@atlanai/sdk 0.1.1 → 0.2.2

package/dist/raw/registry/apis/RolesApi.js

@@ -0,0 +1,95 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const RoleListDto_1 = require("../models/RoleListDto");
+/**
+ *
+ */
+class RolesApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryListRoles without sending the request
+     */
+    async registryListRolesRequestOpts() {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/roles`;
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * The account\'s assignable roles, each as an object carrying its per-org `id` and `name` (a role is a per-org identity, not a bare label). Any account member may read; the roster is gateway-native, so there is no control-plane call.
+     * List the account\'s roles
+     */
+    async registryListRolesRaw(initOverrides) {
+        const requestOptions = await this.registryListRolesRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, RoleListDto_1.RoleListDtoFromJSON)(jsonValue));
+    }
+    /**
+     * The account\'s assignable roles, each as an object carrying its per-org `id` and `name` (a role is a per-org identity, not a bare label). Any account member may read; the roster is gateway-native, so there is no control-plane call.
+     * List the account\'s roles
+     */
+    async registryListRoles(initOverrides) {
+        const response = await this.registryListRolesRaw(initOverrides);
+        return await response.value();
+    }
+}
+exports.RolesApi = RolesApi;

package/dist/raw/registry/apis/ServiceAccountsApi.d.ts

@@ -16,6 +16,7 @@ import { type ServiceAccountDto } from '../models/ServiceAccountDto';
 import { type ServiceAccountsPage } from '../models/ServiceAccountsPage';
 export interface RegistryCreateServiceAccountRequest {
     createServiceAccountBody: CreateServiceAccountBody;
+    contentEncoding?: RegistryCreateServiceAccountContentEncodingEnum;
 }
 export interface RegistryGetServiceAccountRequest {
     principalId: string;
@@ -38,12 +39,12 @@ export declare class ServiceAccountsApi extends runtime.BaseAPI {
      */
     registryCreateServiceAccountRequestOpts(requestParameters: RegistryCreateServiceAccountRequest): Promise<runtime.RequestOpts>;
     /**
-     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  **`agent` and `service_account` only.** The platform flavours (`action`, `registry`) are refused with `400`: the deployment seats an active platform principal `member` on every workspace in the account, so registering one here would be an account-wide grant rather than an identity. Those are provisioned by the registry itself, not over HTTP.  Any member of the account may call this — a machine identity for your own automation is an ordinary member operation.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
      * Create a machine identity
      */
     registryCreateServiceAccountRaw(requestParameters: RegistryCreateServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ServiceAccountDto>>;
     /**
-     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  **`agent` and `service_account` only.** The platform flavours (`action`, `registry`) are refused with `400`: the deployment seats an active platform principal `member` on every workspace in the account, so registering one here would be an account-wide grant rather than an identity. Those are provisioned by the registry itself, not over HTTP.  Any member of the account may call this — a machine identity for your own automation is an ordinary member operation.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
      * Create a machine identity
      */
     registryCreateServiceAccount(requestParameters: RegistryCreateServiceAccountRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ServiceAccountDto>;
@@ -108,13 +109,21 @@ export declare class ServiceAccountsApi extends runtime.BaseAPI {
      */
     registryRotateServiceAccountCredentialRequestOpts(requestParameters: RegistryRotateServiceAccountCredentialRequest): Promise<runtime.RequestOpts>;
     /**
-     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Only identities *you* registered here are reachable.** A platform identity (`action`, `registry`) is refused for the same reason `POST /service-accounts` refuses to create one; an artifact\'s identity belongs to the workspace its artifact lives in and is managed on its own kind\'s route (`POST /agent/v1/agents/{agent_id}/identity/rotate`); and an identity another member registered is theirs, because holding account write says which *account* you may act in and never which *row*. All three answer `404`. There is no admin override — an identity whose registrar has left the account cannot be rotated through this API.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
      * Rotate this identity\'s credential
      */
     registryRotateServiceAccountCredentialRaw(requestParameters: RegistryRotateServiceAccountCredentialRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<RotatedCredentialDto>>;
     /**
-     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Only identities *you* registered here are reachable.** A platform identity (`action`, `registry`) is refused for the same reason `POST /service-accounts` refuses to create one; an artifact\'s identity belongs to the workspace its artifact lives in and is managed on its own kind\'s route (`POST /agent/v1/agents/{agent_id}/identity/rotate`); and an identity another member registered is theirs, because holding account write says which *account* you may act in and never which *row*. All three answer `404`. There is no admin override — an identity whose registrar has left the account cannot be rotated through this API.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
      * Rotate this identity\'s credential
      */
     registryRotateServiceAccountCredential(requestParameters: RegistryRotateServiceAccountCredentialRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<RotatedCredentialDto>;
 }
+/**
+  * @export
+  * @enum {string}
+  */
+export declare enum RegistryCreateServiceAccountContentEncodingEnum {
+    Base64 = "base64",
+    GzipBase64 = "gzip, base64"
+}

package/dist/raw/registry/apis/ServiceAccountsApi.js

@@ -46,7 +46,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAccountsApi = void 0;
+exports.RegistryCreateServiceAccountContentEncodingEnum = exports.ServiceAccountsApi = void 0;
 const runtime = __importStar(require("../runtime"));
 const CreateServiceAccountBody_1 = require("../models/CreateServiceAccountBody");
 const RotatedCredentialDto_1 = require("../models/RotatedCredentialDto");
@@ -66,6 +66,9 @@ class ServiceAccountsApi extends runtime.BaseAPI {
         const queryParameters = {};
         const headerParameters = {};
         headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['contentEncoding'] != null) {
+            headerParameters['Content-Encoding'] = String(requestParameters['contentEncoding']);
+        }
         if (this.configuration && this.configuration.accessToken) {
             const token = this.configuration.accessToken;
             const tokenString = await token("bearer", []);
@@ -83,7 +86,7 @@ class ServiceAccountsApi extends runtime.BaseAPI {
         };
     }
     /**
-     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  **`agent` and `service_account` only.** The platform flavours (`action`, `registry`) are refused with `400`: the deployment seats an active platform principal `member` on every workspace in the account, so registering one here would be an account-wide grant rather than an identity. Those are provisioned by the registry itself, not over HTTP.  Any member of the account may call this — a machine identity for your own automation is an ordinary member operation.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
      * Create a machine identity
      */
     async registryCreateServiceAccountRaw(requestParameters, initOverrides) {
@@ -92,7 +95,7 @@ class ServiceAccountsApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, ServiceAccountDto_1.ServiceAccountDtoFromJSON)(jsonValue));
     }
     /**
-     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  **`agent` and `service_account` only.** The platform flavours (`action`, `registry`) are refused with `400`: the deployment seats an active platform principal `member` on every workspace in the account, so registering one here would be an account-wide grant rather than an identity. Those are provisioned by the registry itself, not over HTTP.  Any member of the account may call this — a machine identity for your own automation is an ordinary member operation.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
      * Create a machine identity
      */
     async registryCreateServiceAccount(requestParameters, initOverrides) {
@@ -289,7 +292,7 @@ class ServiceAccountsApi extends runtime.BaseAPI {
         };
     }
     /**
-     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Only identities *you* registered here are reachable.** A platform identity (`action`, `registry`) is refused for the same reason `POST /service-accounts` refuses to create one; an artifact\'s identity belongs to the workspace its artifact lives in and is managed on its own kind\'s route (`POST /agent/v1/agents/{agent_id}/identity/rotate`); and an identity another member registered is theirs, because holding account write says which *account* you may act in and never which *row*. All three answer `404`. There is no admin override — an identity whose registrar has left the account cannot be rotated through this API.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
      * Rotate this identity\'s credential
      */
     async registryRotateServiceAccountCredentialRaw(requestParameters, initOverrides) {
@@ -298,7 +301,7 @@ class ServiceAccountsApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, RotatedCredentialDto_1.RotatedCredentialDtoFromJSON)(jsonValue));
     }
     /**
-     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Only identities *you* registered here are reachable.** A platform identity (`action`, `registry`) is refused for the same reason `POST /service-accounts` refuses to create one; an artifact\'s identity belongs to the workspace its artifact lives in and is managed on its own kind\'s route (`POST /agent/v1/agents/{agent_id}/identity/rotate`); and an identity another member registered is theirs, because holding account write says which *account* you may act in and never which *row*. All three answer `404`. There is no admin override — an identity whose registrar has left the account cannot be rotated through this API.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
      * Rotate this identity\'s credential
      */
     async registryRotateServiceAccountCredential(requestParameters, initOverrides) {
@@ -307,3 +310,12 @@ class ServiceAccountsApi extends runtime.BaseAPI {
     }
 }
 exports.ServiceAccountsApi = ServiceAccountsApi;
+/**
+  * @export
+  * @enum {string}
+  */
+var RegistryCreateServiceAccountContentEncodingEnum;
+(function (RegistryCreateServiceAccountContentEncodingEnum) {
+    RegistryCreateServiceAccountContentEncodingEnum["Base64"] = "base64";
+    RegistryCreateServiceAccountContentEncodingEnum["GzipBase64"] = "gzip, base64";
+})(RegistryCreateServiceAccountContentEncodingEnum || (exports.RegistryCreateServiceAccountContentEncodingEnum = RegistryCreateServiceAccountContentEncodingEnum = {}));

package/dist/raw/registry/apis/SessionsApi.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+export interface RegistryListOwnSessionsRequest {
+    status?: string;
+}
+export interface RegistryRevokeOwnSessionsRequest {
+    body: Blob;
+    contentEncoding?: RegistryRevokeOwnSessionsContentEncodingEnum;
+}
+/**
+ *
+ */
+export declare class SessionsApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryListOwnSessions without sending the request
+     */
+    registryListOwnSessionsRequestOpts(requestParameters: RegistryListOwnSessionsRequest): Promise<runtime.RequestOpts>;
+    /**
+     * The caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. Accepts a `status` query (`active`, `revoked`, or `all`); the default is the control plane\'s.
+     * List the caller\'s own sessions
+     */
+    registryListOwnSessionsRaw(requestParameters: RegistryListOwnSessionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * The caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. Accepts a `status` query (`active`, `revoked`, or `all`); the default is the control plane\'s.
+     * List the caller\'s own sessions
+     */
+    registryListOwnSessions(requestParameters?: RegistryListOwnSessionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Creates request options for registryRevokeOwnSessions without sending the request
+     */
+    registryRevokeOwnSessionsRequestOpts(requestParameters: RegistryRevokeOwnSessionsRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Revoke the caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. The request body is forwarded verbatim.
+     * Revoke the caller\'s own sessions
+     */
+    registryRevokeOwnSessionsRaw(requestParameters: RegistryRevokeOwnSessionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Revoke the caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. The request body is forwarded verbatim.
+     * Revoke the caller\'s own sessions
+     */
+    registryRevokeOwnSessions(requestParameters: RegistryRevokeOwnSessionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+}
+/**
+  * @export
+  * @enum {string}
+  */
+export declare enum RegistryRevokeOwnSessionsContentEncodingEnum {
+    Base64 = "base64",
+    GzipBase64 = "gzip, base64"
+}

package/dist/raw/registry/apis/SessionsApi.js

@@ -0,0 +1,150 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegistryRevokeOwnSessionsContentEncodingEnum = exports.SessionsApi = void 0;
+const runtime = __importStar(require("../runtime"));
+/**
+ *
+ */
+class SessionsApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryListOwnSessions without sending the request
+     */
+    async registryListOwnSessionsRequestOpts(requestParameters) {
+        const queryParameters = {};
+        if (requestParameters['status'] != null) {
+            queryParameters['status'] = requestParameters['status'];
+        }
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/users/me/sessions`;
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * The caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. Accepts a `status` query (`active`, `revoked`, or `all`); the default is the control plane\'s.
+     * List the caller\'s own sessions
+     */
+    async registryListOwnSessionsRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryListOwnSessionsRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * The caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. Accepts a `status` query (`active`, `revoked`, or `all`); the default is the control plane\'s.
+     * List the caller\'s own sessions
+     */
+    async registryListOwnSessions(requestParameters = {}, initOverrides) {
+        await this.registryListOwnSessionsRaw(requestParameters, initOverrides);
+    }
+    /**
+     * Creates request options for registryRevokeOwnSessions without sending the request
+     */
+    async registryRevokeOwnSessionsRequestOpts(requestParameters) {
+        if (requestParameters['body'] == null) {
+            throw new runtime.RequiredError('body', 'Required parameter "body" was null or undefined when calling registryRevokeOwnSessions().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/octet-stream';
+        if (requestParameters['contentEncoding'] != null) {
+            headerParameters['Content-Encoding'] = String(requestParameters['contentEncoding']);
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/users/me/sessions/revoke`;
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: requestParameters['body'],
+        };
+    }
+    /**
+     * Revoke the caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. The request body is forwarded verbatim.
+     * Revoke the caller\'s own sessions
+     */
+    async registryRevokeOwnSessionsRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryRevokeOwnSessionsRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.VoidApiResponse(response);
+    }
+    /**
+     * Revoke the caller\'s own sessions, proxied from the control plane. Authenticated only - no role check, because the control plane resolves \"me\" from the asserted bearer. The request body is forwarded verbatim.
+     * Revoke the caller\'s own sessions
+     */
+    async registryRevokeOwnSessions(requestParameters, initOverrides) {
+        await this.registryRevokeOwnSessionsRaw(requestParameters, initOverrides);
+    }
+}
+exports.SessionsApi = SessionsApi;
+/**
+  * @export
+  * @enum {string}
+  */
+var RegistryRevokeOwnSessionsContentEncodingEnum;
+(function (RegistryRevokeOwnSessionsContentEncodingEnum) {
+    RegistryRevokeOwnSessionsContentEncodingEnum["Base64"] = "base64";
+    RegistryRevokeOwnSessionsContentEncodingEnum["GzipBase64"] = "gzip, base64";
+})(RegistryRevokeOwnSessionsContentEncodingEnum || (exports.RegistryRevokeOwnSessionsContentEncodingEnum = RegistryRevokeOwnSessionsContentEncodingEnum = {}));