@leaflow/sdk 0.0.0-dev.462.g9520bb3 → 0.0.0-dev.466.gd442bdd

package/dist/fleet/v1/generated/validators/sessionResource.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionResource.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionState.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionState.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signedMessage.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signedMessage.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signingKey.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signingKey.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateAccountRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateAccountRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateGroupRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateGroupRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMachineRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMachineRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerResponse.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerResponse.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updatePrivilegeAutoApprovalRequest.zod.d.ts

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updatePrivilegeAutoApprovalRequest.zod.js

@@ -105,8 +105,8 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/iam/v1/generated/functions.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the
@@ -590,7 +590,7 @@ export type listSshKeysResponseError = listSshKeysResponseDefault & {
 export type listSshKeysResponse = listSshKeysResponseSuccess | listSshKeysResponseError;
 export declare const getListSshKeysUrl: (params?: ListSshKeysParams) => string;
 /**
- * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * The keys the project shares. The keys of members are their own and belong to their accounts (`/account/v1/me/ssh-keys` on the account API), so they are not listed here.
  * @summary List the SSH keys of this project
  */
 export declare const listSshKeys: (params?: ListSshKeysParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listSshKeysResponse>;
@@ -611,8 +611,10 @@ export type createSshKeyResponseError = createSshKeyResponseDefault & {
 export type createSshKeyResponse = createSshKeyResponseSuccess | createSshKeyResponseError;
 export declare const getCreateSshKeyUrl: () => string;
 /**
- * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
- * @summary Add an SSH key
+ * Adds a key the project shares, such as one used by CI or a bastion. It belongs to the project rather than to the member adding it; a member adds a key of their own to their account (`POST /account/v1/me/ssh-keys` on the account API).
+ *
+ * Requires `iam:ssh_keys.manage`.
+ * @summary Add an SSH key to this project
  */
 export declare const createSshKey: (createSSHKeyRequestBody: CreateSSHKeyRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createSshKeyResponse>;
 export type getSshKeyResponse200 = {
@@ -652,7 +654,7 @@ export type renameSshKeyResponseError = renameSshKeyResponseDefault & {
 export type renameSshKeyResponse = renameSshKeyResponseSuccess | renameSshKeyResponseError;
 export declare const getRenameSshKeyUrl: (keyId: string) => string;
 /**
- * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist. Requires `iam:ssh_keys.manage`.
  * @summary Rename an SSH key
  */
 export declare const renameSshKey: (keyId: string, renameSSHKeyRequestBody: RenameSSHKeyRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<renameSshKeyResponse>;
@@ -673,7 +675,7 @@ export type revokeSshKeyResponseError = revokeSshKeyResponseDefault & {
 export type revokeSshKeyResponse = revokeSshKeyResponseSuccess | revokeSshKeyResponseError;
 export declare const getRevokeSshKeyUrl: (keyId: string) => string;
 /**
- * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time. Requires `iam:ssh_keys.manage`.
  * @summary Revoke an SSH key
  */
 export declare const revokeSshKey: (keyId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<revokeSshKeyResponse>;

package/dist/iam/v1/generated/functions.js

@@ -649,7 +649,7 @@ export const getListSshKeysUrl = (params) => {
         : `https://iam.leaflow.cloud/api/v1/ssh-keys`;
 };
 /**
- * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * The keys the project shares. The keys of members are their own and belong to their accounts (`/account/v1/me/ssh-keys` on the account API), so they are not listed here.
  * @summary List the SSH keys of this project
  */
 export const listSshKeys = async (params, options, fetchFn) => {
@@ -665,8 +665,10 @@ export const getCreateSshKeyUrl = () => {
     return `https://iam.leaflow.cloud/api/v1/ssh-keys`;
 };
 /**
- * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
- * @summary Add an SSH key
+ * Adds a key the project shares, such as one used by CI or a bastion. It belongs to the project rather than to the member adding it; a member adds a key of their own to their account (`POST /account/v1/me/ssh-keys` on the account API).
+ *
+ * Requires `iam:ssh_keys.manage`.
+ * @summary Add an SSH key to this project
  */
 export const createSshKey = async (createSSHKeyRequestBody, options, fetchFn) => {
     const getHeaders = (h) => {
@@ -713,7 +715,7 @@ export const getRenameSshKeyUrl = (keyId) => {
     return `https://iam.leaflow.cloud/api/v1/ssh-keys/${encodeURIComponent(String(keyId))}`;
 };
 /**
- * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist. Requires `iam:ssh_keys.manage`.
  * @summary Rename an SSH key
  */
 export const renameSshKey = async (keyId, renameSSHKeyRequestBody, options, fetchFn) => {
@@ -746,7 +748,7 @@ export const getRevokeSshKeyUrl = (keyId) => {
     return `https://iam.leaflow.cloud/api/v1/ssh-keys/${encodeURIComponent(String(keyId))}`;
 };
 /**
- * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time. Requires `iam:ssh_keys.manage`.
  * @summary Revoke an SSH key
  */
 export const revokeSshKey = async (keyId, options, fetchFn) => {

package/dist/iam/v1/generated/models.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the
@@ -489,8 +489,6 @@ export interface SSHKeyResource {
     id: string;
     key_type: string;
     name: string;
-    /** Who the key belongs to. Absent means it belongs to the project itself */
-    owner_user_id?: string;
     public_key: string;
     /**
      * A purpose label. The key the platform generates carries `platform`
@@ -509,22 +507,12 @@ export interface LengthAwarePageSSHKeyResource {
     /** Total number of matches, not only this page */
     total: number;
 }
-/**
- * Who this key belongs to
- */
-export type CreateSSHKeyRequestBodyOwner = (typeof CreateSSHKeyRequestBodyOwner)[keyof typeof CreateSSHKeyRequestBodyOwner];
-export declare const CreateSSHKeyRequestBodyOwner: {
-    readonly me: "me";
-    readonly project: "project";
-};
 export interface CreateSSHKeyRequestBody {
     /**
      * @minLength 1
      * @maxLength 128
      */
     name: string;
-    /** Who this key belongs to */
-    owner?: CreateSSHKeyRequestBodyOwner;
     /**
      * The public key in OpenSSH format. The type and the fingerprint are derived from it and cannot be changed
      * @minLength 1

package/dist/iam/v1/generated/models.js

@@ -27,10 +27,6 @@ export const SSHKeyResourceStatus = {
     ACTIVE: "ACTIVE",
     REVOKED: "REVOKED",
 };
-export const CreateSSHKeyRequestBodyOwner = {
-    me: "me",
-    project: "project",
-};
 export const ApplicationResourceType = {
     PUBLIC: "PUBLIC",
     CONFIDENTIAL: "CONFIDENTIAL",

package/dist/iam/v1/generated/schemas.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the
@@ -224,7 +224,7 @@ export declare const DeleteRoleParams: zod.ZodObject<{
     code: zod.ZodString;
 }, zod.z.core.$strict>;
 /**
- * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * The keys the project shares. The keys of members are their own and belong to their accounts (`/account/v1/me/ssh-keys` on the account API), so they are not listed here.
  * @summary List the SSH keys of this project
  */
 export declare const listSshKeysQueryLimitDefault = 50;
@@ -243,15 +243,13 @@ export declare const ListSshKeysQueryParams: zod.ZodObject<{
     purpose: zod.ZodOptional<zod.ZodString>;
 }, zod.z.core.$strict>;
 /**
- * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
- * @summary Add an SSH key
+ * Adds a key the project shares, such as one used by CI or a bastion. It belongs to the project rather than to the member adding it; a member adds a key of their own to their account (`POST /account/v1/me/ssh-keys` on the account API).
+ *
+ * Requires `iam:ssh_keys.manage`.
+ * @summary Add an SSH key to this project
  */
 export declare const CreateSshKeyBody: zod.ZodObject<{
     name: zod.ZodString;
-    owner: zod.ZodDefault<zod.ZodEnum<{
-        project: "project";
-        me: "me";
-    }>>;
     public_key: zod.ZodString;
     purposes: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
 }, zod.z.core.$strict>;
@@ -262,7 +260,7 @@ export declare const GetSshKeyParams: zod.ZodObject<{
     keyId: zod.ZodUUID;
 }, zod.z.core.$strict>;
 /**
- * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist. Requires `iam:ssh_keys.manage`.
  * @summary Rename an SSH key
  */
 export declare const RenameSshKeyParams: zod.ZodObject<{
@@ -272,7 +270,7 @@ export declare const RenameSshKeyBody: zod.ZodObject<{
     name: zod.ZodString;
 }, zod.z.core.$strict>;
 /**
- * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time. Requires `iam:ssh_keys.manage`.
  * @summary Revoke an SSH key
  */
 export declare const RevokeSshKeyParams: zod.ZodObject<{

package/dist/iam/v1/generated/schemas.zod.js

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the
@@ -217,7 +217,7 @@ export const DeleteRoleParams = zod.strictObject({
     code: zod.string().max(deleteRolePathCodeMax),
 });
 /**
- * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * The keys the project shares. The keys of members are their own and belong to their accounts (`/account/v1/me/ssh-keys` on the account API), so they are not listed here.
  * @summary List the SSH keys of this project
  */
 export const listSshKeysQueryLimitDefault = 50;
@@ -250,8 +250,10 @@ export const ListSshKeysQueryParams = zod.strictObject({
         .describe("Lists only the keys carrying this purpose. The key the platform generates carries `platform`"),
 });
 /**
- * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
- * @summary Add an SSH key
+ * Adds a key the project shares, such as one used by CI or a bastion. It belongs to the project rather than to the member adding it; a member adds a key of their own to their account (`POST /account/v1/me/ssh-keys` on the account API).
+ *
+ * Requires `iam:ssh_keys.manage`.
+ * @summary Add an SSH key to this project
  */
 export const CreateSshKeyBody = CreateSSHKeyRequestBody;
 /**
@@ -261,7 +263,7 @@ export const GetSshKeyParams = zod.strictObject({
     keyId: zod.uuid(),
 });
 /**
- * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist. Requires `iam:ssh_keys.manage`.
  * @summary Rename an SSH key
  */
 export const RenameSshKeyParams = zod.strictObject({
@@ -269,7 +271,7 @@ export const RenameSshKeyParams = zod.strictObject({
 });
 export const RenameSshKeyBody = RenameSSHKeyRequestBody;
 /**
- * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time. Requires `iam:ssh_keys.manage`.
  * @summary Revoke an SSH key
  */
 export const RevokeSshKeyParams = zod.strictObject({

package/dist/iam/v1/generated/validators/applicationResource.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/applicationResource.zod.js

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/attachPolicyRequestBody.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/attachPolicyRequestBody.zod.js

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/batchGetMembersRequestBody.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/batchGetMembersRequestBody.zod.js

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/batchGetMembersResponseBody.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/batchGetMembersResponseBody.zod.js

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/catalogListResponseBody.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/catalogListResponseBody.zod.js

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the

package/dist/iam/v1/generated/validators/catalogResource.zod.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the