@leaflow/sdk 0.0.0-dev.101.g01ce843

package/dist/iam/v1/schema.d.ts

@@ -0,0 +1,1658 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+export interface paths {
+    "/api/v1/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 列出全平台可授予的权限
+         * @description 各服务在启动时把自己那份目录注册进 IAM（和 AddFinalizer 同一段代码），所以这里是一份汇总，不只是 IAM 自己那几条。**IAM 不用它做判定**——判定在各服务自己那边，拿 Grant 配它自己那份目录算；这份汇总只是让界面画得出勾选框，它落后一个版本只会让界面上少几条可选项，不会让判定出错。一个还没启动过的服务，它的权限不在这里。
+         */
+        get: operations["list-permissions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/project": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 查看一个项目
+         * @description 在项目里就看得到，不需要额外的读权限。
+         */
+        get: operations["get-project"];
+        put?: never;
+        post?: never;
+        /**
+         * 删除项目
+         * @description 只有所有者能做，而且没有回头路：项目进入 DELETING，各服务开始清掉它下面的资源。项目行本身永远留着——查一个删掉的项目查得到，答案是它没了，而不是一个 404。
+         */
+        delete: operations["delete-project"];
+        options?: never;
+        head?: never;
+        /** 改项目的名称与描述 */
+        patch: operations["update-project"];
+        trace?: never;
+    };
+    "/api/v1/membership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 查看我在这个项目里的身份
+         * @description 只给事实，不给结论：这里没有 allowed，因为 IAM 不知道你要做的是哪个操作——哪个操作需要哪条权限那份目录属于各个服务，判断在它们那边。
+         */
+        get: operations["get-project-membership"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/invitations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 列出这个项目还在等的要约
+         * @description 在项目里就看得到，和成员列表同一条规则：谁被请了也是「这个项目有谁」的一部分。
+         */
+        get: operations["list-project-invitations"];
+        put?: never;
+        /**
+         * 发出一份邀请
+         * @description 要约站 14 天。有上限是因为里面那些角色是按发出那一刻的项目校验的，一份活得比它所依据的安排还久的要约会授出现在没人打算授的权限。
+         */
+        post: operations["issue-invitation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/invitations/{invitationId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** 撤回一份还没被兑现的要约 */
+        delete: operations["revoke-invitation"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/members:batchGet": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Resolve members by id, including those who have left
+         * @description Resolves a set of account ids to the people behind them, scoped to the current project and **including members who have since left it**.
+         *
+         *     This is what turns the ids held elsewhere in the product — who created a machine, who performed a logged operation — into names. The current member list cannot answer for somebody who has left, and those rows are exactly the ones a reader most often needs explained.
+         *
+         *     Only ids that have belonged to the current project resolve; anything else is omitted, as are ids that do not resolve at all. Match the response against the request by id; the order is not significant.
+         */
+        post: operations["batch-get-members"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** 列出项目成员 */
+        get: operations["list-members"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/members/{userId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * 移除成员，或者自己退出
+         * @description 移除别人要 iam:members.manage；退出只要求自己在这个项目里——任何人都可能被拉进一个项目，那么任何人就得能出去。所有者两条路都不行，先转移所有权。
+         */
+        delete: operations["remove-member"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/members/{userId}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * 设置一个成员持有的角色
+         * @description 整体替换而不是增删：调用方拿到的就是一份完整清单，让它自己算差集只会让「我以为我取消了那个角色」这种事变得可能。所有者身上的 OWNER 不受影响。
+         */
+        put: operations["set-member-roles"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/members/{userId}/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * 设置一个成员直挂的权限
+         * @description 整体替换基础策略上直挂的那些权限。直挂让「给某个人临时开一条」不必先造一个只有他一个人持有的角色，但它不会随角色调整而更新，所以它适合一次性的、说得出理由的授予——角色仍然是主要的组织方式。要 iam:members.manage。
+         */
+        put: operations["set-member-permissions"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/policies": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 列出这个项目里的策略
+         * @description 在项目里就看得到，和成员列表同一条规则：谁被授了什么也是「这个项目有谁」的一部分。
+         */
+        get: operations["list-policies"];
+        put?: never;
+        /**
+         * 附加一条策略
+         * @description 它建的是**附加**策略——要么带资源范围，要么方向是 deny。一条不限资源的 allow 是基础策略，每个成员只有一条，改它走 set-member-roles 和 set-member-permissions。roles 里不能有 OWNER 或 ADMIN：它们是规则而不是权限集合，「限定在三台机器上的所有者」讲不通。要 iam:members.manage。
+         */
+        post: operations["attach-policy"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/policies/{policyId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 查看一条策略
+         * @description 和 list-policies 同一条规则，在项目里就看得到：谁被授了什么也是「这个项目有谁」的一部分，读它不需要额外的权限。
+         */
+        get: operations["get-policy"];
+        /**
+         * 改一条策略
+         * @description 整体替换而不是逐字段改：resources、roles、permissions 各自整份覆盖，没发的那份就是空的——只有「这就是这条策略现在的全貌」这一种语义说得清一次写入到底收回了什么。改不动的是策略的**种类**：基础策略（不限资源的 allow）加不上资源范围，这个成员的角色就存在它上面，给它加个范围等于让他在别的资源上什么都不是；一条带范围的策略反过来也不能把范围清空变成基础策略，那个位置每个成员只有一条。要换种类就删了重建。要 iam:members.manage。
+         */
+        put: operations["update-policy"];
+        post?: never;
+        /**
+         * 摘掉一条策略
+         * @description 基础策略摘不掉——它是这个成员角色的落点，删了它这个人就不再持有任何角色，而「让他离开这个项目」是 remove-member 的事。要 iam:members.manage。
+         */
+        delete: operations["detach-policy"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/transfer-ownership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * 转移项目所有权
+         * @description OWNER 唯一的移动方式，只有所有者本人能发起——能像普通角色那样授予的话，任何管理员都可以顺手把自己变成所有者。
+         */
+        post: operations["transfer-project-ownership"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** 列出项目里的角色 */
+        get: operations["list-roles"];
+        put?: never;
+        /** 建一个角色 */
+        post: operations["create-role"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/roles/{code}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** 查看一个角色 */
+        get: operations["get-role"];
+        /**
+         * 改一个角色
+         * @description 名称、描述和权限整体替换。改完会在同一个事务里重新编译持有它的每一个成员——角色的权限变了，就是那些人的权限变了，而下一次请求是拿编译结果判定的。
+         */
+        put: operations["update-role"];
+        post?: never;
+        /**
+         * 删一个角色
+         * @description 还有人持有时会被拒。级联摘掉那些绑定等于把每个持有者悄悄降级——请求里没有一个字说了这件事，事后也查不到。
+         */
+        delete: operations["delete-role"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/ssh-keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * 列出这个项目的公钥
+         * @description 归成员的和归项目的都在里面，靠每一条上的 owner_user_id 区分。
+         */
+        get: operations["list-ssh-keys"];
+        put?: never;
+        /**
+         * 添加一把公钥
+         * @description owner=me 是自己的，是成员就能加；owner=project 是项目公用的，要 iam:ssh_keys.manage —— 它会进这个项目之后开出来的每一台机器。
+         */
+        post: operations["create-ssh-key"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/ssh-keys/{keyId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** 查看一把公钥 */
+        get: operations["get-ssh-key"];
+        put?: never;
+        post?: never;
+        /**
+         * 吊销一把公钥
+         * @description 行留着，状态变成 REVOKED。事故之后要问的是当时信任的是哪把钥匙。
+         */
+        delete: operations["revoke-ssh-key"];
+        options?: never;
+        head?: never;
+        /**
+         * 给公钥改名
+         * @description 只有名字能改：公钥、类型、指纹是同一样东西的三种说法，改其中一个会让这一行描述一把并不存在的钥匙。
+         */
+        patch: operations["rename-ssh-key"];
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        Error: {
+            code?: string;
+            message: string;
+            meta?: {
+                [key: string]: unknown;
+            };
+            /** Format: int64 */
+            status: number;
+        };
+        PermissionResource: {
+            /** @description 权限的代码，形如 compute:instance.delete。**这里没有展示名**：一条权限对人显示成什么字是本地化的，服务端存一份的话那一份只会是某一种语言，而读它的人可能读别的语言。译名归渲染它的那一层；它没跟上时界面显示的就是这个代码——一个自解释的降级，而且看得见 */
+            name: string;
+            /** @description 只有项目所有者能做，绑到自定义角色上也不会生效 */
+            owner_only: boolean;
+            /** @description 这条权限的判定对象是哪类资源，空表示它是项目级的。**它不必等于操作对象本身**——compute 的 route 表上没有 project_id，隔离本来就经父网络传递，所以 compute:route.create 的判定对象是 compute:private_network。非空同时意味着这条权限可以被限定到具体实例；create 和 list 一律留空 */
+            resource_type: string;
+        };
+        ResourceTypeResource: {
+            /** @description 资源类型的代码，形如 dns:zone。同样没有展示名：它该显示成「托管域名」还是「Zone」由渲染它的那一层按读者的语言决定 */
+            name: string;
+        };
+        CatalogResource: {
+            permissions: components["schemas"]["PermissionResource"][] | null;
+            /** @description 这个服务声明的资源类型。带资源范围的规则只落得到它们上面——一个没有被声明过的类型没人认得，限定在它上面的规则谁都判不出来 */
+            resource_types: components["schemas"]["ResourceTypeResource"][] | null;
+            service: string;
+        };
+        CatalogListResponseBody: {
+            items: components["schemas"]["CatalogResource"][] | null;
+        };
+        ResourceRefResource: {
+            /** @description 是字符串不是 uuid：dns 的 zone 标识是域名，而且不在 IAM 库里。匹配语义是 glob，所以 *.example.com 能表达一批子域名；uuid 和域名都不含 glob 元字符，对它们来说就是精确相等 */
+            id: string;
+            /** @description 形如 compute:instance、dns:zone，和权限名同一个命名空间 */
+            type: string;
+        };
+        RuleResource: {
+            /** @enum {string} */
+            effect: "allow" | "deny";
+            /** @description 权限名，支持尾部通配（compute:instance.*）。通配必须带服务前缀——一条光秃秃的 * 会把日后新上线的服务的操作也一起授出去，而那件事发生的时候没有任何人在场 */
+            permissions: string[] | null;
+            /** @description 为空表示整个项目范围；非空表示这条规则只在这些资源上成立，而那意味着它回答不了项目级的问题 */
+            resources: components["schemas"]["ResourceRefResource"][] | null;
+        };
+        GrantResource: {
+            admin: boolean;
+            owner: boolean;
+            /** @description 持有的角色编码，只用于展示 */
+            roles: string[] | null;
+            /** @description 他全部策略编译出来的规则。**不要自己遍历它做判定**——拿它配上自己那份权限目录交给 pkg/rbac：owner 不可被 deny、deny 优先于 admin、带资源范围的规则不参与项目级判定，那里面的顺序每一条都对着一种会静默放行的写法 */
+            rules: components["schemas"]["RuleResource"][] | null;
+        };
+        ProjectResource: {
+            ban_reason: string;
+            /** Format: date-time */
+            created_at: string;
+            created_by: string;
+            /**
+             * Format: date-time
+             * @description 盖上墓碑的那一刻
+             */
+            deleted_at: string | null;
+            description: string;
+            /** Format: uuid */
+            id: string;
+            name: string;
+            /**
+             * Format: date-time
+             * @description 欠费的起始时间
+             */
+            overdue_at: string | null;
+            /** @enum {string} */
+            status: "ACTIVE" | "SUSPENDED" | "BANNED" | "DELETING" | "DELETED";
+            /** @description 给人看的，不参与任何查询 */
+            status_reason: string;
+            /** Format: date-time */
+            updated_at: string;
+        };
+        ProjectAccessResource: {
+            grant: components["schemas"]["GrantResource"];
+            project: components["schemas"]["ProjectResource"];
+        };
+        UpdateProjectRequestBody: {
+            description?: string;
+            name?: string;
+        };
+        MembershipResource: {
+            grant: components["schemas"]["GrantResource"];
+            member: boolean;
+            project_status: string;
+            user_status: string;
+        };
+        InvitationResource: {
+            /** Format: date-time */
+            created_at: string;
+            email: string;
+            /** Format: date-time */
+            expires_at: string;
+            /** Format: uuid */
+            id: string;
+            invited_by: string;
+            /** Format: uuid */
+            project_id: string;
+            /** @description 兑现时会授予的角色编码 */
+            roles: string[] | null;
+        };
+        LengthAwarePageInvitationResource: {
+            /** @description 这一页的内容 */
+            items: components["schemas"]["InvitationResource"][];
+            /**
+             * Format: int64
+             * @description 这一页最多几条，回显请求里的值
+             */
+            limit: number;
+            /**
+             * Format: int64
+             * @description 跳过了多少条，回显请求里的值
+             */
+            offset: number;
+            /**
+             * Format: int64
+             * @description 命中的总条数，不只是这一页
+             */
+            total: number;
+        };
+        IssueInvitationRequestBody: {
+            /** Format: email */
+            email: string;
+            /** @description 兑现时授予的角色编码。必须是这个项目已经定义的，OWNER 不行 */
+            roles: string[] | null;
+        };
+        IssuedInvitationResponseBody: {
+            invitation: components["schemas"]["InvitationResource"];
+            /** @description 兑现用的明文，**只在这一次响应里出现**。库里只有它的哈希，丢了只能撤销重发 */
+            token: string;
+        };
+        BatchGetMembersRequestBody: {
+            /** @description The account ids to resolve. Blank entries are ignored. */
+            ids: string[];
+        };
+        BatchGetMembersResponseBody: {
+            /** @description The people that resolved. Ids that never belonged to this project are absent, as are ids that do not resolve at all. */
+            items: components["schemas"]["ResolvedMemberResource"][];
+        };
+        /** @description A person referred to by an id held elsewhere in the project. Carries who they are, not what they may do — a member who has left holds nothing, and this shape has no grant to say so. */
+        ResolvedMemberResource: {
+            /** @description MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+            avatar_hash: string;
+            email: string;
+            first_name: string;
+            last_name: string;
+            /** @description True when this person is no longer a member of the project. */
+            left: boolean;
+            user_id: string;
+        };
+        MemberResource: {
+            /** @description MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+            avatar_hash: string;
+            /** Format: date-time */
+            created_at: string;
+            created_by: string;
+            email: string;
+            first_name: string;
+            grant: components["schemas"]["GrantResource"];
+            last_name: string;
+            user_id: string;
+        };
+        LengthAwarePageMemberResource: {
+            /** @description 这一页的内容 */
+            items: components["schemas"]["MemberResource"][];
+            /**
+             * Format: int64
+             * @description 这一页最多几条，回显请求里的值
+             */
+            limit: number;
+            /**
+             * Format: int64
+             * @description 跳过了多少条，回显请求里的值
+             */
+            offset: number;
+            /**
+             * Format: int64
+             * @description 命中的总条数，不只是这一页
+             */
+            total: number;
+        };
+        SetMemberRolesRequestBody: {
+            /** @description 这个人应当持有的**全部**角色编码。OWNER 不能出现在这里 */
+            roles: string[] | null;
+        };
+        SetMemberPermissionsRequestBody: {
+            /** @description 这个人应当直挂的**全部**权限名，整体替换。角色给的那些不在这里，也不会被这次写入碰到 */
+            permissions: string[] | null;
+        };
+        PolicyResource: {
+            /** @description 基础策略是方向 allow、不限资源的那一条，每个成员恰好一条，装的是他的常规角色。改它走 PUT /members/{userId}/roles 和 PUT /members/{userId}/permissions */
+            base: boolean;
+            /** Format: date-time */
+            created_at: string;
+            /** @description 给人看的理由。一条附加策略事后最难回答的是「当初为什么开这一条」 */
+            description: string;
+            /** @enum {string} */
+            effect: "allow" | "deny";
+            /** Format: uuid */
+            id: string;
+            /** @description 直挂在这个人身上的权限名，不经过角色 */
+            permissions: string[] | null;
+            /** @description 为空表示整个项目范围 */
+            resources: components["schemas"]["ResourceRefResource"][] | null;
+            /** @description 这条策略带上的角色编码 */
+            roles: string[] | null;
+            /** Format: date-time */
+            updated_at: string;
+            user_id: string;
+        };
+        PolicyListResponseBody: {
+            items: components["schemas"]["PolicyResource"][] | null;
+        };
+        AttachPolicyRequestBody: {
+            /** @description 给人看的理由。一条附加策略事后最难回答的是「当初为什么开这一条」 */
+            description?: string;
+            /** @enum {string} */
+            effect: "allow" | "deny";
+            /** @description 直挂的权限名，用它就不必为一个人临时造一个只有他持有的角色 */
+            permissions?: string[] | null;
+            /** @description 这条策略只在这些资源上成立。留空只有配合 deny 才讲得通——一条不限资源的 allow 是基础策略，那一条已经有了 */
+            resources?: components["schemas"]["ResourceRefResource"][] | null;
+            /** @description 必须是这个项目已经定义的角色。OWNER 和 ADMIN 不行——它们是规则而不是权限集合，「限定在三台机器上的所有者」讲不通 */
+            roles?: string[] | null;
+            /** @description 必须已经是这个项目的成员 */
+            user_id: string;
+        };
+        UpdatePolicyRequestBody: {
+            /** @description 给人看的理由。它和这次改动一起替换，不然留下来的会是一句解释着上一个版本的话 */
+            description?: string;
+            /**
+             * @description 必须和这条策略当前的方向一致。方向改不动——那不是「改一条策略」，是一次意思完全相反的授权决定，改它的人多半以为自己在收紧，而读这行数据的下一个人看到的是一条方向和当初授予时不同、说明文字却还是旧的策略。仍然要求发这个字段而不是干脆不收，是因为整体替换的语义是「这就是这条策略现在的全貌」：少一个字段的话，调用方以为自己把 deny 改成了 allow，而服务端默默忽略了它。不一致时返回 PROJECT_POLICY_EFFECT_IMMUTABLE
+             * @enum {string}
+             */
+            effect: "allow" | "deny";
+            /** @description 直挂的权限名，整份替换。没列进来的就是被收回了——它不是往上加一条 */
+            permissions?: string[] | null;
+            /** @description 这条策略的资源范围，整份替换。范围内容能改，有没有范围改不了：基础策略加不上范围，带范围的也清不空——清空之后它就是基础策略的形状，而那个位置每个成员只有一条 */
+            resources?: components["schemas"]["ResourceRefResource"][] | null;
+            /** @description 必须是这个项目已经定义的角色，整份替换。和挂上去那次一样不能有 OWNER 或 ADMIN */
+            roles?: string[] | null;
+        };
+        TransferOwnershipRequestBody: {
+            /** @description 接手的人必须已经是这个项目的成员 */
+            to_user_id: string;
+        };
+        OwnershipTransferResponseBody: {
+            /** @description 原所有者。他保留其余的角色——转让的是所有权，不是把人踢出去 */
+            from: components["schemas"]["MemberResource"];
+            to: components["schemas"]["MemberResource"];
+        };
+        RoleResource: {
+            /** @description 内置角色不可删、不可改权限：OWNER 和 ADMIN 的语义写在代码里 */
+            builtin: boolean;
+            code: string;
+            /** Format: date-time */
+            created_at: string;
+            description: string;
+            name: string;
+            permissions: string[] | null;
+            /** Format: date-time */
+            updated_at: string;
+        };
+        RoleListResponseBody: {
+            items: components["schemas"]["RoleResource"][] | null;
+        };
+        CreateRoleRequestBody: {
+            /** @description 小写字母开头，可含数字和下划线。建好之后不能改——成员绑定和邀请都指着它 */
+            code: string;
+            description?: string;
+            name: string;
+            /** @description 权限名。OwnerOnly 的那几条会被拒绝：绑上去也不会生效 */
+            permissions?: string[] | null;
+        };
+        UpdateRoleRequestBody: {
+            description?: string;
+            name: string;
+            permissions?: string[] | null;
+        };
+        SSHKeyResource: {
+            /** Format: date-time */
+            created_at: string;
+            fingerprint: string;
+            /** @description 平台生成并保管的那把。它的私钥不对外提供 */
+            has_private_key: boolean;
+            /** Format: uuid */
+            id: string;
+            key_type: string;
+            name: string;
+            /** @description 归属人；不给表示这把钥匙归项目本身 */
+            owner_user_id?: string;
+            public_key: string;
+            /** @description 用途标签。平台自己生成的那把是 platform */
+            purposes: string[] | null;
+            /** @enum {string} */
+            status: "ACTIVE" | "REVOKED";
+        };
+        LengthAwarePageSSHKeyResource: {
+            /** @description 这一页的内容 */
+            items: components["schemas"]["SSHKeyResource"][];
+            /**
+             * Format: int64
+             * @description 这一页最多几条，回显请求里的值
+             */
+            limit: number;
+            /**
+             * Format: int64
+             * @description 跳过了多少条，回显请求里的值
+             */
+            offset: number;
+            /**
+             * Format: int64
+             * @description 命中的总条数，不只是这一页
+             */
+            total: number;
+        };
+        CreateSSHKeyRequestBody: {
+            name: string;
+            /**
+             * @description 这把钥匙归谁
+             * @default me
+             * @enum {string}
+             */
+            owner?: "me" | "project";
+            /** @description OpenSSH 格式的公钥。类型和指纹从它算出来，都不可改 */
+            public_key: string;
+            /** @description 用途标签，比如 ci、bastion */
+            purposes?: string[] | null;
+        };
+        RenameSSHKeyRequestBody: {
+            name: string;
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    "list-permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CatalogListResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "get-project": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProjectAccessResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "delete-project": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProjectAccessResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "update-project": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateProjectRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProjectAccessResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "get-project-membership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MembershipResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "list-project-invitations": {
+        parameters: {
+            query?: {
+                /** @description 这一页最多返回多少条 */
+                limit?: number;
+                /** @description 跳过多少条。要翻得更深请改用游标翻页的接口 */
+                offset?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LengthAwarePageInvitationResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "issue-invitation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["IssueInvitationRequestBody"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IssuedInvitationResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "revoke-invitation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                invitationId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "batch-get-members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["BatchGetMembersRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BatchGetMembersResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "list-members": {
+        parameters: {
+            query?: {
+                /** @description 这一页最多返回多少条 */
+                limit?: number;
+                /** @description 跳过多少条。要翻得更深请改用游标翻页的接口 */
+                offset?: number;
+                /** @description 按用户 ID、邮箱或姓名模糊匹配 */
+                keyword?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LengthAwarePageMemberResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "remove-member": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "set-member-roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetMemberRolesRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MemberResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "set-member-permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetMemberPermissionsRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "list-policies": {
+        parameters: {
+            query?: {
+                /** @description 只看这个人身上的。不传表示整个项目的 */
+                userId?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyListResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "attach-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AttachPolicyRequestBody"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "get-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "update-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdatePolicyRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "detach-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "transfer-project-ownership": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["TransferOwnershipRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OwnershipTransferResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "list-roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleListResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "create-role": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateRoleRequestBody"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "get-role": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                code: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "update-role": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                code: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateRoleRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "delete-role": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                code: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "list-ssh-keys": {
+        parameters: {
+            query?: {
+                /** @description 这一页最多返回多少条 */
+                limit?: number;
+                /** @description 跳过多少条。要翻得更深请改用游标翻页的接口 */
+                offset?: number;
+                /** @description 不传时两种都返回 */
+                status?: "ACTIVE" | "REVOKED";
+                /** @description 只列挂着这个用途的钥匙。平台自己生成的那把是 platform */
+                purpose?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LengthAwarePageSSHKeyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "create-ssh-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSSHKeyRequestBody"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SSHKeyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "get-ssh-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                keyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SSHKeyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "revoke-ssh-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                keyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SSHKeyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "rename-ssh-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                keyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RenameSSHKeyRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SSHKeyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+}