@leaflow/sdk 0.0.0-dev.16.gac94fbe → 0.0.0-dev.162.g0bbcd1c

package/dist/iam/v1/schema.d.ts

@@ -11,8 +11,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * 列出 IAM 自己声明的权限
-         * @description **只有 IAM 这一份。** 别的服务的操作不在这里——权限目录由各个服务自己声明，IAM 认识它们就等于要跟着每个下游一起发版。
+         * List every permission the platform can grant
+         * @description Each service registers its own catalogue with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with its own catalogue, and this list only serves to render the choices. A service that has never started does not appear here.
          */
         get: operations["list-permissions"];
         put?: never;
@@ -31,20 +31,20 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * 查看一个项目
-         * @description 在项目里就看得到，不需要额外的读权限。
+         * Get a project
+         * @description Visible to any member; no further permission is required.
          */
         get: operations["get-project"];
         put?: never;
         post?: never;
         /**
-         * 删除项目
-         * @description 只有所有者能做，而且没有回头路：项目进入 DELETING，各服务开始清掉它下面的资源。项目行本身永远留着——查一个删掉的项目查得到，答案是它没了，而不是一个 404。
+         * Delete a project
+         * @description Only the owner can do this, and it cannot be undone. The project enters DELETING and each service begins removing the resources under it. The project itself remains readable afterwards, answering that it is gone rather than 404.
          */
         delete: operations["delete-project"];
         options?: never;
         head?: never;
-        /** 改项目的名称与描述 */
+        /** Update the name and description of a project */
         patch: operations["update-project"];
         trace?: never;
     };
@@ -56,8 +56,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * 查看我在这个项目里的身份
-         * @description 只给事实，不给结论：这里没有 allowed，因为 IAM 不知道你要做的是哪个操作——哪个操作需要哪条权限那份目录属于各个服务，判断在它们那边。
+         * Get the caller's standing in this project
+         * @description Facts rather than a conclusion. There is no `allowed` field here, because each service holds the catalogue mapping its operations to permissions and decides on its own.
          */
         get: operations["get-project-membership"];
         put?: never;
@@ -76,14 +76,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * 列出这个项目还在等的要约
-         * @description 在项目里就看得到，和成员列表同一条规则：谁被请了也是「这个项目有谁」的一部分。
+         * List the invitations this project is still waiting on
+         * @description Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
          */
         get: operations["list-project-invitations"];
         put?: never;
         /**
-         * 发出一份邀请
-         * @description 要约站 14 天。有上限是因为里面那些角色是按发出那一刻的项目校验的，一份活得比它所依据的安排还久的要约会授出现在没人打算授的权限。
+         * Send an invitation
+         * @description An invitation stands for 14 days. The roles it carries are validated against the project as it stood when the invitation was sent, so it expires rather than outliving the arrangement it rests on.
          */
         post: operations["issue-invitation"];
         delete?: never;
@@ -102,13 +102,37 @@ export interface paths {
         get?: never;
         put?: never;
         post?: never;
-        /** 撤回一份还没被兑现的要约 */
+        /** Withdraw an invitation that has not been redeemed */
         delete: operations["revoke-invitation"];
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
+    "/api/v1/members:batchGet": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Resolve members by id, including those who have left
+         * @description Resolves a set of account ids to the people behind them, scoped to the current project and **including members who have since left it**.
+         *
+         *     This is what turns the ids held elsewhere in the product — who created a machine, who performed a logged operation — into names. The current member list cannot answer for somebody who has left, and those rows are exactly the ones a reader most often needs explained.
+         *
+         *     Only ids that have belonged to the current project resolve; anything else is omitted, as are ids that do not resolve at all. Match the response against the request by id; the order is not significant.
+         */
+        post: operations["batch-get-members"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/members": {
         parameters: {
             query?: never;
@@ -116,7 +140,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** 列出项目成员 */
+        /** List the members of a project */
         get: operations["list-members"];
         put?: never;
         post?: never;
@@ -137,8 +161,8 @@ export interface paths {
         put?: never;
         post?: never;
         /**
-         * 移除成员，或者自己退出
-         * @description 移除别人要 iam:members.manage；退出只要求自己在这个项目里——任何人都可能被拉进一个项目，那么任何人就得能出去。所有者两条路都不行，先转移所有权。
+         * Remove a member, or leave the project
+         * @description Removing someone else requires `iam:members.manage`; leaving requires only membership of the project. The owner can do neither, and has to transfer ownership first.
          */
         delete: operations["remove-member"];
         options?: never;
@@ -155,8 +179,8 @@ export interface paths {
         };
         get?: never;
         /**
-         * 设置一个成员持有的角色
-         * @description 整体替换而不是增删：调用方拿到的就是一份完整清单，让它自己算差集只会让「我以为我取消了那个角色」这种事变得可能。所有者身上的 OWNER 不受影响。
+         * Set the roles a member holds
+         * @description The list is replaced in full rather than added to or removed from. The `OWNER` role of the owner is unaffected.
          */
         put: operations["set-member-roles"];
         post?: never;
@@ -166,6 +190,78 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/members/{userId}/permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set the permissions attached directly to a member
+         * @description Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
+         */
+        put: operations["set-member-permissions"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/policies": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the policies in this project
+         * @description Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
+         */
+        get: operations["list-policies"];
+        put?: never;
+        /**
+         * Attach a policy
+         * @description This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
+         */
+        post: operations["attach-policy"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/policies/{policyId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a policy
+         * @description Visible to any member, on the same rule as list-policies; no further permission is required.
+         */
+        get: operations["get-policy"];
+        /**
+         * Update a policy
+         * @description Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
+         */
+        put: operations["update-policy"];
+        post?: never;
+        /**
+         * Detach a policy
+         * @description A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
+         */
+        delete: operations["detach-policy"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/transfer-ownership": {
         parameters: {
             query?: never;
@@ -176,8 +272,8 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * 转移项目所有权
-         * @description OWNER 唯一的移动方式，只有所有者本人能发起——能像普通角色那样授予的话，任何管理员都可以顺手把自己变成所有者。
+         * Transfer ownership of a project
+         * @description The only way `OWNER` moves, and only the owner can initiate it.
          */
         post: operations["transfer-project-ownership"];
         delete?: never;
@@ -193,10 +289,10 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** 列出项目里的角色 */
+        /** List the roles in this project */
         get: operations["list-roles"];
         put?: never;
-        /** 建一个角色 */
+        /** Create a role */
         post: operations["create-role"];
         delete?: never;
         options?: never;
@@ -211,17 +307,17 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** 查看一个角色 */
+        /** Get a role */
         get: operations["get-role"];
         /**
-         * 改一个角色
-         * @description 名称、描述和权限整体替换。改完会在同一个事务里重新编译持有它的每一个成员——角色的权限变了，就是那些人的权限变了，而下一次请求是拿编译结果判定的。
+         * Update a role
+         * @description The name, the description and the permissions are replaced in full. Every member holding the role is recompiled in the same transaction, so the change takes effect on the next request.
          */
         put: operations["update-role"];
         post?: never;
         /**
-         * 删一个角色
-         * @description 还有人持有时会被拒。级联摘掉那些绑定等于把每个持有者悄悄降级——请求里没有一个字说了这件事，事后也查不到。
+         * Delete a role
+         * @description Refused while anyone still holds it. Cascading the removal would quietly demote every holder.
          */
         delete: operations["delete-role"];
         options?: never;
@@ -237,14 +333,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * 列出这个项目的公钥
-         * @description 归成员的和归项目的都在里面，靠每一条上的 owner_user_id 区分。
+         * List the SSH keys of this project
+         * @description Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
          */
         get: operations["list-ssh-keys"];
         put?: never;
         /**
-         * 添加一把公钥
-         * @description owner=me 是自己的，是成员就能加；owner=project 是项目公用的，要 iam:ssh_keys.manage —— 它会进这个项目之后开出来的每一台机器。
+         * Add an SSH key
+         * @description `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
          */
         post: operations["create-ssh-key"];
         delete?: never;
@@ -260,20 +356,20 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** 查看一把公钥 */
+        /** Get an SSH key */
         get: operations["get-ssh-key"];
         put?: never;
         post?: never;
         /**
-         * 吊销一把公钥
-         * @description 行留着，状态变成 REVOKED。事故之后要问的是当时信任的是哪把钥匙。
+         * Revoke an SSH key
+         * @description The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
          */
         delete: operations["revoke-ssh-key"];
         options?: never;
         head?: never;
         /**
-         * 给公钥改名
-         * @description 只有名字能改：公钥、类型、指纹是同一样东西的三种说法，改其中一个会让这一行描述一把并不存在的钥匙。
+         * Rename an SSH key
+         * @description Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
          */
         patch: operations["rename-ssh-key"];
         trace?: never;
@@ -285,6 +381,10 @@ export interface components {
         Error: {
             code?: string;
             message: string;
+            /**
+             * @description What a given `code` carries alongside the message. The keys depend on the code,
+             *     and a client that does not recognise one ignores it.
+             */
             meta?: {
                 [key: string]: unknown;
             };
@@ -292,21 +392,47 @@ export interface components {
             status: number;
         };
         PermissionResource: {
-            description: string;
+            /** @description The code of the permission, such as compute:instance.delete. **There is no display name here** — what a permission reads as is localised, and translation belongs to the layer rendering it. Until a translation catches up, the code itself is what is shown */
             name: string;
-            /** @description 只有项目所有者能做，绑到自定义角色上也不会生效 */
+            /** @description Reserved for the project owner. Attaching it to a custom role has no effect */
             owner_only: boolean;
+            /** @description The kind of resource this permission is decided against; empty means it is decided at project level. **It need not be the object being operated on** — a compute route carries no project_id and is isolated through its parent network, so compute:route.create is decided against compute:private_network. A non-empty value also means the permission can be scoped to particular instances; create and list are always empty */
+            resource_type: string;
+        };
+        ResourceTypeResource: {
+            /** @description The code of the resource type, such as dns:zone. There is no display name here either; what it reads as is decided by the layer rendering it */
+            name: string;
+        };
+        CatalogResource: {
+            permissions: components["schemas"]["PermissionResource"][] | null;
+            /** @description The resource types this service declares. A scoped rule can only land on one of them */
+            resource_types: components["schemas"]["ResourceTypeResource"][] | null;
+            service: string;
+        };
+        CatalogListResponseBody: {
+            items: components["schemas"]["CatalogResource"][] | null;
+        };
+        ResourceRefResource: {
+            /** @description A string rather than a UUID; a DNS zone is named by its domain, which IAM does not hold. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly */
+            id: string;
+            /** @description Of the form compute:instance or dns:zone, in the same namespace as permission names */
+            type: string;
         };
-        PermissionListResponseBody: {
-            items: components["schemas"]["PermissionResource"][] | null;
+        RuleResource: {
+            /** @enum {string} */
+            effect: "allow" | "deny";
+            /** @description A permission name, with a trailing wildcard supported (compute:instance.*). A wildcard must carry the service prefix; a bare wildcard would also grant the operations of services that go live later */
+            permissions: string[] | null;
+            /** @description Empty means the rule holds across the whole project. A non-empty value means it holds only on those resources, and therefore answers no project-level question */
+            resources: components["schemas"]["ResourceRefResource"][] | null;
         };
         GrantResource: {
             admin: boolean;
             owner: boolean;
-            /** @description 持有的全部自定义角色的权限并集，已去重排序 */
-            permissions: string[] | null;
-            /** @description 持有的角色编码，只用于展示 */
+            /** @description The role codes held, for display only */
             roles: string[] | null;
+            /** @description **The rules compiled from every policy that applies. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it */
+            rules: components["schemas"]["RuleResource"][] | null;
         };
         ProjectResource: {
             ban_reason: string;
@@ -315,21 +441,16 @@ export interface components {
             created_by: string;
             /**
              * Format: date-time
-             * @description 盖上墓碑的那一刻
+             * @description When the project was deleted
              */
             deleted_at: string | null;
             description: string;
             /** Format: uuid */
             id: string;
             name: string;
-            /**
-             * Format: date-time
-             * @description 欠费的起始时间
-             */
-            overdue_at: string | null;
             /** @enum {string} */
             status: "ACTIVE" | "SUSPENDED" | "BANNED" | "DELETING" | "DELETED";
-            /** @description 给人看的，不参与任何查询 */
+            /** @description Written for a reader; it takes part in no query */
             status_reason: string;
             /** Format: date-time */
             updated_at: string;
@@ -359,40 +480,61 @@ export interface components {
             invited_by: string;
             /** Format: uuid */
             project_id: string;
-            /** @description 兑现时会授予的角色编码 */
+            /** @description The role codes granted on redemption */
             roles: string[] | null;
         };
         LengthAwarePageInvitationResource: {
-            /** @description 这一页的内容 */
+            /** @description The items in this page */
             items: components["schemas"]["InvitationResource"][];
             /**
              * Format: int64
-             * @description 这一页最多几条，回显请求里的值
+             * @description Maximum number of items in this page, echoing the request
              */
             limit: number;
             /**
              * Format: int64
-             * @description 跳过了多少条，回显请求里的值
+             * @description Number of items skipped, echoing the request
              */
             offset: number;
             /**
              * Format: int64
-             * @description 命中的总条数，不只是这一页
+             * @description Total number of matches, not only this page
              */
             total: number;
         };
         IssueInvitationRequestBody: {
             /** Format: email */
             email: string;
-            /** @description 兑现时授予的角色编码。必须是这个项目已经定义的，OWNER 不行 */
+            /** @description The role codes granted on redemption. Each must already be defined in this project, and `OWNER` is not accepted */
             roles: string[] | null;
         };
         IssuedInvitationResponseBody: {
             invitation: components["schemas"]["InvitationResource"];
-            /** @description 兑现用的明文，**只在这一次响应里出现**。库里只有它的哈希，丢了只能撤销重发 */
+            /** @description The token that redeems the invitation, **returned in this response only**. If it is lost, withdraw the invitation and send another */
             token: string;
         };
+        BatchGetMembersRequestBody: {
+            /** @description The account ids to resolve. Blank entries are ignored. */
+            ids: string[];
+        };
+        BatchGetMembersResponseBody: {
+            /** @description The people that resolved. Ids that never belonged to this project are absent, as are ids that do not resolve at all. */
+            items: components["schemas"]["ResolvedMemberResource"][];
+        };
+        /** @description A person referred to by an id held elsewhere in the project. Carries who they are, not what they may do — a member who has left holds nothing, and this shape has no grant to say so. */
+        ResolvedMemberResource: {
+            /** @description MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+            avatar_hash: string;
+            email: string;
+            first_name: string;
+            last_name: string;
+            /** @description True when this person is no longer a member of the project. */
+            left: boolean;
+            user_id: string;
+        };
         MemberResource: {
+            /** @description MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
+            avatar_hash: string;
             /** Format: date-time */
             created_at: string;
             created_by: string;
@@ -403,39 +545,96 @@ export interface components {
             user_id: string;
         };
         LengthAwarePageMemberResource: {
-            /** @description 这一页的内容 */
+            /** @description The items in this page */
             items: components["schemas"]["MemberResource"][];
             /**
              * Format: int64
-             * @description 这一页最多几条，回显请求里的值
+             * @description Maximum number of items in this page, echoing the request
              */
             limit: number;
             /**
              * Format: int64
-             * @description 跳过了多少条，回显请求里的值
+             * @description Number of items skipped, echoing the request
              */
             offset: number;
             /**
              * Format: int64
-             * @description 命中的总条数，不只是这一页
+             * @description Total number of matches, not only this page
              */
             total: number;
         };
         SetMemberRolesRequestBody: {
-            /** @description 这个人应当持有的**全部**角色编码。OWNER 不能出现在这里 */
+            /** @description **Every** role code this person is to hold. `OWNER` cannot appear here */
+            roles: string[] | null;
+        };
+        SetMemberPermissionsRequestBody: {
+            /** @description **Every** permission name to be attached directly to this person, replaced in full. The permissions a role grants are neither listed here nor touched by this write */
+            permissions: string[] | null;
+        };
+        PolicyResource: {
+            /** @description The base policy is the one whose effect is `allow` and which covers every resource. Each member holds exactly one, and it carries their ordinary roles. Change it with PUT /members/{userId}/roles and PUT /members/{userId}/permissions */
+            base: boolean;
+            /** Format: date-time */
+            created_at: string;
+            /** @description Why it was granted, written for a reader */
+            description: string;
+            /** @enum {string} */
+            effect: "allow" | "deny";
+            /** Format: uuid */
+            id: string;
+            /** @description Permission names attached directly to this person, without passing through a role */
+            permissions: string[] | null;
+            /** @description Empty means the whole project */
+            resources: components["schemas"]["ResourceRefResource"][] | null;
+            /** @description The role codes this policy carries */
             roles: string[] | null;
+            /** Format: date-time */
+            updated_at: string;
+            user_id: string;
+        };
+        PolicyListResponseBody: {
+            items: components["schemas"]["PolicyResource"][] | null;
+        };
+        AttachPolicyRequestBody: {
+            /** @description Why it was granted, written for a reader */
+            description?: string;
+            /** @enum {string} */
+            effect: "allow" | "deny";
+            /** @description Permission names attached directly, which avoids creating a role only one person holds */
+            permissions?: string[] | null;
+            /** @description The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists */
+            resources?: components["schemas"]["ResourceRefResource"][] | null;
+            /** @description Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions */
+            roles?: string[] | null;
+            /** @description Must already be a member of this project */
+            user_id: string;
+        };
+        UpdatePolicyRequestBody: {
+            /** @description Why it was granted, written for a reader. It is replaced together with the change, so that what remains does not explain an earlier version */
+            description?: string;
+            /**
+             * @description Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE
+             * @enum {string}
+             */
+            effect: "allow" | "deny";
+            /** @description Permission names attached directly, replaced in full. Anything not listed is withdrawn rather than kept */
+            permissions?: string[] | null;
+            /** @description The resource scope of this policy, replaced in full. What the scope contains can change; whether the policy has one cannot. A base policy cannot take a scope, and a scoped policy cannot have its scope cleared */
+            resources?: components["schemas"]["ResourceRefResource"][] | null;
+            /** @description Each must be a role already defined in this project, replaced in full. As when attaching, `OWNER` and `ADMIN` are not accepted */
+            roles?: string[] | null;
         };
         TransferOwnershipRequestBody: {
-            /** @description 接手的人必须已经是这个项目的成员 */
+            /** @description The recipient must already be a member of this project */
             to_user_id: string;
         };
         OwnershipTransferResponseBody: {
-            /** @description 原所有者。他保留其余的角色——转让的是所有权，不是把人踢出去 */
+            /** @description The former owner, who keeps every other role held. Ownership is transferred rather than the person removed */
             from: components["schemas"]["MemberResource"];
             to: components["schemas"]["MemberResource"];
         };
         RoleResource: {
-            /** @description 内置角色不可删、不可改权限：OWNER 和 ADMIN 的语义写在代码里 */
+            /** @description A built-in role can be neither deleted nor have its permissions changed */
             builtin: boolean;
             code: string;
             /** Format: date-time */
@@ -450,11 +649,11 @@ export interface components {
             items: components["schemas"]["RoleResource"][] | null;
         };
         CreateRoleRequestBody: {
-            /** @description 小写字母开头，可含数字和下划线。建好之后不能改——成员绑定和邀请都指着它 */
+            /** @description Begins with a lower-case letter and may contain digits and underscores. It cannot be changed once created, as member bindings and invitations refer to it */
             code: string;
             description?: string;
             name: string;
-            /** @description 权限名。OwnerOnly 的那几条会被拒绝：绑上去也不会生效 */
+            /** @description A permission name. The ones reserved for the owner are refused, since attaching them would have no effect */
             permissions?: string[] | null;
         };
         UpdateRoleRequestBody: {
@@ -466,50 +665,50 @@ export interface components {
             /** Format: date-time */
             created_at: string;
             fingerprint: string;
-            /** @description 平台生成并保管的那把。它的私钥不对外提供 */
+            /** @description The key the platform generates and holds. Its private key is not handed out */
             has_private_key: boolean;
             /** Format: uuid */
             id: string;
             key_type: string;
             name: string;
-            /** @description 归属人；不给表示这把钥匙归项目本身 */
+            /** @description Who the key belongs to. Absent means it belongs to the project itself */
             owner_user_id?: string;
             public_key: string;
-            /** @description 用途标签。平台自己生成的那把是 platform */
+            /** @description A purpose label. The key the platform generates carries `platform` */
             purposes: string[] | null;
             /** @enum {string} */
             status: "ACTIVE" | "REVOKED";
         };
         LengthAwarePageSSHKeyResource: {
-            /** @description 这一页的内容 */
+            /** @description The items in this page */
             items: components["schemas"]["SSHKeyResource"][];
             /**
              * Format: int64
-             * @description 这一页最多几条，回显请求里的值
+             * @description Maximum number of items in this page, echoing the request
              */
             limit: number;
             /**
              * Format: int64
-             * @description 跳过了多少条，回显请求里的值
+             * @description Number of items skipped, echoing the request
              */
             offset: number;
             /**
              * Format: int64
-             * @description 命中的总条数，不只是这一页
+             * @description Total number of matches, not only this page
              */
             total: number;
         };
         CreateSSHKeyRequestBody: {
             name: string;
             /**
-             * @description 这把钥匙归谁
+             * @description Who this key belongs to
              * @default me
              * @enum {string}
              */
             owner?: "me" | "project";
-            /** @description OpenSSH 格式的公钥。类型和指纹从它算出来，都不可改 */
+            /** @description The public key in OpenSSH format. The type and the fingerprint are derived from it and cannot be changed */
             public_key: string;
-            /** @description 用途标签，比如 ci、bastion */
+            /** @description A purpose label, such as ci or bastion */
             purposes?: string[] | null;
         };
         RenameSSHKeyRequestBody: {
@@ -539,7 +738,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["PermissionListResponseBody"];
+                    "application/json": components["schemas"]["CatalogListResponseBody"];
                 };
             };
             /** @description Error */
@@ -676,9 +875,9 @@ export interface operations {
     "list-project-invitations": {
         parameters: {
             query?: {
-                /** @description 这一页最多返回多少条 */
+                /** @description Maximum number of items in this page */
                 limit?: number;
-                /** @description 跳过多少条。要翻得更深请改用游标翻页的接口 */
+                /** @description Number of items to skip. Use the cursor-paged endpoint to page deeper */
                 offset?: number;
             };
             header?: never;
@@ -769,14 +968,47 @@ export interface operations {
             };
         };
     };
+    "batch-get-members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["BatchGetMembersRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["BatchGetMembersResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     "list-members": {
         parameters: {
             query?: {
-                /** @description 这一页最多返回多少条 */
+                /** @description Maximum number of items in this page */
                 limit?: number;
-                /** @description 跳过多少条。要翻得更深请改用游标翻页的接口 */
+                /** @description Number of items to skip. Use the cursor-paged endpoint to page deeper */
                 offset?: number;
-                /** @description 按用户 ID、邮箱或姓名模糊匹配 */
+                /** @description Matches against user id, email address or name */
                 keyword?: string;
             };
             header?: never;
@@ -869,6 +1101,201 @@ export interface operations {
             };
         };
     };
+    "set-member-permissions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                userId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetMemberPermissionsRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "list-policies": {
+        parameters: {
+            query?: {
+                /** @description Restricts the result to one person. Omitting it covers the whole project */
+                userId?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyListResponseBody"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "attach-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AttachPolicyRequestBody"];
+            };
+        };
+        responses: {
+            /** @description Created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "get-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "update-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdatePolicyRequestBody"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PolicyResource"];
+                };
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    "detach-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                policyId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No Content */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Error */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     "transfer-project-ownership": {
         parameters: {
             query?: never;
@@ -1062,13 +1489,13 @@ export interface operations {
     "list-ssh-keys": {
         parameters: {
             query?: {
-                /** @description 这一页最多返回多少条 */
+                /** @description Maximum number of items in this page */
                 limit?: number;
-                /** @description 跳过多少条。要翻得更深请改用游标翻页的接口 */
+                /** @description Number of items to skip. Use the cursor-paged endpoint to page deeper */
                 offset?: number;
-                /** @description 不传时两种都返回 */
+                /** @description Both kinds are returned while this is absent */
                 status?: "ACTIVE" | "REVOKED";
-                /** @description 只列挂着这个用途的钥匙。平台自己生成的那把是 platform */
+                /** @description Lists only the keys carrying this purpose. The key the platform generates carries `platform` */
                 purpose?: string;
             };
             header?: never;