@leaflow/sdk 0.0.0-dev.53.gd8db059 → 0.0.0-dev.538.g0285c19

package/dist/account/v1/generated/validators/projectTraitResource.zod.js

@@ -0,0 +1,54 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const ProjectTraitResource = zod.strictObject({
+    key: zod.string(),
+    value: zod.string(),
+    effect: zod.enum(["NoWrite", "NoAccess"]),
+    reason: zod.string(),
+});

package/dist/account/v1/generated/validators/registerRequestBody.zod.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const registerRequestBodyCountryMin = 2;
+export declare const registerRequestBodyCountryMax = 2;
+export declare const RegisterRequestBody: zod.ZodObject<{
+    consents: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        type: zod.ZodEnum<{
+            TERMS: "TERMS";
+            PRIVACY: "PRIVACY";
+            DPA: "DPA";
+        }>;
+        version: zod.ZodString;
+    }, zod.z.core.$strict>>>;
+    country: zod.ZodString;
+    locale: zod.ZodEnum<{
+        "zh-Hans": "zh-Hans";
+        "zh-Hant-HK": "zh-Hant-HK";
+        en: "en";
+    }>;
+}, zod.z.core.$strict>;
+export type RegisterRequestBody = zod.input<typeof RegisterRequestBody>;
+export type RegisterRequestBodyOutput = zod.output<typeof RegisterRequestBody>;

package/dist/account/v1/generated/validators/registerRequestBody.zod.js

@@ -0,0 +1,64 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { ConsentBody } from "./consentBody.zod.js";
+import { Locale } from "./locale.zod.js";
+export const registerRequestBodyCountryMin = 2;
+export const registerRequestBodyCountryMax = 2;
+export const RegisterRequestBody = zod.strictObject({
+    consents: zod
+        .array(ConsentBody)
+        .nullable()
+        .describe("Must cover every agreement currently in force, at the versions returned by GET /account/v1/agreements"),
+    country: zod
+        .string()
+        .min(registerRequestBodyCountryMin)
+        .max(registerRequestBodyCountryMax)
+        .describe("ISO 3166-1 alpha-2 (CN, HK, US). Must denote a country or territory that exists; codes such as EU and ZZ hold a place in the standard without denoting one and are refused"),
+    locale: Locale,
+});

package/dist/account/v1/generated/validators/renameSSHKeyRequestBody.zod.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const renameSSHKeyRequestBodyNameMax = 128;
+export declare const RenameSSHKeyRequestBody: zod.ZodObject<{
+    name: zod.ZodString;
+}, zod.z.core.$strict>;
+export type RenameSSHKeyRequestBody = zod.input<typeof RenameSSHKeyRequestBody>;
+export type RenameSSHKeyRequestBodyOutput = zod.output<typeof RenameSSHKeyRequestBody>;

package/dist/account/v1/generated/validators/renameSSHKeyRequestBody.zod.js

@@ -0,0 +1,52 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const renameSSHKeyRequestBodyNameMax = 128;
+export const RenameSSHKeyRequestBody = zod.strictObject({
+    name: zod.string().min(1).max(renameSSHKeyRequestBodyNameMax),
+});

package/dist/account/v1/generated/validators/requestAccountDeletionParams.zod.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const RequestAccountDeletionParams: zod.ZodObject<{
+    acknowledge_forfeiture: zod.ZodLiteral<true>;
+}, zod.z.core.$strict>;
+export type RequestAccountDeletionParams = zod.input<typeof RequestAccountDeletionParams>;
+export type RequestAccountDeletionParamsOutput = zod.output<typeof RequestAccountDeletionParams>;

package/dist/account/v1/generated/validators/requestAccountDeletionParams.zod.js

@@ -0,0 +1,51 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const RequestAccountDeletionParams = zod.strictObject({
+    acknowledge_forfeiture: zod.literal(true),
+});

package/dist/account/v1/generated/validators/resourceRefResource.zod.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const ResourceRefResource: zod.ZodObject<{
+    id: zod.ZodString;
+    type: zod.ZodString;
+}, zod.z.core.$strict>;
+export type ResourceRefResource = zod.input<typeof ResourceRefResource>;
+export type ResourceRefResourceOutput = zod.output<typeof ResourceRefResource>;

package/dist/account/v1/generated/validators/resourceRefResource.zod.js

@@ -0,0 +1,56 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const ResourceRefResource = zod.strictObject({
+    id: zod
+        .string()
+        .describe("A string rather than a UUID; a DNS zone, for one, is named by its domain. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly"),
+    type: zod
+        .string()
+        .describe("Of the form compute:instance or dns:zone, in the same namespace as permission names"),
+});

package/dist/account/v1/generated/validators/ruleResource.zod.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## Applications
+ *
+ * An application registered by a project signs its users in at auth.leaflow.net in the same manner as any other OAuth client. To call the Leaflow API on behalf of a user, the application requests the `iam` scope, and the user must then authorize the application for each project in which it is to act:
+ *
+ * 1. The application directs the user to the authorization page of the console:
+ *
+ *    ```
+ *    https://console.leaflow.net/applications/authorize?client_id=<client_id>&redirect_uri=<redirect_uri>&state=<state>
+ *    ```
+ *
+ *    All three parameters are required. The `redirect_uri` is URL-encoded and must exactly match one of the redirect URIs registered for the application; a custom scheme registered for a public application is accepted in the same way. If a parameter is missing, if the `redirect_uri` does not match, or if the application does not exist or is not active, the page reports the problem to the user and does not redirect. A user who is not signed in, or who has not yet completed registration and accepted the agreements, does so first and then returns to the page.
+ * 2. The user selects a project and confirms the authorization. The console calls `POST /account/v1/me/authorized-applications` and returns the user to the `redirect_uri` with the query parameters `project_id` and `state`. If the user declines, the console returns the user to the `redirect_uri` with `error=access_denied` and `state`. In both cases the existing query parameters of the `redirect_uri` are retained, and a parameter of the same name is replaced. The application must verify that `state` equals the value it supplied before it uses the response.
+ * 3. The application exchanges its access token for a scoped token at `POST /account/v1/projects/{projectId}/scoped-tokens`, as described in the preceding section.
+ *
+ * Within an authorized project, the application holds exactly the permissions of the user in that project and none beyond them. The user may revoke an authorization at any time at https://console.leaflow.net/account/applications, and an authorization ends when the user leaves the project.
+ *
+ * An access token issued to an application is accepted only by `create-scoped-token`, `list-authorized-applications` and `revoke-authorized-application`. Every other endpoint rejects it with 403 `APPLICATION_TOKEN_NOT_ACCEPTED`; consequently, an application cannot authorize itself.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const RuleResource: zod.ZodObject<{
+    effect: zod.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+    permissions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
+    resources: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        id: zod.ZodString;
+        type: zod.ZodString;
+    }, zod.z.core.$strict>>>;
+}, zod.z.core.$strict>;
+export type RuleResource = zod.input<typeof RuleResource>;
+export type RuleResourceOutput = zod.output<typeof RuleResource>;