@leaflow/sdk 0.189.0 → 0.190.1

package/dist/account/v1/generated/validators/sSHKeyResource.zod.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const SSHKeyResource: zod.ZodObject<{
+    created_at: zod.z.ZodISODateTime;
+    fingerprint: zod.ZodString;
+    id: zod.ZodUUID;
+    key_type: zod.ZodString;
+    name: zod.ZodString;
+    public_key: zod.ZodString;
+    status: zod.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        REVOKED: "REVOKED";
+    }>;
+}, zod.z.core.$strict>;
+export type SSHKeyResource = zod.input<typeof SSHKeyResource>;
+export type SSHKeyResourceOutput = zod.output<typeof SSHKeyResource>;

package/dist/account/v1/generated/validators/sSHKeyResource.zod.js

@@ -0,0 +1,41 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Account API
+ * Everything that comes before a project is chosen: registration, the account itself, the projects the caller belongs to, and entry into one of them.
+ *
+ * ## Authentication
+ *
+ * Every request carries `Authorization: Bearer <access token>`, obtained by signing in at auth.leaflow.net. The endpoints that need no token say so.
+ *
+ * ## Entering a project
+ *
+ * 1. `QUERY /account/v1/projects` searches the projects the caller belongs to. The first call registers the account, taking the name and email address from the sign-in claims.
+ * 2. `POST /account/v1/projects/{projectId}/scoped-tokens` returns a scoped token for the project chosen.
+ * 3. Every other service is called with that scoped token.
+ *
+ * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
+ *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
+ * ## Project slugs
+ *
+ * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.
+ *
+ * Looking up slugs and claiming custom slugs are rate limited per account. A request over the limit fails with 429, and `meta.retry_after_seconds` on the error states how many seconds to wait before retrying.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const SSHKeyResource = zod.strictObject({
+    created_at: zod.iso.datetime({ offset: true }),
+    fingerprint: zod.string().describe("The SHA-256 fingerprint, as `ssh-keygen -l` prints it"),
+    id: zod.uuid(),
+    key_type: zod.string().describe("The algorithm, such as `ssh-ed25519`"),
+    name: zod.string(),
+    public_key: zod
+        .string()
+        .describe("The key in OpenSSH format, without the comment it was added with"),
+    status: zod.enum(["ACTIVE", "REVOKED"]),
+});

package/dist/account/v1/generated/validators/scopedTokenResponseBody.zod.d.ts

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/scopedTokenResponseBody.zod.js

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/searchProjectsRequestBody.zod.d.ts

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/searchProjectsRequestBody.zod.js

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/settingsResource.zod.d.ts

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/settingsResource.zod.js

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/submitIdentityVerificationRequestBody.zod.d.ts

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/submitIdentityVerificationRequestBody.zod.js

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/updateAccountRequestBody.zod.d.ts

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/account/v1/generated/validators/updateAccountRequestBody.zod.js

@@ -16,6 +16,10 @@
  *
  * A scoped token cannot be renewed. Repeat step 2 for a new one, and sign in again at auth.leaflow.net once the access token itself has expired.
  *
+ * ## SSH keys
+ *
+ * The SSH keys of an account belong to its holder rather than to any project, and a key is active on one account at most. Keys shared by a project, such as one used by CI, belong to the project instead and are managed through the IAM API.
+ *
  * ## Project slugs
  *
  * Every project carries a `slug`, the label naming it in its address. Until a custom slug is chosen the slug is the project's `id`, and the address under the `id` keeps working after a custom slug is chosen. `GET /account/v1/projects/by-slug/{slug}` finds the project named by either label.

package/dist/fleet/v1/generated/functions.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/models.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/schemas.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/schemas.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/accountList.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/accountList.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/accountResource.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/accountResource.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/approveEnrollmentRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/approveEnrollmentRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/callMcpToolRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/callMcpToolRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/callMcpToolResponse.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/callMcpToolResponse.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createGroupMemberRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createGroupMemberRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createGroupRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createGroupRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createMachineRegistrationRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createMachineRegistrationRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createMachineRegistrationResponse.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createMachineRegistrationResponse.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createParticipantRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createParticipantRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createParticipantResponse.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createParticipantResponse.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createPeerConnectionCandidatesRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createPeerConnectionCandidatesRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createPeerConnectionRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createPeerConnectionRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createSessionRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/createSessionRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps