@axonflow/sdk 9.1.0 → 9.3.0

package/dist/cjs/types/authzen.gen.js

@@ -0,0 +1,804 @@
+"use strict";
+/**
+ * AuthZEN wire types and validators. GENERATED FILE — DO NOT EDIT.
+ *
+ * Source: tests/fixtures/authzen-surface.json
+ *   artifact:        axonflow-authzen-surface v1
+ *   profile:         axonflow-authzen-profile-2026-08-29
+ *   contract schema: 2026-08-29
+ *   schema digest:   sha256:04f63f4d97215faa9fbf2b6a5152630f7310edbe47440b975d0f66ad63df811f
+ *
+ * Regenerate with:
+ *
+ *   node scripts/gen-authzen-types/generate.js
+ *
+ * Editing this file by hand is pointless: tests/authzen-generator.test.ts
+ * regenerates it in memory and compares bytes, so a hand edit fails CI on the
+ * next run.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHZEN_OPERATIONAL_STATE_VALUES = exports.AUTHZEN_OPERATIONAL_STATE_ERROR = exports.AUTHZEN_OPERATIONAL_STATE_CHALLENGE = exports.AUTHZEN_OPERATIONAL_STATE_DENY = exports.AUTHZEN_OPERATIONAL_STATE_ALLOW = exports.AUTHZEN_OBLIGATION_TYPE_VALUES = exports.AUTHZEN_OBLIGATION_TYPE_NOTIFICATION = exports.AUTHZEN_OBLIGATION_TYPE_IMMUTABLE_AUDIT = exports.AUTHZEN_OBLIGATION_TYPE_QUOTA_RESERVATION = exports.AUTHZEN_OBLIGATION_TYPE_STEP_UP_AUTHENTICATION = exports.AUTHZEN_OBLIGATION_TYPE_ROUTE_RESTRICTION = exports.AUTHZEN_OBLIGATION_TYPE_RESPONSE_FILTER = exports.AUTHZEN_OBLIGATION_TYPE_SCHEMA_TRANSFORM = exports.AUTHZEN_OBLIGATION_TYPE_FIELD_TOKENIZE = exports.AUTHZEN_OBLIGATION_TYPE_FIELD_ANNOTATE = exports.AUTHZEN_OBLIGATION_TYPE_FIELD_MASK = exports.AUTHZEN_OBLIGATION_TYPE_FIELD_HASH = exports.AUTHZEN_OBLIGATION_TYPE_FIELD_REDACT = exports.AUTHZEN_OBLIGATION_TYPE_FIELD_REMOVE = exports.AUTHZEN_OBLIGATION_TYPE_APPROVAL_CHALLENGE = exports.AUTHZEN_IDENTIFIER_KIND_VALUES = exports.AUTHZEN_IDENTIFIER_KIND_SESSION = exports.AUTHZEN_IDENTIFIER_KIND_CLIENT = exports.AUTHZEN_IDENTIFIER_KIND_TOOL = exports.AUTHZEN_IDENTIFIER_KIND_ACTION = exports.AUTHZEN_IDENTIFIER_KIND_RESOURCE = exports.AUTHZEN_IDENTIFIER_KIND_GROUP = exports.AUTHZEN_IDENTIFIER_KIND_PRINCIPAL = exports.AUTHZEN_IDENTIFIER_KIND_ORGANIZATION = exports.AUTHZEN_CATEGORY_VALUES = exports.AUTHZEN_CATEGORY_INVALID_REQUEST = exports.AUTHZEN_CATEGORY_TEMPORARILY_UNAVAILABLE = exports.AUTHZEN_CATEGORY_APPROVAL_REQUIRED = exports.AUTHZEN_CATEGORY_NOT_PERMITTED = exports.AUTHZEN_CATEGORY_ALLOWED = exports.AUTHZEN_ERROR_CODE_VALUES = exports.AUTHZEN_ERROR_CODE_EVALUATION_UNAVAILABLE = exports.AUTHZEN_ERROR_CODE_MISSING_EVALUABLE_CONTENT = exports.AUTHZEN_ERROR_CODE_UNEVALUABLE_ATTRIBUTE = exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_RESOURCE = exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_ACTION = exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_SUBJECT = exports.AUTHZEN_ERROR_CODE_INCOMPLETE_EVALUATION = exports.AUTHZEN_ERROR_CODE_MALFORMED_ENVELOPE = exports.AuthZENSchemaError = exports.AUTHZEN_SOURCE_SCHEMA_SHA256 = exports.AUTHZEN_PROFILE_HEADER = exports.AUTHZEN_PATH = exports.AUTHZEN_CONTRACT_SCHEMA_VERSION = exports.AUTHZEN_PROFILE_V1 = void 0;
+exports.AUTHZEN_REASON_CODE_VALUES = exports.AUTHZEN_REASON_CODE_AUTHORING_REJECTED = exports.AUTHZEN_REASON_CODE_APPROVAL_EXPIRED = exports.AUTHZEN_REASON_CODE_APPROVAL_UNSATISFIABLE = exports.AUTHZEN_REASON_CODE_BINDING_MISMATCH = exports.AUTHZEN_REASON_CODE_BUDGET_EXHAUSTED = exports.AUTHZEN_REASON_CODE_DELEGATION_DEPTH_EXCEEDED = exports.AUTHZEN_REASON_CODE_SCHEMA_VIOLATION = exports.AUTHZEN_REASON_CODE_UNKNOWN_REALM = exports.AUTHZEN_REASON_CODE_UNKNOWN_ACTION = exports.AUTHZEN_REASON_CODE_OBLIGATION_CONFLICT = exports.AUTHZEN_REASON_CODE_UNSUPPORTED_OBLIGATION = exports.AUTHZEN_REASON_CODE_EVALUATION_ERROR = exports.AUTHZEN_REASON_CODE_INVALID_INPUT = exports.AUTHZEN_REASON_CODE_UNKNOWN_REQUIREMENT = exports.AUTHZEN_REASON_CODE_UNKNOWN_PERMISSION = exports.AUTHZEN_REASON_CODE_UNKNOWN_CONSTRAINT = exports.AUTHZEN_REASON_CODE_NO_MATCHING_PERMISSION = exports.AUTHZEN_REASON_CODE_EXPLICIT_CONSTRAINT = exports.AUTHZEN_REASON_CODE_APPROVAL_REQUIRED = exports.AUTHZEN_REASON_CODE_PERMITTED = void 0;
+exports.authzenFail = authzenFail;
+exports.authzenObject = authzenObject;
+exports.authzenString = authzenString;
+exports.authzenBoolean = authzenBoolean;
+exports.authzenInteger = authzenInteger;
+exports.authzenArray = authzenArray;
+exports.authzenNoExtraMembers = authzenNoExtraMembers;
+exports.validateAuthZENApprovalClause = validateAuthZENApprovalClause;
+exports.validateAuthZENApprovalRequirement = validateAuthZENApprovalRequirement;
+exports.validateAuthZENAction = validateAuthZENAction;
+exports.validateAuthZENBulk = validateAuthZENBulk;
+exports.validateAuthZENEnvelope = validateAuthZENEnvelope;
+exports.validateAuthZENError = validateAuthZENError;
+exports.validateAuthZENRequest = validateAuthZENRequest;
+exports.validateAuthZENResource = validateAuthZENResource;
+exports.validateAuthZENResponse = validateAuthZENResponse;
+exports.validateAuthZENResponseContext = validateAuthZENResponseContext;
+exports.validateAuthZENSubject = validateAuthZENSubject;
+exports.validateAuthZENIdentifier = validateAuthZENIdentifier;
+exports.validateAuthZENObligation = validateAuthZENObligation;
+// The profile a Policy Enforcement Point negotiates to receive anything beyond the
+// boolean decision. AuthZEN 1.0's response is a bare boolean; the four-valued state,
+// the obligations, the approval challenge and the safe reason code all ride in the
+// response context and are returned ONLY to a caller that asked for them by version.
+exports.AUTHZEN_PROFILE_V1 = 'axonflow-authzen-profile-2026-08-29';
+// The contract version these types were generated from. It is the value the server
+// echoes in AuthZENResponseContext.schema_version.
+exports.AUTHZEN_CONTRACT_SCHEMA_VERSION = '2026-08-29';
+// The one route the AuthZEN surface is served on, and the request header the profile
+// is negotiated with. Both are generated from the platform's contract through the
+// artifact, not written here: a rename on the platform is a regenerate-and-diff
+// failure in this SDK, not a 404 in production (axonflow-enterprise#3603).
+exports.AUTHZEN_PATH = '/api/v1/access/evaluation';
+exports.AUTHZEN_PROFILE_HEADER = 'X-Axonflow-AuthZEN-Profile';
+// The digest of the JSON Schema the artifact was reduced from. It is carried so a
+// support conversation can establish which contract a deployed SDK was built against
+// without reading its dependency tree.
+exports.AUTHZEN_SOURCE_SCHEMA_SHA256 = 'sha256:04f63f4d97215faa9fbf2b6a5152630f7310edbe47440b975d0f66ad63df811f';
+/**
+ * Raised when a value does not match the AuthZEN contract. The message always
+ * names a JSON Pointer, because on this surface the pointer IS the diagnosis:
+ * "unsupported_subject" without the offending member is a puzzle.
+ */
+class AuthZENSchemaError extends Error {
+    constructor(pointer, detail) {
+        super(`${pointer || '/'} ${detail}`);
+        this.name = 'AuthZENSchemaError';
+        this.pointer = pointer;
+        Object.setPrototypeOf(this, AuthZENSchemaError.prototype);
+    }
+}
+exports.AuthZENSchemaError = AuthZENSchemaError;
+function authzenFail(pointer, detail) {
+    throw new AuthZENSchemaError(pointer, detail);
+}
+function authzenObject(value, at) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        authzenFail(at, 'must be an object');
+    }
+    return { ...value };
+}
+function authzenString(value, at) {
+    if (typeof value !== 'string') {
+        authzenFail(at, 'must be a string');
+    }
+    return value;
+}
+function authzenBoolean(value, at) {
+    if (typeof value !== 'boolean') {
+        authzenFail(at, 'must be a boolean');
+    }
+    return value;
+}
+// An integer, not merely a number. The artifact distinguishes them, and a
+// fractional schema_version is not a schema_version.
+function authzenInteger(value, at) {
+    if (typeof value !== 'number' || !Number.isInteger(value)) {
+        authzenFail(at, 'must be an integer');
+    }
+    return value;
+}
+function authzenArray(value, at) {
+    if (!Array.isArray(value)) {
+        authzenFail(at, 'must be an array');
+    }
+    return value;
+}
+/**
+ * Refuse a member the contract does not declare.
+ *
+ * On the RESPONSE path this is the whole strictness argument: a member this
+ * build has never heard of means the server is speaking a profile it cannot
+ * fully read, and dropping it silently would mean acting on a partial reading
+ * of an authorization decision. On the REQUEST path it catches a member the
+ * caller invented before it becomes a 422.
+ */
+function authzenNoExtraMembers(obj, at, known) {
+    const extra = Object.keys(obj)
+        .filter(key => !known.includes(key))
+        .sort();
+    if (extra.length > 0) {
+        authzenFail(at, `carries members this build does not understand: ${extra.join(', ')}`);
+    }
+}
+exports.AUTHZEN_ERROR_CODE_MALFORMED_ENVELOPE = 'malformed_envelope';
+exports.AUTHZEN_ERROR_CODE_INCOMPLETE_EVALUATION = 'incomplete_evaluation';
+exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_SUBJECT = 'unsupported_subject';
+exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_ACTION = 'unsupported_action';
+exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_RESOURCE = 'unsupported_resource';
+exports.AUTHZEN_ERROR_CODE_UNEVALUABLE_ATTRIBUTE = 'unevaluable_attribute';
+exports.AUTHZEN_ERROR_CODE_MISSING_EVALUABLE_CONTENT = 'missing_evaluable_content';
+exports.AUTHZEN_ERROR_CODE_EVALUATION_UNAVAILABLE = 'evaluation_unavailable';
+// Every value of authzen_error_code this build knows, in the artifact's order.
+exports.AUTHZEN_ERROR_CODE_VALUES = [
+    exports.AUTHZEN_ERROR_CODE_MALFORMED_ENVELOPE,
+    exports.AUTHZEN_ERROR_CODE_INCOMPLETE_EVALUATION,
+    exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_SUBJECT,
+    exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_ACTION,
+    exports.AUTHZEN_ERROR_CODE_UNSUPPORTED_RESOURCE,
+    exports.AUTHZEN_ERROR_CODE_UNEVALUABLE_ATTRIBUTE,
+    exports.AUTHZEN_ERROR_CODE_MISSING_EVALUABLE_CONTENT,
+    exports.AUTHZEN_ERROR_CODE_EVALUATION_UNAVAILABLE,
+];
+exports.AUTHZEN_CATEGORY_ALLOWED = 'allowed';
+exports.AUTHZEN_CATEGORY_NOT_PERMITTED = 'not_permitted';
+exports.AUTHZEN_CATEGORY_APPROVAL_REQUIRED = 'approval_required';
+exports.AUTHZEN_CATEGORY_TEMPORARILY_UNAVAILABLE = 'temporarily_unavailable';
+exports.AUTHZEN_CATEGORY_INVALID_REQUEST = 'invalid_request';
+// Every value of category this build knows, in the artifact's order.
+exports.AUTHZEN_CATEGORY_VALUES = [
+    exports.AUTHZEN_CATEGORY_ALLOWED,
+    exports.AUTHZEN_CATEGORY_NOT_PERMITTED,
+    exports.AUTHZEN_CATEGORY_APPROVAL_REQUIRED,
+    exports.AUTHZEN_CATEGORY_TEMPORARILY_UNAVAILABLE,
+    exports.AUTHZEN_CATEGORY_INVALID_REQUEST,
+];
+exports.AUTHZEN_IDENTIFIER_KIND_ORGANIZATION = 'organization';
+exports.AUTHZEN_IDENTIFIER_KIND_PRINCIPAL = 'principal';
+exports.AUTHZEN_IDENTIFIER_KIND_GROUP = 'group';
+exports.AUTHZEN_IDENTIFIER_KIND_RESOURCE = 'resource';
+exports.AUTHZEN_IDENTIFIER_KIND_ACTION = 'action';
+exports.AUTHZEN_IDENTIFIER_KIND_TOOL = 'tool';
+exports.AUTHZEN_IDENTIFIER_KIND_CLIENT = 'client';
+exports.AUTHZEN_IDENTIFIER_KIND_SESSION = 'session';
+// Every value of identifier_kind this build knows, in the artifact's order.
+exports.AUTHZEN_IDENTIFIER_KIND_VALUES = [
+    exports.AUTHZEN_IDENTIFIER_KIND_ORGANIZATION,
+    exports.AUTHZEN_IDENTIFIER_KIND_PRINCIPAL,
+    exports.AUTHZEN_IDENTIFIER_KIND_GROUP,
+    exports.AUTHZEN_IDENTIFIER_KIND_RESOURCE,
+    exports.AUTHZEN_IDENTIFIER_KIND_ACTION,
+    exports.AUTHZEN_IDENTIFIER_KIND_TOOL,
+    exports.AUTHZEN_IDENTIFIER_KIND_CLIENT,
+    exports.AUTHZEN_IDENTIFIER_KIND_SESSION,
+];
+exports.AUTHZEN_OBLIGATION_TYPE_APPROVAL_CHALLENGE = 'approval_challenge';
+exports.AUTHZEN_OBLIGATION_TYPE_FIELD_REMOVE = 'field_remove';
+exports.AUTHZEN_OBLIGATION_TYPE_FIELD_REDACT = 'field_redact';
+exports.AUTHZEN_OBLIGATION_TYPE_FIELD_HASH = 'field_hash';
+exports.AUTHZEN_OBLIGATION_TYPE_FIELD_MASK = 'field_mask';
+exports.AUTHZEN_OBLIGATION_TYPE_FIELD_ANNOTATE = 'field_annotate';
+exports.AUTHZEN_OBLIGATION_TYPE_FIELD_TOKENIZE = 'field_tokenize';
+exports.AUTHZEN_OBLIGATION_TYPE_SCHEMA_TRANSFORM = 'schema_transform';
+exports.AUTHZEN_OBLIGATION_TYPE_RESPONSE_FILTER = 'response_filter';
+exports.AUTHZEN_OBLIGATION_TYPE_ROUTE_RESTRICTION = 'route_restriction';
+exports.AUTHZEN_OBLIGATION_TYPE_STEP_UP_AUTHENTICATION = 'step_up_authentication';
+exports.AUTHZEN_OBLIGATION_TYPE_QUOTA_RESERVATION = 'quota_reservation';
+exports.AUTHZEN_OBLIGATION_TYPE_IMMUTABLE_AUDIT = 'immutable_audit';
+exports.AUTHZEN_OBLIGATION_TYPE_NOTIFICATION = 'notification';
+// Every value of obligation_type this build knows, in the artifact's order.
+exports.AUTHZEN_OBLIGATION_TYPE_VALUES = [
+    exports.AUTHZEN_OBLIGATION_TYPE_APPROVAL_CHALLENGE,
+    exports.AUTHZEN_OBLIGATION_TYPE_FIELD_REMOVE,
+    exports.AUTHZEN_OBLIGATION_TYPE_FIELD_REDACT,
+    exports.AUTHZEN_OBLIGATION_TYPE_FIELD_HASH,
+    exports.AUTHZEN_OBLIGATION_TYPE_FIELD_MASK,
+    exports.AUTHZEN_OBLIGATION_TYPE_FIELD_ANNOTATE,
+    exports.AUTHZEN_OBLIGATION_TYPE_FIELD_TOKENIZE,
+    exports.AUTHZEN_OBLIGATION_TYPE_SCHEMA_TRANSFORM,
+    exports.AUTHZEN_OBLIGATION_TYPE_RESPONSE_FILTER,
+    exports.AUTHZEN_OBLIGATION_TYPE_ROUTE_RESTRICTION,
+    exports.AUTHZEN_OBLIGATION_TYPE_STEP_UP_AUTHENTICATION,
+    exports.AUTHZEN_OBLIGATION_TYPE_QUOTA_RESERVATION,
+    exports.AUTHZEN_OBLIGATION_TYPE_IMMUTABLE_AUDIT,
+    exports.AUTHZEN_OBLIGATION_TYPE_NOTIFICATION,
+];
+exports.AUTHZEN_OPERATIONAL_STATE_ALLOW = 'ALLOW';
+exports.AUTHZEN_OPERATIONAL_STATE_DENY = 'DENY';
+exports.AUTHZEN_OPERATIONAL_STATE_CHALLENGE = 'CHALLENGE';
+exports.AUTHZEN_OPERATIONAL_STATE_ERROR = 'ERROR';
+// Every value of operational_state this build knows, in the artifact's order.
+exports.AUTHZEN_OPERATIONAL_STATE_VALUES = [
+    exports.AUTHZEN_OPERATIONAL_STATE_ALLOW,
+    exports.AUTHZEN_OPERATIONAL_STATE_DENY,
+    exports.AUTHZEN_OPERATIONAL_STATE_CHALLENGE,
+    exports.AUTHZEN_OPERATIONAL_STATE_ERROR,
+];
+exports.AUTHZEN_REASON_CODE_PERMITTED = 'permitted';
+exports.AUTHZEN_REASON_CODE_APPROVAL_REQUIRED = 'approval_required';
+exports.AUTHZEN_REASON_CODE_EXPLICIT_CONSTRAINT = 'explicit_constraint';
+exports.AUTHZEN_REASON_CODE_NO_MATCHING_PERMISSION = 'no_matching_permission';
+exports.AUTHZEN_REASON_CODE_UNKNOWN_CONSTRAINT = 'unknown_constraint';
+exports.AUTHZEN_REASON_CODE_UNKNOWN_PERMISSION = 'unknown_permission';
+exports.AUTHZEN_REASON_CODE_UNKNOWN_REQUIREMENT = 'unknown_requirement';
+exports.AUTHZEN_REASON_CODE_INVALID_INPUT = 'invalid_input';
+exports.AUTHZEN_REASON_CODE_EVALUATION_ERROR = 'evaluation_error';
+exports.AUTHZEN_REASON_CODE_UNSUPPORTED_OBLIGATION = 'unsupported_obligation';
+exports.AUTHZEN_REASON_CODE_OBLIGATION_CONFLICT = 'obligation_conflict';
+exports.AUTHZEN_REASON_CODE_UNKNOWN_ACTION = 'unknown_action';
+exports.AUTHZEN_REASON_CODE_UNKNOWN_REALM = 'unknown_realm';
+exports.AUTHZEN_REASON_CODE_SCHEMA_VIOLATION = 'schema_violation';
+exports.AUTHZEN_REASON_CODE_DELEGATION_DEPTH_EXCEEDED = 'delegation_depth_exceeded';
+exports.AUTHZEN_REASON_CODE_BUDGET_EXHAUSTED = 'budget_exhausted';
+exports.AUTHZEN_REASON_CODE_BINDING_MISMATCH = 'binding_mismatch';
+exports.AUTHZEN_REASON_CODE_APPROVAL_UNSATISFIABLE = 'approval_unsatisfiable';
+exports.AUTHZEN_REASON_CODE_APPROVAL_EXPIRED = 'approval_expired';
+exports.AUTHZEN_REASON_CODE_AUTHORING_REJECTED = 'authoring_rejected';
+// Every value of reason_code this build knows, in the artifact's order.
+exports.AUTHZEN_REASON_CODE_VALUES = [
+    exports.AUTHZEN_REASON_CODE_PERMITTED,
+    exports.AUTHZEN_REASON_CODE_APPROVAL_REQUIRED,
+    exports.AUTHZEN_REASON_CODE_EXPLICIT_CONSTRAINT,
+    exports.AUTHZEN_REASON_CODE_NO_MATCHING_PERMISSION,
+    exports.AUTHZEN_REASON_CODE_UNKNOWN_CONSTRAINT,
+    exports.AUTHZEN_REASON_CODE_UNKNOWN_PERMISSION,
+    exports.AUTHZEN_REASON_CODE_UNKNOWN_REQUIREMENT,
+    exports.AUTHZEN_REASON_CODE_INVALID_INPUT,
+    exports.AUTHZEN_REASON_CODE_EVALUATION_ERROR,
+    exports.AUTHZEN_REASON_CODE_UNSUPPORTED_OBLIGATION,
+    exports.AUTHZEN_REASON_CODE_OBLIGATION_CONFLICT,
+    exports.AUTHZEN_REASON_CODE_UNKNOWN_ACTION,
+    exports.AUTHZEN_REASON_CODE_UNKNOWN_REALM,
+    exports.AUTHZEN_REASON_CODE_SCHEMA_VIOLATION,
+    exports.AUTHZEN_REASON_CODE_DELEGATION_DEPTH_EXCEEDED,
+    exports.AUTHZEN_REASON_CODE_BUDGET_EXHAUSTED,
+    exports.AUTHZEN_REASON_CODE_BINDING_MISMATCH,
+    exports.AUTHZEN_REASON_CODE_APPROVAL_UNSATISFIABLE,
+    exports.AUTHZEN_REASON_CODE_APPROVAL_EXPIRED,
+    exports.AUTHZEN_REASON_CODE_AUTHORING_REJECTED,
+];
+/**
+ * Validate an unknown value as AuthZENApprovalClause, or throw naming the member at
+ * fault. Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENApprovalClause(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['quorum', 'eligible']);
+    if (obj['quorum'] === undefined || obj['quorum'] === null) {
+        authzenFail(`${at}/quorum`, 'is required');
+    }
+    else {
+        authzenInteger(obj['quorum'], `${at}/quorum`);
+    }
+    if (obj['eligible'] === undefined || obj['eligible'] === null) {
+        authzenFail(`${at}/eligible`, 'is required');
+    }
+    else {
+        const items = authzenArray(obj['eligible'], `${at}/eligible`);
+        if (items.length < 1) {
+            authzenFail(`${at}/eligible`, 'needs at least 1 entry');
+        }
+        obj['eligible'] = items.map((item, index) => validateAuthZENIdentifier(item, `${`${at}/eligible`}/${index}`));
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENApprovalRequirement, or throw naming the member
+ * at fault. Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENApprovalRequirement(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['all_of', 'separation_of_duties', 'expires_at']);
+    if (obj['all_of'] === undefined || obj['all_of'] === null) {
+        authzenFail(`${at}/all_of`, 'is required');
+    }
+    else {
+        const items = authzenArray(obj['all_of'], `${at}/all_of`);
+        if (items.length < 1) {
+            authzenFail(`${at}/all_of`, 'needs at least 1 entry');
+        }
+        obj['all_of'] = items.map((item, index) => validateAuthZENApprovalClause(item, `${`${at}/all_of`}/${index}`));
+    }
+    if (obj['separation_of_duties'] === undefined || obj['separation_of_duties'] === null) {
+        authzenFail(`${at}/separation_of_duties`, 'is required');
+    }
+    else {
+        authzenBoolean(obj['separation_of_duties'], `${at}/separation_of_duties`);
+    }
+    if (obj['expires_at'] === undefined || obj['expires_at'] === null) {
+        authzenFail(`${at}/expires_at`, 'is required');
+    }
+    else {
+        authzenString(obj['expires_at'], `${at}/expires_at`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENAction, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENAction(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['name', 'properties']);
+    if (obj['name'] === undefined || obj['name'] === null) {
+        authzenFail(`${at}/name`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['name'], `${at}/name`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/name`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['properties'] === undefined || obj['properties'] === null) {
+        delete obj['properties'];
+    }
+    else {
+        authzenObject(obj['properties'], `${at}/properties`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENBulk, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENBulk(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['subject', 'action', 'resource', 'context', 'evaluations']);
+    if (obj['subject'] === undefined || obj['subject'] === null) {
+        delete obj['subject'];
+    }
+    else {
+        obj['subject'] = validateAuthZENSubject(obj['subject'], `${at}/subject`);
+    }
+    if (obj['action'] === undefined || obj['action'] === null) {
+        delete obj['action'];
+    }
+    else {
+        obj['action'] = validateAuthZENAction(obj['action'], `${at}/action`);
+    }
+    if (obj['resource'] === undefined || obj['resource'] === null) {
+        delete obj['resource'];
+    }
+    else {
+        obj['resource'] = validateAuthZENResource(obj['resource'], `${at}/resource`);
+    }
+    if (obj['context'] === undefined || obj['context'] === null) {
+        delete obj['context'];
+    }
+    else {
+        authzenObject(obj['context'], `${at}/context`);
+    }
+    if (obj['evaluations'] === undefined || obj['evaluations'] === null) {
+        authzenFail(`${at}/evaluations`, 'is required');
+    }
+    else {
+        const items = authzenArray(obj['evaluations'], `${at}/evaluations`);
+        if (items.length < 1) {
+            authzenFail(`${at}/evaluations`, 'needs at least 1 entry');
+        }
+        obj['evaluations'] = items.map((item, index) => validateAuthZENRequest(item, `${`${at}/evaluations`}/${index}`));
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENEnvelope, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENEnvelope(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['evaluation', 'evaluations']);
+    if (obj['evaluation'] === undefined || obj['evaluation'] === null) {
+        delete obj['evaluation'];
+    }
+    else {
+        obj['evaluation'] = validateAuthZENRequest(obj['evaluation'], `${at}/evaluation`);
+    }
+    if (obj['evaluations'] === undefined || obj['evaluations'] === null) {
+        delete obj['evaluations'];
+    }
+    else {
+        obj['evaluations'] = validateAuthZENBulk(obj['evaluations'], `${at}/evaluations`);
+    }
+    {
+        const set = [obj['evaluation'] !== undefined, obj['evaluations'] !== undefined].filter(Boolean).length;
+        if (set !== 1) {
+            authzenFail(at, `exactly one of evaluation or evaluations must be set, ${set} are`);
+        }
+    }
+    if (obj['evaluation'] !== undefined) {
+        const nested = obj['evaluation'];
+        if (nested['action'] === undefined || nested['action'] === null) {
+            authzenFail(`${at}/evaluation`, 'has no action; it has no shared base to inherit one from');
+        }
+    }
+    if (obj['evaluation'] !== undefined) {
+        const nested = obj['evaluation'];
+        if (nested['resource'] === undefined || nested['resource'] === null) {
+            authzenFail(`${at}/evaluation`, 'has no resource; it has no shared base to inherit one from');
+        }
+    }
+    if (obj['evaluation'] !== undefined) {
+        const nested = obj['evaluation'];
+        if (nested['subject'] === undefined || nested['subject'] === null) {
+            authzenFail(`${at}/evaluation`, 'has no subject; it has no shared base to inherit one from');
+        }
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENError, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENError(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['code', 'pointer', 'message', 'supported', 'request_id']);
+    if (obj['code'] === undefined || obj['code'] === null) {
+        authzenFail(`${at}/code`, 'is required');
+    }
+    else {
+        authzenString(obj['code'], `${at}/code`);
+    }
+    if (obj['pointer'] === undefined || obj['pointer'] === null) {
+        delete obj['pointer'];
+    }
+    else {
+        authzenString(obj['pointer'], `${at}/pointer`);
+    }
+    if (obj['message'] === undefined || obj['message'] === null) {
+        authzenFail(`${at}/message`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['message'], `${at}/message`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/message`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['supported'] === undefined || obj['supported'] === null) {
+        delete obj['supported'];
+    }
+    else {
+        const items = authzenArray(obj['supported'], `${at}/supported`);
+        items.forEach((item, index) => {
+            authzenString(item, `${`${at}/supported`}/${index}`);
+        });
+    }
+    if (obj['request_id'] === undefined || obj['request_id'] === null) {
+        delete obj['request_id'];
+    }
+    else {
+        authzenString(obj['request_id'], `${at}/request_id`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENRequest, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENRequest(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['subject', 'action', 'resource', 'context']);
+    if (obj['subject'] === undefined || obj['subject'] === null) {
+        delete obj['subject'];
+    }
+    else {
+        obj['subject'] = validateAuthZENSubject(obj['subject'], `${at}/subject`);
+    }
+    if (obj['action'] === undefined || obj['action'] === null) {
+        delete obj['action'];
+    }
+    else {
+        obj['action'] = validateAuthZENAction(obj['action'], `${at}/action`);
+    }
+    if (obj['resource'] === undefined || obj['resource'] === null) {
+        delete obj['resource'];
+    }
+    else {
+        obj['resource'] = validateAuthZENResource(obj['resource'], `${at}/resource`);
+    }
+    if (obj['context'] === undefined || obj['context'] === null) {
+        delete obj['context'];
+    }
+    else {
+        authzenObject(obj['context'], `${at}/context`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENResource, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENResource(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['type', 'id', 'properties']);
+    if (obj['type'] === undefined || obj['type'] === null) {
+        authzenFail(`${at}/type`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['type'], `${at}/type`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/type`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['id'] === undefined || obj['id'] === null) {
+        authzenFail(`${at}/id`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['id'], `${at}/id`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/id`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['properties'] === undefined || obj['properties'] === null) {
+        delete obj['properties'];
+    }
+    else {
+        authzenObject(obj['properties'], `${at}/properties`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENResponse, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENResponse(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['decision', 'context']);
+    if (obj['decision'] === undefined || obj['decision'] === null) {
+        authzenFail(`${at}/decision`, 'is required');
+    }
+    else {
+        authzenBoolean(obj['decision'], `${at}/decision`);
+    }
+    if (obj['context'] === undefined || obj['context'] === null) {
+        delete obj['context'];
+    }
+    else {
+        obj['context'] = validateAuthZENResponseContext(obj['context'], `${at}/context`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENResponseContext, or throw naming the member at
+ * fault. Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENResponseContext(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, [
+        'profile',
+        'state',
+        'category',
+        'reason',
+        'obligations',
+        'approval',
+        'decision_id',
+        'schema_version',
+    ]);
+    if (obj['profile'] === undefined || obj['profile'] === null) {
+        authzenFail(`${at}/profile`, 'is required');
+    }
+    else {
+        authzenString(obj['profile'], `${at}/profile`);
+    }
+    if (obj['state'] === undefined || obj['state'] === null) {
+        authzenFail(`${at}/state`, 'is required');
+    }
+    else {
+        authzenString(obj['state'], `${at}/state`);
+    }
+    if (obj['category'] === undefined || obj['category'] === null) {
+        authzenFail(`${at}/category`, 'is required');
+    }
+    else {
+        authzenString(obj['category'], `${at}/category`);
+    }
+    if (obj['reason'] === undefined || obj['reason'] === null) {
+        delete obj['reason'];
+    }
+    else {
+        authzenString(obj['reason'], `${at}/reason`);
+    }
+    if (obj['obligations'] === undefined || obj['obligations'] === null) {
+        delete obj['obligations'];
+    }
+    else {
+        const items = authzenArray(obj['obligations'], `${at}/obligations`);
+        obj['obligations'] = items.map((item, index) => validateAuthZENObligation(item, `${`${at}/obligations`}/${index}`));
+    }
+    if (obj['approval'] === undefined || obj['approval'] === null) {
+        delete obj['approval'];
+    }
+    else {
+        obj['approval'] = validateAuthZENApprovalRequirement(obj['approval'], `${at}/approval`);
+    }
+    if (obj['decision_id'] === undefined || obj['decision_id'] === null) {
+        authzenFail(`${at}/decision_id`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['decision_id'], `${at}/decision_id`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/decision_id`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['schema_version'] === undefined || obj['schema_version'] === null) {
+        authzenFail(`${at}/schema_version`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['schema_version'], `${at}/schema_version`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/schema_version`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENSubject, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENSubject(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['type', 'id', 'properties']);
+    if (obj['type'] === undefined || obj['type'] === null) {
+        authzenFail(`${at}/type`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['type'], `${at}/type`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/type`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['id'] === undefined || obj['id'] === null) {
+        authzenFail(`${at}/id`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['id'], `${at}/id`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/id`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['properties'] === undefined || obj['properties'] === null) {
+        delete obj['properties'];
+    }
+    else {
+        authzenObject(obj['properties'], `${at}/properties`);
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENIdentifier, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENIdentifier(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, ['kind', 'type', 'qualifier', 'local']);
+    if (obj['kind'] === undefined || obj['kind'] === null) {
+        authzenFail(`${at}/kind`, 'is required');
+    }
+    else {
+        authzenString(obj['kind'], `${at}/kind`);
+    }
+    if (obj['type'] === undefined || obj['type'] === null) {
+        authzenFail(`${at}/type`, 'is required');
+    }
+    else {
+        authzenString(obj['type'], `${at}/type`);
+    }
+    if (obj['qualifier'] === undefined || obj['qualifier'] === null) {
+        delete obj['qualifier'];
+    }
+    else {
+        authzenString(obj['qualifier'], `${at}/qualifier`);
+    }
+    if (obj['local'] === undefined || obj['local'] === null) {
+        authzenFail(`${at}/local`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['local'], `${at}/local`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/local`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    return obj;
+}
+/**
+ * Validate an unknown value as AuthZENObligation, or throw naming the member at fault.
+ * Unknown members are REFUSED rather than dropped: on the response path an
+ * unrecognised member is a server speaking a profile this build does not understand,
+ * and quietly ignoring it would mean acting on a partial reading of an authorization
+ * decision.
+ */
+function validateAuthZENObligation(value, at) {
+    const obj = authzenObject(value, at);
+    authzenNoExtraMembers(obj, at, [
+        'type',
+        'target',
+        'params',
+        'mandatory',
+        'source_policy',
+        'schema_version',
+    ]);
+    if (obj['type'] === undefined || obj['type'] === null) {
+        authzenFail(`${at}/type`, 'is required');
+    }
+    else {
+        authzenString(obj['type'], `${at}/type`);
+    }
+    if (obj['target'] === undefined || obj['target'] === null) {
+        delete obj['target'];
+    }
+    else {
+        const raw = authzenString(obj['target'], `${at}/target`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/target`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['params'] === undefined || obj['params'] === null) {
+        delete obj['params'];
+    }
+    else {
+        const entries = authzenObject(obj['params'], `${at}/params`);
+        Object.keys(entries).forEach(key => {
+            authzenString(entries[key], `${`${at}/params`}/${key}`);
+        });
+    }
+    if (obj['mandatory'] === undefined || obj['mandatory'] === null) {
+        authzenFail(`${at}/mandatory`, 'is required');
+    }
+    else {
+        authzenBoolean(obj['mandatory'], `${at}/mandatory`);
+    }
+    if (obj['source_policy'] === undefined || obj['source_policy'] === null) {
+        authzenFail(`${at}/source_policy`, 'is required');
+    }
+    else {
+        const raw = authzenString(obj['source_policy'], `${at}/source_policy`);
+        if (raw.length < 1) {
+            authzenFail(`${at}/source_policy`, 'must be at least 1 character(s); it is present but too short');
+        }
+    }
+    if (obj['schema_version'] === undefined || obj['schema_version'] === null) {
+        authzenFail(`${at}/schema_version`, 'is required');
+    }
+    else {
+        authzenInteger(obj['schema_version'], `${at}/schema_version`);
+    }
+    return obj;
+}
+//# sourceMappingURL=authzen.gen.js.map