@leaflow/sdk 0.0.0-dev.481.g3bd94d5 → 0.0.0-dev.482.g339e5e7

package/dist/iam/v1/generated/functions.d.ts

@@ -12,7 +12,7 @@
  * project. It does not state whether a given operation is allowed; each service declares which permission its own operations require.
  * OpenAPI spec version: 1.0.0
  */
-import type { ApplicationResource, AttachPolicyRequestBody, BatchGetMembersRequestBody, BatchGetMembersResponseBody, CatalogListResponseBody, CreateApplicationRequestBody, CreateApplicationResponseBody, CreateRoleRequestBody, CreateSSHKeyRequestBody, Error, IssueInvitationRequestBody, IssuedInvitationResponseBody, LengthAwarePageApplicationResource, LengthAwarePageInvitationResource, LengthAwarePageMemberResource, LengthAwarePageSSHKeyResource, ListApplicationsParams, ListMembersParams, ListPoliciesParams, ListProjectInvitationsParams, ListSshKeysParams, MemberResource, MembershipResource, OwnershipTransferResponseBody, PolicyListResponseBody, PolicyResource, ProjectAccessResource, QuotaListResponseBody, RenameSSHKeyRequestBody, RoleListResponseBody, RoleResource, RotateApplicationSecretResponseBody, SSHKeyResource, SetMemberPermissionsRequestBody, SetMemberRolesRequestBody, SetProjectSlugRequestBody, TransferOwnershipRequestBody, UpdateApplicationRequestBody, UpdatePolicyRequestBody, UpdateProjectRequestBody, UpdateRoleRequestBody } from "./models.js";
+import type { ApplicationResource, BatchGetMembersRequestBody, BatchGetMembersResponseBody, CreateApplicationRequestBody, CreateApplicationResponseBody, CreateMemberPermissionRequestBody, CreateRoleRequestBody, CreateSSHKeyRequestBody, Error, IssueInvitationRequestBody, IssuedInvitationResponseBody, LengthAwarePageApplicationResource, LengthAwarePageInvitationResource, LengthAwarePageMemberResource, LengthAwarePageSSHKeyResource, ListApplicationsParams, ListInvitationsParams, ListMembersParams, ListSshKeysParams, MemberPermissionListResponseBody, MemberPermissionResource, MemberResource, MembershipResource, OwnershipTransferResponseBody, PermissionListResponseBody, ProjectAccessResource, QuotaListResponseBody, RenameSSHKeyRequestBody, RoleListResponseBody, RoleResource, RotateApplicationSecretResponseBody, SSHKeyResource, SetMemberRolesRequestBody, SetProjectSlugRequestBody, TransferOwnershipRequestBody, UpdateApplicationRequestBody, UpdateProjectRequestBody, UpdateRoleRequestBody } from "./models.js";
 export type HTTPStatusCode1xx = 100 | 101 | 102 | 103;
 export type HTTPStatusCode2xx = 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207;
 export type HTTPStatusCode3xx = 300 | 301 | 302 | 303 | 304 | 305 | 307 | 308;
@@ -20,7 +20,7 @@ export type HTTPStatusCode4xx = 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 |
 export type HTTPStatusCode5xx = 500 | 501 | 502 | 503 | 504 | 505 | 507 | 511;
 export type HTTPStatusCodes = HTTPStatusCode1xx | HTTPStatusCode2xx | HTTPStatusCode3xx | HTTPStatusCode4xx | HTTPStatusCode5xx;
 export type listPermissionsResponse200 = {
-    data: CatalogListResponseBody;
+    data: PermissionListResponseBody;
     status: 200;
 };
 export type listPermissionsResponseDefault = {
@@ -36,7 +36,7 @@ export type listPermissionsResponseError = listPermissionsResponseDefault & {
 export type listPermissionsResponse = listPermissionsResponseSuccess | listPermissionsResponseError;
 export declare const getListPermissionsUrl: () => string;
 /**
- * Each service registers its own catalogue with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with its own catalogue, and this list only serves to render the choices. A service that has never started does not appear here.
+ * Each service registers the permissions it enforces with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with the permissions compiled into its own binary, and this list only serves to render the choices. A service that has never started does not appear here.
  * @summary List every permission the platform can grant
  */
 export declare const listPermissions: (options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listPermissionsResponse>;
@@ -150,7 +150,7 @@ export type getProjectMembershipResponseError = getProjectMembershipResponseDefa
 export type getProjectMembershipResponse = getProjectMembershipResponseSuccess | getProjectMembershipResponseError;
 export declare const getGetProjectMembershipUrl: () => string;
 /**
- * Facts rather than a conclusion. There is no `allowed` field here, because each service holds the catalogue mapping its operations to permissions and decides on its own.
+ * Facts rather than a conclusion. There is no `allowed` field here, because each service holds the permissions its operations need and decides on its own.
  * @summary Get the caller's standing in this project
  */
 export declare const getProjectMembership: (options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getProjectMembershipResponse>;
@@ -175,27 +175,27 @@ export declare const getListQuotasUrl: () => string;
  * @summary List this project's quotas
  */
 export declare const listQuotas: (options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listQuotasResponse>;
-export type listProjectInvitationsResponse200 = {
+export type listInvitationsResponse200 = {
     data: LengthAwarePageInvitationResource;
     status: 200;
 };
-export type listProjectInvitationsResponseDefault = {
+export type listInvitationsResponseDefault = {
     data: Error;
     status: Exclude<HTTPStatusCodes, 200>;
 };
-export type listProjectInvitationsResponseSuccess = listProjectInvitationsResponse200 & {
+export type listInvitationsResponseSuccess = listInvitationsResponse200 & {
     headers: Headers;
 };
-export type listProjectInvitationsResponseError = listProjectInvitationsResponseDefault & {
+export type listInvitationsResponseError = listInvitationsResponseDefault & {
     headers: Headers;
 };
-export type listProjectInvitationsResponse = listProjectInvitationsResponseSuccess | listProjectInvitationsResponseError;
-export declare const getListProjectInvitationsUrl: (params?: ListProjectInvitationsParams) => string;
+export type listInvitationsResponse = listInvitationsResponseSuccess | listInvitationsResponseError;
+export declare const getListInvitationsUrl: (params?: ListInvitationsParams) => string;
 /**
  * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
  * @summary List the invitations this project is still waiting on
  */
-export declare const listProjectInvitations: (params?: ListProjectInvitationsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listProjectInvitationsResponse>;
+export declare const listInvitations: (params?: ListInvitationsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listInvitationsResponse>;
 export type issueInvitationResponse201 = {
     data: IssuedInvitationResponseBody;
     status: 201;
@@ -324,132 +324,75 @@ export declare const getSetMemberRolesUrl: (userId: string) => string;
  * @summary Set the roles a member holds
  */
 export declare const setMemberRoles: (userId: string, setMemberRolesRequestBody: SetMemberRolesRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<setMemberRolesResponse>;
-export type setMemberPermissionsResponse200 = {
-    data: PolicyResource;
+export type listMemberPermissionsResponse200 = {
+    data: MemberPermissionListResponseBody;
     status: 200;
 };
-export type setMemberPermissionsResponseDefault = {
+export type listMemberPermissionsResponseDefault = {
     data: Error;
     status: Exclude<HTTPStatusCodes, 200>;
 };
-export type setMemberPermissionsResponseSuccess = setMemberPermissionsResponse200 & {
+export type listMemberPermissionsResponseSuccess = listMemberPermissionsResponse200 & {
     headers: Headers;
 };
-export type setMemberPermissionsResponseError = setMemberPermissionsResponseDefault & {
+export type listMemberPermissionsResponseError = listMemberPermissionsResponseDefault & {
     headers: Headers;
 };
-export type setMemberPermissionsResponse = setMemberPermissionsResponseSuccess | setMemberPermissionsResponseError;
-export declare const getSetMemberPermissionsUrl: (userId: string) => string;
+export type listMemberPermissionsResponse = listMemberPermissionsResponseSuccess | listMemberPermissionsResponseError;
+export declare const getListMemberPermissionsUrl: (userId: string) => string;
 /**
- * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
- * @summary Set the permissions attached directly to a member
- */
-export declare const setMemberPermissions: (userId: string, setMemberPermissionsRequestBody: SetMemberPermissionsRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<setMemberPermissionsResponse>;
-export type listPoliciesResponse200 = {
-    data: PolicyListResponseBody;
-    status: 200;
-};
-export type listPoliciesResponseDefault = {
-    data: Error;
-    status: Exclude<HTTPStatusCodes, 200>;
-};
-export type listPoliciesResponseSuccess = listPoliciesResponse200 & {
-    headers: Headers;
-};
-export type listPoliciesResponseError = listPoliciesResponseDefault & {
-    headers: Headers;
-};
-export type listPoliciesResponse = listPoliciesResponseSuccess | listPoliciesResponseError;
-export declare const getListPoliciesUrl: (params?: ListPoliciesParams) => string;
-/**
- * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
- * @summary List the policies in this project
+ * Every row states one permission this person holds apart from their roles: project-wide when `resource_type` and `resource_id` are null, otherwise only on that resource. What a role grants is not listed here; the member's grant carries the roles and their compiled rules.
+ *
+ * Visible to any member, on the same rule as the member list.
+ * @summary List the permissions granted directly to a member
  */
-export declare const listPolicies: (params?: ListPoliciesParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listPoliciesResponse>;
-export type attachPolicyResponse201 = {
-    data: PolicyResource;
+export declare const listMemberPermissions: (userId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listMemberPermissionsResponse>;
+export type createMemberPermissionResponse201 = {
+    data: MemberPermissionResource;
     status: 201;
 };
-export type attachPolicyResponseDefault = {
+export type createMemberPermissionResponseDefault = {
     data: Error;
     status: Exclude<HTTPStatusCodes, 201>;
 };
-export type attachPolicyResponseSuccess = attachPolicyResponse201 & {
-    headers: Headers;
-};
-export type attachPolicyResponseError = attachPolicyResponseDefault & {
-    headers: Headers;
-};
-export type attachPolicyResponse = attachPolicyResponseSuccess | attachPolicyResponseError;
-export declare const getAttachPolicyUrl: () => string;
-/**
- * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
- * @summary Attach a policy
- */
-export declare const attachPolicy: (attachPolicyRequestBody: AttachPolicyRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<attachPolicyResponse>;
-export type getPolicyResponse200 = {
-    data: PolicyResource;
-    status: 200;
-};
-export type getPolicyResponseDefault = {
-    data: Error;
-    status: Exclude<HTTPStatusCodes, 200>;
-};
-export type getPolicyResponseSuccess = getPolicyResponse200 & {
-    headers: Headers;
-};
-export type getPolicyResponseError = getPolicyResponseDefault & {
-    headers: Headers;
-};
-export type getPolicyResponse = getPolicyResponseSuccess | getPolicyResponseError;
-export declare const getGetPolicyUrl: (policyId: string) => string;
-/**
- * Visible to any member, on the same rule as list-policies; no further permission is required.
- * @summary Get a policy
- */
-export declare const getPolicy: (policyId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getPolicyResponse>;
-export type updatePolicyResponse200 = {
-    data: PolicyResource;
-    status: 200;
-};
-export type updatePolicyResponseDefault = {
-    data: Error;
-    status: Exclude<HTTPStatusCodes, 200>;
-};
-export type updatePolicyResponseSuccess = updatePolicyResponse200 & {
+export type createMemberPermissionResponseSuccess = createMemberPermissionResponse201 & {
     headers: Headers;
 };
-export type updatePolicyResponseError = updatePolicyResponseDefault & {
+export type createMemberPermissionResponseError = createMemberPermissionResponseDefault & {
     headers: Headers;
 };
-export type updatePolicyResponse = updatePolicyResponseSuccess | updatePolicyResponseError;
-export declare const getUpdatePolicyUrl: (policyId: string) => string;
+export type createMemberPermissionResponse = createMemberPermissionResponseSuccess | createMemberPermissionResponseError;
+export declare const getCreateMemberPermissionUrl: (userId: string) => string;
 /**
- * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
- * @summary Update a policy
+ * Creates one permission row. The same row twice answers 409; changing a grant means revoking the row and creating another, so that each row records when it was granted.
+ *
+ * `OWNER` and `ADMIN` cannot be granted here, being facts on the membership. A permission that carries no resource dimension cannot be scoped: IAM refuses the row at grant time rather than storing a scope that would never hold.
+ *
+ * Requires `iam:members.manage`.
+ * @summary Grant a permission to a member
  */
-export declare const updatePolicy: (policyId: string, updatePolicyRequestBody: UpdatePolicyRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<updatePolicyResponse>;
-export type detachPolicyResponse204 = {
+export declare const createMemberPermission: (userId: string, createMemberPermissionRequestBody: CreateMemberPermissionRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createMemberPermissionResponse>;
+export type deleteMemberPermissionResponse204 = {
     data: void;
     status: 204;
 };
-export type detachPolicyResponseDefault = {
+export type deleteMemberPermissionResponseDefault = {
     data: Error;
     status: Exclude<HTTPStatusCodes, 204>;
 };
-export type detachPolicyResponseSuccess = detachPolicyResponse204 & {
+export type deleteMemberPermissionResponseSuccess = deleteMemberPermissionResponse204 & {
     headers: Headers;
 };
-export type detachPolicyResponseError = detachPolicyResponseDefault & {
+export type deleteMemberPermissionResponseError = deleteMemberPermissionResponseDefault & {
     headers: Headers;
 };
-export type detachPolicyResponse = detachPolicyResponseSuccess | detachPolicyResponseError;
-export declare const getDetachPolicyUrl: (policyId: string) => string;
+export type deleteMemberPermissionResponse = deleteMemberPermissionResponseSuccess | deleteMemberPermissionResponseError;
+export declare const getDeleteMemberPermissionUrl: (userId: string, permissionId: string) => string;
 /**
- * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
- * @summary Detach a policy
+ * Removes that one row. Requires `iam:members.manage`.
+ * @summary Revoke a permission granted directly to a member
  */
-export declare const detachPolicy: (policyId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<detachPolicyResponse>;
+export declare const deleteMemberPermission: (userId: string, permissionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteMemberPermissionResponse>;
 export type transferProjectOwnershipResponse200 = {
     data: OwnershipTransferResponseBody;
     status: 200;

package/dist/iam/v1/generated/functions.js

@@ -2,7 +2,7 @@ export const getListPermissionsUrl = () => {
     return `https://iam.leaflow.cloud/api/v1/permissions`;
 };
 /**
- * Each service registers its own catalogue with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with its own catalogue, and this list only serves to render the choices. A service that has never started does not appear here.
+ * Each service registers the permissions it enforces with IAM at start-up, so this is the platform-wide list rather than the permissions of IAM alone. **IAM does not decide anything with it** — each service decides using the caller's grant together with the permissions compiled into its own binary, and this list only serves to render the choices. A service that has never started does not appear here.
  * @summary List every permission the platform can grant
  */
 export const listPermissions = async (options, fetchFn) => {
@@ -125,7 +125,7 @@ export const getGetProjectMembershipUrl = () => {
     return `https://iam.leaflow.cloud/api/v1/membership`;
 };
 /**
- * Facts rather than a conclusion. There is no `allowed` field here, because each service holds the catalogue mapping its operations to permissions and decides on its own.
+ * Facts rather than a conclusion. There is no `allowed` field here, because each service holds the permissions its operations need and decides on its own.
  * @summary Get the caller's standing in this project
  */
 export const getProjectMembership = async (options, fetchFn) => {
@@ -153,7 +153,7 @@ export const listQuotas = async (options, fetchFn) => {
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getListProjectInvitationsUrl = (params) => {
+export const getListInvitationsUrl = (params) => {
     const normalizedParams = new URLSearchParams();
     Object.entries(params || {}).forEach(([key, value]) => {
         if (value !== undefined) {
@@ -169,8 +169,8 @@ export const getListProjectInvitationsUrl = (params) => {
  * Visible to any member, on the same rule as the member list. Who has been invited is part of who is in the project.
  * @summary List the invitations this project is still waiting on
  */
-export const listProjectInvitations = async (params, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getListProjectInvitationsUrl(params), {
+export const listInvitations = async (params, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getListInvitationsUrl(params), {
         ...options,
         method: "GET",
     });
@@ -336,57 +336,17 @@ export const setMemberRoles = async (userId, setMemberRolesRequestBody, options,
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getSetMemberPermissionsUrl = (userId) => {
+export const getListMemberPermissionsUrl = (userId) => {
     return `https://iam.leaflow.cloud/api/v1/members/${encodeURIComponent(String(userId))}/permissions`;
 };
 /**
- * Replaces, in full, the permissions attached directly to the base policy. A direct permission grants one person something without creating a role only they hold, and it does not follow later changes to any role. Requires `iam:members.manage`.
- * @summary Set the permissions attached directly to a member
- */
-export const setMemberPermissions = async (userId, setMemberPermissionsRequestBody, options, fetchFn) => {
-    const getHeaders = (h) => {
-        if (!h)
-            return {};
-        if (h instanceof Headers)
-            return Object.fromEntries(h.entries());
-        if (Symbol.iterator in h) {
-            return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
-        }
-        const headers = {};
-        for (const [name, value] of Object.entries(h)) {
-            if (value !== undefined)
-                headers[name] = value;
-        }
-        return headers;
-    };
-    const res = await (fetchFn ?? fetch)(getSetMemberPermissionsUrl(userId), {
-        ...options,
-        method: "PUT",
-        headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
-        body: JSON.stringify(setMemberPermissionsRequestBody),
-    });
-    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
-    const data = body ? JSON.parse(body) : {};
-    return { data, status: res.status, headers: res.headers };
-};
-export const getListPoliciesUrl = (params) => {
-    const normalizedParams = new URLSearchParams();
-    Object.entries(params || {}).forEach(([key, value]) => {
-        if (value !== undefined) {
-            normalizedParams.append(key, value === null ? "null" : String(value));
-        }
-    });
-    const stringifiedParams = normalizedParams.toString();
-    return stringifiedParams.length > 0
-        ? `https://iam.leaflow.cloud/api/v1/policies?${stringifiedParams}`
-        : `https://iam.leaflow.cloud/api/v1/policies`;
-};
-/**
- * Visible to any member, on the same rule as the member list. What has been granted to whom is part of who is in the project.
- * @summary List the policies in this project
+ * Every row states one permission this person holds apart from their roles: project-wide when `resource_type` and `resource_id` are null, otherwise only on that resource. What a role grants is not listed here; the member's grant carries the roles and their compiled rules.
+ *
+ * Visible to any member, on the same rule as the member list.
+ * @summary List the permissions granted directly to a member
  */
-export const listPolicies = async (params, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getListPoliciesUrl(params), {
+export const listMemberPermissions = async (userId, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getListMemberPermissionsUrl(userId), {
         ...options,
         method: "GET",
     });
@@ -394,14 +354,18 @@ export const listPolicies = async (params, options, fetchFn) => {
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getAttachPolicyUrl = () => {
-    return `https://iam.leaflow.cloud/api/v1/policies`;
+export const getCreateMemberPermissionUrl = (userId) => {
+    return `https://iam.leaflow.cloud/api/v1/members/${encodeURIComponent(String(userId))}/permissions`;
 };
 /**
- * This creates an **additional** policy, which either carries a resource scope or has `deny` as its effect. An `allow` covering every resource is a base policy, of which each member holds exactly one, and it is changed with set-member-roles and set-member-permissions. `roles` cannot contain `OWNER` or `ADMIN`. Requires `iam:members.manage`.
- * @summary Attach a policy
+ * Creates one permission row. The same row twice answers 409; changing a grant means revoking the row and creating another, so that each row records when it was granted.
+ *
+ * `OWNER` and `ADMIN` cannot be granted here, being facts on the membership. A permission that carries no resource dimension cannot be scoped: IAM refuses the row at grant time rather than storing a scope that would never hold.
+ *
+ * Requires `iam:members.manage`.
+ * @summary Grant a permission to a member
  */
-export const attachPolicy = async (attachPolicyRequestBody, options, fetchFn) => {
+export const createMemberPermission = async (userId, createMemberPermissionRequestBody, options, fetchFn) => {
     const getHeaders = (h) => {
         if (!h)
             return {};
@@ -417,74 +381,25 @@ export const attachPolicy = async (attachPolicyRequestBody, options, fetchFn) =>
         }
         return headers;
     };
-    const res = await (fetchFn ?? fetch)(getAttachPolicyUrl(), {
+    const res = await (fetchFn ?? fetch)(getCreateMemberPermissionUrl(userId), {
         ...options,
         method: "POST",
         headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
-        body: JSON.stringify(attachPolicyRequestBody),
-    });
-    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
-    const data = body ? JSON.parse(body) : {};
-    return { data, status: res.status, headers: res.headers };
-};
-export const getGetPolicyUrl = (policyId) => {
-    return `https://iam.leaflow.cloud/api/v1/policies/${encodeURIComponent(String(policyId))}`;
-};
-/**
- * Visible to any member, on the same rule as list-policies; no further permission is required.
- * @summary Get a policy
- */
-export const getPolicy = async (policyId, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getGetPolicyUrl(policyId), {
-        ...options,
-        method: "GET",
-    });
-    const body = [204, 205, 304].includes(res.status) ? null : await res.text();
-    const data = body ? JSON.parse(body) : {};
-    return { data, status: res.status, headers: res.headers };
-};
-export const getUpdatePolicyUrl = (policyId) => {
-    return `https://iam.leaflow.cloud/api/v1/policies/${encodeURIComponent(String(policyId))}`;
-};
-/**
- * Replaced in full rather than field by field — `resources`, `roles` and `permissions` are each overwritten, and an omitted one becomes empty. The **kind** of a policy cannot change — a base policy (an `allow` covering every resource) cannot take a resource scope, and a scoped policy cannot have its scope cleared. Delete and recreate to change the kind. Requires `iam:members.manage`.
- * @summary Update a policy
- */
-export const updatePolicy = async (policyId, updatePolicyRequestBody, options, fetchFn) => {
-    const getHeaders = (h) => {
-        if (!h)
-            return {};
-        if (h instanceof Headers)
-            return Object.fromEntries(h.entries());
-        if (Symbol.iterator in h) {
-            return Object.fromEntries(Array.from(h, (entry) => Array.from(entry)));
-        }
-        const headers = {};
-        for (const [name, value] of Object.entries(h)) {
-            if (value !== undefined)
-                headers[name] = value;
-        }
-        return headers;
-    };
-    const res = await (fetchFn ?? fetch)(getUpdatePolicyUrl(policyId), {
-        ...options,
-        method: "PUT",
-        headers: { "Content-Type": "application/json", ...getHeaders(options?.headers) },
-        body: JSON.stringify(updatePolicyRequestBody),
+        body: JSON.stringify(createMemberPermissionRequestBody),
     });
     const body = [204, 205, 304].includes(res.status) ? null : await res.text();
     const data = body ? JSON.parse(body) : {};
     return { data, status: res.status, headers: res.headers };
 };
-export const getDetachPolicyUrl = (policyId) => {
-    return `https://iam.leaflow.cloud/api/v1/policies/${encodeURIComponent(String(policyId))}`;
+export const getDeleteMemberPermissionUrl = (userId, permissionId) => {
+    return `https://iam.leaflow.cloud/api/v1/members/${encodeURIComponent(String(userId))}/permissions/${encodeURIComponent(String(permissionId))}`;
 };
 /**
- * A base policy cannot be detached; it is where a member's roles sit. Use remove-member to take someone out of the project. Requires `iam:members.manage`.
- * @summary Detach a policy
+ * Removes that one row. Requires `iam:members.manage`.
+ * @summary Revoke a permission granted directly to a member
  */
-export const detachPolicy = async (policyId, options, fetchFn) => {
-    const res = await (fetchFn ?? fetch)(getDetachPolicyUrl(policyId), {
+export const deleteMemberPermission = async (userId, permissionId, options, fetchFn) => {
+    const res = await (fetchFn ?? fetch)(getDeleteMemberPermissionUrl(userId, permissionId), {
         ...options,
         method: "DELETE",
     });