@leaflow/sdk 0.0.0-dev.478.g138087b → 0.0.0-dev.482.g339e5e7

package/dist/iam/v1/generated/functions.js

@@ -2,7 +2,7 @@ export const getListPermissionsUrl = () => {
     return `https://iam.leaflow.cloud/api/v1/permissions`;
 };
 /**
- * Each service registers its own catalogue with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with its own catalogue, and this list only serves to render the choices. A service that has never started does not appear here.
+ * Each service registers the permissions it enforces with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with the permissions compiled into its own binary, and this list only serves to render the choices. A service that has never started does not appear here.
  * @summary List every permission the platform can grant
  */
 export const listPermissions = async (options, fetchFn) => {
@@ -125,7 +125,7 @@ export const getGetProjectMembershipUrl = () => {
     return `https://iam.leaflow.cloud/api/v1/membership`;
 };
 /**
- * Facts rather than a conclusion. There is no `allowed` field here, because each service holds the catalogue mapping its operations to permissions and decides on its own.
+ * Facts rather than a conclusion. There is no `allowed` field here, because each service holds the permissions its operations need and decides on its own.
  * @summary Get the caller's standing in this project
  */
 export const getProjectMembership = async (options, fetchFn) => {
@@ -153,7 +153,7 @@ export const listQuotas = async (options, fetchFn) => {
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getListProjectInvitationsUrl = (params) => {
+export const getListInvitationsUrl = (params) => {
     const normalizedParams = new URLSearchParams();
     Object.entries(params || {}).forEach(([key, value]) => {
         if (value !== undefined) {
@@ -169,8 +169,8 @@ export const getListProjectInvitationsUrl = (params) => {
  * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
  * @summary List the invitations this project is still waiting on
  */
-export const listProjectInvitations = async (params, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getListProjectInvitationsUrl(params), {
+export const listInvitations = async (params, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getListInvitationsUrl(params), {
         ...options,
         method: "GET",
     });
@@ -336,57 +336,17 @@ export const setMemberRoles = async (userId, setMemberRolesRequestBody, options,
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getSetMemberPermissionsUrl = (userId) => {
+export const getListMemberPermissionsUrl = (userId) => {
     return `https://iam.leaflow.cloud/api/v1/members/${encodeURIComponent(String(userId))}/permissions`;
 };
 /**
- * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
- * @summary Set the permissions attached directly to a member
- */
-export const setMemberPermissions = async (userId, setMemberPermissionsRequestBody, options, fetchFn) => {
-    const getHeaders = (h) => {
-        if (!h)
-            return {};
-        if (h instanceof Headers)
-            return Object.fromEntries(h.entries());
-        if (Symbol.iterator in h) {
-            return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
-        }
-        const headers = {};
-        for (const [name, value] of Object.entries(h)) {
-            if (value !== undefined)
-                headers[name] = value;
-        }
-        return headers;
-    };
-    const res = await (fetchFn ?? fetch)(getSetMemberPermissionsUrl(userId), {
-        ...options,
-        method: "PUT",
-        headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
-        body: JSON.stringify(setMemberPermissionsRequestBody),
-    });
-    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
-    const data = body ? JSON.parse(body) : {};
-    return { data, status: res.status, headers: res.headers };
-};
-export const getListPoliciesUrl = (params) => {
-    const normalizedParams = new URLSearchParams();
-    Object.entries(params || {}).forEach(([key, value]) => {
-        if (value !== undefined) {
-            normalizedParams.append(key, value === null ? "null" : String(value));
-        }
-    });
-    const stringifiedParams = normalizedParams.toString();
-    return stringifiedParams.length > 0
-        ? `https://iam.leaflow.cloud/api/v1/policies?${stringifiedParams}`
-        : `https://iam.leaflow.cloud/api/v1/policies`;
-};
-/**
- * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
- * @summary List the policies in this project
+ * Every row states one permission this person holds apart from their roles: project-wide when `resource_type` and `resource_id` are null, otherwise only on that resource. What a role grants is not listed here; the member's grant carries the roles and their compiled rules.
+ *
+ * Visible to any member, on the same rule as the member list.
+ * @summary List the permissions granted directly to a member
  */
-export const listPolicies = async (params, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getListPoliciesUrl(params), {
+export const listMemberPermissions = async (userId, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getListMemberPermissionsUrl(userId), {
         ...options,
         method: "GET",
     });
@@ -394,14 +354,18 @@ export const listPolicies = async (params, options, fetchFn) => {
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getAttachPolicyUrl = () => {
-    return `https://iam.leaflow.cloud/api/v1/policies`;
+export const getCreateMemberPermissionUrl = (userId) => {
+    return `https://iam.leaflow.cloud/api/v1/members/${encodeURIComponent(String(userId))}/permissions`;
 };
 /**
- * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
- * @summary Attach a policy
+ * Creates one permission row. The same row twice answers 409; changing a grant means revoking the row and creating another, so that each row records when it was granted.
+ *
+ * `OWNER` and `ADMIN` cannot be granted here, being facts on the membership. A permission that carries no resource dimension cannot be scoped: IAM refuses the row at grant time rather than storing a scope that would never hold.
+ *
+ * Requires `iam:members.manage`.
+ * @summary Grant a permission to a member
  */
-export const attachPolicy = async (attachPolicyRequestBody, options, fetchFn) => {
+export const createMemberPermission = async (userId, createMemberPermissionRequestBody, options, fetchFn) => {
     const getHeaders = (h) => {
         if (!h)
             return {};
@@ -417,74 +381,25 @@ export const attachPolicy = async (attachPolicyRequestBody, options, fetchFn) =>
         }
         return headers;
     };
-    const res = await (fetchFn ?? fetch)(getAttachPolicyUrl(), {
+    const res = await (fetchFn ?? fetch)(getCreateMemberPermissionUrl(userId), {
         ...options,
         method: "POST",
         headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
-        body: JSON.stringify(attachPolicyRequestBody),
-    });
-    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
-    const data = body ? JSON.parse(body) : {};
-    return { data, status: res.status, headers: res.headers };
-};
-export const getGetPolicyUrl = (policyId) => {
-    return `https://iam.leaflow.cloud/api/v1/policies/${encodeURIComponent(String(policyId))}`;
-};
-/**
- * Visible to any member, on the same rule as list-policies; no further permission is required.
- * @summary Get a policy
- */
-export const getPolicy = async (policyId, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getGetPolicyUrl(policyId), {
-        ...options,
-        method: "GET",
-    });
-    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
-    const data = body ? JSON.parse(body) : {};
-    return { data, status: res.status, headers: res.headers };
-};
-export const getUpdatePolicyUrl = (policyId) => {
-    return `https://iam.leaflow.cloud/api/v1/policies/${encodeURIComponent(String(policyId))}`;
-};
-/**
- * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
- * @summary Update a policy
- */
-export const updatePolicy = async (policyId, updatePolicyRequestBody, options, fetchFn) => {
-    const getHeaders = (h) => {
-        if (!h)
-            return {};
-        if (h instanceof Headers)
-            return Object.fromEntries(h.entries());
-        if (Symbol.iterator in h) {
-            return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
-        }
-        const headers = {};
-        for (const [name, value] of Object.entries(h)) {
-            if (value !== undefined)
-                headers[name] = value;
-        }
-        return headers;
-    };
-    const res = await (fetchFn ?? fetch)(getUpdatePolicyUrl(policyId), {
-        ...options,
-        method: "PUT",
-        headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
-        body: JSON.stringify(updatePolicyRequestBody),
+        body: JSON.stringify(createMemberPermissionRequestBody),
     });
     const body = [204, 205, 304].includes(res.status) ? null : await res.text();
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getDetachPolicyUrl = (policyId) => {
-    return `https://iam.leaflow.cloud/api/v1/policies/${encodeURIComponent(String(policyId))}`;
+export const getDeleteMemberPermissionUrl = (userId, permissionId) => {
+    return `https://iam.leaflow.cloud/api/v1/members/${encodeURIComponent(String(userId))}/permissions/${encodeURIComponent(String(permissionId))}`;
 };
 /**
- * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
- * @summary Detach a policy
+ * Removes that one row. Requires `iam:members.manage`.
+ * @summary Revoke a permission granted directly to a member
  */
-export const detachPolicy = async (policyId, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getDetachPolicyUrl(policyId), {
+export const deleteMemberPermission = async (userId, permissionId, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getDeleteMemberPermissionUrl(userId, permissionId), {
         ...options,
         method: "DELETE",
     });

package/dist/iam/v1/generated/models.d.ts

@@ -79,23 +79,9 @@ export interface PermissionResource {
     /** The kind of resource this permission is decided against; empty means it is decided at project level. **It need not be the object being operated on** — a compute route carries no project_id and is isolated through its parent network, so compute:route.create is decided against compute:private_network. A non-empty value also means the permission can be scoped to particular instances; create and list are always empty */
     resource_type: string;
 }
-export interface ResourceTypeResource {
-    /** The code of the resource type, such as dns:zone. There is no display name here either; what it reads as is decided by the layer rendering it */
-    name: string;
-}
-export interface CatalogResource {
-    /** @nullable */
-    permissions: PermissionResource[] | null;
-    /**
-     * The resource types this service declares. A scoped rule can only land on one of them
-     * @nullable
-     */
-    resource_types: ResourceTypeResource[] | null;
-    service: string;
-}
-export interface CatalogListResponseBody {
+export interface PermissionListResponseBody {
     /** @nullable */
-    items: CatalogResource[] | null;
+    items: PermissionResource[] | null;
 }
 export interface ResourceRefResource {
     /** A string rather than a UUID; a DNS zone is named by its domain, which IAM does not hold. Matching is glob, so `*.example.com` covers a set of subdomains, while a value carrying no glob metacharacter matches exactly */
@@ -130,7 +116,7 @@ export interface GrantResource {
      */
     roles: string[] | null;
     /**
-     * **The rules compiled from every policy that applies. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it
+     * **The rules compiled from the roles and grants that apply. Do not walk them to reach a decision.** They are here to render what a user may do; each request is decided by the service handling it
      * @nullable
      */
     rules: RuleResource[] | null;
@@ -281,6 +267,35 @@ export interface BatchGetMembersResponseBody {
     /** The people that resolved. Ids that never belonged to this project are absent, as are ids that do not resolve at all. */
     items: ResolvedMemberResource[];
 }
+export type MemberPermissionResourceEffect = (typeof MemberPermissionResourceEffect)[keyof typeof MemberPermissionResourceEffect];
+export declare const MemberPermissionResourceEffect: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+export interface MemberPermissionResource {
+    /** The id of this grant, used to revoke it */
+    id: string;
+    /**
+     * The code of the permission, such as compute:instance.delete
+     * @maxLength 128
+     */
+    permission: string;
+    effect: MemberPermissionResourceEffect;
+    /**
+     * The kind of resource this grant holds on, such as fleet:machine. Null with `resource_id` means it holds project-wide
+     * @maxLength 128
+     * @nullable
+     */
+    resource_type: string | null;
+    /**
+     * The resource identifier, which may carry a glob. Null with `resource_type` means the grant holds project-wide
+     * @maxLength 255
+     * @nullable
+     */
+    resource_id: string | null;
+    created_at: string;
+    updated_at: string;
+}
 export interface MemberResource {
     /** MD5 hash of the lowercased, trimmed email address, for use with Gravatar-compatible avatar services. Empty if the account has no email address. */
     avatar_hash: string;
@@ -290,6 +305,11 @@ export interface MemberResource {
     first_name: string;
     grant: GrantResource;
     last_name: string;
+    /**
+     * The permissions granted to this person directly, apart from their roles
+     * @nullable
+     */
+    permissions: MemberPermissionResource[] | null;
     user_id: string;
 }
 export interface LengthAwarePageMemberResource {
@@ -309,113 +329,35 @@ export interface SetMemberRolesRequestBody {
      */
     roles: string[] | null;
 }
-export interface SetMemberPermissionsRequestBody {
-    /**
-     * **Every** permission name to be attached directly to this person, replaced in full. The permissions a role grants are neither listed here nor touched by this write
-     * @nullable
-     */
-    permissions: string[] | null;
-}
-export type PolicyResourceEffect = (typeof PolicyResourceEffect)[keyof typeof PolicyResourceEffect];
-export declare const PolicyResourceEffect: {
-    readonly allow: "allow";
-    readonly deny: "deny";
-};
-export interface PolicyResource {
-    /** The base policy is the one whose effect is `allow` and which covers every resource. Each member holds exactly one, and it carries their ordinary roles. Change it with PUT /members/{userId}/roles and PUT /members/{userId}/permissions */
-    base: boolean;
-    created_at: string;
-    /** Why it was granted, written for a reader */
-    description: string;
-    effect: PolicyResourceEffect;
-    id: string;
-    /**
-     * Permission names attached directly to this person, without passing through a role
-     * @nullable
-     */
-    permissions: string[] | null;
-    /**
-     * Empty means the whole project
-     * @nullable
-     */
-    resources: ResourceRefResource[] | null;
-    /**
-     * The role codes this policy carries
-     * @nullable
-     */
-    roles: string[] | null;
-    updated_at: string;
-    user_id: string;
-}
-export interface PolicyListResponseBody {
+export interface MemberPermissionListResponseBody {
     /** @nullable */
-    items: PolicyResource[] | null;
+    items: MemberPermissionResource[] | null;
 }
-export type AttachPolicyRequestBodyEffect = (typeof AttachPolicyRequestBodyEffect)[keyof typeof AttachPolicyRequestBodyEffect];
-export declare const AttachPolicyRequestBodyEffect: {
+export type CreateMemberPermissionRequestBodyEffect = (typeof CreateMemberPermissionRequestBodyEffect)[keyof typeof CreateMemberPermissionRequestBodyEffect];
+export declare const CreateMemberPermissionRequestBodyEffect: {
     readonly allow: "allow";
     readonly deny: "deny";
 };
-export interface AttachPolicyRequestBody {
-    /**
-     * Why it was granted, written for a reader
-     * @maxLength 255
-     */
-    description?: string;
-    effect: AttachPolicyRequestBodyEffect;
-    /**
-     * Permission names attached directly, which avoids creating a role only one person holds
-     * @nullable
-     */
-    permissions?: string[] | null;
-    /**
-     * The policy holds only on these resources. Leaving it empty makes sense only together with `deny`, since an `allow` covering every resource is the base policy, which already exists
-     * @nullable
-     */
-    resources?: ResourceRefResource[] | null;
-    /**
-     * Each must be a role already defined in this project. `OWNER` and `ADMIN` are not accepted, being rules rather than sets of permissions
-     * @nullable
-     */
-    roles?: string[] | null;
+export interface CreateMemberPermissionRequestBody {
     /**
-     * Must already be a member of this project
+     * The code of the permission to grant
      * @minLength 1
-     * @maxLength 255
-     */
-    user_id: string;
-}
-/**
- * Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE
- */
-export type UpdatePolicyRequestBodyEffect = (typeof UpdatePolicyRequestBodyEffect)[keyof typeof UpdatePolicyRequestBodyEffect];
-export declare const UpdatePolicyRequestBodyEffect: {
-    readonly allow: "allow";
-    readonly deny: "deny";
-};
-export interface UpdatePolicyRequestBody {
-    /**
-     * Why it was granted, written for a reader. It is replaced together with the change, so that what remains does not explain an earlier version
-     * @maxLength 255
-     */
-    description?: string;
-    /** Must match the current effect of the policy. The effect itself cannot be changed; delete the policy and create another instead. It is still required in the request because the write replaces the policy in full, and omitting it would let a caller believe an effect had been changed while the field was ignored. A mismatch answers PROJECT_POLICY_EFFECT_IMMUTABLE */
-    effect: UpdatePolicyRequestBodyEffect;
-    /**
-     * Permission names attached directly, replaced in full. Anything not listed is withdrawn rather than kept
-     * @nullable
+     * @maxLength 128
      */
-    permissions?: string[] | null;
+    permission: string;
+    effect: CreateMemberPermissionRequestBodyEffect;
     /**
-     * The resource scope of this policy, replaced in full. What the scope contains can change; whether the policy has one cannot. A base policy cannot take a scope, and a scoped policy cannot have its scope cleared
+     * The kind of resource to hold on; give it together with `resource_id`. Both null grant the permission project-wide
+     * @maxLength 128
      * @nullable
      */
-    resources?: ResourceRefResource[] | null;
+    resource_type: string | null;
     /**
-     * Each must be a role already defined in this project, replaced in full. As when attaching, `OWNER` and `ADMIN` are not accepted
+     * The resource identifier to hold on, which may carry a glob. Give it together with `resource_type`
+     * @maxLength 255
      * @nullable
      */
-    roles?: string[] | null;
+    resource_id: string | null;
 }
 export interface TransferOwnershipRequestBody {
     /**
@@ -637,7 +579,7 @@ export interface CursorPagination {
     /** @nullable */
     next_cursor?: string | null;
 }
-export type ListProjectInvitationsParams = {
+export type ListInvitationsParams = {
     /**
      * Items returned in this page. Defaults to 50; at most 200.
      * @minimum 1
@@ -670,13 +612,6 @@ export type ListMembersParams = {
      */
     keyword?: string;
 };
-export type ListPoliciesParams = {
-    /**
-     * Restricts the result to one person. Omitting it covers the whole project
-     * @maxLength 255
-     */
-    userId?: string;
-};
 export type ListSshKeysParams = {
     /**
      * Items returned in this page. Defaults to 50; at most 200.

package/dist/iam/v1/generated/models.js

@@ -11,15 +11,11 @@ export const ProjectResourceStatus = {
     deleting: "deleting",
     deleted: "deleted",
 };
-export const PolicyResourceEffect = {
+export const MemberPermissionResourceEffect = {
     allow: "allow",
     deny: "deny",
 };
-export const AttachPolicyRequestBodyEffect = {
-    allow: "allow",
-    deny: "deny",
-};
-export const UpdatePolicyRequestBodyEffect = {
+export const CreateMemberPermissionRequestBodyEffect = {
     allow: "allow",
     deny: "deny",
 };

package/dist/iam/v1/generated/schemas.zod.d.ts

@@ -41,12 +41,12 @@ export declare const SetProjectSlugBody: zod.ZodObject<{
  * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
  * @summary List the invitations this project is still waiting on
  */
-export declare const listProjectInvitationsQueryLimitDefault = 50;
-export declare const listProjectInvitationsQueryLimitMax = 200;
-export declare const listProjectInvitationsQueryOffsetDefault = 0;
-export declare const listProjectInvitationsQueryOffsetMin = 0;
-export declare const listProjectInvitationsQueryOffsetMax = 10000;
-export declare const ListProjectInvitationsQueryParams: zod.ZodObject<{
+export declare const listInvitationsQueryLimitDefault = 50;
+export declare const listInvitationsQueryLimitMax = 200;
+export declare const listInvitationsQueryOffsetDefault = 0;
+export declare const listInvitationsQueryOffsetMin = 0;
+export declare const listInvitationsQueryOffsetMax = 10000;
+export declare const ListInvitationsQueryParams: zod.ZodObject<{
     limit: zod.ZodDefault<zod.ZodInt>;
     offset: zod.ZodDefault<zod.ZodInt>;
 }, zod.z.core.$strict>;
@@ -109,75 +109,44 @@ export declare const SetMemberRolesBody: zod.ZodObject<{
     roles: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
 }, zod.z.core.$strict>;
 /**
- * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
- * @summary Set the permissions attached directly to a member
+ * Every row states one permission this person holds apart from their roles: project-wide when `resource_type` and `resource_id` are null, otherwise only on that resource. What a role grants is not listed here; the member's grant carries the roles and their compiled rules.
+ *
+ * Visible to any member, on the same rule as the member list.
+ * @summary List the permissions granted directly to a member
  */
-export declare const setMemberPermissionsPathUserIdMax = 255;
-export declare const SetMemberPermissionsParams: zod.ZodObject<{
+export declare const listMemberPermissionsPathUserIdMax = 255;
+export declare const ListMemberPermissionsParams: zod.ZodObject<{
     userId: zod.ZodString;
 }, zod.z.core.$strict>;
-export declare const SetMemberPermissionsBody: zod.ZodObject<{
-    permissions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
-}, zod.z.core.$strict>;
-/**
- * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
- * @summary List the policies in this project
- */
-export declare const listPoliciesQueryUserIdMax = 255;
-export declare const ListPoliciesQueryParams: zod.ZodObject<{
-    userId: zod.ZodOptional<zod.ZodString>;
-}, zod.z.core.$strict>;
 /**
- * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
- * @summary Attach a policy
- */
-export declare const AttachPolicyBody: zod.ZodObject<{
-    description: zod.ZodOptional<zod.ZodString>;
-    effect: zod.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-    }>;
-    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        id: zod.ZodString;
-        type: zod.ZodString;
-    }, zod.z.core.$strict>>>>;
-    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    user_id: zod.ZodString;
-}, zod.z.core.$strict>;
-/**
- * Visible to any member, on the same rule as list-policies; no further permission is required.
- * @summary Get a policy
- */
-export declare const GetPolicyParams: zod.ZodObject<{
-    policyId: zod.ZodUUID;
-}, zod.z.core.$strict>;
-/**
- * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
- * @summary Update a policy
+ * Creates one permission row. The same row twice answers 409; changing a grant means revoking the row and creating another, so that each row records when it was granted.
+ *
+ * `OWNER` and `ADMIN` cannot be granted here, being facts on the membership. A permission that carries no resource dimension cannot be scoped: IAM refuses the row at grant time rather than storing a scope that would never hold.
+ *
+ * Requires `iam:members.manage`.
+ * @summary Grant a permission to a member
  */
-export declare const UpdatePolicyParams: zod.ZodObject<{
-    policyId: zod.ZodUUID;
+export declare const createMemberPermissionPathUserIdMax = 255;
+export declare const CreateMemberPermissionParams: zod.ZodObject<{
+    userId: zod.ZodString;
 }, zod.z.core.$strict>;
-export declare const UpdatePolicyBody: zod.ZodObject<{
-    description: zod.ZodOptional<zod.ZodString>;
+export declare const CreateMemberPermissionBody: zod.ZodObject<{
+    permission: zod.ZodString;
     effect: zod.ZodEnum<{
         allow: "allow";
         deny: "deny";
     }>;
-    permissions: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
-    resources: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
-        id: zod.ZodString;
-        type: zod.ZodString;
-    }, zod.z.core.$strict>>>>;
-    roles: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>;
+    resource_type: zod.ZodNullable<zod.ZodString>;
+    resource_id: zod.ZodNullable<zod.ZodString>;
 }, zod.z.core.$strict>;
 /**
- * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
- * @summary Detach a policy
+ * Removes that one row. Requires `iam:members.manage`.
+ * @summary Revoke a permission granted directly to a member
  */
-export declare const DetachPolicyParams: zod.ZodObject<{
-    policyId: zod.ZodUUID;
+export declare const deleteMemberPermissionPathUserIdMax = 255;
+export declare const DeleteMemberPermissionParams: zod.ZodObject<{
+    userId: zod.ZodString;
+    permissionId: zod.ZodUUID;
 }, zod.z.core.$strict>;
 /**
  * The only way `OWNER` moves, and only the owner can initiate it.