@origincloud/iam 0.26.0 → 0.28.0

package/dist/v1beta1/audit_log.d.ts

@@ -50,8 +50,9 @@ export interface AuditLogEntry {
      * Who made the change, as it was when the change was made:
      * `user:{email}` with the verified address the account had then,
      * `userId:{user}` when none was recorded, `serviceAccount:{service_account}`,
-     * or `platform` for a change the platform made itself. A later change of
-     * address doesn't change it.
+     * `serviceAgent:{service_agent}` for a platform service agent acting in
+     * the organization, or `platform` for a change the platform made itself.
+     * A later change of address doesn't change it.
      */
     actor?: string;
     /**
@@ -82,6 +83,12 @@ export declare const AuditLogEntry_Outcome: {
     readonly SUCCEEDED: "SUCCEEDED";
     /** It was refused for lack of a permission. */
     readonly DENIED: "DENIED";
+    /**
+     * It was attempted and refused for another reason, which `details`
+     * names in `reason`, such as a key asked to decrypt under the wrong
+     * encryption context.
+     */
+    readonly FAILED: "FAILED";
 };
 /** Whether the change was made. */
 export type AuditLogEntry_Outcome = (typeof AuditLogEntry_Outcome)[keyof typeof AuditLogEntry_Outcome];
@@ -104,8 +111,8 @@ export interface ListAuditLogEntriesRequest {
     project?: string;
     /**
      * Only the entries of changes made by this member's account,
-     * `user:{email}` or `serviceAccount:{service_account}`. Every actor's
-     * when empty.
+     * `user:{email}`, `serviceAccount:{service_account}` or
+     * `serviceAgent:{service_agent}`. Every actor's when empty.
      */
     actor?: string;
     /**

package/dist/v1beta1/audit_log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log.d.ts","sourceRoot":"","sources":["../../src/v1beta1/audit_log.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,yEAAyE;gBAC7D,MAAM,EAAE,MAAM;IAI1B;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAavG;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAa3H;;;;OAIG;IACI,kBAAkB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC;CAQtI;AAED,2BAA2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,mCAAmC;AACnC,eAAO,MAAM,qBAAqB;IAChC,eAAe;;IAEf,mBAAmB;;IAEnB,+CAA+C;;CAEvC,CAAC;AAEX,mCAAmC;AACnC,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAEvG,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;IAClC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"audit_log.d.ts","sourceRoot":"","sources":["../../src/v1beta1/audit_log.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,yEAAyE;gBAC7D,MAAM,EAAE,MAAM;IAI1B;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAavG;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAa3H;;;;OAIG;IACI,kBAAkB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC;CAQtI;AAED,2BAA2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,mCAAmC;AACnC,eAAO,MAAM,qBAAqB;IAChC,eAAe;;IAEf,mBAAmB;;IAEnB,+CAA+C;;IAE/C;;;;OAIG;;CAEK,CAAC;AAEX,mCAAmC;AACnC,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAEvG,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;IAClC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/v1beta1/audit_log.js

@@ -73,5 +73,11 @@ export const AuditLogEntry_Outcome = {
     SUCCEEDED: "SUCCEEDED",
     /** It was refused for lack of a permission. */
     DENIED: "DENIED",
+    /**
+     * It was attempted and refused for another reason, which `details`
+     * names in `reason`, such as a key asked to decrypt under the wrong
+     * encryption context.
+     */
+    FAILED: "FAILED",
 };
 //# sourceMappingURL=audit_log.js.map

package/dist/v1beta1/audit_log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../src/v1beta1/audit_log.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,kDAAkD;AAElD,OAAO,EAA+C,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACzB;;;OAGG;IACM,OAAO,CAAU;IAE1B,yEAAyE;IACzE,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAmC,EAAE,OAAqB;QAClF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,kBAAkB;YACtC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,kBAAkB,CAAC,OAAmC,EAAE,OAAqB;QAClF,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/D,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;CACF;AAwCD,mCAAmC;AACnC,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB;IACnB,SAAS,EAAE,WAAW;IACtB,+CAA+C;IAC/C,MAAM,EAAE,QAAQ;CACR,CAAC"}
+{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../src/v1beta1/audit_log.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,kDAAkD;AAElD,OAAO,EAA+C,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACzB;;;OAGG;IACM,OAAO,CAAU;IAE1B,yEAAyE;IACzE,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAmC,EAAE,OAAqB;QAClF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,kBAAkB;YACtC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,kBAAkB,CAAC,OAAmC,EAAE,OAAqB;QAClF,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/D,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;CACF;AAyCD,mCAAmC;AACnC,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB;IACnB,SAAS,EAAE,WAAW;IACtB,+CAA+C;IAC/C,MAAM,EAAE,QAAQ;IAChB;;;;OAIG;IACH,MAAM,EAAE,QAAQ;CACR,CAAC"}

package/dist/v1beta1/role_binding.d.ts

@@ -14,6 +14,14 @@ import { type CallOptions, type Client, type Empty, type Service } from "@origin
  *   account's current one.
  * - `serviceAccount:{service_account}`: a service account of the same
  *   organization, by its id.
+ * - `serviceAgent:{service_agent}`: a platform service agent, by its name,
+ *   such as `serviceAgent:compute`. A service agent is the identity one of
+ *   the platform's services acts as in an organization. Any organization
+ *   can bind one, but only to a role its service needs; nobody outside the
+ *   platform can act as one or get a credential for it. Every organization
+ *   is created with `serviceAgent:compute` bound to
+ *   `roles/kms.grant-delegate`; delete that binding and compute makes no
+ *   new grants on the organization's keys.
  *
  * and shown, never accepted, as:
  * - `userId:{user}`: a user by the id of their account, when no verified
@@ -54,7 +62,8 @@ export declare class RoleBindingClient {
      * verified email: nothing is held for an address until its account
      * exists. Refused with `CONFLICT` when the member already holds the role
      * at that scope, and with `BAD_REQUEST` when the member is a deleted
-     * service account.
+     * service account, names no service agent the platform has, or is a
+     * service agent and the role isn't one its service needs.
      */
     createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding>;
     /**
@@ -79,8 +88,8 @@ export interface RoleBinding {
      */
     urn?: string;
     /**
-     * Who holds the role: `user:{email}` or
-     * `serviceAccount:{service_account}`. A user is shown with their
+     * Who holds the role: `user:{email}`, `serviceAccount:{service_account}`
+     * or `serviceAgent:{service_agent}`. A user is shown with their
      * account's current verified address, as `userId:{user}` when it has
      * none, or as `deleted:user:{user}` once the account is gone.
      */
@@ -116,8 +125,9 @@ export interface ListRoleBindingsRequest {
      */
     parent?: string;
     /**
-     * Only the bindings of this member, `user:{email}` or
-     * `serviceAccount:{service_account}`. Every member's when empty.
+     * Only the bindings of this member, `user:{email}`,
+     * `serviceAccount:{service_account}` or `serviceAgent:{service_agent}`.
+     * Every member's when empty.
      */
     member?: string;
     /**

package/dist/v1beta1/role_binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4EAA4E;gBAChE,MAAM,EAAE,MAAM;IAI1B,2EAA2E;IACrE,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAajG;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAalH;;;;OAIG;IACI,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;IAS7H;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAevG;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAalG;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,iCAAiC;IACjC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4EAA4E;gBAChE,MAAM,EAAE,MAAM;IAI1B,2EAA2E;IACrE,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAajG;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAalH;;;;OAIG;IACI,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;IAS7H;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAevG;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAalG;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,iCAAiC;IACjC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/v1beta1/role_binding.js

@@ -16,6 +16,14 @@ import { newRequestId, pathValue, query, } from "@origincloud/core";
  *   account's current one.
  * - `serviceAccount:{service_account}`: a service account of the same
  *   organization, by its id.
+ * - `serviceAgent:{service_agent}`: a platform service agent, by its name,
+ *   such as `serviceAgent:compute`. A service agent is the identity one of
+ *   the platform's services acts as in an organization. Any organization
+ *   can bind one, but only to a role its service needs; nobody outside the
+ *   platform can act as one or get a credential for it. Every organization
+ *   is created with `serviceAgent:compute` bound to
+ *   `roles/kms.grant-delegate`; delete that binding and compute makes no
+ *   new grants on the organization's keys.
  *
  * and shown, never accepted, as:
  * - `userId:{user}`: a user by the id of their account, when no verified
@@ -82,7 +90,8 @@ export class RoleBindingClient {
      * verified email: nothing is held for an address until its account
      * exists. Refused with `CONFLICT` when the member already holds the role
      * at that scope, and with `BAD_REQUEST` when the member is a deleted
-     * service account.
+     * service account, names no service agent the platform has, or is a
+     * service agent and the role isn't one its service needs.
      */
     async createRoleBinding(request, options) {
         if (!request.requestId)

package/dist/v1beta1/role_binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACM,OAAO,CAAU;IAE1B,4EAA4E;IAC5E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAE,OAAqB;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,OAAgC,EAAE,OAAqB;QAC5E,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACM,OAAO,CAAU;IAE1B,4EAA4E;IAC5E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAE,OAAqB;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,OAAgC,EAAE,OAAqB;QAC5E,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@origincloud/iam",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Origin Cloud's IAM service: users, service accounts, roles, role bindings, permissions and the audit log.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
@@ -34,9 +34,9 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "peerDependencies": {
-    "@origincloud/core": "^0.26.0"
+    "@origincloud/core": "^0.28.0"
   },
   "devDependencies": {
-    "@origincloud/core": "^0.26.0"
+    "@origincloud/core": "^0.28.0"
   }
 }

package/src/v1beta1/audit_log.ts

@@ -90,8 +90,9 @@ export interface AuditLogEntry {
    * Who made the change, as it was when the change was made:
    * `user:{email}` with the verified address the account had then,
    * `userId:{user}` when none was recorded, `serviceAccount:{service_account}`,
-   * or `platform` for a change the platform made itself. A later change of
-   * address doesn't change it.
+   * `serviceAgent:{service_agent}` for a platform service agent acting in
+   * the organization, or `platform` for a change the platform made itself.
+   * A later change of address doesn't change it.
    */
   actor?: string;
   /**
@@ -123,6 +124,12 @@ export const AuditLogEntry_Outcome = {
   SUCCEEDED: "SUCCEEDED",
   /** It was refused for lack of a permission. */
   DENIED: "DENIED",
+  /**
+   * It was attempted and refused for another reason, which `details`
+   * names in `reason`, such as a key asked to decrypt under the wrong
+   * encryption context.
+   */
+  FAILED: "FAILED",
 } as const;
 
 /** Whether the change was made. */
@@ -148,8 +155,8 @@ export interface ListAuditLogEntriesRequest {
   project?: string;
   /**
    * Only the entries of changes made by this member's account,
-   * `user:{email}` or `serviceAccount:{service_account}`. Every actor's
-   * when empty.
+   * `user:{email}`, `serviceAccount:{service_account}` or
+   * `serviceAgent:{service_agent}`. Every actor's when empty.
    */
   actor?: string;
   /**

package/src/v1beta1/role_binding.ts

@@ -26,6 +26,14 @@ import {
  *   account's current one.
  * - `serviceAccount:{service_account}`: a service account of the same
  *   organization, by its id.
+ * - `serviceAgent:{service_agent}`: a platform service agent, by its name,
+ *   such as `serviceAgent:compute`. A service agent is the identity one of
+ *   the platform's services acts as in an organization. Any organization
+ *   can bind one, but only to a role its service needs; nobody outside the
+ *   platform can act as one or get a credential for it. Every organization
+ *   is created with `serviceAgent:compute` bound to
+ *   `roles/kms.grant-delegate`; delete that binding and compute makes no
+ *   new grants on the organization's keys.
  *
  * and shown, never accepted, as:
  * - `userId:{user}`: a user by the id of their account, when no verified
@@ -102,7 +110,8 @@ export class RoleBindingClient {
    * verified email: nothing is held for an address until its account
    * exists. Refused with `CONFLICT` when the member already holds the role
    * at that scope, and with `BAD_REQUEST` when the member is a deleted
-   * service account.
+   * service account, names no service agent the platform has, or is a
+   * service agent and the role isn't one its service needs.
    */
   async createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding> {
     if (!request.requestId) request = { ...request, requestId: newRequestId() };
@@ -154,8 +163,8 @@ export interface RoleBinding {
    */
   urn?: string;
   /**
-   * Who holds the role: `user:{email}` or
-   * `serviceAccount:{service_account}`. A user is shown with their
+   * Who holds the role: `user:{email}`, `serviceAccount:{service_account}`
+   * or `serviceAgent:{service_agent}`. A user is shown with their
    * account's current verified address, as `userId:{user}` when it has
    * none, or as `deleted:user:{user}` once the account is gone.
    */
@@ -193,8 +202,9 @@ export interface ListRoleBindingsRequest {
    */
   parent?: string;
   /**
-   * Only the bindings of this member, `user:{email}` or
-   * `serviceAccount:{service_account}`. Every member's when empty.
+   * Only the bindings of this member, `user:{email}`,
+   * `serviceAccount:{service_account}` or `serviceAgent:{service_agent}`.
+   * Every member's when empty.
    */
   member?: string;
   /**