@leaflow/sdk 0.0.0-dev.510.g8eb7f2e → 0.0.0-dev.516.g28eeab9

package/dist/account/v1/generated/functions.d.ts

@@ -16,6 +16,24 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
  * ## SSH keys
  *
  * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
@@ -27,7 +45,7 @@
  * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
  * OpenAPI spec version: 1.0.0
  */
-import type { AcceptConsentsRequestBody, AcceptInvitationByTokenRequestBody, AcceptedInvitationResponseBody, AccountDeletionResource, AccountResource, AgreementListResponseBody, ConsentListResponseBody, CreateProjectRequestBody, CreateSSHKeyRequestBody, Error, IdentityVerificationResource, InvitationPreviewResource, LengthAwarePageInvitationResource, LengthAwarePageProjectAccessResource, LengthAwarePageSSHKeyResource, ListMyInvitationsParams, ListProjectsParams, ListSshKeysParams, LocaleOptionsResource, PreviewInvitationByTokenParams, ProjectAccessList, ProjectAccessResource, ProjectSlugAvailabilityResource, RegisterRequestBody, RenameSSHKeyRequestBody, RequestAccountDeletionParams, SSHKeyResource, ScopedTokenResponseBody, SearchProjectsRequestBody, SettingsResource, SubmitIdentityVerificationRequestBody, UpdateAccountRequestBody } from "./models.js";
+import type { AcceptConsentsRequestBody, AcceptInvitationByTokenRequestBody, AcceptedInvitationResponseBody, AccountDeletionResource, AccountResource, AgreementListResponseBody, ApplicationResource, AuthorizeApplicationRequestBody, AuthorizedApplicationResource, ConsentListResponseBody, CreateProjectRequestBody, CreateSSHKeyRequestBody, Error, IdentityVerificationResource, InvitationPreviewResource, LengthAwarePageAuthorizedApplicationResource, LengthAwarePageInvitationResource, LengthAwarePageProjectAccessResource, LengthAwarePageSSHKeyResource, ListAuthorizedApplicationsParams, ListMyInvitationsParams, ListProjectsParams, ListSshKeysParams, LocaleOptionsResource, PreviewInvitationByTokenParams, ProjectAccessList, ProjectAccessResource, ProjectSlugAvailabilityResource, RegisterRequestBody, RenameSSHKeyRequestBody, RequestAccountDeletionParams, SSHKeyResource, ScopedTokenResponseBody, SearchProjectsRequestBody, SettingsResource, SubmitIdentityVerificationRequestBody, UpdateAccountRequestBody } from "./models.js";
 export type HTTPStatusCode1xx = 100 | 101 | 102 | 103;
 export type HTTPStatusCode2xx = 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207;
 export type HTTPStatusCode3xx = 300 | 301 | 302 | 303 | 304 | 305 | 307 | 308;
@@ -438,6 +456,102 @@ export declare const getRevokeSshKeyUrl: (keyId: string) => string;
  * @summary Revoke an SSH key of the current account
  */
 export declare const revokeSshKey: (keyId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<revokeSshKeyResponse>;
+export type getApplicationResponse200 = {
+    data: ApplicationResource;
+    status: 200;
+};
+export type getApplicationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getApplicationResponseSuccess = getApplicationResponse200 & {
+    headers: Headers;
+};
+export type getApplicationResponseError = getApplicationResponseDefault & {
+    headers: Headers;
+};
+export type getApplicationResponse = getApplicationResponseSuccess | getApplicationResponseError;
+export declare const getGetApplicationUrl: (clientId: string) => string;
+/**
+ * Returns the application requesting authorization, so that the authorization page can identify the requester. Any authenticated account may read it, since the `client_id` is part of every authorization request.
+ *
+ * A deleted application is reported as not found. A disabled application is returned with `status` `DISABLED` and cannot be authorized.
+ *
+ * The authorization page returns the user only to a `redirect_uri` that exactly matches one of `redirect_uris`; if none matches, the user is not redirected.
+ * @summary Get an application by its client ID
+ */
+export declare const getApplication: (clientId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getApplicationResponse>;
+export type listAuthorizedApplicationsResponse200 = {
+    data: LengthAwarePageAuthorizedApplicationResource;
+    status: 200;
+};
+export type listAuthorizedApplicationsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listAuthorizedApplicationsResponseSuccess = listAuthorizedApplicationsResponse200 & {
+    headers: Headers;
+};
+export type listAuthorizedApplicationsResponseError = listAuthorizedApplicationsResponseDefault & {
+    headers: Headers;
+};
+export type listAuthorizedApplicationsResponse = listAuthorizedApplicationsResponseSuccess | listAuthorizedApplicationsResponseError;
+export declare const getListAuthorizedApplicationsUrl: (params?: ListAuthorizedApplicationsParams) => string;
+/**
+ * Returns one item for each application and project, most recent first. An authorization is omitted once it has been revoked, once the membership under which it was granted has ended, or once the application has been deleted.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application are returned.
+ * @summary List the applications the current account has authorized
+ */
+export declare const listAuthorizedApplications: (params?: ListAuthorizedApplicationsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listAuthorizedApplicationsResponse>;
+export type authorizeApplicationResponse201 = {
+    data: AuthorizedApplicationResource;
+    status: 201;
+};
+export type authorizeApplicationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type authorizeApplicationResponseSuccess = authorizeApplicationResponse201 & {
+    headers: Headers;
+};
+export type authorizeApplicationResponseError = authorizeApplicationResponseDefault & {
+    headers: Headers;
+};
+export type authorizeApplicationResponse = authorizeApplicationResponseSuccess | authorizeApplicationResponseError;
+export declare const getAuthorizeApplicationUrl: () => string;
+/**
+ * Permits the application to exchange the access tokens of this account for scoped tokens of the project. Within the project, the application then holds exactly the permissions of this account and none beyond them.
+ *
+ * The caller must be a member of the project. Repeating the request returns the existing authorization. Authorizing a disabled application fails with 412 `APPLICATION_DISABLED`.
+ *
+ * An access token issued to an application is rejected, so that an application cannot authorize itself.
+ * @summary Authorize an application to act in a project
+ */
+export declare const authorizeApplication: (authorizeApplicationRequestBody: AuthorizeApplicationRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<authorizeApplicationResponse>;
+export type revokeAuthorizedApplicationResponse200 = {
+    data: AuthorizedApplicationResource;
+    status: 200;
+};
+export type revokeAuthorizedApplicationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type revokeAuthorizedApplicationResponseSuccess = revokeAuthorizedApplicationResponse200 & {
+    headers: Headers;
+};
+export type revokeAuthorizedApplicationResponseError = revokeAuthorizedApplicationResponseDefault & {
+    headers: Headers;
+};
+export type revokeAuthorizedApplicationResponse = revokeAuthorizedApplicationResponseSuccess | revokeAuthorizedApplicationResponseError;
+export declare const getRevokeAuthorizedApplicationUrl: (authorizationId: string) => string;
+/**
+ * After revocation, the application can no longer exchange tokens for the project. A scoped token already issued to it remains valid until it expires. Repeating the request returns the same authorization.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application can be revoked; this allows an application to disconnect itself.
+ * @summary Revoke an application's authorization
+ */
+export declare const revokeAuthorizedApplication: (authorizationId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<revokeAuthorizedApplicationResponse>;
 export type listMyInvitationsResponse200 = {
     data: LengthAwarePageInvitationResource;
     status: 200;
@@ -701,6 +815,8 @@ export declare const getCreateScopedTokenUrl: (projectId: string) => string;
  * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
  *
  * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ *
+ * An access token issued to an application is exchanged only for a project for which the user has authorized that application. Otherwise, the exchange fails with 403 `APPLICATION_AUTHORIZATION_REQUIRED`, whose `meta` contains the `client_id` and the `project_id`; the application should then direct the user to the authorization page. For a disabled application the exchange fails with 412 `APPLICATION_DISABLED`, and for a deleted application with 404 `APPLICATION_NOT_FOUND`, even if its access token has not yet expired.
  * @summary Exchange the access token for a scoped token
  */
 export declare const createScopedToken: (projectId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createScopedTokenResponse>;

package/dist/account/v1/generated/functions.js

@@ -432,6 +432,108 @@ export const revokeSshKey = async (keyId, options, fetchFn) => {
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
+export const getGetApplicationUrl = (clientId) => {
+    return `https://account.leaflow.cloud/account/v1/applications/${encodeURIComponent(String(clientId))}`;
+};
+/**
+ * Returns the application requesting authorization, so that the authorization page can identify the requester. Any authenticated account may read it, since the `client_id` is part of every authorization request.
+ *
+ * A deleted application is reported as not found. A disabled application is returned with `status` `DISABLED` and cannot be authorized.
+ *
+ * The authorization page returns the user only to a `redirect_uri` that exactly matches one of `redirect_uris`; if none matches, the user is not redirected.
+ * @summary Get an application by its client ID
+ */
+export const getApplication = async (clientId, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getGetApplicationUrl(clientId), {
+        ...options,
+        method: "GET",
+    });
+    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
+    const data = body ? JSON.parse(body) : {};
+    return { data, status: res.status, headers: res.headers };
+};
+export const getListAuthorizedApplicationsUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value !== undefined) {
+            normalizedParams.append(key, value === null ? "null" : String(value));
+        }
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0
+        ? `https://account.leaflow.cloud/account/v1/me/authorized-applications?${stringifiedParams}`
+        : `https://account.leaflow.cloud/account/v1/me/authorized-applications`;
+};
+/**
+ * Returns one item for each application and project, most recent first. An authorization is omitted once it has been revoked, once the membership under which it was granted has ended, or once the application has been deleted.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application are returned.
+ * @summary List the applications the current account has authorized
+ */
+export const listAuthorizedApplications = async (params, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getListAuthorizedApplicationsUrl(params), {
+        ...options,
+        method: "GET",
+    });
+    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
+    const data = body ? JSON.parse(body) : {};
+    return { data, status: res.status, headers: res.headers };
+};
+export const getAuthorizeApplicationUrl = () => {
+    return `https://account.leaflow.cloud/account/v1/me/authorized-applications`;
+};
+/**
+ * Permits the application to exchange the access tokens of this account for scoped tokens of the project. Within the project, the application then holds exactly the permissions of this account and none beyond them.
+ *
+ * The caller must be a member of the project. Repeating the request returns the existing authorization. Authorizing a disabled application fails with 412 `APPLICATION_DISABLED`.
+ *
+ * An access token issued to an application is rejected, so that an application cannot authorize itself.
+ * @summary Authorize an application to act in a project
+ */
+export const authorizeApplication = async (authorizeApplicationRequestBody, options, fetchFn) => {
+    const getHeaders = (h) => {
+        if (!h)
+            return {};
+        if (h instanceof Headers)
+            return Object.fromEntries(h.entries());
+        if (Symbol.iterator in h) {
+            return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
+        }
+        const headers = {};
+        for (const [name, value] of Object.entries(h)) {
+            if (value !== undefined)
+                headers[name] = value;
+        }
+        return headers;
+    };
+    const res = await (fetchFn ?? fetch)(getAuthorizeApplicationUrl(), {
+        ...options,
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
+        body: JSON.stringify(authorizeApplicationRequestBody),
+    });
+    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
+    const data = body ? JSON.parse(body) : {};
+    return { data, status: res.status, headers: res.headers };
+};
+export const getRevokeAuthorizedApplicationUrl = (authorizationId) => {
+    return `https://account.leaflow.cloud/account/v1/me/authorized-applications/${encodeURIComponent(String(authorizationId))}`;
+};
+/**
+ * After revocation, the application can no longer exchange tokens for the project. A scoped token already issued to it remains valid until it expires. Repeating the request returns the same authorization.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application can be revoked; this allows an application to disconnect itself.
+ * @summary Revoke an application's authorization
+ */
+export const revokeAuthorizedApplication = async (authorizationId, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getRevokeAuthorizedApplicationUrl(authorizationId), {
+        ...options,
+        method: "DELETE",
+    });
+    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
+    const data = body ? JSON.parse(body) : {};
+    return { data, status: res.status, headers: res.headers };
+};
 export const getListMyInvitationsUrl = (params) => {
     const normalizedParams = new URLSearchParams();
     Object.entries(params || {}).forEach(([key, value]) => {
@@ -710,6 +812,8 @@ export const getCreateScopedTokenUrl = (projectId) => {
  * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
  *
  * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ *
+ * An access token issued to an application is exchanged only for a project for which the user has authorized that application. Otherwise, the exchange fails with 403 `APPLICATION_AUTHORIZATION_REQUIRED`, whose `meta` contains the `client_id` and the `project_id`; the application should then direct the user to the authorization page. For a disabled application the exchange fails with 412 `APPLICATION_DISABLED`, and for a deleted application with 404 `APPLICATION_NOT_FOUND`, even if its access token has not yet expired.
  * @summary Exchange the access token for a scoped token
  */
 export const createScopedToken = async (projectId, options, fetchFn) => {

package/dist/account/v1/generated/models.d.ts

@@ -16,6 +16,24 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
  * ## SSH keys
  *
  * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
@@ -416,6 +434,59 @@ export interface RenameSSHKeyRequestBody {
      */
     name: string;
 }
+/**
+ * `ARCHIVED` appears only within an authorization, after the application has been deleted
+ */
+export type ApplicationResourceStatus = (typeof ApplicationResourceStatus)[keyof typeof ApplicationResourceStatus];
+export declare const ApplicationResourceStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly DISABLED: "DISABLED";
+    readonly ARCHIVED: "ARCHIVED";
+};
+/**
+ * An application, as presented to an account that is asked to authorize it
+ */
+export interface ApplicationResource {
+    client_id: string;
+    name: string;
+    /** The URIs to which the user may be returned; a `redirect_uri` must match one of them exactly */
+    redirect_uris: string[];
+    /** `ARCHIVED` appears only within an authorization, after the application has been deleted */
+    status: ApplicationResourceStatus;
+}
+export type AuthorizedApplicationResourceStatus = (typeof AuthorizedApplicationResourceStatus)[keyof typeof AuthorizedApplicationResourceStatus];
+export declare const AuthorizedApplicationResourceStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly REVOKED: "REVOKED";
+};
+/**
+ * An application that the account has authorized to act in one of its projects
+ */
+export interface AuthorizedApplicationResource {
+    id: string;
+    application: ApplicationResource;
+    project: ProjectResource;
+    status: AuthorizedApplicationResourceStatus;
+    created_at: string;
+}
+export interface LengthAwarePageAuthorizedApplicationResource {
+    /** The items in this page */
+    items: AuthorizedApplicationResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface AuthorizeApplicationRequestBody {
+    /**
+     * @minLength 1
+     * @maxLength 255
+     */
+    client_id: string;
+    project_id: string;
+}
 /**
  * What an invitation states before it is accepted. It carries neither the invitation id nor the full recipient address; the invitations listed against the current account are returned by `list-my-invitations`
  */
@@ -648,6 +719,20 @@ export declare const ListSshKeysStatus: {
     readonly ACTIVE: "ACTIVE";
     readonly REVOKED: "REVOKED";
 };
+export type ListAuthorizedApplicationsParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+};
 export type ListMyInvitationsParams = {
     /**
      * Items returned in this page. Defaults to 50; at most 200.

package/dist/account/v1/generated/models.js

@@ -64,6 +64,15 @@ export const SSHKeyResourceStatus = {
     ACTIVE: "ACTIVE",
     REVOKED: "REVOKED",
 };
+export const ApplicationResourceStatus = {
+    ACTIVE: "ACTIVE",
+    DISABLED: "DISABLED",
+    ARCHIVED: "ARCHIVED",
+};
+export const AuthorizedApplicationResourceStatus = {
+    ACTIVE: "ACTIVE",
+    REVOKED: "REVOKED",
+};
 export const RuleResourceEffect = {
     allow: "allow",
     deny: "deny",

package/dist/account/v1/generated/schemas.zod.d.ts

@@ -16,6 +16,24 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
  * ## SSH keys
  *
  * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
@@ -150,6 +168,54 @@ export declare const RenameSshKeyBody: zod.ZodObject<{
 export declare const RevokeSshKeyParams: zod.ZodObject<{
     keyId: zod.ZodUUID;
 }, zod.z.core.$strict>;
+/**
+ * Returns the application requesting authorization, so that the authorization page can identify the requester. Any authenticated account may read it, since the `client_id` is part of every authorization request.
+ *
+ * A deleted application is reported as not found. A disabled application is returned with `status` `DISABLED` and cannot be authorized.
+ *
+ * The authorization page returns the user only to a `redirect_uri` that exactly matches one of `redirect_uris`; if none matches, the user is not redirected.
+ * @summary Get an application by its client ID
+ */
+export declare const getApplicationPathClientIdMax = 255;
+export declare const GetApplicationParams: zod.ZodObject<{
+    clientId: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Returns one item for each application and project, most recent first. An authorization is omitted once it has been revoked, once the membership under which it was granted has ended, or once the application has been deleted.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application are returned.
+ * @summary List the applications the current account has authorized
+ */
+export declare const listAuthorizedApplicationsQueryLimitDefault = 50;
+export declare const listAuthorizedApplicationsQueryLimitMax = 200;
+export declare const listAuthorizedApplicationsQueryOffsetDefault = 0;
+export declare const listAuthorizedApplicationsQueryOffsetMin = 0;
+export declare const listAuthorizedApplicationsQueryOffsetMax = 10000;
+export declare const ListAuthorizedApplicationsQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+}, zod.z.core.$strict>;
+/**
+ * Permits the application to exchange the access tokens of this account for scoped tokens of the project. Within the project, the application then holds exactly the permissions of this account and none beyond them.
+ *
+ * The caller must be a member of the project. Repeating the request returns the existing authorization. Authorizing a disabled application fails with 412 `APPLICATION_DISABLED`.
+ *
+ * An access token issued to an application is rejected, so that an application cannot authorize itself.
+ * @summary Authorize an application to act in a project
+ */
+export declare const AuthorizeApplicationBody: zod.ZodObject<{
+    client_id: zod.ZodString;
+    project_id: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * After revocation, the application can no longer exchange tokens for the project. A scoped token already issued to it remains valid until it expires. Repeating the request returns the same authorization.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application can be revoked; this allows an application to disconnect itself.
+ * @summary Revoke an application's authorization
+ */
+export declare const RevokeAuthorizedApplicationParams: zod.ZodObject<{
+    authorizationId: zod.ZodUUID;
+}, zod.z.core.$strict>;
 /**
  * Matched against the email address of the current account.
  * @summary List invitations addressed to the caller
@@ -271,6 +337,8 @@ export declare const GetProjectSlugAvailabilityParams: zod.ZodObject<{
  * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
  *
  * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ *
+ * An access token issued to an application is exchanged only for a project for which the user has authorized that application. Otherwise, the exchange fails with 403 `APPLICATION_AUTHORIZATION_REQUIRED`, whose `meta` contains the `client_id` and the `project_id`; the application should then direct the user to the authorization page. For a disabled application the exchange fails with 412 `APPLICATION_DISABLED`, and for a deleted application with 404 `APPLICATION_NOT_FOUND`, even if its access token has not yet expired.
  * @summary Exchange the access token for a scoped token
  */
 export declare const CreateScopedTokenParams: zod.ZodObject<{

package/dist/account/v1/generated/schemas.zod.js

@@ -16,6 +16,24 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
  * ## SSH keys
  *
  * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
@@ -30,6 +48,7 @@
 import * as zod from "zod";
 import { AcceptConsentsRequestBody } from "./validators/acceptConsentsRequestBody.zod.js";
 import { AcceptInvitationByTokenRequestBody } from "./validators/acceptInvitationByTokenRequestBody.zod.js";
+import { AuthorizeApplicationRequestBody } from "./validators/authorizeApplicationRequestBody.zod.js";
 import { CreateProjectRequestBody } from "./validators/createProjectRequestBody.zod.js";
 import { CreateSSHKeyRequestBody } from "./validators/createSSHKeyRequestBody.zod.js";
 import { RegisterRequestBody } from "./validators/registerRequestBody.zod.js";
@@ -131,6 +150,61 @@ export const RenameSshKeyBody = RenameSSHKeyRequestBody;
 export const RevokeSshKeyParams = zod.strictObject({
     keyId: zod.uuid(),
 });
+/**
+ * Returns the application requesting authorization, so that the authorization page can identify the requester. Any authenticated account may read it, since the `client_id` is part of every authorization request.
+ *
+ * A deleted application is reported as not found. A disabled application is returned with `status` `DISABLED` and cannot be authorized.
+ *
+ * The authorization page returns the user only to a `redirect_uri` that exactly matches one of `redirect_uris`; if none matches, the user is not redirected.
+ * @summary Get an application by its client ID
+ */
+export const getApplicationPathClientIdMax = 255;
+export const GetApplicationParams = zod.strictObject({
+    clientId: zod.string().min(1).max(getApplicationPathClientIdMax),
+});
+/**
+ * Returns one item for each application and project, most recent first. An authorization is omitted once it has been revoked, once the membership under which it was granted has ended, or once the application has been deleted.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application are returned.
+ * @summary List the applications the current account has authorized
+ */
+export const listAuthorizedApplicationsQueryLimitDefault = 50;
+export const listAuthorizedApplicationsQueryLimitMax = 200;
+export const listAuthorizedApplicationsQueryOffsetDefault = 0;
+export const listAuthorizedApplicationsQueryOffsetMin = 0;
+export const listAuthorizedApplicationsQueryOffsetMax = 10000;
+export const ListAuthorizedApplicationsQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listAuthorizedApplicationsQueryLimitMax)
+        .default(listAuthorizedApplicationsQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listAuthorizedApplicationsQueryOffsetMin)
+        .max(listAuthorizedApplicationsQueryOffsetMax)
+        .default(listAuthorizedApplicationsQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+});
+/**
+ * Permits the application to exchange the access tokens of this account for scoped tokens of the project. Within the project, the application then holds exactly the permissions of this account and none beyond them.
+ *
+ * The caller must be a member of the project. Repeating the request returns the existing authorization. Authorizing a disabled application fails with 412 `APPLICATION_DISABLED`.
+ *
+ * An access token issued to an application is rejected, so that an application cannot authorize itself.
+ * @summary Authorize an application to act in a project
+ */
+export const AuthorizeApplicationBody = AuthorizeApplicationRequestBody;
+/**
+ * After revocation, the application can no longer exchange tokens for the project. A scoped token already issued to it remains valid until it expires. Repeating the request returns the same authorization.
+ *
+ * When called with an access token issued to an application, only the authorizations of that application can be revoked; this allows an application to disconnect itself.
+ * @summary Revoke an application's authorization
+ */
+export const RevokeAuthorizedApplicationParams = zod.strictObject({
+    authorizationId: zod.uuid(),
+});
 /**
  * Matched against the email address of the current account.
  * @summary List invitations addressed to the caller
@@ -274,6 +348,8 @@ export const GetProjectSlugAvailabilityParams = zod.strictObject({
  * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
  *
  * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ *
+ * An access token issued to an application is exchanged only for a project for which the user has authorized that application. Otherwise, the exchange fails with 403 `APPLICATION_AUTHORIZATION_REQUIRED`, whose `meta` contains the `client_id` and the `project_id`; the application should then direct the user to the authorization page. For a disabled application the exchange fails with 412 `APPLICATION_DISABLED`, and for a deleted application with 404 `APPLICATION_NOT_FOUND`, even if its access token has not yet expired.
  * @summary Exchange the access token for a scoped token
  */
 export const CreateScopedTokenParams = zod.strictObject({

package/dist/account/v1/generated/validators/acceptConsentsRequestBody.zod.d.ts

@@ -16,6 +16,24 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
  * ## SSH keys
  *
  * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.

package/dist/account/v1/generated/validators/acceptConsentsRequestBody.zod.js

@@ -16,6 +16,24 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
  * ## SSH keys
  *
  * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.