@toshicloud/sdk 0.5.0 → 0.6.0

package/dist/gen/toshi/workspace/v1/storage_providers_pb.js

@@ -7,7 +7,7 @@ import { file_toshi_permission } from "../../permission_pb.js";
 /**
  * Describes the file toshi/workspace/v1/storage_providers.proto.
  */
-export const file_toshi_workspace_v1_storage_providers = /*@__PURE__*/ fileDesc("Cip0b3NoaS93b3Jrc3BhY2UvdjEvc3RvcmFnZV9wcm92aWRlcnMucHJvdG8SEnRvc2hpLndvcmtzcGFjZS52MSLUAwoPU3RvcmFnZVByb3ZpZGVyEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkSDAoEbW9kZRgDIAEoCRIQCghlbmRwb2ludBgEIAEoCRIOCgZyZWdpb24YBSABKAkSDgoGYnVja2V0GAYgASgJEhMKC3Jvb3RfcHJlZml4GAcgASgJEhIKCnBhdGhfc3R5bGUYCCABKAgSFQoNY2FwX2xpZmVjeWNsZRgJIAEoCBIZChFjYXBfZ3Vlc3RfcHJlc2lnbhgKIAEoCBIeChZjYXBfZ2xvYmFsX3JlcGxpY2F0aW9uGAsgASgIEiIKGmVncmVzc19wcmljZV9taWNyb3NfcGVyX2diGAwgASgDEhsKE2NyZWRlbnRpYWxzX3dyYXBwZWQYDSABKAgSMQoNbGFzdF9jaGVja19hdBgOIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGAoQbGFzdF9jaGVja19lcnJvchgPIAEoCRIuCgpjcmVhdGVkX2F0GBAgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GBEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKCAgocQ3JlYXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdBIMCgRuYW1lGAEgASgJEhAKCGVuZHBvaW50GAIgASgJEg4KBnJlZ2lvbhgDIAEoCRIOCgZidWNrZXQYBCABKAkSEwoLcm9vdF9wcmVmaXgYBSABKAkSEgoKcGF0aF9zdHlsZRgGIAEoCBIVCg1jYXBfbGlmZWN5Y2xlGAcgASgIEhkKEWNhcF9ndWVzdF9wcmVzaWduGAggASgIEjkKCmNyZWRlbnRpYWwYCSABKAsyJS50b3NoaS53b3Jrc3BhY2UudjEuU3RvcmFnZUNyZWRlbnRpYWwSDAoEbW9kZRgKIAEoCSJcChFTdG9yYWdlQ3JlZGVudGlhbBIVCg1hY2Nlc3Nfa2V5X2lkGAEgASgJEhkKEXNlY3JldF9hY2Nlc3Nfa2V5GAIgASgJEhUKDXNlc3Npb25fdG9rZW4YAyABKAkiVgodQ3JlYXRlU3RvcmFnZVByb3ZpZGVyUmVzcG9uc2USNQoIcHJvdmlkZXIYASABKAsyIy50b3NoaS53b3Jrc3BhY2UudjEuU3RvcmFnZVByb3ZpZGVyIl0KG0xpc3RTdG9yYWdlUHJvdmlkZXJzUmVxdWVzdBIXCg9pbmNsdWRlX2RlZmF1bHQYASABKAgSEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkirgEKHExpc3RTdG9yYWdlUHJvdmlkZXJzUmVzcG9uc2USNgoJcHJvdmlkZXJzGAEgAygLMiMudG9zaGkud29ya3NwYWNlLnYxLlN0b3JhZ2VQcm92aWRlchI9ChBkZWZhdWx0X3Byb3ZpZGVyGAIgASgLMiMudG9zaGkud29ya3NwYWNlLnYxLlN0b3JhZ2VQcm92aWRlchIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkiewobQ2hlY2tTdG9yYWdlUHJvdmlkZXJSZXF1ZXN0EgwKAmlkGAEgASgJSAASRAoIcHJvdmlkZXIYAiABKAsyMC50b3NoaS53b3Jrc3BhY2UudjEuQ3JlYXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdEgAQggKBnRhcmdldCKgAQocQ2hlY2tTdG9yYWdlUHJvdmlkZXJSZXNwb25zZRI1Cghwcm92aWRlchgBIAEoCzIjLnRvc2hpLndvcmtzcGFjZS52MS5TdG9yYWdlUHJvdmlkZXISCgoCb2sYAiABKAgSDQoFZXJyb3IYAyABKAkSLgoKY2hlY2tlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiKgocRGVsZXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdBIKCgJpZBgBIAEoCSIfCh1EZWxldGVTdG9yYWdlUHJvdmlkZXJSZXNwb25zZTLZBAoWU3RvcmFnZVByb3ZpZGVyU2VydmljZRKLAQoUTGlzdFN0b3JhZ2VQcm92aWRlcnMSLy50b3NoaS53b3Jrc3BhY2UudjEuTGlzdFN0b3JhZ2VQcm92aWRlcnNSZXF1ZXN0GjAudG9zaGkud29ya3NwYWNlLnYxLkxpc3RTdG9yYWdlUHJvdmlkZXJzUmVzcG9uc2UiEMLzGAxzdG9yYWdlLnJlYWQSjwEKFUNyZWF0ZVN0b3JhZ2VQcm92aWRlchIwLnRvc2hpLndvcmtzcGFjZS52MS5DcmVhdGVTdG9yYWdlUHJvdmlkZXJSZXF1ZXN0GjEudG9zaGkud29ya3NwYWNlLnYxLkNyZWF0ZVN0b3JhZ2VQcm92aWRlclJlc3BvbnNlIhHC8xgNc3RvcmFnZS53cml0ZRKMAQoUQ2hlY2tTdG9yYWdlUHJvdmlkZXISLy50b3NoaS53b3Jrc3BhY2UudjEuQ2hlY2tTdG9yYWdlUHJvdmlkZXJSZXF1ZXN0GjAudG9zaGkud29ya3NwYWNlLnYxLkNoZWNrU3RvcmFnZVByb3ZpZGVyUmVzcG9uc2UiEcLzGA1zdG9yYWdlLndyaXRlEo8BChVEZWxldGVTdG9yYWdlUHJvdmlkZXISMC50b3NoaS53b3Jrc3BhY2UudjEuRGVsZXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdBoxLnRvc2hpLndvcmtzcGFjZS52MS5EZWxldGVTdG9yYWdlUHJvdmlkZXJSZXNwb25zZSIRwvMYDXN0b3JhZ2Uud3JpdGVCIlogZ28udG9zaGljbG91ZC5pby9hcGkvd29ya3NwYWNldjFiBnByb3RvMw", [file_google_protobuf_timestamp, file_toshi_permission]);
+export const file_toshi_workspace_v1_storage_providers = /*@__PURE__*/ fileDesc("Cip0b3NoaS93b3Jrc3BhY2UvdjEvc3RvcmFnZV9wcm92aWRlcnMucHJvdG8SEnRvc2hpLndvcmtzcGFjZS52MSLUAwoPU3RvcmFnZVByb3ZpZGVyEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkSDAoEbW9kZRgDIAEoCRIQCghlbmRwb2ludBgEIAEoCRIOCgZyZWdpb24YBSABKAkSDgoGYnVja2V0GAYgASgJEhMKC3Jvb3RfcHJlZml4GAcgASgJEhIKCnBhdGhfc3R5bGUYCCABKAgSFQoNY2FwX2xpZmVjeWNsZRgJIAEoCBIZChFjYXBfZ3Vlc3RfcHJlc2lnbhgKIAEoCBIeChZjYXBfZ2xvYmFsX3JlcGxpY2F0aW9uGAsgASgIEiIKGmVncmVzc19wcmljZV9taWNyb3NfcGVyX2diGAwgASgDEhsKE2NyZWRlbnRpYWxzX3dyYXBwZWQYDSABKAgSMQoNbGFzdF9jaGVja19hdBgOIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGAoQbGFzdF9jaGVja19lcnJvchgPIAEoCRIuCgpjcmVhdGVkX2F0GBAgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GBEgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCKXAgocQ3JlYXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdBIMCgRuYW1lGAEgASgJEhAKCGVuZHBvaW50GAIgASgJEg4KBnJlZ2lvbhgDIAEoCRIOCgZidWNrZXQYBCABKAkSEwoLcm9vdF9wcmVmaXgYBSABKAkSEgoKcGF0aF9zdHlsZRgGIAEoCBIVCg1jYXBfbGlmZWN5Y2xlGAcgASgIEhkKEWNhcF9ndWVzdF9wcmVzaWduGAggASgIEjkKCmNyZWRlbnRpYWwYCSABKAsyJS50b3NoaS53b3Jrc3BhY2UudjEuU3RvcmFnZUNyZWRlbnRpYWwSDAoEbW9kZRgKIAEoCRITCgtyZXF1ZXN0X2tleRgLIAEoCSJcChFTdG9yYWdlQ3JlZGVudGlhbBIVCg1hY2Nlc3Nfa2V5X2lkGAEgASgJEhkKEXNlY3JldF9hY2Nlc3Nfa2V5GAIgASgJEhUKDXNlc3Npb25fdG9rZW4YAyABKAkiVgodQ3JlYXRlU3RvcmFnZVByb3ZpZGVyUmVzcG9uc2USNQoIcHJvdmlkZXIYASABKAsyIy50b3NoaS53b3Jrc3BhY2UudjEuU3RvcmFnZVByb3ZpZGVyIl0KG0xpc3RTdG9yYWdlUHJvdmlkZXJzUmVxdWVzdBIXCg9pbmNsdWRlX2RlZmF1bHQYASABKAgSEQoJcGFnZV9zaXplGAIgASgFEhIKCnBhZ2VfdG9rZW4YAyABKAkirgEKHExpc3RTdG9yYWdlUHJvdmlkZXJzUmVzcG9uc2USNgoJcHJvdmlkZXJzGAEgAygLMiMudG9zaGkud29ya3NwYWNlLnYxLlN0b3JhZ2VQcm92aWRlchI9ChBkZWZhdWx0X3Byb3ZpZGVyGAIgASgLMiMudG9zaGkud29ya3NwYWNlLnYxLlN0b3JhZ2VQcm92aWRlchIXCg9uZXh0X3BhZ2VfdG9rZW4YAyABKAkiewobQ2hlY2tTdG9yYWdlUHJvdmlkZXJSZXF1ZXN0EgwKAmlkGAEgASgJSAASRAoIcHJvdmlkZXIYAiABKAsyMC50b3NoaS53b3Jrc3BhY2UudjEuQ3JlYXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdEgAQggKBnRhcmdldCKgAQocQ2hlY2tTdG9yYWdlUHJvdmlkZXJSZXNwb25zZRI1Cghwcm92aWRlchgBIAEoCzIjLnRvc2hpLndvcmtzcGFjZS52MS5TdG9yYWdlUHJvdmlkZXISCgoCb2sYAiABKAgSDQoFZXJyb3IYAyABKAkSLgoKY2hlY2tlZF9hdBgEIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiKgocRGVsZXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdBIKCgJpZBgBIAEoCSIfCh1EZWxldGVTdG9yYWdlUHJvdmlkZXJSZXNwb25zZTLZBAoWU3RvcmFnZVByb3ZpZGVyU2VydmljZRKLAQoUTGlzdFN0b3JhZ2VQcm92aWRlcnMSLy50b3NoaS53b3Jrc3BhY2UudjEuTGlzdFN0b3JhZ2VQcm92aWRlcnNSZXF1ZXN0GjAudG9zaGkud29ya3NwYWNlLnYxLkxpc3RTdG9yYWdlUHJvdmlkZXJzUmVzcG9uc2UiEMLzGAxzdG9yYWdlLnJlYWQSjwEKFUNyZWF0ZVN0b3JhZ2VQcm92aWRlchIwLnRvc2hpLndvcmtzcGFjZS52MS5DcmVhdGVTdG9yYWdlUHJvdmlkZXJSZXF1ZXN0GjEudG9zaGkud29ya3NwYWNlLnYxLkNyZWF0ZVN0b3JhZ2VQcm92aWRlclJlc3BvbnNlIhHC8xgNc3RvcmFnZS53cml0ZRKMAQoUQ2hlY2tTdG9yYWdlUHJvdmlkZXISLy50b3NoaS53b3Jrc3BhY2UudjEuQ2hlY2tTdG9yYWdlUHJvdmlkZXJSZXF1ZXN0GjAudG9zaGkud29ya3NwYWNlLnYxLkNoZWNrU3RvcmFnZVByb3ZpZGVyUmVzcG9uc2UiEcLzGA1zdG9yYWdlLndyaXRlEo8BChVEZWxldGVTdG9yYWdlUHJvdmlkZXISMC50b3NoaS53b3Jrc3BhY2UudjEuRGVsZXRlU3RvcmFnZVByb3ZpZGVyUmVxdWVzdBoxLnRvc2hpLndvcmtzcGFjZS52MS5EZWxldGVTdG9yYWdlUHJvdmlkZXJSZXNwb25zZSIRwvMYDXN0b3JhZ2Uud3JpdGVCIlogZ28udG9zaGljbG91ZC5pby9hcGkvd29ya3NwYWNldjFiBnByb3RvMw", [file_google_protobuf_timestamp, file_toshi_permission]);
 /**
  * Describes the message toshi.workspace.v1.StorageProvider.
  * Use `create(StorageProviderSchema)` to create a new message.

package/dist/gen/toshi/workspace/v1/tokens_pb.d.ts

@@ -1,5 +1,6 @@
 import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { Timestamp, TimestampJson } from "@bufbuild/protobuf/wkt";
+import type { FieldMask, FieldMaskJson, Timestamp, TimestampJson } from "@bufbuild/protobuf/wkt";
+import type { Subject, SubjectJson } from "./roles_pb.js";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file toshi/workspace/v1/tokens.proto.
@@ -32,7 +33,9 @@ export type Token = Message<"toshi.workspace.v1.Token"> & {
      */
     createdAt?: Timestamp | undefined;
     /**
-     * Unset when the token does not expire.
+     * When the token stops working: the expiry it was given, or 30 days
+     * after creator_left_at when that is sooner (expiry_reason). Unset when
+     * the token does not expire.
      *
      * @generated from field: google.protobuf.Timestamp expires_at = 5;
      */
@@ -70,6 +73,48 @@ export type Token = Message<"toshi.workspace.v1.Token"> & {
      * @generated from field: string environment = 10;
      */
     environment: string;
+    /**
+     * When an API token starts working; unset when it works from its
+     * creation.
+     *
+     * @generated from field: google.protobuf.Timestamp not_before = 11;
+     */
+    notBefore?: Timestamp | undefined;
+    /**
+     * The client addresses an API token is accepted from; unset when every
+     * address is.
+     *
+     * @generated from field: toshi.workspace.v1.ClientRanges client_ranges = 12;
+     */
+    clientRanges?: ClientRanges | undefined;
+    /**
+     * Who made the token: a person, a token, or the system for one the
+     * control plane made. Unset when that was not recorded.
+     *
+     * @generated from field: toshi.workspace.v1.Subject created_by = 13;
+     */
+    createdBy?: Subject | undefined;
+    /**
+     * When the token was last accepted for a call, at most a minute out of
+     * date; unset when it never was.
+     *
+     * @generated from field: google.protobuf.Timestamp last_used = 14;
+     */
+    lastUsed?: Timestamp | undefined;
+    /**
+     * When the person who made the token, or made the token that made it,
+     * stopped being a member of the workspace; unset while they are one, and
+     * once an Owner re-owns the token (UpdateToken).
+     *
+     * @generated from field: google.protobuf.Timestamp creator_left_at = 15;
+     */
+    creatorLeftAt?: Timestamp | undefined;
+    /**
+     * Why expires_at is what it is.
+     *
+     * @generated from field: toshi.workspace.v1.TokenExpiryReason expiry_reason = 16;
+     */
+    expiryReason: TokenExpiryReason;
 };
 /**
  * Token is one of the workspace's tokens, without its value.
@@ -98,7 +143,9 @@ export type TokenJson = {
      */
     createdAt?: TimestampJson;
     /**
-     * Unset when the token does not expire.
+     * When the token stops working: the expiry it was given, or 30 days
+     * after creator_left_at when that is sooner (expiry_reason). Unset when
+     * the token does not expire.
      *
      * @generated from field: google.protobuf.Timestamp expires_at = 5;
      */
@@ -136,6 +183,48 @@ export type TokenJson = {
      * @generated from field: string environment = 10;
      */
     environment?: string;
+    /**
+     * When an API token starts working; unset when it works from its
+     * creation.
+     *
+     * @generated from field: google.protobuf.Timestamp not_before = 11;
+     */
+    notBefore?: TimestampJson;
+    /**
+     * The client addresses an API token is accepted from; unset when every
+     * address is.
+     *
+     * @generated from field: toshi.workspace.v1.ClientRanges client_ranges = 12;
+     */
+    clientRanges?: ClientRangesJson;
+    /**
+     * Who made the token: a person, a token, or the system for one the
+     * control plane made. Unset when that was not recorded.
+     *
+     * @generated from field: toshi.workspace.v1.Subject created_by = 13;
+     */
+    createdBy?: SubjectJson;
+    /**
+     * When the token was last accepted for a call, at most a minute out of
+     * date; unset when it never was.
+     *
+     * @generated from field: google.protobuf.Timestamp last_used = 14;
+     */
+    lastUsed?: TimestampJson;
+    /**
+     * When the person who made the token, or made the token that made it,
+     * stopped being a member of the workspace; unset while they are one, and
+     * once an Owner re-owns the token (UpdateToken).
+     *
+     * @generated from field: google.protobuf.Timestamp creator_left_at = 15;
+     */
+    creatorLeftAt?: TimestampJson;
+    /**
+     * Why expires_at is what it is.
+     *
+     * @generated from field: toshi.workspace.v1.TokenExpiryReason expiry_reason = 16;
+     */
+    expiryReason?: TokenExpiryReasonJson;
 };
 /**
  * Describes the message toshi.workspace.v1.Token.
@@ -144,6 +233,65 @@ export type TokenJson = {
 export declare const TokenSchema: GenMessage<Token, {
     jsonType: TokenJson;
 }>;
+/**
+ * ClientRanges are the client addresses an API token is accepted from,
+ * each an IP address or a CIDR range, such as "203.0.113.0/24" or
+ * "2001:db8::/32". A call from another address, or before the token's
+ * not_before, is refused with UNAUTHENTICATED, as an expired token's is,
+ * with a google.rpc.ErrorInfo of domain "toshi.run" and reason
+ * TOKEN_OUTSIDE_RANGES or TOKEN_OUTSIDE_WINDOW, and the refusal is
+ * recorded in the audit log.
+ *
+ * @generated from message toshi.workspace.v1.ClientRanges
+ */
+export type ClientRanges = Message<"toshi.workspace.v1.ClientRanges"> & {
+    /**
+     * The token is accepted only from an address in one of these; empty
+     * accepts every address.
+     *
+     * @generated from field: repeated string in = 1;
+     */
+    in: string[];
+    /**
+     * The token is refused from an address in any of these, one in in too.
+     *
+     * @generated from field: repeated string not_in = 2;
+     */
+    notIn: string[];
+};
+/**
+ * ClientRanges are the client addresses an API token is accepted from,
+ * each an IP address or a CIDR range, such as "203.0.113.0/24" or
+ * "2001:db8::/32". A call from another address, or before the token's
+ * not_before, is refused with UNAUTHENTICATED, as an expired token's is,
+ * with a google.rpc.ErrorInfo of domain "toshi.run" and reason
+ * TOKEN_OUTSIDE_RANGES or TOKEN_OUTSIDE_WINDOW, and the refusal is
+ * recorded in the audit log.
+ *
+ * @generated from message toshi.workspace.v1.ClientRanges
+ */
+export type ClientRangesJson = {
+    /**
+     * The token is accepted only from an address in one of these; empty
+     * accepts every address.
+     *
+     * @generated from field: repeated string in = 1;
+     */
+    in?: string[];
+    /**
+     * The token is refused from an address in any of these, one in in too.
+     *
+     * @generated from field: repeated string not_in = 2;
+     */
+    notIn?: string[];
+};
+/**
+ * Describes the message toshi.workspace.v1.ClientRanges.
+ * Use `create(ClientRangesSchema)` to create a new message.
+ */
+export declare const ClientRangesSchema: GenMessage<ClientRanges, {
+    jsonType: ClientRangesJson;
+}>;
 /**
  * ListTokensRequest optionally narrows the list to one kind.
  *
@@ -255,7 +403,7 @@ export type CreateWorkspaceTokenRequest = Message<"toshi.workspace.v1.CreateWork
      */
     name: string;
     /**
-     * Unset means the token never expires.
+     * Unset means the longest lifetime allowed, 90 days by default.
      *
      * @generated from field: google.protobuf.Timestamp expires_at = 2;
      */
@@ -274,6 +422,28 @@ export type CreateWorkspaceTokenRequest = Message<"toshi.workspace.v1.CreateWork
      * @generated from field: string environment = 4;
      */
     environment: string;
+    /**
+     * When the token starts working; unset means at once.
+     *
+     * @generated from field: google.protobuf.Timestamp not_before = 5;
+     */
+    notBefore?: Timestamp | undefined;
+    /**
+     * The client addresses the token is accepted from; unset means every
+     * address.
+     *
+     * @generated from field: toshi.workspace.v1.ClientRanges client_ranges = 6;
+     */
+    clientRanges?: ClientRanges | undefined;
+    /**
+     * The token's role, by id: a built-in role or one of the workspace's
+     * own, which the caller must hold everything of where the token acts.
+     * Empty gives Admin to a whole-workspace token and Member to a limited
+     * one.
+     *
+     * @generated from field: string role = 7;
+     */
+    role: string;
 };
 /**
  * CreateWorkspaceTokenRequest names the token and what it may reach.
@@ -288,7 +458,7 @@ export type CreateWorkspaceTokenRequestJson = {
      */
     name?: string;
     /**
-     * Unset means the token never expires.
+     * Unset means the longest lifetime allowed, 90 days by default.
      *
      * @generated from field: google.protobuf.Timestamp expires_at = 2;
      */
@@ -307,6 +477,28 @@ export type CreateWorkspaceTokenRequestJson = {
      * @generated from field: string environment = 4;
      */
     environment?: string;
+    /**
+     * When the token starts working; unset means at once.
+     *
+     * @generated from field: google.protobuf.Timestamp not_before = 5;
+     */
+    notBefore?: TimestampJson;
+    /**
+     * The client addresses the token is accepted from; unset means every
+     * address.
+     *
+     * @generated from field: toshi.workspace.v1.ClientRanges client_ranges = 6;
+     */
+    clientRanges?: ClientRangesJson;
+    /**
+     * The token's role, by id: a built-in role or one of the workspace's
+     * own, which the caller must hold everything of where the token acts.
+     * Empty gives Admin to a whole-workspace token and Member to a limited
+     * one.
+     *
+     * @generated from field: string role = 7;
+     */
+    role?: string;
 };
 /**
  * Describes the message toshi.workspace.v1.CreateWorkspaceTokenRequest.
@@ -426,6 +618,162 @@ export type RevokeTokenResponseJson = {
 export declare const RevokeTokenResponseSchema: GenMessage<RevokeTokenResponse, {
     jsonType: RevokeTokenResponseJson;
 }>;
+/**
+ * RollWorkspaceTokenRequest names the token to roll.
+ *
+ * @generated from message toshi.workspace.v1.RollWorkspaceTokenRequest
+ */
+export type RollWorkspaceTokenRequest = Message<"toshi.workspace.v1.RollWorkspaceTokenRequest"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+};
+/**
+ * RollWorkspaceTokenRequest names the token to roll.
+ *
+ * @generated from message toshi.workspace.v1.RollWorkspaceTokenRequest
+ */
+export type RollWorkspaceTokenRequestJson = {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.RollWorkspaceTokenRequest.
+ * Use `create(RollWorkspaceTokenRequestSchema)` to create a new message.
+ */
+export declare const RollWorkspaceTokenRequestSchema: GenMessage<RollWorkspaceTokenRequest, {
+    jsonType: RollWorkspaceTokenRequestJson;
+}>;
+/**
+ * RollWorkspaceTokenResponse carries the token and its new value.
+ *
+ * @generated from message toshi.workspace.v1.RollWorkspaceTokenResponse
+ */
+export type RollWorkspaceTokenResponse = Message<"toshi.workspace.v1.RollWorkspaceTokenResponse"> & {
+    /**
+     * @generated from field: toshi.workspace.v1.Token token = 1;
+     */
+    token?: Token | undefined;
+    /**
+     * The new value. It is returned only here.
+     *
+     * @generated from field: string value = 2;
+     */
+    value: string;
+};
+/**
+ * RollWorkspaceTokenResponse carries the token and its new value.
+ *
+ * @generated from message toshi.workspace.v1.RollWorkspaceTokenResponse
+ */
+export type RollWorkspaceTokenResponseJson = {
+    /**
+     * @generated from field: toshi.workspace.v1.Token token = 1;
+     */
+    token?: TokenJson;
+    /**
+     * The new value. It is returned only here.
+     *
+     * @generated from field: string value = 2;
+     */
+    value?: string;
+};
+/**
+ * Describes the message toshi.workspace.v1.RollWorkspaceTokenResponse.
+ * Use `create(RollWorkspaceTokenResponseSchema)` to create a new message.
+ */
+export declare const RollWorkspaceTokenResponseSchema: GenMessage<RollWorkspaceTokenResponse, {
+    jsonType: RollWorkspaceTokenResponseJson;
+}>;
+/**
+ * UpdateTokenRequest names an API token and the fields to change.
+ *
+ * @generated from message toshi.workspace.v1.UpdateTokenRequest
+ */
+export type UpdateTokenRequest = Message<"toshi.workspace.v1.UpdateTokenRequest"> & {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id: string;
+    /**
+     * Carries the new values of the fields update_mask names. An unset
+     * not_before or client_ranges clears it; expires_at must be set.
+     *
+     * @generated from field: toshi.workspace.v1.Token token = 2;
+     */
+    token?: Token | undefined;
+    /**
+     * One or more of name, expires_at, not_before, client_ranges and
+     * created_by.
+     *
+     * @generated from field: google.protobuf.FieldMask update_mask = 3;
+     */
+    updateMask?: FieldMask | undefined;
+};
+/**
+ * UpdateTokenRequest names an API token and the fields to change.
+ *
+ * @generated from message toshi.workspace.v1.UpdateTokenRequest
+ */
+export type UpdateTokenRequestJson = {
+    /**
+     * @generated from field: string id = 1;
+     */
+    id?: string;
+    /**
+     * Carries the new values of the fields update_mask names. An unset
+     * not_before or client_ranges clears it; expires_at must be set.
+     *
+     * @generated from field: toshi.workspace.v1.Token token = 2;
+     */
+    token?: TokenJson;
+    /**
+     * One or more of name, expires_at, not_before, client_ranges and
+     * created_by.
+     *
+     * @generated from field: google.protobuf.FieldMask update_mask = 3;
+     */
+    updateMask?: FieldMaskJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.UpdateTokenRequest.
+ * Use `create(UpdateTokenRequestSchema)` to create a new message.
+ */
+export declare const UpdateTokenRequestSchema: GenMessage<UpdateTokenRequest, {
+    jsonType: UpdateTokenRequestJson;
+}>;
+/**
+ * UpdateTokenResponse carries the token as it now is.
+ *
+ * @generated from message toshi.workspace.v1.UpdateTokenResponse
+ */
+export type UpdateTokenResponse = Message<"toshi.workspace.v1.UpdateTokenResponse"> & {
+    /**
+     * @generated from field: toshi.workspace.v1.Token token = 1;
+     */
+    token?: Token | undefined;
+};
+/**
+ * UpdateTokenResponse carries the token as it now is.
+ *
+ * @generated from message toshi.workspace.v1.UpdateTokenResponse
+ */
+export type UpdateTokenResponseJson = {
+    /**
+     * @generated from field: toshi.workspace.v1.Token token = 1;
+     */
+    token?: TokenJson;
+};
+/**
+ * Describes the message toshi.workspace.v1.UpdateTokenResponse.
+ * Use `create(UpdateTokenResponseSchema)` to create a new message.
+ */
+export declare const UpdateTokenResponseSchema: GenMessage<UpdateTokenResponse, {
+    jsonType: UpdateTokenResponseJson;
+}>;
 /**
  * TokenKind says what a token grants.
  *
@@ -459,6 +807,42 @@ export type TokenKindJson = "TOKEN_KIND_UNSPECIFIED" | "TOKEN_KIND_ENROLLMENT" |
  * Describes the enum toshi.workspace.v1.TokenKind.
  */
 export declare const TokenKindSchema: GenEnum<TokenKind, TokenKindJson>;
+/**
+ * TokenExpiryReason says why a token expires when it does.
+ *
+ * @generated from enum toshi.workspace.v1.TokenExpiryReason
+ */
+export declare enum TokenExpiryReason {
+    /**
+     * The token does not expire.
+     *
+     * @generated from enum value: TOKEN_EXPIRY_REASON_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * The token expires when it was made, rolled or updated to.
+     *
+     * @generated from enum value: TOKEN_EXPIRY_REASON_SET = 1;
+     */
+    SET = 1,
+    /**
+     * The token expires 30 days after its creator left the workspace, sooner
+     * than the expiry it was given.
+     *
+     * @generated from enum value: TOKEN_EXPIRY_REASON_CREATOR_LEFT = 2;
+     */
+    CREATOR_LEFT = 2
+}
+/**
+ * TokenExpiryReason says why a token expires when it does.
+ *
+ * @generated from enum toshi.workspace.v1.TokenExpiryReason
+ */
+export type TokenExpiryReasonJson = "TOKEN_EXPIRY_REASON_UNSPECIFIED" | "TOKEN_EXPIRY_REASON_SET" | "TOKEN_EXPIRY_REASON_CREATOR_LEFT";
+/**
+ * Describes the enum toshi.workspace.v1.TokenExpiryReason.
+ */
+export declare const TokenExpiryReasonSchema: GenEnum<TokenExpiryReason, TokenExpiryReasonJson>;
 /**
  * TokenService manages the workspace's tokens: its API tokens, which call
  * the Workspace API as the workspace, and its enrollment tokens, with which
@@ -515,4 +899,49 @@ export declare const TokenService: GenService<{
         input: typeof RevokeTokenRequestSchema;
         output: typeof RevokeTokenResponseSchema;
     };
+    /**
+     * RollWorkspaceToken gives one of the workspace's tokens a new value and
+     * returns it; the old value stops working at once. The token keeps its
+     * ID, name, roles, limit, client address ranges, start, expiry and
+     * creator, so what was granted to it stays granted. An API or enrollment
+     * token rolls.
+     *
+     * Only a signed-in session may call it, as for CreateWorkspaceToken. A
+     * token someone else made needs members.write as well, and is refused
+     * without it with PERMISSION_DENIED. A token of another workspace, and an
+     * unknown ID, fail with NOT_FOUND; a revoked or expired token with
+     * FAILED_PRECONDITION.
+     *
+     * @generated from rpc toshi.workspace.v1.TokenService.RollWorkspaceToken
+     */
+    rollWorkspaceToken: {
+        methodKind: "unary";
+        input: typeof RollWorkspaceTokenRequestSchema;
+        output: typeof RollWorkspaceTokenResponseSchema;
+    };
+    /**
+     * UpdateToken changes an API token's name, expiry, start and client
+     * address ranges: the fields update_mask names. The expiry stays within
+     * the longest lifetime allowed from now. Only a signed-in session may
+     * call it, but a person's access token may make the call whose mask is
+     * created_by alone; and a token someone else made needs members.write as
+     * well, as for RollWorkspaceToken. An enrollment token fails with
+     * INVALID_ARGUMENT; a token of another workspace, and an unknown ID,
+     * with NOT_FOUND; a revoked token with FAILED_PRECONDITION.
+     *
+     * created_by re-owns the token: the caller becomes its creator, and the
+     * token, with the tokens it made, no longer runs out because its
+     * creator left (creator_left_at). The new creator must be the caller,
+     * or the call fails with INVALID_ARGUMENT; the caller needs the Owner
+     * role, and must hold every permission of the token's role where the
+     * token acts, or it fails with PERMISSION_DENIED; an expired token
+     * fails with FAILED_PRECONDITION.
+     *
+     * @generated from rpc toshi.workspace.v1.TokenService.UpdateToken
+     */
+    updateToken: {
+        methodKind: "unary";
+        input: typeof UpdateTokenRequestSchema;
+        output: typeof UpdateTokenResponseSchema;
+    };
 }>;

package/dist/gen/toshi/workspace/v1/tokens_pb.js

@@ -2,47 +2,73 @@
 // @generated from file toshi/workspace/v1/tokens.proto (package toshi.workspace.v1, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_field_mask, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import { file_toshi_permission } from "../../permission_pb.js";
+import { file_toshi_workspace_v1_roles } from "./roles_pb.js";
 /**
  * Describes the file toshi/workspace/v1/tokens.proto.
  */
-export const file_toshi_workspace_v1_tokens = /*@__PURE__*/ fileDesc("Ch90b3NoaS93b3Jrc3BhY2UvdjEvdG9rZW5zLnByb3RvEhJ0b3NoaS53b3Jrc3BhY2UudjEipAIKBVRva2VuEgoKAmlkGAEgASgJEisKBGtpbmQYAiABKA4yHS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW5LaW5kEg4KBnNvdXJjZRgDIAEoCRIuCgpjcmVhdGVkX2F0GAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpleHBpcmVzX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpyZXZva2VkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZhY3RpdmUYByABKAgSDAoEbmFtZRgIIAEoCRIPCgdwcm9qZWN0GAkgASgJEhMKC2Vudmlyb25tZW50GAogASgJImcKEUxpc3RUb2tlbnNSZXF1ZXN0EisKBGtpbmQYASABKA4yHS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW5LaW5kEhEKCXBhZ2Vfc2l6ZRgCIAEoBRISCgpwYWdlX3Rva2VuGAMgASgJIlgKEkxpc3RUb2tlbnNSZXNwb25zZRIpCgZ0b2tlbnMYASADKAsyGS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW4SFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIoEBChtDcmVhdGVXb3Jrc3BhY2VUb2tlblJlcXVlc3QSDAoEbmFtZRgBIAEoCRIuCgpleHBpcmVzX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIPCgdwcm9qZWN0GAMgASgJEhMKC2Vudmlyb25tZW50GAQgASgJIlcKHENyZWF0ZVdvcmtzcGFjZVRva2VuUmVzcG9uc2USKAoFdG9rZW4YASABKAsyGS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW4SDQoFdmFsdWUYAiABKAkiIAoSUmV2b2tlVG9rZW5SZXF1ZXN0EgoKAmlkGAEgASgJIlkKE1Jldm9rZVRva2VuUmVzcG9uc2USKAoFdG9rZW4YASABKAsyGS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW4SGAoQaG9zdHNfc2lnbmVkX291dBgCIAEoBSpcCglUb2tlbktpbmQSGgoWVE9LRU5fS0lORF9VTlNQRUNJRklFRBAAEhkKFVRPS0VOX0tJTkRfRU5ST0xMTUVOVBACEhgKFFRPS0VOX0tJTkRfV09SS1NQQUNFEAMyiQMKDFRva2VuU2VydmljZRJsCgpMaXN0VG9rZW5zEiUudG9zaGkud29ya3NwYWNlLnYxLkxpc3RUb2tlbnNSZXF1ZXN0GiYudG9zaGkud29ya3NwYWNlLnYxLkxpc3RUb2tlbnNSZXNwb25zZSIPwvMYC3Rva2Vucy5yZWFkEpgBChRDcmVhdGVXb3Jrc3BhY2VUb2tlbhIvLnRvc2hpLndvcmtzcGFjZS52MS5DcmVhdGVXb3Jrc3BhY2VUb2tlblJlcXVlc3QaMC50b3NoaS53b3Jrc3BhY2UudjEuQ3JlYXRlV29ya3NwYWNlVG9rZW5SZXNwb25zZSIdwvMYDHRva2Vucy53cml0ZcrzGAl3b3Jrc3BhY2UScAoLUmV2b2tlVG9rZW4SJi50b3NoaS53b3Jrc3BhY2UudjEuUmV2b2tlVG9rZW5SZXF1ZXN0GicudG9zaGkud29ya3NwYWNlLnYxLlJldm9rZVRva2VuUmVzcG9uc2UiEMLzGAx0b2tlbnMud3JpdGVCIlogZ28udG9zaGljbG91ZC5pby9hcGkvd29ya3NwYWNldjFiBnByb3RvMw", [file_google_protobuf_timestamp, file_toshi_permission]);
+export const file_toshi_workspace_v1_tokens = /*@__PURE__*/ fileDesc("Ch90b3NoaS93b3Jrc3BhY2UvdjEvdG9rZW5zLnByb3RvEhJ0b3NoaS53b3Jrc3BhY2UudjEi4AQKBVRva2VuEgoKAmlkGAEgASgJEisKBGtpbmQYAiABKA4yHS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW5LaW5kEg4KBnNvdXJjZRgDIAEoCRIuCgpjcmVhdGVkX2F0GAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpleHBpcmVzX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpyZXZva2VkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZhY3RpdmUYByABKAgSDAoEbmFtZRgIIAEoCRIPCgdwcm9qZWN0GAkgASgJEhMKC2Vudmlyb25tZW50GAogASgJEi4KCm5vdF9iZWZvcmUYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjcKDWNsaWVudF9yYW5nZXMYDCABKAsyIC50b3NoaS53b3Jrc3BhY2UudjEuQ2xpZW50UmFuZ2VzEi8KCmNyZWF0ZWRfYnkYDSABKAsyGy50b3NoaS53b3Jrc3BhY2UudjEuU3ViamVjdBItCglsYXN0X3VzZWQYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjMKD2NyZWF0b3JfbGVmdF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASPAoNZXhwaXJ5X3JlYXNvbhgQIAEoDjIlLnRvc2hpLndvcmtzcGFjZS52MS5Ub2tlbkV4cGlyeVJlYXNvbiIqCgxDbGllbnRSYW5nZXMSCgoCaW4YASADKAkSDgoGbm90X2luGAIgAygJImcKEUxpc3RUb2tlbnNSZXF1ZXN0EisKBGtpbmQYASABKA4yHS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW5LaW5kEhEKCXBhZ2Vfc2l6ZRgCIAEoBRISCgpwYWdlX3Rva2VuGAMgASgJIlgKEkxpc3RUb2tlbnNSZXNwb25zZRIpCgZ0b2tlbnMYASADKAsyGS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW4SFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIvgBChtDcmVhdGVXb3Jrc3BhY2VUb2tlblJlcXVlc3QSDAoEbmFtZRgBIAEoCRIuCgpleHBpcmVzX2F0GAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIPCgdwcm9qZWN0GAMgASgJEhMKC2Vudmlyb25tZW50GAQgASgJEi4KCm5vdF9iZWZvcmUYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjcKDWNsaWVudF9yYW5nZXMYBiABKAsyIC50b3NoaS53b3Jrc3BhY2UudjEuQ2xpZW50UmFuZ2VzEgwKBHJvbGUYByABKAkiVwocQ3JlYXRlV29ya3NwYWNlVG9rZW5SZXNwb25zZRIoCgV0b2tlbhgBIAEoCzIZLnRvc2hpLndvcmtzcGFjZS52MS5Ub2tlbhINCgV2YWx1ZRgCIAEoCSIgChJSZXZva2VUb2tlblJlcXVlc3QSCgoCaWQYASABKAkiWQoTUmV2b2tlVG9rZW5SZXNwb25zZRIoCgV0b2tlbhgBIAEoCzIZLnRvc2hpLndvcmtzcGFjZS52MS5Ub2tlbhIYChBob3N0c19zaWduZWRfb3V0GAIgASgFIicKGVJvbGxXb3Jrc3BhY2VUb2tlblJlcXVlc3QSCgoCaWQYASABKAkiVQoaUm9sbFdvcmtzcGFjZVRva2VuUmVzcG9uc2USKAoFdG9rZW4YASABKAsyGS50b3NoaS53b3Jrc3BhY2UudjEuVG9rZW4SDQoFdmFsdWUYAiABKAkiewoSVXBkYXRlVG9rZW5SZXF1ZXN0EgoKAmlkGAEgASgJEigKBXRva2VuGAIgASgLMhkudG9zaGkud29ya3NwYWNlLnYxLlRva2VuEi8KC3VwZGF0ZV9tYXNrGAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLkZpZWxkTWFzayI/ChNVcGRhdGVUb2tlblJlc3BvbnNlEigKBXRva2VuGAEgASgLMhkudG9zaGkud29ya3NwYWNlLnYxLlRva2VuKlwKCVRva2VuS2luZBIaChZUT0tFTl9LSU5EX1VOU1BFQ0lGSUVEEAASGQoVVE9LRU5fS0lORF9FTlJPTExNRU5UEAISGAoUVE9LRU5fS0lORF9XT1JLU1BBQ0UQAyp7ChFUb2tlbkV4cGlyeVJlYXNvbhIjCh9UT0tFTl9FWFBJUllfUkVBU09OX1VOU1BFQ0lGSUVEEAASGwoXVE9LRU5fRVhQSVJZX1JFQVNPTl9TRVQQARIkCiBUT0tFTl9FWFBJUllfUkVBU09OX0NSRUFUT1JfTEVGVBACMqgFCgxUb2tlblNlcnZpY2USbAoKTGlzdFRva2VucxIlLnRvc2hpLndvcmtzcGFjZS52MS5MaXN0VG9rZW5zUmVxdWVzdBomLnRvc2hpLndvcmtzcGFjZS52MS5MaXN0VG9rZW5zUmVzcG9uc2UiD8LzGAt0b2tlbnMucmVhZBKrAQoUQ3JlYXRlV29ya3NwYWNlVG9rZW4SLy50b3NoaS53b3Jrc3BhY2UudjEuQ3JlYXRlV29ya3NwYWNlVG9rZW5SZXF1ZXN0GjAudG9zaGkud29ya3NwYWNlLnYxLkNyZWF0ZVdvcmtzcGFjZVRva2VuUmVzcG9uc2UiMMLzGAx0b2tlbnMud3JpdGXK8xgJd29ya3NwYWNl0vMYDwoNdG9rZW4uY3JlYXRlZBJwCgtSZXZva2VUb2tlbhImLnRvc2hpLndvcmtzcGFjZS52MS5SZXZva2VUb2tlblJlcXVlc3QaJy50b3NoaS53b3Jrc3BhY2UudjEuUmV2b2tlVG9rZW5SZXNwb25zZSIQwvMYDHRva2Vucy53cml0ZRKXAQoSUm9sbFdvcmtzcGFjZVRva2VuEi0udG9zaGkud29ya3NwYWNlLnYxLlJvbGxXb3Jrc3BhY2VUb2tlblJlcXVlc3QaLi50b3NoaS53b3Jrc3BhY2UudjEuUm9sbFdvcmtzcGFjZVRva2VuUmVzcG9uc2UiIsLzGAx0b2tlbnMud3JpdGXS8xgOCgx0b2tlbi5yb2xsZWQScAoLVXBkYXRlVG9rZW4SJi50b3NoaS53b3Jrc3BhY2UudjEuVXBkYXRlVG9rZW5SZXF1ZXN0GicudG9zaGkud29ya3NwYWNlLnYxLlVwZGF0ZVRva2VuUmVzcG9uc2UiEMLzGAx0b2tlbnMud3JpdGVCIlogZ28udG9zaGljbG91ZC5pby9hcGkvd29ya3NwYWNldjFiBnByb3RvMw", [file_google_protobuf_field_mask, file_google_protobuf_timestamp, file_toshi_permission, file_toshi_workspace_v1_roles]);
 /**
  * Describes the message toshi.workspace.v1.Token.
  * Use `create(TokenSchema)` to create a new message.
  */
 export const TokenSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 0);
+/**
+ * Describes the message toshi.workspace.v1.ClientRanges.
+ * Use `create(ClientRangesSchema)` to create a new message.
+ */
+export const ClientRangesSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 1);
 /**
  * Describes the message toshi.workspace.v1.ListTokensRequest.
  * Use `create(ListTokensRequestSchema)` to create a new message.
  */
-export const ListTokensRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 1);
+export const ListTokensRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 2);
 /**
  * Describes the message toshi.workspace.v1.ListTokensResponse.
  * Use `create(ListTokensResponseSchema)` to create a new message.
  */
-export const ListTokensResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 2);
+export const ListTokensResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 3);
 /**
  * Describes the message toshi.workspace.v1.CreateWorkspaceTokenRequest.
  * Use `create(CreateWorkspaceTokenRequestSchema)` to create a new message.
  */
-export const CreateWorkspaceTokenRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 3);
+export const CreateWorkspaceTokenRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 4);
 /**
  * Describes the message toshi.workspace.v1.CreateWorkspaceTokenResponse.
  * Use `create(CreateWorkspaceTokenResponseSchema)` to create a new message.
  */
-export const CreateWorkspaceTokenResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 4);
+export const CreateWorkspaceTokenResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 5);
 /**
  * Describes the message toshi.workspace.v1.RevokeTokenRequest.
  * Use `create(RevokeTokenRequestSchema)` to create a new message.
  */
-export const RevokeTokenRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 5);
+export const RevokeTokenRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 6);
 /**
  * Describes the message toshi.workspace.v1.RevokeTokenResponse.
  * Use `create(RevokeTokenResponseSchema)` to create a new message.
  */
-export const RevokeTokenResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 6);
+export const RevokeTokenResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 7);
+/**
+ * Describes the message toshi.workspace.v1.RollWorkspaceTokenRequest.
+ * Use `create(RollWorkspaceTokenRequestSchema)` to create a new message.
+ */
+export const RollWorkspaceTokenRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 8);
+/**
+ * Describes the message toshi.workspace.v1.RollWorkspaceTokenResponse.
+ * Use `create(RollWorkspaceTokenResponseSchema)` to create a new message.
+ */
+export const RollWorkspaceTokenResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 9);
+/**
+ * Describes the message toshi.workspace.v1.UpdateTokenRequest.
+ * Use `create(UpdateTokenRequestSchema)` to create a new message.
+ */
+export const UpdateTokenRequestSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 10);
+/**
+ * Describes the message toshi.workspace.v1.UpdateTokenResponse.
+ * Use `create(UpdateTokenResponseSchema)` to create a new message.
+ */
+export const UpdateTokenResponseSchema = /*@__PURE__*/ messageDesc(file_toshi_workspace_v1_tokens, 11);
 /**
  * TokenKind says what a token grants.
  *
@@ -71,6 +97,37 @@ export var TokenKind;
  * Describes the enum toshi.workspace.v1.TokenKind.
  */
 export const TokenKindSchema = /*@__PURE__*/ enumDesc(file_toshi_workspace_v1_tokens, 0);
+/**
+ * TokenExpiryReason says why a token expires when it does.
+ *
+ * @generated from enum toshi.workspace.v1.TokenExpiryReason
+ */
+export var TokenExpiryReason;
+(function (TokenExpiryReason) {
+    /**
+     * The token does not expire.
+     *
+     * @generated from enum value: TOKEN_EXPIRY_REASON_UNSPECIFIED = 0;
+     */
+    TokenExpiryReason[TokenExpiryReason["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * The token expires when it was made, rolled or updated to.
+     *
+     * @generated from enum value: TOKEN_EXPIRY_REASON_SET = 1;
+     */
+    TokenExpiryReason[TokenExpiryReason["SET"] = 1] = "SET";
+    /**
+     * The token expires 30 days after its creator left the workspace, sooner
+     * than the expiry it was given.
+     *
+     * @generated from enum value: TOKEN_EXPIRY_REASON_CREATOR_LEFT = 2;
+     */
+    TokenExpiryReason[TokenExpiryReason["CREATOR_LEFT"] = 2] = "CREATOR_LEFT";
+})(TokenExpiryReason || (TokenExpiryReason = {}));
+/**
+ * Describes the enum toshi.workspace.v1.TokenExpiryReason.
+ */
+export const TokenExpiryReasonSchema = /*@__PURE__*/ enumDesc(file_toshi_workspace_v1_tokens, 1);
 /**
  * TokenService manages the workspace's tokens: its API tokens, which call
  * the Workspace API as the workspace, and its enrollment tokens, with which