@leaflow/sdk 0.0.0-dev.53.gd8db059 → 0.0.0-dev.538.g0285c19

package/dist/account/v1/generated/validators/createProjectRequestBody.zod.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const createProjectRequestBodyDescriptionMax = 2000;
+export declare const createProjectRequestBodyNameMax = 128;
+export declare const createProjectRequestBodySlugMax = 32;
+export declare const CreateProjectRequestBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    name: zod.ZodString;
+    slug: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+export type CreateProjectRequestBody = zod.input<typeof CreateProjectRequestBody>;
+export type CreateProjectRequestBodyOutput = zod.output<typeof CreateProjectRequestBody>;

package/dist/account/v1/generated/validators/createProjectRequestBody.zod.js

@@ -0,0 +1,60 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const createProjectRequestBodyDescriptionMax = 2000;
+export const createProjectRequestBodyNameMax = 128;
+export const createProjectRequestBodySlugMax = 32;
+export const CreateProjectRequestBody = zod.strictObject({
+    description: zod.string().max(createProjectRequestBodyDescriptionMax).optional(),
+    name: zod.string().min(1).max(createProjectRequestBodyNameMax),
+    slug: zod
+        .string()
+        .max(createProjectRequestBodySlugMax)
+        .optional()
+        .describe("A custom slug of 6 to 32 characters made of lower-case letters, digits and single hyphens, beginning with a letter and ending with a letter or digit. Omitted or empty, the slug is the new project's `id`, and a custom slug can be set once later"),
+});

package/dist/account/v1/generated/validators/createSSHKeyRequestBody.zod.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const createSSHKeyRequestBodyNameMax = 128;
+export declare const createSSHKeyRequestBodyPublicKeyMax = 16384;
+export declare const CreateSSHKeyRequestBody: zod.ZodObject<{
+    name: zod.ZodString;
+    public_key: zod.ZodString;
+}, zod.z.core.$strict>;
+export type CreateSSHKeyRequestBody = zod.input<typeof CreateSSHKeyRequestBody>;
+export type CreateSSHKeyRequestBodyOutput = zod.output<typeof CreateSSHKeyRequestBody>;

package/dist/account/v1/generated/validators/createSSHKeyRequestBody.zod.js

@@ -0,0 +1,58 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const createSSHKeyRequestBodyNameMax = 128;
+export const createSSHKeyRequestBodyPublicKeyMax = 16384;
+export const CreateSSHKeyRequestBody = zod.strictObject({
+    name: zod.string().min(1).max(createSSHKeyRequestBodyNameMax),
+    public_key: zod
+        .string()
+        .min(1)
+        .max(createSSHKeyRequestBodyPublicKeyMax)
+        .describe("The public key in OpenSSH format. The type and the fingerprint are derived from it and cannot be changed. A certificate is refused, being a signature rather than a key"),
+});

package/dist/account/v1/generated/validators/cursorPagination.zod.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const CursorPagination: zod.ZodObject<{
+    page_size: zod.ZodInt;
+    next_cursor: zod.ZodOptional<zod.ZodNullable<zod.ZodString>>;
+}, zod.z.core.$strict>;
+export type CursorPagination = zod.input<typeof CursorPagination>;
+export type CursorPaginationOutput = zod.output<typeof CursorPagination>;

package/dist/account/v1/generated/validators/cursorPagination.zod.js

@@ -0,0 +1,54 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const CursorPagination = zod
+    .strictObject({
+    page_size: zod.int().min(1),
+    next_cursor: zod.string().nullish(),
+})
+    .describe("Pagination metadata for keyset traversal. Pass next_cursor as cursor to read the following page; null means there is no following page.");

package/dist/account/v1/generated/validators/error.zod.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const Error: zod.ZodObject<{
+    error: zod.ZodObject<{
+        code: zod.ZodInt;
+        status: zod.ZodString;
+        message: zod.ZodString;
+        reason: zod.ZodOptional<zod.ZodString>;
+        metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodString>>;
+        field_violations: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+            field: zod.ZodString;
+            reason: zod.ZodOptional<zod.ZodString>;
+        }, zod.z.core.$strict>>>;
+        retry_delay: zod.ZodOptional<zod.ZodString>;
+        request_id: zod.ZodOptional<zod.ZodString>;
+    }, zod.z.core.$strict>;
+}, zod.z.core.$strict>;
+export type Error = zod.input<typeof Error>;
+export type ErrorOutput = zod.output<typeof Error>;

package/dist/account/v1/generated/validators/error.zod.js

@@ -0,0 +1,54 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { ErrorStatus } from "./errorStatus.zod.js";
+export const Error = zod
+    .strictObject({
+    error: ErrorStatus,
+})
+    .describe("A failed request. The envelope follows the Google REST error format: `code` is the HTTP\nstatus, `status` is its canonical name, and `reason` is the stable machine-readable code\nthat identifies the failure.");

package/dist/account/v1/generated/validators/errorStatus.zod.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const ErrorStatus: zod.ZodObject<{
+    code: zod.ZodInt;
+    status: zod.ZodString;
+    message: zod.ZodString;
+    reason: zod.ZodOptional<zod.ZodString>;
+    metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodString>>;
+    field_violations: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+        field: zod.ZodString;
+        reason: zod.ZodOptional<zod.ZodString>;
+    }, zod.z.core.$strict>>>;
+    retry_delay: zod.ZodOptional<zod.ZodString>;
+    request_id: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+export type ErrorStatus = zod.input<typeof ErrorStatus>;
+export type ErrorStatusOutput = zod.output<typeof ErrorStatus>;

package/dist/account/v1/generated/validators/errorStatus.zod.js

@@ -0,0 +1,78 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { FieldViolation } from "./fieldViolation.zod.js";
+export const ErrorStatus = zod.strictObject({
+    code: zod.int().describe("The HTTP status code of the response."),
+    status: zod
+        .string()
+        .describe("The canonical name of the status, such as `INVALID_ARGUMENT` or `UNAVAILABLE`."),
+    message: zod
+        .string()
+        .describe("A description of the failure for developers. It is always English and is not meant\nto be shown to end users as is."),
+    reason: zod
+        .string()
+        .optional()
+        .describe("A stable machine-readable code identifying the failure. Clients branch on this value\nand render their own text; it does not change once published."),
+    metadata: zod
+        .record(zod.string(), zod.string())
+        .optional()
+        .describe("Values that belong to `reason`, one set per reason. Clients use them to fill in\nlocalized text and never parse `message` to obtain them. Keys are documented per\nreason; a key that has appeared once keeps appearing."),
+    field_violations: zod
+        .array(FieldViolation)
+        .optional()
+        .describe("Request fields rejected by the request's constraints. Present on validation\nfailures; one request may violate several fields."),
+    retry_delay: zod
+        .string()
+        .optional()
+        .describe("How long the client should wait before retrying, as a duration string such as\n`30s`. Present only when waiting can succeed."),
+    request_id: zod
+        .string()
+        .optional()
+        .describe("The identifier of the request in the service's logs. Quote it when reporting a\nfailure."),
+});