@leaflow/sdk 0.189.0 → 0.190.0

package/dist/fleet/v1/generated/validators/renewParticipantResponse.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/replaceMcpConfigurationRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/replaceMcpConfigurationRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/rtcConfiguration.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/rtcConfiguration.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/runCommandRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/runCommandRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/runCommandResponse.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/runCommandResponse.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sendMcpRequestRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sendMcpRequestRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sendMcpRequestResponse.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sendMcpRequestResponse.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionCloseReason.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionCloseReason.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionList.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionList.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionMode.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionMode.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionResource.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionResource.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionState.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/sessionState.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signedMessage.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signedMessage.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signingKey.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/signingKey.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateAccountRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateAccountRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateGroupRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateGroupRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMachineRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMachineRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerResponse.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updateMcpServerResponse.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updatePrivilegeAutoApprovalRequest.zod.d.ts

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/fleet/v1/generated/validators/updatePrivilegeAutoApprovalRequest.zod.js

@@ -105,8 +105,9 @@
  * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
  * Elevation through sudo is never approved by a password; see "Approving sudo".
  *
- * Members log in over SSH with the keys they own among the project's SSH keys, while they may
- * log in to the machine.
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine. The SSH keys a project shares sign in
+ * to no directory account.
  *
  * Machines resolve directory accounts and groups themselves and never write them into their local
  * account files. A local account or group that already uses a name or id of the directory keeps

package/dist/iam/v1/generated/functions.d.ts

@@ -2,7 +2,7 @@
  * Generated by orval 🍺
  * Do not edit manually.
  * Leaflow IAM API
- * What happens inside a project: members, roles, invitations and SSH keys.
+ * What happens inside a project: members, roles, invitations and the SSH keys the project shares.
  *
  * Every request carries a scoped token; see the `bearerAuth` security scheme. No path carries a
  * `projectId`, and the current project is the one the token states. Tokens are obtained from the
@@ -590,7 +590,7 @@ export type listSshKeysResponseError = listSshKeysResponseDefault & {
 export type listSshKeysResponse = listSshKeysResponseSuccess | listSshKeysResponseError;
 export declare const getListSshKeysUrl: (params?: ListSshKeysParams) => string;
 /**
- * Both the keys belonging to members and the keys belonging to the project are listed; the `owner_user_id` on each one tells them apart.
+ * The keys the project shares. The keys of members are their own and belong to their accounts (`/account/v1/me/ssh-keys` on the account API), so they are not listed here.
  * @summary List the SSH keys of this project
  */
 export declare const listSshKeys: (params?: ListSshKeysParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listSshKeysResponse>;
@@ -611,8 +611,10 @@ export type createSshKeyResponseError = createSshKeyResponseDefault & {
 export type createSshKeyResponse = createSshKeyResponseSuccess | createSshKeyResponseError;
 export declare const getCreateSshKeyUrl: () => string;
 /**
- * `owner=me` adds a key of the caller's own, which any member may do. `owner=project` adds a key shared by the project, requires `iam:ssh_keys.manage`, and lands on every machine created in the project afterwards.
- * @summary Add an SSH key
+ * Adds a key the project shares, such as one used by CI or a bastion. Compute installs it on every server created in the project afterwards. It belongs to no member, so it signs in as nobody on Fleet machines; a member adds a key of their own to their account (`POST /account/v1/me/ssh-keys` on the account API).
+ *
+ * Requires `iam:ssh_keys.manage`.
+ * @summary Add an SSH key to this project
  */
 export declare const createSshKey: (createSSHKeyRequestBody: CreateSSHKeyRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createSshKeyResponse>;
 export type getSshKeyResponse200 = {
@@ -652,7 +654,7 @@ export type renameSshKeyResponseError = renameSshKeyResponseDefault & {
 export type renameSshKeyResponse = renameSshKeyResponseSuccess | renameSshKeyResponseError;
 export declare const getRenameSshKeyUrl: (keyId: string) => string;
 /**
- * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist.
+ * Only the name can change. The key, its type and its fingerprint are three statements about one thing, and changing one of them would leave the row describing a key that does not exist. Requires `iam:ssh_keys.manage`.
  * @summary Rename an SSH key
  */
 export declare const renameSshKey: (keyId: string, renameSSHKeyRequestBody: RenameSSHKeyRequestBody, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<renameSshKeyResponse>;
@@ -673,7 +675,7 @@ export type revokeSshKeyResponseError = revokeSshKeyResponseDefault & {
 export type revokeSshKeyResponse = revokeSshKeyResponseSuccess | revokeSshKeyResponseError;
 export declare const getRevokeSshKeyUrl: (keyId: string) => string;
 /**
- * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time.
+ * The row remains and its status becomes `REVOKED`, so it stays answerable afterwards which key was trusted at the time. A server on which Compute installed the key keeps it until it is removed there. Requires `iam:ssh_keys.manage`.
  * @summary Revoke an SSH key
  */
 export declare const revokeSshKey: (keyId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<revokeSshKeyResponse>;