@leaflow/sdk 0.0.0-dev.29.g8fe6a71 → 0.0.0-dev.291.gcde7444

package/dist/iam/v1/generated/schemas.zod.d.ts

@@ -0,0 +1,263 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+/**
+ * @summary Update the name and description of a project
+ */
+export declare const UpdateProjectBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    name: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+/**
+ * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
+ * @summary List the invitations this project is still waiting on
+ */
+export declare const listProjectInvitationsQueryLimitDefault = 50;
+export declare const listProjectInvitationsQueryLimitMax = 200;
+export declare const listProjectInvitationsQueryOffsetDefault = 0;
+export declare const listProjectInvitationsQueryOffsetMin = 0;
+export declare const listProjectInvitationsQueryOffsetMax = 10000;
+export declare const ListProjectInvitationsQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+}, zod.z.core.$strict>;
+/**
+ * An invitation stands for 14 days. The roles it carries are validated against the project as it stood when the invitation was sent, so it expires rather than outliving the arrangement it rests on.
+ * @summary Send an invitation
+ */
+export declare const IssueInvitationBody: zod.ZodObject<{
+    email: zod.ZodEmail;
+    roles: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
+}, zod.z.core.$strict>;
+/**
+ * @summary Withdraw an invitation that has not been redeemed
+ */
+export declare const RevokeInvitationParams: zod.ZodObject<{
+    invitationId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Resolves a set of account ids to the people behind them, scoped to the current project and **including members who have since left it**.
+ *
+ * This is what turns the ids held elsewhere in the product — who created a machine, who performed a logged operation — into names. The current member list cannot answer for somebody who has left, and those rows are exactly the ones a reader most often needs explained.
+ *
+ * Only ids that have belonged to the current project resolve; anything else is omitted, as are ids that do not resolve at all. Match the response against the request by id; the order is not significant.
+ * @summary Resolve members by id, including those who have left
+ */
+export declare const BatchGetMembersBody: zod.ZodObject<{
+    ids: zod.ZodArray<zod.ZodString>;
+}, zod.z.core.$strict>;
+/**
+ * @summary List the members of a project
+ */
+export declare const listMembersQueryLimitDefault = 50;
+export declare const listMembersQueryLimitMax = 200;
+export declare const listMembersQueryOffsetDefault = 0;
+export declare const listMembersQueryOffsetMin = 0;
+export declare const listMembersQueryOffsetMax = 10000;
+export declare const listMembersQueryKeywordMax = 255;
+export declare const ListMembersQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+    keyword: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+/**
+ * Removing someone else requires `iam:members.manage`; leaving requires only membership of the project. The owner can do neither, and has to transfer ownership first.
+ * @summary Remove a member, or leave the project
+ */
+export declare const removeMemberPathUserIdMax = 255;
+export declare const RemoveMemberParams: zod.ZodObject<{
+    userId: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * The list is replaced in full rather than added to or removed from. The `OWNER` role of the owner is unaffected.
+ * @summary Set the roles a member holds
+ */
+export declare const setMemberRolesPathUserIdMax = 255;
+export declare const SetMemberRolesParams: zod.ZodObject<{
+    userId: zod.ZodString;
+}, zod.z.core.$strict>;
+export declare const SetMemberRolesBody: zod.ZodObject<{
+    roles: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
+}, zod.z.core.$strict>;
+/**
+ * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
+ * @summary Set the permissions attached directly to a member
+ */
+export declare const setMemberPermissionsPathUserIdMax = 255;
+export declare const SetMemberPermissionsParams: zod.ZodObject<{
+    userId: zod.ZodString;
+}, zod.z.core.$strict>;
+export declare const SetMemberPermissionsBody: zod.ZodObject<{
+    permissions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
+}, zod.z.core.$strict>;
+/**
+ * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
+ * @summary List the policies in this project
+ */
+export declare const listPoliciesQueryUserIdMax = 255;
+export declare const ListPoliciesQueryParams: zod.ZodObject<{
+    userId: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+/**
+ * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
+ * @summary Attach a policy
+ */
+export declare const AttachPolicyBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    effect: zod.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        id: zod.ZodString;
+        type: zod.ZodString;
+    }, zod.z.core.$strict>>>>;
+    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    user_id: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Visible to any member, on the same rule as list-policies; no further permission is required.
+ * @summary Get a policy
+ */
+export declare const GetPolicyParams: zod.ZodObject<{
+    policyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
+ * @summary Update a policy
+ */
+export declare const UpdatePolicyParams: zod.ZodObject<{
+    policyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+export declare const UpdatePolicyBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    effect: zod.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        id: zod.ZodString;
+        type: zod.ZodString;
+    }, zod.z.core.$strict>>>>;
+    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+}, zod.z.core.$strict>;
+/**
+ * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
+ * @summary Detach a policy
+ */
+export declare const DetachPolicyParams: zod.ZodObject<{
+    policyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * The only way `OWNER` moves, and only the owner can initiate it.
+ * @summary Transfer ownership of a project
+ */
+export declare const TransferProjectOwnershipBody: zod.ZodObject<{
+    to_user_id: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * @summary Create a role
+ */
+export declare const CreateRoleBody: zod.ZodObject<{
+    code: zod.ZodString;
+    description: zod.ZodOptional<zod.ZodString>;
+    name: zod.ZodString;
+    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+}, zod.z.core.$strict>;
+/**
+ * @summary Get a role
+ */
+export declare const getRolePathCodeMax = 64;
+export declare const GetRoleParams: zod.ZodObject<{
+    code: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * The name, the description and the permissions are replaced in full. Every member holding the role is recompiled in the same transaction, so the change takes effect on the next request.
+ * @summary Update a role
+ */
+export declare const updateRolePathCodeMax = 64;
+export declare const UpdateRoleParams: zod.ZodObject<{
+    code: zod.ZodString;
+}, zod.z.core.$strict>;
+export declare const UpdateRoleBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    name: zod.ZodString;
+    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+}, zod.z.core.$strict>;
+/**
+ * Refused while anyone still holds it. Cascading the removal would quietly demote every holder.
+ * @summary Delete a role
+ */
+export declare const deleteRolePathCodeMax = 64;
+export declare const DeleteRoleParams: zod.ZodObject<{
+    code: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * @summary List the SSH keys of this project
+ */
+export declare const listSshKeysQueryLimitDefault = 50;
+export declare const listSshKeysQueryLimitMax = 200;
+export declare const listSshKeysQueryOffsetDefault = 0;
+export declare const listSshKeysQueryOffsetMin = 0;
+export declare const listSshKeysQueryOffsetMax = 10000;
+export declare const listSshKeysQueryPurposeMax = 64;
+export declare const ListSshKeysQueryParams: zod.ZodObject<{
+    limit: zod.ZodDefault<zod.ZodInt>;
+    offset: zod.ZodDefault<zod.ZodInt>;
+    status: zod.ZodOptional<zod.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        REVOKED: "REVOKED";
+    }>>;
+    purpose: zod.ZodOptional<zod.ZodString>;
+}, zod.z.core.$strict>;
+/**
+ * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
+ * @summary Add an SSH key
+ */
+export declare const CreateSshKeyBody: zod.ZodObject<{
+    name: zod.ZodString;
+    owner: zod.ZodDefault<zod.ZodEnum<{
+        project: "project";
+        me: "me";
+    }>>;
+    public_key: zod.ZodString;
+    purposes: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+}, zod.z.core.$strict>;
+/**
+ * @summary Get an SSH key
+ */
+export declare const GetSshKeyParams: zod.ZodObject<{
+    keyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+/**
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * @summary Rename an SSH key
+ */
+export declare const RenameSshKeyParams: zod.ZodObject<{
+    keyId: zod.ZodUUID;
+}, zod.z.core.$strict>;
+export declare const RenameSshKeyBody: zod.ZodObject<{
+    name: zod.ZodString;
+}, zod.z.core.$strict>;
+/**
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * @summary Revoke an SSH key
+ */
+export declare const RevokeSshKeyParams: zod.ZodObject<{
+    keyId: zod.ZodUUID;
+}, zod.z.core.$strict>;

package/dist/iam/v1/generated/schemas.zod.js

@@ -0,0 +1,259 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { AttachPolicyRequestBody } from "./validators/attachPolicyRequestBody.zod.js";
+import { BatchGetMembersRequestBody } from "./validators/batchGetMembersRequestBody.zod.js";
+import { CreateRoleRequestBody } from "./validators/createRoleRequestBody.zod.js";
+import { CreateSSHKeyRequestBody } from "./validators/createSSHKeyRequestBody.zod.js";
+import { IssueInvitationRequestBody } from "./validators/issueInvitationRequestBody.zod.js";
+import { RenameSSHKeyRequestBody } from "./validators/renameSSHKeyRequestBody.zod.js";
+import { SetMemberPermissionsRequestBody } from "./validators/setMemberPermissionsRequestBody.zod.js";
+import { SetMemberRolesRequestBody } from "./validators/setMemberRolesRequestBody.zod.js";
+import { TransferOwnershipRequestBody } from "./validators/transferOwnershipRequestBody.zod.js";
+import { UpdatePolicyRequestBody } from "./validators/updatePolicyRequestBody.zod.js";
+import { UpdateProjectRequestBody } from "./validators/updateProjectRequestBody.zod.js";
+import { UpdateRoleRequestBody } from "./validators/updateRoleRequestBody.zod.js";
+/**
+ * @summary Update the name and description of a project
+ */
+export const UpdateProjectBody = UpdateProjectRequestBody;
+/**
+ * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
+ * @summary List the invitations this project is still waiting on
+ */
+export const listProjectInvitationsQueryLimitDefault = 50;
+export const listProjectInvitationsQueryLimitMax = 200;
+export const listProjectInvitationsQueryOffsetDefault = 0;
+export const listProjectInvitationsQueryOffsetMin = 0;
+export const listProjectInvitationsQueryOffsetMax = 10000;
+export const ListProjectInvitationsQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listProjectInvitationsQueryLimitMax)
+        .default(listProjectInvitationsQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listProjectInvitationsQueryOffsetMin)
+        .max(listProjectInvitationsQueryOffsetMax)
+        .default(listProjectInvitationsQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+});
+/**
+ * An invitation stands for 14 days. The roles it carries are validated against the project as it stood when the invitation was sent, so it expires rather than outliving the arrangement it rests on.
+ * @summary Send an invitation
+ */
+export const IssueInvitationBody = IssueInvitationRequestBody;
+/**
+ * @summary Withdraw an invitation that has not been redeemed
+ */
+export const RevokeInvitationParams = zod.strictObject({
+    invitationId: zod.uuid(),
+});
+/**
+ * Resolves a set of account ids to the people behind them, scoped to the current project and **including members who have since left it**.
+ *
+ * This is what turns the ids held elsewhere in the product — who created a machine, who performed a logged operation — into names. The current member list cannot answer for somebody who has left, and those rows are exactly the ones a reader most often needs explained.
+ *
+ * Only ids that have belonged to the current project resolve; anything else is omitted, as are ids that do not resolve at all. Match the response against the request by id; the order is not significant.
+ * @summary Resolve members by id, including those who have left
+ */
+export const BatchGetMembersBody = BatchGetMembersRequestBody;
+/**
+ * @summary List the members of a project
+ */
+export const listMembersQueryLimitDefault = 50;
+export const listMembersQueryLimitMax = 200;
+export const listMembersQueryOffsetDefault = 0;
+export const listMembersQueryOffsetMin = 0;
+export const listMembersQueryOffsetMax = 10000;
+export const listMembersQueryKeywordMax = 255;
+export const ListMembersQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listMembersQueryLimitMax)
+        .default(listMembersQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listMembersQueryOffsetMin)
+        .max(listMembersQueryOffsetMax)
+        .default(listMembersQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+    keyword: zod
+        .string()
+        .max(listMembersQueryKeywordMax)
+        .optional()
+        .describe("Matches against user id, email address or name"),
+});
+/**
+ * Removing someone else requires `iam:members.manage`; leaving requires only membership of the project. The owner can do neither, and has to transfer ownership first.
+ * @summary Remove a member, or leave the project
+ */
+export const removeMemberPathUserIdMax = 255;
+export const RemoveMemberParams = zod.strictObject({
+    userId: zod.string().max(removeMemberPathUserIdMax),
+});
+/**
+ * The list is replaced in full rather than added to or removed from. The `OWNER` role of the owner is unaffected.
+ * @summary Set the roles a member holds
+ */
+export const setMemberRolesPathUserIdMax = 255;
+export const SetMemberRolesParams = zod.strictObject({
+    userId: zod.string().max(setMemberRolesPathUserIdMax),
+});
+export const SetMemberRolesBody = SetMemberRolesRequestBody;
+/**
+ * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
+ * @summary Set the permissions attached directly to a member
+ */
+export const setMemberPermissionsPathUserIdMax = 255;
+export const SetMemberPermissionsParams = zod.strictObject({
+    userId: zod.string().max(setMemberPermissionsPathUserIdMax),
+});
+export const SetMemberPermissionsBody = SetMemberPermissionsRequestBody;
+/**
+ * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
+ * @summary List the policies in this project
+ */
+export const listPoliciesQueryUserIdMax = 255;
+export const ListPoliciesQueryParams = zod.strictObject({
+    userId: zod
+        .string()
+        .max(listPoliciesQueryUserIdMax)
+        .optional()
+        .describe("Restricts the result to one person. Omitting it covers the whole project"),
+});
+/**
+ * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
+ * @summary Attach a policy
+ */
+export const AttachPolicyBody = AttachPolicyRequestBody;
+/**
+ * Visible to any member, on the same rule as list-policies; no further permission is required.
+ * @summary Get a policy
+ */
+export const GetPolicyParams = zod.strictObject({
+    policyId: zod.uuid(),
+});
+/**
+ * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
+ * @summary Update a policy
+ */
+export const UpdatePolicyParams = zod.strictObject({
+    policyId: zod.uuid(),
+});
+export const UpdatePolicyBody = UpdatePolicyRequestBody;
+/**
+ * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
+ * @summary Detach a policy
+ */
+export const DetachPolicyParams = zod.strictObject({
+    policyId: zod.uuid(),
+});
+/**
+ * The only way `OWNER` moves, and only the owner can initiate it.
+ * @summary Transfer ownership of a project
+ */
+export const TransferProjectOwnershipBody = TransferOwnershipRequestBody;
+/**
+ * @summary Create a role
+ */
+export const CreateRoleBody = CreateRoleRequestBody;
+/**
+ * @summary Get a role
+ */
+export const getRolePathCodeMax = 64;
+export const GetRoleParams = zod.strictObject({
+    code: zod.string().max(getRolePathCodeMax),
+});
+/**
+ * The name, the description and the permissions are replaced in full. Every member holding the role is recompiled in the same transaction, so the change takes effect on the next request.
+ * @summary Update a role
+ */
+export const updateRolePathCodeMax = 64;
+export const UpdateRoleParams = zod.strictObject({
+    code: zod.string().max(updateRolePathCodeMax),
+});
+export const UpdateRoleBody = UpdateRoleRequestBody;
+/**
+ * Refused while anyone still holds it. Cascading the removal would quietly demote every holder.
+ * @summary Delete a role
+ */
+export const deleteRolePathCodeMax = 64;
+export const DeleteRoleParams = zod.strictObject({
+    code: zod.string().max(deleteRolePathCodeMax),
+});
+/**
+ * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * @summary List the SSH keys of this project
+ */
+export const listSshKeysQueryLimitDefault = 50;
+export const listSshKeysQueryLimitMax = 200;
+export const listSshKeysQueryOffsetDefault = 0;
+export const listSshKeysQueryOffsetMin = 0;
+export const listSshKeysQueryOffsetMax = 10000;
+export const listSshKeysQueryPurposeMax = 64;
+export const ListSshKeysQueryParams = zod.strictObject({
+    limit: zod
+        .int()
+        .min(1)
+        .max(listSshKeysQueryLimitMax)
+        .default(listSshKeysQueryLimitDefault)
+        .describe("Items returned in this page. Defaults to 50; at most 200."),
+    offset: zod
+        .int()
+        .min(listSshKeysQueryOffsetMin)
+        .max(listSshKeysQueryOffsetMax)
+        .default(listSshKeysQueryOffsetDefault)
+        .describe("Items to skip. Defaults to 0; at most 10000."),
+    status: zod
+        .enum(["ACTIVE", "REVOKED"])
+        .optional()
+        .describe("Both kinds are returned while this is absent"),
+    purpose: zod
+        .string()
+        .max(listSshKeysQueryPurposeMax)
+        .optional()
+        .describe("Lists only the keys carrying this purpose. The key the platform generates carries `platform`"),
+});
+/**
+ * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
+ * @summary Add an SSH key
+ */
+export const CreateSshKeyBody = CreateSSHKeyRequestBody;
+/**
+ * @summary Get an SSH key
+ */
+export const GetSshKeyParams = zod.strictObject({
+    keyId: zod.uuid(),
+});
+/**
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * @summary Rename an SSH key
+ */
+export const RenameSshKeyParams = zod.strictObject({
+    keyId: zod.uuid(),
+});
+export const RenameSshKeyBody = RenameSSHKeyRequestBody;
+/**
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * @summary Revoke an SSH key
+ */
+export const RevokeSshKeyParams = zod.strictObject({
+    keyId: zod.uuid(),
+});

package/dist/iam/v1/generated/validators/attachPolicyRequestBody.zod.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const attachPolicyRequestBodyDescriptionMax = 255;
+export declare const attachPolicyRequestBodyUserIdMax = 255;
+export declare const AttachPolicyRequestBody: zod.ZodObject<{
+    description: zod.ZodOptional<zod.ZodString>;
+    effect: zod.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        id: zod.ZodString;
+        type: zod.ZodString;
+    }, zod.z.core.$strict>>>>;
+    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    user_id: zod.ZodString;
+}, zod.z.core.$strict>;
+export type AttachPolicyRequestBody = zod.input<typeof AttachPolicyRequestBody>;
+export type AttachPolicyRequestBodyOutput = zod.output<typeof AttachPolicyRequestBody>;

package/dist/iam/v1/generated/validators/attachPolicyRequestBody.zod.js

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { ResourceRefResource } from "./resourceRefResource.zod.js";
+export const attachPolicyRequestBodyDescriptionMax = 255;
+export const attachPolicyRequestBodyUserIdMax = 255;
+export const AttachPolicyRequestBody = zod.strictObject({
+    description: zod
+        .string()
+        .max(attachPolicyRequestBodyDescriptionMax)
+        .optional()
+        .describe("Why it was granted, written for a reader"),
+    effect: zod.enum(["allow", "deny"]),
+    permissions: zod
+        .array(zod.string())
+        .nullish()
+        .describe("Permission names attached directly, which avoids creating a role only one person holds"),
+    resources: zod
+        .array(ResourceRefResource)
+        .nullish()
+        .describe("The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists"),
+    roles: zod
+        .array(zod.string())
+        .nullish()
+        .describe("Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions"),
+    user_id: zod
+        .string()
+        .min(1)
+        .max(attachPolicyRequestBodyUserIdMax)
+        .describe("Must already be a member of this project"),
+});

package/dist/iam/v1/generated/validators/batchGetMembersRequestBody.zod.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const batchGetMembersRequestBodyIdsItemMax = 255;
+export declare const batchGetMembersRequestBodyIdsMax = 100;
+export declare const BatchGetMembersRequestBody: zod.ZodObject<{
+    ids: zod.ZodArray<zod.ZodString>;
+}, zod.z.core.$strict>;
+export type BatchGetMembersRequestBody = zod.input<typeof BatchGetMembersRequestBody>;
+export type BatchGetMembersRequestBodyOutput = zod.output<typeof BatchGetMembersRequestBody>;

package/dist/iam/v1/generated/validators/batchGetMembersRequestBody.zod.js

@@ -0,0 +1,23 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const batchGetMembersRequestBodyIdsItemMax = 255;
+export const batchGetMembersRequestBodyIdsMax = 100;
+export const BatchGetMembersRequestBody = zod.strictObject({
+    ids: zod
+        .array(zod.string().max(batchGetMembersRequestBodyIdsItemMax))
+        .max(batchGetMembersRequestBodyIdsMax)
+        .describe("The account ids to resolve. Blank entries are ignored."),
+});

package/dist/iam/v1/generated/validators/batchGetMembersResponseBody.zod.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow IAM API
+ * What happens inside a project: members, roles, invitations and SSH keys.
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
+ * `projectId`, and the current project is the one the token states. Tokens are obtained from the
+ * account API.
+ *
+ * `GET /api/v1/membership` returns the roles and permissions the caller holds in the current
+ * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const BatchGetMembersResponseBody: zod.ZodObject<{
+    items: zod.ZodArray<zod.ZodObject<{
+        avatar_hash: zod.ZodString;
+        email: zod.ZodString;
+        first_name: zod.ZodString;
+        last_name: zod.ZodString;
+        left: zod.ZodBoolean;
+        user_id: zod.ZodString;
+    }, zod.z.core.$strict>>;
+}, zod.z.core.$strict>;
+export type BatchGetMembersResponseBody = zod.input<typeof BatchGetMembersResponseBody>;
+export type BatchGetMembersResponseBodyOutput = zod.output<typeof BatchGetMembersResponseBody>;