Regenerate from the latest API

API_REVISION

@@ -1 +1 @@
-ec8bbdfe780c903e4d0db8aa63f51e6c4cb5d331
+992b5bdeca9c01d16aa77a789de6f2bdc636f3cd

CONTRIBUTING.md

@@ -20,11 +20,11 @@ time on it. CI must pass: the checks below, run on every pull request.
 
 ## How the CLI is built
 
-- `crates/cli` is the `origin` binary. The command groups `iam`, `id`,
-  `config` and `completion` are written by hand (`src/handler/`,
-  `src/service_apis/`); `iam`
-  and `id login` call the GraphQL API with the queries in `graphql/`,
-  checked against `graphql/schema.graphql`, the schema
+- `crates/cli` is the `origin` binary. The command groups `id`, `config`,
+  `mcp` and `completion` are written by hand (`src/handler/`). `id login`
+  reads the signed-in user from the GraphQL API once after a login, which
+  applies their pending invitations (`src/service_apis/`), with the query
+  in `graphql/`, checked against `graphql/schema.graphql`, the schema
   `graph.origincloudapis.eu` serves.
 - A group per service of the API, such as `origin pvs` and
   `origin location`, is generated (`crates/cli/src/sdk/generated/`) from the
@@ -226,7 +226,7 @@ pull request:
 2. If the service's package has several services, give the group's help a
    `[[service]]` entry in `generator/commands.toml`, and regenerate; the
    generator warns, and the coverage test fails, until it has one.
-3. If the service replaces a hand-written group, by name (`iam`)
+3. If the service replaces a hand-written group, by name (as `iam` did)
    or by a `[[replacement]]` entry (`resourcemanager` replaces `admin`),
    generation fails until that group is retired in the same pull request, as
    the next section says.
@@ -242,8 +242,8 @@ a string flag taking the whole name.
 
 ### A service replacing a hand-written group
 
-The hand-written groups that call the GraphQL API (`iam`) are each replaced
-by a service of the API in time.
+A hand-written group that calls the GraphQL API is replaced by a service of
+the API in time, as `admin`, `compute`, `network` and `iam` were.
 When the API gains the service that replaces one, the generated group lands
 and the hand-written one goes in the same change, so that `origin` never has
 both. A service replaces the group of its name; one replacing a group under
@@ -258,10 +258,10 @@ regeneration pull request puts the switch on that pull request. The switch:
    `crates/cli/src/handler/{group}/`.
 2. Delete its GraphQL client, `crates/cli/src/service_apis/{name}.rs`, its
    module line, and its queries, `crates/cli/graphql/{name}/`, unless another
-   group still uses part of it: `origin id login` uses `service_apis::iam`'s
-   current user, so retiring `iam` keeps that part, or moves `id` to the
-   generated group, and deletes the rest (clippy names what nothing uses any
-   more).
+   group still uses part of it, as `origin id login` still reads the
+   current user with `service_apis::iam` after `iam` was retired, since
+   that read applies pending invitations; delete the rest (clippy names
+   what nothing uses any more).
 3. Take the group off `hand_written` in `generator/commands.toml`, and add a
    `[[retired]]` entry, with the reason and what to use instead, for each of
    its commands no command of the same name replaces (such as `admin

Cargo.toml

@@ -13,18 +13,19 @@ homepage = "https://origincloud.eu"
 # API_REVISION: the generated commands use its request and response types,
 # so the two must come from the same API definitions. scripts/update.sh moves
 # both together, and scripts/generate.sh --check fails when they differ.
-origincloud-core = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
-origincloud-pvs = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
-origincloud-location = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
-origincloud-compute = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
-origincloud-network = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
-origincloud-resourcemanager = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
-fake-server = { git = "https://github.com/origincloudhq/sdk-rust", rev = "1235829ebe482f58fea66de6132de421d7f9fbcc" }
+origincloud-core = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+origincloud-pvs = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+origincloud-location = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+origincloud-compute = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+origincloud-network = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+origincloud-resourcemanager = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+origincloud-iam = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
+fake-server = { git = "https://github.com/origincloudhq/sdk-rust", rev = "5a673315cba8fd9e48b47ec9698870eb17b40a73" }
 # The MCP tools `origin mcp serve` serves, at a commit built on the same SDK
 # commit as the lines above: the CLI hands them the SDK's `Client`, so both
 # must be the same crate. scripts/update.sh moves the three together, and
 # scripts/generate.sh --check fails when they differ.
-origincloud-mcp = { git = "https://github.com/origincloudhq/mcp", rev = "31604b53b5128808b1fe33ffcd71633b55013078" }
+origincloud-mcp = { git = "https://github.com/origincloudhq/mcp", rev = "7c3bf43ad7f560eb83f099204d7ad219c4b5a3dc" }
 
 anyhow = "1"
 base64 = "0.22"

README.md

@@ -104,7 +104,7 @@ origin config profile
 | `output-format` | `ORIGINCLOUD_OUTPUT_FORMAT` | `table`, `wide`, `json` or `name` (see [Output](#output)); `--output` (`-o`) overrides it. |
 | `default-project` | `ORIGINCLOUD_PROJECT` | `--project` of the generated commands, such as `origin pvs`'s, when not given. |
 | `default-zone` | `ORIGINCLOUD_ZONE` | `--zone` of the generated commands, when not given; not of the lists, which list every zone without `--zone`. |
-| `region` | `ORIGINCLOUD_REGION` | The region the generated commands work in: the `--region` of the `network` commands' regional resources, when not given, and the front door the `compute`, `network` and `pvs` commands call, such as `pvs.{region}.origincloudapis.eu`. Without it, the region of the default zone (`eu-central1` for `eu-central1-az1`); without either, `--region` must be given, and the calls go to the regionless host, such as `pvs.origincloudapis.eu`, which serves every resource. The `location` and `resourcemanager` commands always call their regionless host. |
+| `region` | `ORIGINCLOUD_REGION` | The region the generated commands work in: the `--region` of the `network` commands' regional resources, when not given, and the front door the `compute`, `network` and `pvs` commands call, such as `pvs.{region}.origincloudapis.eu`. Without it, the region of the default zone (`eu-central1` for `eu-central1-az1`); without either, `--region` must be given, and the calls go to the regionless host, such as `pvs.origincloudapis.eu`, which serves every resource. The `location`, `resourcemanager` and `iam` commands always call their regionless host. |
 
 As in the AWS CLI, a flag comes first, then the environment variable, then
 the profile's value: an environment variable overrides the profile while a
@@ -146,14 +146,16 @@ A command that fails exits with status 1: in `json`, it prints
 always has; in the other formats, `error: ...` on standard error. A command
 line the CLI can't parse exits with status 2 before sending anything.
 
-Irreversible commands (every delete, `origin iam revoke-service-account`,
-and growing a volume with `origin pvs update-volume --size-gib`) refuse to run without `--yes` and say
+Irreversible commands (every delete, and growing a volume with
+`origin pvs update-volume --size-gib`) refuse to run without `--yes` and say
 what they would have done; the refusal happens before any request.
 
 `origin compute create-key-pair` without `--public-key` prints the private
 key it generates as `privateKey`, which the API returns this once, and says
 so on standard error: save it, readable by you alone, such as with
 `origin compute create-key-pair | (umask 077; jq -r .privateKey > my-key)`.
+`origin iam create-service-account` does the same with the service
+account's client secret, `clientSecret`.
 
 ## The generated commands
 
@@ -167,6 +169,10 @@ A group per service of the API:
 - `origin pvs`: the persistent volume service's volumes, snapshots and
   storage classes.
 - `origin resourcemanager`: organizations and projects, and their quotas.
+- `origin iam`: role bindings, which grant a role to a member
+  (`user:{email}` or `serviceAccount:{id}`) in an organization or one of its
+  projects; service accounts; the roles and permissions on offer, and which
+  permissions you hold; your user; and an organization's audit log.
 - `origin location`: the regions and zones, and which services each zone
   offers.
 

crates/cli/Cargo.toml

@@ -25,6 +25,7 @@ origincloud-location.workspace = true
 origincloud-compute.workspace = true
 origincloud-network.workspace = true
 origincloud-resourcemanager.workspace = true
+origincloud-iam.workspace = true
 # A message field's JSON flag checks its value against the API's
 # descriptors, which the generator checks in beside the commands.
 prost-reflect = "0.16"