns it unchanged. Fails with 412 `USER_OWNS_PROJECTS` while `blocking_projects` is not empty, and with 401 `INSUFFICIENT_USER_AUTHENTICATION` unless the caller signed in within the last `meta.max_age` seconds; sign in again with that `max_age` and retry.
+ * @summary Request deletion of the current account
+ */
+export const RequestAccountDeletionQueryParams = zod.strictObject({
+    acknowledge_forfeiture: zod
+        .literal(true)
+        .describe("Must be true. Confirms that any remaining balance and prepaid benefits are forfeited when the deletion is carried out."),
+});
+/**
+ * A submission awaiting review, and an account already verified, are both refused. A rejected submission may be corrected and sent again.
+ * @summary Submit identity verification
+ */
+export const SubmitIdentityVerificationBody = SubmitIdentityVerificationRequestBody;
+/**
+ * Most recent first.
+ * @summary List the SSH keys of the current account
+ */
+export const listSshKeysQueryLimitDefault = 50;
+export const listSshKeysQueryLimitMax = 200;
+export const listSshKeysQueryOffsetDefault = 0;
+export const listSshKeysQueryOffsetMin = 0;
+export const listSshKeysQueryOffsetMax = 10000;
+export const ListSshKeysQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listSshKeysQueryLimitMax)
+        .default(listSshKeysQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listSshKeysQueryOffsetMin)
+        .max(listSshKeysQueryOffsetMax)
+        .default(listSshKeysQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+    status: zod
+        .enum(["ACTIVE", "REVOKED"])
+        .optional()
+        .describe("Both kinds are returned while this is absent"),
+});
+/**
+ * Fails with 409 `SSH_KEY_ALREADY_EXISTS` while the same key is active on any account, this one included, and with 412 `SSH_KEY_QUOTA_EXCEEDED` while the account already holds 50 active keys.
+ * @summary Add an SSH key to the current account
+ */
+export const CreateSshKeyBody = CreateSSHKeyRequestBody;
+/**
+ * @summary Get an SSH key of the current account
+ */
+export const GetSshKeyParams = zod.strictObject({
+    keyId: zod.uuid(),
+});
+/**
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * @summary Rename an SSH key of the current account
+ */
+export const RenameSshKeyParams = zod.strictObject({
+    keyId: zod.uuid(),
+});
+export const RenameSshKeyBody = RenameSSHKeyRequestBody;
+/**
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ *
+ * The same key can then be added again, to this account or another.
+ * @summary Revoke an SSH key of the current account
+ */
+export const RevokeSshKeyParams = zod.strictObject({
+    keyId: zod.uuid(),
+});
+/**
+ * Matched against the email address of the current account.
+ * @summary List invitations addressed to the caller
+ */
+export const listMyInvitationsQueryLimitDefault = 50;
+export const listMyInvitationsQueryLimitMax = 200;
+export const listMyInvitationsQueryOffsetDefault = 0;
+export const listMyInvitationsQueryOffsetMin = 0;
+export const listMyInvitationsQueryOffsetMax = 10000;
+export const ListMyInvitationsQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listMyInvitationsQueryLimitMax)
+        .default(listMyInvitationsQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listMyInvitationsQueryOffsetMin)
+        .max(listMyInvitationsQueryOffsetMax)
+        .default(listMyInvitationsQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+});
+/**
+ * No token required: whoever follows the link in an invitation email has usually not signed in, and may hold no account at all.
+ *
+ * The recipient address is masked (`t***@example.com`).
+ *
+ * A token that does not exist, one already redeemed, one revoked and one expired all answer the same 404.
+ * @summary Preview an invitation by its token
+ */
+export const previewInvitationByTokenQueryTokenMax = 128;
+export const PreviewInvitationByTokenQueryParams = zod.strictObject({
+    token: zod
+        .string()
+        .min(1)
+        .max(previewInvitationByTokenQueryTokenMax)
+        .describe("The token carried by the invitation link"),
+});
+/**
+ * A token that does not match, and an invitation that no longer stands, answer the same way.
+ * @summary Accept an invitation by its token
+ */
+export const AcceptInvitationByTokenBody = AcceptInvitationByTokenRequestBody;
+/**
+ * No token is required; the invitation is addressed to the email address of the current account.
+ * @summary Accept an invitation listed against the caller
+ */
+export const AcceptInvitationParams = zod.strictObject({
+    invitationId: zod.uuid(),
+});
+/**
+ * Superseded by `QUERY /account/v1/projects`, which filters by status and pages by page number. Projects whose deletion has finished are excluded unless `include_deleted` is true; projects being deleted are included.
+ * @deprecated
+ * @summary List the projects the caller belongs to
+ */
+export const listProjectsQueryLimitDefault = 50;
+export const listProjectsQueryLimitMax = 200;
+export const listProjectsQueryOffsetDefault = 0;
+export const listProjectsQueryOffsetMin = 0;
+export const listProjectsQueryOffsetMax = 10000;
+export const listProjectsQueryKeywordMax = 128;
+export const listProjectsQueryIncludeDeletedDefault = false;
+export const ListProjectsQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listProjectsQueryLimitMax)
+        .default(listProjectsQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listProjectsQueryOffsetMin)
+        .max(listProjectsQueryOffsetMax)
+        .default(listProjectsQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+    keyword: zod
+        .string()
+        .max(listProjectsQueryKeywordMax)
+        .optional()
+        .describe("Matches against name, slug or description, and against the id when it is a complete project id"),
+    include_deleted: zod.boolean().default(listProjectsQueryIncludeDeletedDefault),
+});
+/**
+ * The caller becomes its owner. The project is created with the built-in `OWNER` and `ADMIN` roles and a `member` role carrying no permissions.
+ *
+ * A custom `slug` may be chosen here; without one the slug is the new project's `id`. A custom slug is refused with:
+ *
+ * - 400 `PROJECT_SLUG_INVALID` when it does not follow the format described on `slug`;
+ * - 422 `PROJECT_SLUG_RESERVED` when the name is reserved;
+ * - 409 `PROJECT_SLUG_TAKEN` when another project, including a deleted one, holds it;
+ * - 429 `PROJECT_SLUG_CLAIM_RATE_LIMITED` when the account has attempted to claim custom slugs too often. Attempts count whether or not they succeed; creating a project without a custom slug does not count.
+ * @summary Create a project
+ */
+export const CreateProjectBody = CreateProjectRequestBody;
+/**
+ * Returns a project the caller belongs to, found by an address label: a custom slug is compared exactly, and a label in the form of a project id finds the project with that id, whether or not it has since chosen a custom slug.
+ *
+ * A deleted project is returned, answering that it is gone. Fails with:
+ *
+ * - 400 `PROJECT_SLUG_INVALID` when the value cannot be a slug;
+ * - 404 `PROJECT_NOT_FOUND` when no project holds the slug;
+ * - 403 `PROJECT_MEMBERSHIP_REQUIRED` when the caller is not a member of the project;
+ * - 429 `PROJECT_SLUG_LOOKUP_RATE_LIMITED` when the account has looked up slugs too often. This operation shares its limit with `GET /account/v1/project-slugs/{slug}/availability`.
+ * @summary Get a project by its slug
+ */
+export const getProjectBySlugPathSlugMax = 63;
+export const GetProjectBySlugParams = zod.strictObject({
+    slug: zod.string().min(1).max(getProjectBySlugPathSlugMax),
+});
+/**
+ * Returns a project the caller belongs to. A deleted project is returned, answering that it is gone. Fails with:
+ *
+ * - 404 `PROJECT_NOT_FOUND` when no project has the id;
+ * - 403 `PROJECT_MEMBERSHIP_REQUIRED` when the caller is not a member of the project.
+ * @summary Get a project
+ */
+export const GetProjectParams = zod.strictObject({
+    projectId: zod.uuid(),
+});
+/**
+ * Reports whether a custom slug can be chosen now. Nothing is reserved by asking: the slug is claimed only by creating a project with it or by setting it, either of which may still fail with 409 `PROJECT_SLUG_TAKEN`.
+ *
+ * Fails with:
+ *
+ * - 400 `PROJECT_SLUG_INVALID` when the value does not follow the format of a custom slug;
+ * - 429 `PROJECT_SLUG_LOOKUP_RATE_LIMITED` when the account has looked up slugs too often. This operation shares its limit with `GET /account/v1/projects/by-slug/{slug}`.
+ * @summary Check whether a custom slug can be chosen
+ */
+export const getProjectSlugAvailabilityPathSlugMax = 63;
+export const GetProjectSlugAvailabilityParams = zod.strictObject({
+    slug: zod.string().min(1).max(getProjectSlugAvailabilityPathSlugMax),
+});
+/**
+ * Once a project has been chosen, exchange the access token for a scoped token for that project.
+ *
+ * **Only an access token issued by auth.leaflow.net is accepted; a scoped token is not.** Once a scoped token has expired, obtain a fresh access token at auth.leaflow.net and call this endpoint again.
+ *
+ * The exchange confirms that the account is usable, that the project exists, and that the caller is a member of it. A caller who is not a member obtains no token.
+ *
+ * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
+ *
+ * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ * @summary Exchange the access token for a scoped token
+ */
+export const CreateScopedTokenParams = zod.strictObject({
+    projectId: zod.uuid(),
+});