@atlanai/sdk 0.1.0

package/dist/raw/registry/apis/ReposApi.js

@@ -0,0 +1,359 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReposApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const ArchiveAck_1 = require("../models/ArchiveAck");
+const CreateRepoBody_1 = require("../models/CreateRepoBody");
+const PatchRepoBody_1 = require("../models/PatchRepoBody");
+const RepoBulkCreateRequest_1 = require("../models/RepoBulkCreateRequest");
+const RepoDto_1 = require("../models/RepoDto");
+const ReposBulkResponse_1 = require("../models/ReposBulkResponse");
+const ReposPage_1 = require("../models/ReposPage");
+/**
+ *
+ */
+class ReposApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryArchiveRepo without sending the request
+     */
+    async registryArchiveRepoRequestOpts(requestParameters) {
+        if (requestParameters['repoId'] == null) {
+            throw new runtime.RequiredError('repoId', 'Required parameter "repoId" was null or undefined when calling registryArchiveRepo().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos/{repo_id}/archive`;
+        urlPath = urlPath.replace('{repo_id}', encodeURIComponent(String(requestParameters['repoId'])));
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Archive the repo: it stays readable and is excluded from a client\'s own default discovery by convention rather than by predicate — every read here still returns it, so a caller who wants archived rows gone filters `repo_status`.  Archiving keeps the repo readable **and keeps its remote taken**: re-registering the same `source_uri` while an archive holds it is a `409`. That is deliberate — only a `DELETE` releases the remote — and it works because the archived row is readable, so the conflict names something the caller can inspect.  **Idempotent**: archiving an archived repo is `200` with `changed: false`, because that is what a retrying client does and \"it is archived\" is the honest answer to both calls.  Authorized by `delete` on the repo\'s workspace — an archive is a removal from a client\'s point of view, so it takes the removal receipt and runs the same guard a `DELETE` does.
+     * Archive a repo
+     */
+    async registryArchiveRepoRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryArchiveRepoRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ArchiveAck_1.ArchiveAckFromJSON)(jsonValue));
+    }
+    /**
+     * Archive the repo: it stays readable and is excluded from a client\'s own default discovery by convention rather than by predicate — every read here still returns it, so a caller who wants archived rows gone filters `repo_status`.  Archiving keeps the repo readable **and keeps its remote taken**: re-registering the same `source_uri` while an archive holds it is a `409`. That is deliberate — only a `DELETE` releases the remote — and it works because the archived row is readable, so the conflict names something the caller can inspect.  **Idempotent**: archiving an archived repo is `200` with `changed: false`, because that is what a retrying client does and \"it is archived\" is the honest answer to both calls.  Authorized by `delete` on the repo\'s workspace — an archive is a removal from a client\'s point of view, so it takes the removal receipt and runs the same guard a `DELETE` does.
+     * Archive a repo
+     */
+    async registryArchiveRepo(requestParameters, initOverrides) {
+        const response = await this.registryArchiveRepoRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryBulkCreateRepos without sending the request
+     */
+    async registryBulkCreateReposRequestOpts(requestParameters) {
+        if (requestParameters['repoBulkCreateRequest'] == null) {
+            throw new runtime.RequiredError('repoBulkCreateRequest', 'Required parameter "repoBulkCreateRequest" was null or undefined when calling registryBulkCreateRepos().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos/bulk`;
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, RepoBulkCreateRequest_1.RepoBulkCreateRequestToJSON)(requestParameters['repoBulkCreateRequest']),
+        };
+    }
+    /**
+     * Register up to 100 remotes in one request. Per-item semantics are exactly `POST /repos`, and each item names its own `workspace_id` — so one batch can span workspaces and the receipt is checked per parent.  **Partial success**: the response is always `207 Multi-Status` with one slot per index, even when every item succeeded, because a client that branches on the envelope status before reading the slots will get that branch wrong the first time one item fails. An item\'s failure carries the same problem body a single-item request would have returned, including `403` for a workspace the caller cannot write.
+     * Bulk create repos
+     */
+    async registryBulkCreateReposRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryBulkCreateReposRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ReposBulkResponse_1.ReposBulkResponseFromJSON)(jsonValue));
+    }
+    /**
+     * Register up to 100 remotes in one request. Per-item semantics are exactly `POST /repos`, and each item names its own `workspace_id` — so one batch can span workspaces and the receipt is checked per parent.  **Partial success**: the response is always `207 Multi-Status` with one slot per index, even when every item succeeded, because a client that branches on the envelope status before reading the slots will get that branch wrong the first time one item fails. An item\'s failure carries the same problem body a single-item request would have returned, including `403` for a workspace the caller cannot write.
+     * Bulk create repos
+     */
+    async registryBulkCreateRepos(requestParameters, initOverrides) {
+        const response = await this.registryBulkCreateReposRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryCreateRepo without sending the request
+     */
+    async registryCreateRepoRequestOpts(requestParameters) {
+        if (requestParameters['createRepoBody'] == null) {
+            throw new runtime.RequiredError('createRepoBody', 'Required parameter "createRepoBody" was null or undefined when calling registryCreateRepo().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos`;
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, CreateRepoBody_1.CreateRepoBodyToJSON)(requestParameters['createRepoBody']),
+        };
+    }
+    /**
+     * Register a remote in a workspace the caller can create in. `source_uri` is **normalised** before storage — scheme forced to `https`, host lowercased, credentials, `.git` and trailing slashes stripped — so the value echoed back may differ from the one sent, and two spellings of one remote are one row. A `project_id`, if given, must live in the same workspace. Registering an existing readable remote returns that repo unchanged with `200`; an existing repo the caller cannot read returns `409 repo_exists` without exposing its fields.
+     * Create a repo
+     */
+    async registryCreateRepoRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryCreateRepoRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, RepoDto_1.RepoDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Register a remote in a workspace the caller can create in. `source_uri` is **normalised** before storage — scheme forced to `https`, host lowercased, credentials, `.git` and trailing slashes stripped — so the value echoed back may differ from the one sent, and two spellings of one remote are one row. A `project_id`, if given, must live in the same workspace. Registering an existing readable remote returns that repo unchanged with `200`; an existing repo the caller cannot read returns `409 repo_exists` without exposing its fields.
+     * Create a repo
+     */
+    async registryCreateRepo(requestParameters, initOverrides) {
+        const response = await this.registryCreateRepoRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryDeleteRepo without sending the request
+     */
+    async registryDeleteRepoRequestOpts(requestParameters) {
+        if (requestParameters['repoId'] == null) {
+            throw new runtime.RequiredError('repoId', 'Required parameter "repoId" was null or undefined when calling registryDeleteRepo().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos/{repo_id}`;
+        urlPath = urlPath.replace('{repo_id}', encodeURIComponent(String(requestParameters['repoId'])));
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Tombstone the repo. The `source_uri` is **released** in the same statement — a deleted repo that kept it would hold the unique slot forever behind a read filter that hides it, so re-registering the same remote would collide with a row nothing can return.
+     * Delete a repo
+     */
+    async registryDeleteRepoRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryDeleteRepoRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Tombstone the repo. The `source_uri` is **released** in the same statement — a deleted repo that kept it would hold the unique slot forever behind a read filter that hides it, so re-registering the same remote would collide with a row nothing can return.
+     * Delete a repo
+     */
+    async registryDeleteRepo(requestParameters, initOverrides) {
+        await this.registryDeleteRepoRaw(requestParameters, initOverrides);
+    }
+    /**
+     * Creates request options for registryGetRepo without sending the request
+     */
+    async registryGetRepoRequestOpts(requestParameters) {
+        if (requestParameters['repoId'] == null) {
+            throw new runtime.RequiredError('repoId', 'Required parameter "repoId" was null or undefined when calling registryGetRepo().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos/{repo_id}`;
+        urlPath = urlPath.replace('{repo_id}', encodeURIComponent(String(requestParameters['repoId'])));
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Use this operation to get a repo.
+     * Get a repo
+     */
+    async registryGetRepoRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryGetRepoRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, RepoDto_1.RepoDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Use this operation to get a repo.
+     * Get a repo
+     */
+    async registryGetRepo(requestParameters, initOverrides) {
+        const response = await this.registryGetRepoRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryListRepos without sending the request
+     */
+    async registryListReposRequestOpts() {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos`;
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Return a page of the non-deleted repos the caller can discover. Supports the shared query grammar: `filter[field][op]=`, `sort=`, `q=`, `limit`/`offset`, and `count=false` to skip the total.  **`source_metadata` is not served here.** This list pages at `discover`, which on this surface means any member of the account, and the provenance bag is caller-supplied and free-form — the repo-onboard flow writes `contributors[].email` into it, the same addresses `GET /detected-users` serves at `read`. Read one repo by id for the bag.  Fields: `name`, `display_name`, `description`, `source_type`, `repo_status`, `project_id`, `created_at`, `updated_at`.
+     * List repos
+     */
+    async registryListReposRaw(initOverrides) {
+        const requestOptions = await this.registryListReposRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ReposPage_1.ReposPageFromJSON)(jsonValue));
+    }
+    /**
+     * Return a page of the non-deleted repos the caller can discover. Supports the shared query grammar: `filter[field][op]=`, `sort=`, `q=`, `limit`/`offset`, and `count=false` to skip the total.  **`source_metadata` is not served here.** This list pages at `discover`, which on this surface means any member of the account, and the provenance bag is caller-supplied and free-form — the repo-onboard flow writes `contributors[].email` into it, the same addresses `GET /detected-users` serves at `read`. Read one repo by id for the bag.  Fields: `name`, `display_name`, `description`, `source_type`, `repo_status`, `project_id`, `created_at`, `updated_at`.
+     * List repos
+     */
+    async registryListRepos(initOverrides) {
+        const response = await this.registryListReposRaw(initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryUpdateRepo without sending the request
+     */
+    async registryUpdateRepoRequestOpts(requestParameters) {
+        if (requestParameters['repoId'] == null) {
+            throw new runtime.RequiredError('repoId', 'Required parameter "repoId" was null or undefined when calling registryUpdateRepo().');
+        }
+        if (requestParameters['patchRepoBody'] == null) {
+            throw new runtime.RequiredError('patchRepoBody', 'Required parameter "patchRepoBody" was null or undefined when calling registryUpdateRepo().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/repos/{repo_id}`;
+        urlPath = urlPath.replace('{repo_id}', encodeURIComponent(String(requestParameters['repoId'])));
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, PatchRepoBody_1.PatchRepoBodyToJSON)(requestParameters['patchRepoBody']),
+        };
+    }
+    /**
+     * Patch the label or the description. `name` is immutable — it is the machine handle — and `source_uri` is fixed at create, because it is the row\'s identity and the unique key.
+     * Update a repo
+     */
+    async registryUpdateRepoRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryUpdateRepoRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, RepoDto_1.RepoDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Patch the label or the description. `name` is immutable — it is the machine handle — and `source_uri` is fixed at create, because it is the row\'s identity and the unique key.
+     * Update a repo
+     */
+    async registryUpdateRepo(requestParameters, initOverrides) {
+        const response = await this.registryUpdateRepoRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}
+exports.ReposApi = ReposApi;

package/dist/raw/registry/apis/ServiceAccountsApi.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import { type CreateServiceAccountBody } from '../models/CreateServiceAccountBody';
+import { type RotatedCredentialDto } from '../models/RotatedCredentialDto';
+import { type ServiceAccountDto } from '../models/ServiceAccountDto';
+import { type ServiceAccountsPage } from '../models/ServiceAccountsPage';
+export interface RegistryCreateServiceAccountRequest {
+    createServiceAccountBody: CreateServiceAccountBody;
+}
+export interface RegistryGetServiceAccountRequest {
+    principalId: string;
+}
+export interface RegistryRevokeServiceAccountRequest {
+    principalId: string;
+}
+export interface RegistryRevokeServiceAccountCredentialRequest {
+    principalId: string;
+}
+export interface RegistryRotateServiceAccountCredentialRequest {
+    principalId: string;
+}
+/**
+ *
+ */
+export declare class ServiceAccountsApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryCreateServiceAccount without sending the request
+     */
+    registryCreateServiceAccountRequestOpts(requestParameters: RegistryCreateServiceAccountRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Create a machine identity
+     */
+    registryCreateServiceAccountRaw(requestParameters: RegistryCreateServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ServiceAccountDto>>;
+    /**
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Create a machine identity
+     */
+    registryCreateServiceAccount(requestParameters: RegistryCreateServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ServiceAccountDto>;
+    /**
+     * Creates request options for registryGetServiceAccount without sending the request
+     */
+    registryGetServiceAccountRequestOpts(requestParameters: RegistryGetServiceAccountRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to get a machine identity.
+     * Get a machine identity
+     */
+    registryGetServiceAccountRaw(requestParameters: RegistryGetServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ServiceAccountDto>>;
+    /**
+     * Use this operation to get a machine identity.
+     * Get a machine identity
+     */
+    registryGetServiceAccount(requestParameters: RegistryGetServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ServiceAccountDto>;
+    /**
+     * Creates request options for registryListServiceAccounts without sending the request
+     */
+    registryListServiceAccountsRequestOpts(): Promise<runtime.RequestOpts>;
+    /**
+     * Agents, service accounts and action identities. A `revoked` row stays: the audit trail names these principals, so erasing one would leave its events pointing at nothing.  Narrowed through the shared query grammar rather than bespoke parameters: `filter[principal_type][eq]`, `filter[principal_status][eq]`, `filter[credential_kind][eq]`, `filter[client_id][eq]`, `filter[principal_id][eq]`, `filter[display_name][contains]`, and `q=` for a case-insensitive substring over `display_name`. `sort`, `limit`/`offset` and `count=false` behave as they do on every other collection. **Credential material is never returned** — `secret_ref` is neither readable nor filterable, because a grammar that can probe for a secret handle turns a directory read into an oracle.  Fields: `principal_id`, `principal_type`, `principal_status`, `credential_kind`, `client_id`, `created_at`, `expires_at`.
+     * List machine identities
+     */
+    registryListServiceAccountsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ServiceAccountsPage>>;
+    /**
+     * Agents, service accounts and action identities. A `revoked` row stays: the audit trail names these principals, so erasing one would leave its events pointing at nothing.  Narrowed through the shared query grammar rather than bespoke parameters: `filter[principal_type][eq]`, `filter[principal_status][eq]`, `filter[credential_kind][eq]`, `filter[client_id][eq]`, `filter[principal_id][eq]`, `filter[display_name][contains]`, and `q=` for a case-insensitive substring over `display_name`. `sort`, `limit`/`offset` and `count=false` behave as they do on every other collection. **Credential material is never returned** — `secret_ref` is neither readable nor filterable, because a grammar that can probe for a secret handle turns a directory read into an oracle.  Fields: `principal_id`, `principal_type`, `principal_status`, `credential_kind`, `client_id`, `created_at`, `expires_at`.
+     * List machine identities
+     */
+    registryListServiceAccounts(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ServiceAccountsPage>;
+    /**
+     * Creates request options for registryRevokeServiceAccount without sending the request
+     */
+    registryRevokeServiceAccountRequestOpts(requestParameters: RegistryRevokeServiceAccountRequest): Promise<runtime.RequestOpts>;
+    /**
+     * **Revokes, and the row stays readable.** `status` becomes `revoked` and `revoked_at` is stamped in the same statement — the row is not removed and not hidden, because every audit event this principal ever produced names it as the actor. A revoked identity that vanished from reads would make its own history unreadable.  Returns the retired row rather than 204, so a client can see the revocation time it just caused. Revoking twice is idempotent.
+     * Revoke a machine identity
+     */
+    registryRevokeServiceAccountRaw(requestParameters: RegistryRevokeServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ServiceAccountDto>>;
+    /**
+     * **Revokes, and the row stays readable.** `status` becomes `revoked` and `revoked_at` is stamped in the same statement — the row is not removed and not hidden, because every audit event this principal ever produced names it as the actor. A revoked identity that vanished from reads would make its own history unreadable.  Returns the retired row rather than 204, so a client can see the revocation time it just caused. Revoking twice is idempotent.
+     * Revoke a machine identity
+     */
+    registryRevokeServiceAccount(requestParameters: RegistryRevokeServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ServiceAccountDto>;
+    /**
+     * Creates request options for registryRevokeServiceAccountCredential without sending the request
+     */
+    registryRevokeServiceAccountCredentialRequestOpts(requestParameters: RegistryRevokeServiceAccountCredentialRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Revokes the credential at the identity provider **and** retires the row, in that order. Distinct from `DELETE /service-accounts/{principal_id}`, which only retires the row: that leaves a live credential at the provider that this registry no longer knows about, which is the worse half of a revocation to skip.  The provider first, deliberately. If it refuses, the row stays active and the caller sees why — a retired row beside a working credential is the state nobody can discover.  Idempotent: revoking twice succeeds, since both halves are.
+     * Revoke this identity\'s credential at the provider
+     */
+    registryRevokeServiceAccountCredentialRaw(requestParameters: RegistryRevokeServiceAccountCredentialRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ServiceAccountDto>>;
+    /**
+     * Revokes the credential at the identity provider **and** retires the row, in that order. Distinct from `DELETE /service-accounts/{principal_id}`, which only retires the row: that leaves a live credential at the provider that this registry no longer knows about, which is the worse half of a revocation to skip.  The provider first, deliberately. If it refuses, the row stays active and the caller sees why — a retired row beside a working credential is the state nobody can discover.  Idempotent: revoking twice succeeds, since both halves are.
+     * Revoke this identity\'s credential at the provider
+     */
+    registryRevokeServiceAccountCredential(requestParameters: RegistryRevokeServiceAccountCredentialRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ServiceAccountDto>;
+    /**
+     * Creates request options for registryRotateServiceAccountCredential without sending the request
+     */
+    registryRotateServiceAccountCredentialRequestOpts(requestParameters: RegistryRotateServiceAccountCredentialRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotate this identity\'s credential
+     */
+    registryRotateServiceAccountCredentialRaw(requestParameters: RegistryRotateServiceAccountCredentialRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<RotatedCredentialDto>>;
+    /**
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotate this identity\'s credential
+     */
+    registryRotateServiceAccountCredential(requestParameters: RegistryRotateServiceAccountCredentialRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<RotatedCredentialDto>;
+}