@leaflow/sdk 0.107.0 → 0.109.0

package/dist/account/v1/generated/models.d.ts

@@ -0,0 +1,460 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `GET /account/v1/projects` lists the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ * OpenAPI spec version: 1.0.0
+ */
+/**
+ * What a given `code` carries alongside the message. The keys depend on the code,
+ * and a client that does not recognise one ignores it.
+ */
+export type ErrorMeta = {
+    [key: string]: unknown;
+};
+export interface Error {
+    code?: string;
+    message: string;
+    /**
+     * What a given `code` carries alongside the message. The keys depend on the code,
+     * and a client that does not recognise one ignores it.
+     */
+    meta?: ErrorMeta;
+    status: number;
+}
+/**
+ * VERIFIED_ONLY requires identity verification to have completed; a submission under review does not qualify
+ */
+export type SettingsResourceProjectCreationMode = (typeof SettingsResourceProjectCreationMode)[keyof typeof SettingsResourceProjectCreationMode];
+export declare const SettingsResourceProjectCreationMode: {
+    readonly OPEN: "OPEN";
+    readonly VERIFIED_ONLY: "VERIFIED_ONLY";
+    readonly CLOSED: "CLOSED";
+};
+/**
+ * INVITE_ONLY accepts only an email address holding a project invitation
+ */
+export type SettingsResourceRegistrationMode = (typeof SettingsResourceRegistrationMode)[keyof typeof SettingsResourceRegistrationMode];
+export declare const SettingsResourceRegistrationMode: {
+    readonly OPEN: "OPEN";
+    readonly INVITE_ONLY: "INVITE_ONLY";
+    readonly CLOSED: "CLOSED";
+};
+export interface SettingsResource {
+    /** Maximum number of members a project may hold; 0 means unlimited */
+    max_members_per_project: number;
+    /** Maximum number of projects an account may own; 0 means unlimited. Deleted projects do not count */
+    max_projects_per_user: number;
+    /** VERIFIED_ONLY requires identity verification to have completed; a submission under review does not qualify */
+    project_creation_mode: SettingsResourceProjectCreationMode;
+    /** INVITE_ONLY accepts only an email address holding a project invitation */
+    registration_mode: SettingsResourceRegistrationMode;
+}
+export type AgreementResourceType = (typeof AgreementResourceType)[keyof typeof AgreementResourceType];
+export declare const AgreementResourceType: {
+    readonly TERMS: "TERMS";
+    readonly PRIVACY: "PRIVACY";
+    readonly DPA: "DPA";
+};
+export interface AgreementResource {
+    /** From this moment on, registration requires this version */
+    effective_at: string;
+    type: AgreementResourceType;
+    /** Where the text is published */
+    url: string;
+    /** Send this value back unchanged when consenting */
+    version: string;
+}
+export interface AgreementListResponseBody {
+    /** @nullable */
+    items: AgreementResource[] | null;
+}
+/**
+ * OFFLINE is a consent given off the platform and recorded by an operator
+ */
+export type ConsentResourceMethod = (typeof ConsentResourceMethod)[keyof typeof ConsentResourceMethod];
+export declare const ConsentResourceMethod: {
+    readonly CLICKWRAP: "CLICKWRAP";
+    readonly OFFLINE: "OFFLINE";
+};
+export type ConsentResourceType = (typeof ConsentResourceType)[keyof typeof ConsentResourceType];
+export declare const ConsentResourceType: {
+    readonly TERMS: "TERMS";
+    readonly PRIVACY: "PRIVACY";
+    readonly DPA: "DPA";
+};
+export interface ConsentResource {
+    consented_at: string;
+    /** OFFLINE is a consent given off the platform and recorded by an operator */
+    method: ConsentResourceMethod;
+    type: ConsentResourceType;
+    version: string;
+}
+export interface ConsentListResponseBody {
+    /** @nullable */
+    items: ConsentResource[] | null;
+}
+export type ConsentBodyType = (typeof ConsentBodyType)[keyof typeof ConsentBodyType];
+export declare const ConsentBodyType: {
+    readonly TERMS: "TERMS";
+    readonly PRIVACY: "PRIVACY";
+    readonly DPA: "DPA";
+};
+export interface ConsentBody {
+    type: ConsentBodyType;
+    /**
+     * @minLength 1
+     * @maxLength 32
+     */
+    version: string;
+}
+export interface AcceptConsentsRequestBody {
+    /** @nullable */
+    consents: ConsentBody[] | null;
+}
+export type AccountResourceStatus = (typeof AccountResourceStatus)[keyof typeof AccountResourceStatus];
+export declare const AccountResourceStatus: {
+    readonly ACTIVE: "ACTIVE";
+    readonly SUSPENDED: "SUSPENDED";
+    readonly BANNED: "BANNED";
+    readonly DELETING: "DELETING";
+};
+export interface AccountResource {
+    created_at: string;
+    email: string;
+    /** @nullable */
+    email_verified_at: string | null;
+    /** Taken from the sign-in claims; may be empty */
+    first_name: string;
+    /** The subject issued by the identity provider */
+    id: string;
+    /** Taken from the sign-in claims; may be empty */
+    last_name: string;
+    /** ISO 3166-1 alpha-2. Empty on an account that registered before this was required; such an account continues to work and can set it from the settings page */
+    country?: string;
+    /** Empty while never set, in which case `Accept-Language` applies, and the platform default when that is absent as well */
+    locale?: string;
+    /** @nullable */
+    pending_agreements: AgreementResource[] | null;
+    status: AccountResourceStatus;
+}
+/**
+ * The language used for the interface and for email. It is independent of `country`, and neither can be inferred from the other
+ */
+export type Locale = (typeof Locale)[keyof typeof Locale];
+export declare const Locale: {
+    readonly "zh-Hans": "zh-Hans";
+    readonly "zh-Hant-HK": "zh-Hant-HK";
+    readonly en: "en";
+};
+export interface RegisterRequestBody {
+    /**
+     * Must cover every agreement currently in force, at the versions returned by GET /account/v1/agreements
+     * @nullable
+     */
+    consents: ConsentBody[] | null;
+    /**
+     * ISO 3166-1 alpha-2 (CN, HK, US). Must denote a country or territory that exists; codes such as EU and ZZ hold a place in the standard without denoting one and are refused
+     * @minLength 2
+     * @maxLength 2
+     */
+    country: string;
+    locale: Locale;
+}
+export interface CountryOption {
+    /** ISO 3166-1 alpha-2, sent back unchanged at registration */
+    code: string;
+    /** The name rendered according to `Accept-Language` */
+    name: string;
+}
+export interface LanguageOption {
+    code: Locale;
+    /** The endonym of the language, written in that language itself. It does not follow `Accept-Language` */
+    name: string;
+}
+export interface LocaleOptionsResource {
+    countries: CountryOption[];
+    languages: LanguageOption[];
+}
+/**
+ * Both fields are optional, and an omitted field is left unchanged
+ */
+export interface UpdateAccountRequestBody {
+    /**
+     * As at registration
+     * @minLength 2
+     * @maxLength 2
+     */
+    country?: string;
+    locale?: Locale;
+}
+/**
+ * PERSONAL and ENTERPRISE are two kinds of subject rather than two levels, and are not ordered
+ */
+export type IdentityVerificationResourceStatus = (typeof IdentityVerificationResourceStatus)[keyof typeof IdentityVerificationResourceStatus];
+export declare const IdentityVerificationResourceStatus: {
+    readonly UNVERIFIED: "UNVERIFIED";
+    readonly PENDING: "PENDING";
+    readonly PERSONAL: "PERSONAL";
+    readonly ENTERPRISE: "ENTERPRISE";
+    readonly REJECTED: "REJECTED";
+};
+export interface IdentityVerificationResource {
+    reject_reason: string;
+    /** PERSONAL and ENTERPRISE are two kinds of subject rather than two levels, and are not ordered */
+    status: IdentityVerificationResourceStatus;
+    /** @nullable */
+    submitted_at: string | null;
+    /** @nullable */
+    verified_at: string | null;
+}
+export interface SubmitIdentityVerificationRequestBody {
+    /**
+     * The document number. It is returned by no endpoint, and one number cannot be attached to two accounts
+     * @minLength 6
+     * @maxLength 64
+     */
+    id_number: string;
+    /**
+     * The legal name. It is returned by no endpoint
+     * @minLength 1
+     * @maxLength 128
+     */
+    real_name: string;
+}
+/**
+ * What an invitation states before it is accepted. It carries neither the invitation id nor the full recipient address; the invitations listed against the current account are returned by `list-my-invitations`
+ */
+export interface InvitationPreviewResource {
+    /** The masked recipient address, enough for the recipient to recognise it */
+    email_masked: string;
+    expires_at: string;
+    /** The display name of the sender, or their email address when no name is set */
+    invited_by_name: string;
+    project_name: string;
+    /**
+     * The display names of the roles granted on acceptance
+     * @nullable
+     */
+    role_names: string[] | null;
+}
+export interface InvitationResource {
+    created_at: string;
+    email: string;
+    expires_at: string;
+    id: string;
+    /** The id of the account that issued the invitation */
+    invited_by: string;
+    /** The display name of that account, or its email address when no name is set. It reflects the value at the time of reading rather than at the time the invitation was sent */
+    invited_by_name: string;
+    project_id: string;
+    /** The name of the target project */
+    project_name: string;
+    /**
+     * The role codes granted on acceptance
+     * @nullable
+     */
+    roles: string[] | null;
+    /**
+     * The display names of those codes, in the same order
+     * @nullable
+     */
+    role_names: string[] | null;
+}
+export interface LengthAwarePageInvitationResource {
+    /** The items in this page */
+    items: InvitationResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface AcceptInvitationByTokenRequestBody {
+    /**
+     * The token carried by the invitation link
+     * @minLength 1
+     * @maxLength 128
+     */
+    token: string;
+}
+export type ProjectTraitResourceEffect = (typeof ProjectTraitResourceEffect)[keyof typeof ProjectTraitResourceEffect];
+export declare const ProjectTraitResourceEffect: {
+    readonly NoWrite: "NoWrite";
+    readonly NoAccess: "NoAccess";
+};
+export interface ProjectTraitResource {
+    key: string;
+    value: string;
+    effect: ProjectTraitResourceEffect;
+    reason: string;
+}
+export interface ProjectResource {
+    traits: ProjectTraitResource[];
+    /** @nullable */
+    deletion_requested_at: string | null;
+    created_at: string;
+    created_by: string;
+    /**
+     * When the project was deleted
+     * @nullable
+     */
+    deleted_at: string | null;
+    description: string;
+    id: string;
+    name: string;
+    updated_at: string;
+}
+export interface AcceptedInvitationResponseBody {
+    project: ProjectResource;
+}
+export type RuleResourceEffect = (typeof RuleResourceEffect)[keyof typeof RuleResourceEffect];
+export declare const RuleResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface ResourceRefResource {
+    /** A string rather than a UUID; a DNS zone, for one, is named by its domain. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly */
+    id: string;
+    /** Of the form compute:instance or dns:zone, in the same namespace as permission names */
+    type: string;
+}
+export interface RuleResource {
+    effect: RuleResourceEffect;
+    /**
+     * A trailing wildcard is supported (compute:instance.*), and must carry the service prefix
+     * @nullable
+     */
+    permissions: string[] | null;
+    /**
+     * Empty means the rule holds across the whole project. While it is not empty the rule holds only on those resources, and therefore answers no project-level question
+     * @nullable
+     */
+    resources: ResourceRefResource[] | null;
+}
+export interface GrantResource {
+    admin: boolean;
+    owner: boolean;
+    /**
+     * The role codes held, for display only
+     * @nullable
+     */
+    roles: string[] | null;
+    /**
+     * **Do not walk these rules to reach a decision.** They are compiled from every policy that applies to the caller, and serve to render what a user may do. Each request is decided by the service handling it
+     * @nullable
+     */
+    rules: RuleResource[] | null;
+}
+export interface ProjectAccessResource {
+    grant: GrantResource;
+    project: ProjectResource;
+}
+export interface LengthAwarePageProjectAccessResource {
+    /** The items in this page */
+    items: ProjectAccessResource[];
+    /** Maximum number of items in this page, echoing the request */
+    limit: number;
+    /** Number of items skipped, echoing the request */
+    offset: number;
+    /** Total number of matches, not only this page */
+    total: number;
+}
+export interface CreateProjectRequestBody {
+    /** @maxLength 2000 */
+    description?: string;
+    /**
+     * @minLength 1
+     * @maxLength 128
+     */
+    name: string;
+}
+export interface ScopedTokenResponseBody {
+    /** When the token expires. Exchange for a new one before then rather than waiting for the first 401 */
+    expires_at: string;
+    /** Seconds remaining before expiry */
+    expires_in: number;
+    /** **A snapshot taken at the moment of the exchange. It is not carried in the token, and must not be cached.** It serves to render what a user may do; each request is decided again */
+    grant: GrantResource;
+    /** The project itself, so that no further lookup is needed after the exchange */
+    project: ProjectResource;
+    /** The scoped token, to be sent as `Authorization: Bearer` */
+    token: string;
+    /** Always `Bearer` */
+    token_type: string;
+}
+/**
+ * Pagination metadata for stable numbered pages. total_count is returned only when the operation can determine it without an unbounded scan.
+ */
+export interface OffsetPagination {
+    /** @minimum 1 */
+    page: number;
+    /** @minimum 1 */
+    page_size: number;
+    /** @minimum 0 */
+    total_count?: number;
+}
+/**
+ * Pagination metadata for keyset traversal. Pass next_cursor as cursor to read the following page; null means there is no following page.
+ */
+export interface CursorPagination {
+    /** @minimum 1 */
+    page_size: number;
+    /** @nullable */
+    next_cursor?: string | null;
+}
+export type ListMyInvitationsParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+};
+export type PreviewInvitationByTokenParams = {
+    /**
+     * The token carried by the invitation link
+     * @minLength 1
+     * @maxLength 128
+     */
+    token: string;
+};
+export type ListProjectsParams = {
+    /**
+     * Items returned in this page. Defaults to 50; at most 200.
+     * @minimum 1
+     * @maximum 200
+     */
+    limit?: number;
+    /**
+     * Items to skip. Defaults to 0; at most 10000.
+     * @minimum 0
+     * @maximum 10000
+     */
+    offset?: number;
+    /**
+     * Matches against name or description
+     * @maxLength 128
+     */
+    keyword?: string;
+    include_deleted?: boolean;
+};

package/dist/account/v1/generated/models.js

@@ -0,0 +1,55 @@
+export const SettingsResourceProjectCreationMode = {
+    OPEN: "OPEN",
+    VERIFIED_ONLY: "VERIFIED_ONLY",
+    CLOSED: "CLOSED",
+};
+export const SettingsResourceRegistrationMode = {
+    OPEN: "OPEN",
+    INVITE_ONLY: "INVITE_ONLY",
+    CLOSED: "CLOSED",
+};
+export const AgreementResourceType = {
+    TERMS: "TERMS",
+    PRIVACY: "PRIVACY",
+    DPA: "DPA",
+};
+export const ConsentResourceMethod = {
+    CLICKWRAP: "CLICKWRAP",
+    OFFLINE: "OFFLINE",
+};
+export const ConsentResourceType = {
+    TERMS: "TERMS",
+    PRIVACY: "PRIVACY",
+    DPA: "DPA",
+};
+export const ConsentBodyType = {
+    TERMS: "TERMS",
+    PRIVACY: "PRIVACY",
+    DPA: "DPA",
+};
+export const AccountResourceStatus = {
+    ACTIVE: "ACTIVE",
+    SUSPENDED: "SUSPENDED",
+    BANNED: "BANNED",
+    DELETING: "DELETING",
+};
+export const Locale = {
+    "zh-Hans": "zh-Hans",
+    "zh-Hant-HK": "zh-Hant-HK",
+    en: "en",
+};
+export const IdentityVerificationResourceStatus = {
+    UNVERIFIED: "UNVERIFIED",
+    PENDING: "PENDING",
+    PERSONAL: "PERSONAL",
+    ENTERPRISE: "ENTERPRISE",
+    REJECTED: "REJECTED",
+};
+export const ProjectTraitResourceEffect = {
+    NoWrite: "NoWrite",
+    NoAccess: "NoAccess",
+};
+export const RuleResourceEffect = {
+    allow: "allow",
+    deny: "deny",
+};

package/dist/account/v1/generated/schemas.zod.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `GET /account/v1/projects` lists the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+/**
+ * Call this once a new version is published, which is whenever `pending_agreements` on `GET /account/v1/me` is not empty.
+ *
+ * Only the version currently in force is accepted; consenting to an earlier one answers 409. Submitting the same version twice is not an error and leaves the first record in place.
+ * @summary Consent to the current agreements
+ */
+export declare const AcceptAgreementsBody: zod.ZodObject<{
+    consents: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        type: zod.ZodEnum<{
+            TERMS: "TERMS";
+            PRIVACY: "PRIVACY";
+            DPA: "DPA";
+        }>;
+        version: zod.ZodString;
+    }, zod.z.core.$strict>>>;
+}, zod.z.core.$strict>;
+/**
+ * Call this after signing in at auth.leaflow.net, carrying the access token. The name and email address are taken from the sign-in claims and are not read from the request body.
+ *
+ * `consents` must cover every agreement returned by `GET /account/v1/agreements`, at the same versions. A missing agreement answers 400 and a stale version answers 409, in which case fetch the list again. An account that already exists answers 409.
+ * @summary Register an account
+ */
+export declare const RegisterBody: zod.ZodObject<{
+    consents: zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        type: zod.ZodEnum<{
+            TERMS: "TERMS";
+            PRIVACY: "PRIVACY";
+            DPA: "DPA";
+        }>;
+        version: zod.ZodString;
+    }, zod.z.core.$strict>>>;
+    country: zod.ZodString;
+    locale: zod.ZodEnum<{
+        "zh-Hans": "zh-Hans";
+        "zh-Hant-HK": "zh-Hant-HK";
+        en: "en";
+    }>;
+}, zod.z.core.$strict>;
+/**
+ * The name and email address cannot be changed here. They come from the identity provider, and a change would be overwritten at the next sign-in.
+ * @summary Update the country and language of the current account
+ */
+export declare const UpdateAccountBody: zod.ZodObject<{
+    country: zod.ZodOptional<zod.ZodString>;
+    locale: zod.ZodOptional<zod.ZodEnum<{
+        "zh-Hans": "zh-Hans";
+        "zh-Hant-HK": "zh-Hant-HK";
+        en: "en";
+    }>>;
+}, zod.z.core.$strict>;
+/**
+ * A submission awaiting review, and an account already verified, are both refused. A rejected submission may be corrected and sent again.
+ * @summary Submit identity verification
+ */
+export declare const SubmitIdentityVerificationBody: zod.ZodObject<{
+    id_number: zod.ZodString;
+    real_name: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Matched against the email address of the current account.
+ * @summary List invitations addressed to the caller
+ */
+export declare const listMyInvitationsQueryLimitDefault = 50;
+export declare const listMyInvitationsQueryLimitMax = 200;
+export declare const listMyInvitationsQueryOffsetDefault = 0;
+export declare const listMyInvitationsQueryOffsetMin = 0;
+export declare const listMyInvitationsQueryOffsetMax = 10000;
+export declare const ListMyInvitationsQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+}, zod.z.core.$strict>;
+/**
+ * No token required: whoever follows the link in an invitation email has usually not signed in, and may hold no account at all.
+ *
+ * The recipient address is masked (`t***@example.com`).
+ *
+ * A token that does not exist, one already redeemed, one revoked and one expired all answer the same 404.
+ * @summary Preview an invitation by its token
+ */
+export declare const previewInvitationByTokenQueryTokenMax = 128;
+export declare const PreviewInvitationByTokenQueryParams: zod.ZodObject<{
+    token: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * A token that does not match, and an invitation that no longer stands, answer the same way.
+ * @summary Accept an invitation by its token
+ */
+export declare const AcceptInvitationByTokenBody: zod.ZodObject<{
+    token: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * No token is required; the invitation is addressed to the email address of the current account.
+ * @summary Accept an invitation listed against the caller
+ */
+export declare const AcceptInvitationParams: zod.ZodObject<{
+    invitationId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Deleted projects are excluded unless `status=DELETED` asks for them by name.
+ * @summary List the projects the caller belongs to
+ */
+export declare const listProjectsQueryLimitDefault = 50;
+export declare const listProjectsQueryLimitMax = 200;
+export declare const listProjectsQueryOffsetDefault = 0;
+export declare const listProjectsQueryOffsetMin = 0;
+export declare const listProjectsQueryOffsetMax = 10000;
+export declare const listProjectsQueryKeywordMax = 128;
+export declare const listProjectsQueryIncludeDeletedDefault = false;
+export declare const ListProjectsQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+    keyword: zod.ZodOptional<zod.ZodString>;
+    include_deleted: zod.ZodDefault<zod.ZodBoolean>;
+}, zod.z.core.$strict>;
+/**
+ * The caller becomes its owner. The project is created with the built-in `OWNER` and `ADMIN` roles and a `member` role carrying no permissions.
+ * @summary Create a project
+ */
+export declare const CreateProjectBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    name: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Once a project has been chosen, exchange the access token for a scoped token for that project.
+ *
+ * **Only an access token issued by auth.leaflow.net is accepted; a scoped token is not.** Once a scoped token has expired, obtain a fresh access token at auth.leaflow.net and call this endpoint again.
+ *
+ * The exchange confirms that the account is usable, that the project exists, and that the caller is a member of it. A caller who is not a member obtains no token.
+ *
+ * A scoped token states identity only — the user and the project — and **carries no permissions**. Permissions are evaluated on every request, so a change of role takes effect immediately rather than at the next expiry.
+ *
+ * A project that is suspended, banned or being deleted still issues tokens; those states restrict writes, and the project remains readable.
+ * @summary Exchange the access token for a scoped token
+ */
+export declare const CreateScopedTokenParams: zod.ZodObject<{
+    projectId: zod.ZodUUID;
+}, zod.z.core.$strict>;