@limecloud/cli 0.6.0 → 0.10.0

package/dist/identity.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Lime Identity API",
-    "version": "0.6.0",
+    "version": "0.10.0",
     "description": "Implemented public OAuth 2.0 and OpenID Connect endpoints. Plain protocol responses; separate from authenticated management BFF APIs."
   },
   "servers": [
@@ -77,11 +77,18 @@
             "name": "redirect_uri",
             "in": "query",
             "required": true,
-            "description": "Exact registered callback. Production requires HTTPS; sandbox accepts an explicitly registered HTTP loopback callback.",
-            "x-lime-zh-CN": "精确匹配已登记回调。生产要求 HTTPS；沙箱可使用显式登记的 HTTP 回环地址。",
+            "description": "Exact registered callback. Ordinary production clients require HTTPS. Only the dedicated native MCP client may use a registered numeric 127.0.0.1 HTTP callback; a registration without a port permits the host-selected port while preserving the exact path.",
             "schema": {
               "type": "string",
               "format": "uri"
+            },
+            "x-lime-localizations": {
+              "en": {
+                "description": "Exact registered callback. Ordinary production clients require HTTPS. Only the dedicated native MCP client may use a registered numeric 127.0.0.1 HTTP callback; a registration without a port permits the host-selected port while preserving the exact path."
+              },
+              "zh-CN": {
+                "description": "精确登记的回调。普通生产客户端要求 HTTPS；仅专用原生 MCP 客户端可使用登记的数值 127.0.0.1 HTTP 回调，未登记端口时允许宿主选择端口，路径仍须精确一致。"
+              }
             }
           },
           {
@@ -206,6 +213,25 @@
               "type": "string",
               "maxLength": 40
             }
+          },
+          {
+            "name": "resource",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "format": "uri",
+              "maxLength": 2048
+            },
+            "description": "Required exactly once for the explicitly provisioned MCP client: the canonical API origin plus /mcp. Do not send audience, installation or space selectors. Ordinary user clients cannot use this MCP resource parameter.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Required exactly once for the explicitly provisioned MCP client: the canonical API origin plus /mcp. Do not send audience, installation or space selectors. Ordinary user clients cannot use this MCP resource parameter."
+              },
+              "zh-CN": {
+                "description": "显式登记的 MCP 客户端必须准确提供一次：规范 API Origin 加 /mcp。不发送 audience、安装或空间选择；普通用户客户端不能使用此 MCP resource 参数。"
+              }
+            }
           }
         ],
         "responses": {
@@ -263,9 +289,9 @@
               }
             }
           },
-          "503": {
-            "description": "A required dependency is unavailable.",
-            "x-lime-zh-CN": "必要依赖暂时不可用。",
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
             "content": {
               "application/json": {
                 "schema": {
@@ -274,9 +300,9 @@
               }
             }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
             "content": {
               "application/json": {
                 "schema": {
@@ -293,8 +319,7 @@
         "operationId": "identity_token",
         "summary": "Exchange or refresh tokens",
         "x-lime-summary-zh-CN": "兑换或刷新令牌",
-        "description": "Form-encoded request, not JSON. Public clients send client_id and no secret. Confidential and machine clients use client_secret_basic. Code+S256 is required for all authorization-code clients. Installation context is frozen before token exchange; installation_id, space_id, expected_generation and expected_release_id are rejected here. Responses are plain OAuth JSON, without a data envelope.",
-        "x-lime-zh-CN": "使用表单编码，不接收 JSON。公共客户端提交 client_id，不持有 Secret；机密与机器客户端使用 client_secret_basic。所有授权码客户端均要求 S256。安装上下文在兑换前冻结，此处拒绝 installation_id、space_id、expected_generation、expected_release_id。响应直接为 OAuth JSON，没有 data 包装。",
+        "description": "Use form encoding, not JSON. Public clients send client_id without a secret; confidential and machine clients use HTTP Basic. All authorization-code clients require S256. Installation context is frozen before exchange and cannot be supplied here. A production business machine request selects one current customer ClientGrant, one exact Audience and explicit scopes. Responses are plain OAuth JSON without a data envelope.",
         "tags": [
           "Identity"
         ],
@@ -348,6 +373,24 @@
               }
             }
           },
+          "403": {
+            "description": "The client, customer approval, Audience or requested scope is not currently allowed. Do not retry unchanged requests or substitute another customer context.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The client, customer approval, Audience or requested scope is not currently allowed. Do not retry unchanged requests or substitute another customer context."
+              },
+              "zh-CN": {
+                "description": "当前 Client、客户批准、Audience 或所请求 Scope 不允许。不要原样重试或替换其他客户上下文。"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
           "429": {
             "description": "Rate limit exceeded. Wait before retrying.",
             "x-lime-zh-CN": "请求超过限流窗口，等待后重试。",
@@ -367,9 +410,9 @@
               }
             }
           },
-          "503": {
-            "description": "A required dependency is unavailable.",
-            "x-lime-zh-CN": "必要依赖暂时不可用。",
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
             "content": {
               "application/json": {
                 "schema": {
@@ -378,9 +421,9 @@
               }
             }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
             "content": {
               "application/json": {
                 "schema": {
@@ -389,6 +432,14 @@
               }
             }
           }
+        },
+        "x-lime-localizations": {
+          "en": {
+            "description": "Use form encoding, not JSON. Public clients send client_id without a secret; confidential and machine clients use HTTP Basic. All authorization-code clients require S256. Installation context is frozen before exchange and cannot be supplied here. A production business machine request selects one current customer ClientGrant, one exact Audience and explicit scopes. Responses are plain OAuth JSON without a data envelope."
+          },
+          "zh-CN": {
+            "description": "使用表单编码，不接收 JSON。公共客户端提交 client_id，不持有 Secret；机密与机器客户端使用 HTTP Basic。所有授权码客户端均要求 S256。安装上下文在兑换前冻结，不能在此提交。生产业务机器请求选择一个当前客户 ClientGrant、一个精确 Audience 和显式 Scope。响应直接为 OAuth JSON，没有 data 包装。"
+          }
         }
       }
     },
@@ -471,9 +522,9 @@
               }
             }
           },
-          "503": {
-            "description": "A required dependency is unavailable.",
-            "x-lime-zh-CN": "必要依赖暂时不可用。",
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
             "content": {
               "application/json": {
                 "schema": {
@@ -482,9 +533,9 @@
               }
             }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
             "content": {
               "application/json": {
                 "schema": {
@@ -564,9 +615,9 @@
               }
             }
           },
-          "503": {
-            "description": "A required dependency is unavailable.",
-            "x-lime-zh-CN": "必要依赖暂时不可用。",
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
             "content": {
               "application/json": {
                 "schema": {
@@ -575,9 +626,9 @@
               }
             }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
             "content": {
               "application/json": {
                 "schema": {
@@ -655,9 +706,9 @@
               }
             }
           },
-          "503": {
-            "description": "A required dependency is unavailable.",
-            "x-lime-zh-CN": "必要依赖暂时不可用。",
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
             "content": {
               "application/json": {
                 "schema": {
@@ -666,9 +717,9 @@
               }
             }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
             "content": {
               "application/json": {
                 "schema": {
@@ -778,9 +829,9 @@
               }
             }
           },
-          "503": {
-            "description": "A required dependency is unavailable.",
-            "x-lime-zh-CN": "必要依赖暂时不可用。",
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
             "content": {
               "application/json": {
                 "schema": {
@@ -789,9 +840,9 @@
               }
             }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "503": {
+            "description": "A required dependency is unavailable.",
+            "x-lime-zh-CN": "必要依赖暂时不可用。",
             "content": {
               "application/json": {
                 "schema": {
@@ -881,6 +932,17 @@
               }
             }
           },
+          "500": {
+            "description": "Protocol processing failed.",
+            "x-lime-zh-CN": "协议处理失败。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
           "503": {
             "description": "A required dependency is unavailable.",
             "x-lime-zh-CN": "必要依赖暂时不可用。",
@@ -891,10 +953,145 @@
                 }
               }
             }
+          }
+        }
+      }
+    },
+    "/oauth/resource/introspect": {
+      "post": {
+        "operationId": "identity_resource_introspect",
+        "summary": "Check resource access",
+        "description": "Check a business machine access token for one exact API and action using a separately provisioned resource-server credential. Current token, customer approval, API/runtime generations and verifier binding are checked in one MySQL transaction. Provisioning currently requires trusted internal orchestration; self-service management is pending. Enforce the returned customer, data and field limits in the real resource owner. Do not cache allowed responses; a remote decision does not lock the provider database or guarantee atomic revocation of in-flight work.",
+        "x-lime-localizations": {
+          "en": {
+            "summary": "Check resource access",
+            "description": "Check a business machine access token for one exact API and action using a separately provisioned resource-server credential. Current token, customer approval, API/runtime generations and verifier binding are checked in one MySQL transaction. Provisioning currently requires trusted internal orchestration; self-service management is pending. Enforce the returned customer, data and field limits in the real resource owner. Do not cache allowed responses; a remote decision does not lock the provider database or guarantee atomic revocation of in-flight work."
+          },
+          "zh-CN": {
+            "summary": "检查资源访问权限",
+            "description": "使用单独登记的资源服务器专用凭据，为一个精确 API 和动作检查业务机器 Access Token。在同一 MySQL 事务中重验当前令牌、客户批准、API/运行代次及校验方绑定。当前登记需可信内部编排，自助管理尚待接通。实际资源所属领域必须执行返回的客户、数据及字段限制。不得缓存允许结果；远程决策不会锁定提供方数据库，也不能保证在途工作的原子撤权。"
+          }
+        },
+        "tags": [
+          "Identity"
+        ],
+        "security": [
+          {
+            "ResourceServerBasic": []
+          }
+        ],
+        "x-lime-cli": "identity.resource.introspect",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/x-www-form-urlencoded": {
+              "schema": {
+                "$ref": "#/components/schemas/ResourceIntrospectionInput"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The token is currently permitted for this API and action. Enforce all returned restrictions in the resource owner before querying or writing. Responses use Cache-Control:no-store.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The token is currently permitted for this API and action. Enforce all returned restrictions in the resource owner before querying or writing. Responses use Cache-Control:no-store."
+              },
+              "zh-CN": {
+                "description": "令牌当前允许访问此 API 和动作。资源所属领域须在查询或写入前执行全部返回限制。响应使用 Cache-Control:no-store。"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ResourceIntrospectionResult"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid content type, query, form shape, repeated field or bounded input.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Invalid content type, query, form shape, repeated field or bounded input."
+              },
+              "zh-CN": {
+                "description": "内容类型、查询参数、表单结构、重复字段或有界输入不合法。"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
           },
-          "500": {
-            "description": "Protocol processing failed.",
-            "x-lime-zh-CN": "协议处理失败。",
+          "401": {
+            "description": "Dedicated resource-server credentials are missing, incorrect or revoked.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Dedicated resource-server credentials are missing, incorrect or revoked."
+              },
+              "zh-CN": {
+                "description": "资源服务器专用凭据缺失、不正确或已撤销。"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "The verifier has no current binding for the requested Audience or action. Rotation requires explicit approval for the new credential generation.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The verifier has no current binding for the requested Audience or action. Rotation requires explicit approval for the new credential generation."
+              },
+              "zh-CN": {
+                "description": "校验方没有请求 Audience 或动作的当前绑定。凭据轮换后需显式批准新代次。"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded. Observe Retry-After.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Rate limit exceeded. Observe Retry-After."
+              },
+              "zh-CN": {
+                "description": "请求超出限流。遵守 Retry-After。"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Identity, authorization, storage or audit is unavailable or inconsistent. Deny resource access and follow the original business operation's retry policy.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Identity, authorization, storage or audit is unavailable or inconsistent. Deny resource access and follow the original business operation's retry policy."
+              },
+              "zh-CN": {
+                "description": "身份、授权、存储或审计不可用或不一致。拒绝资源访问，按原业务操作政策处理重试。"
+              }
+            },
             "content": {
               "application/json": {
                 "schema": {
@@ -905,6 +1102,41 @@
           }
         }
       }
+    },
+    "/.well-known/oauth-authorization-server": {
+      "get": {
+        "operationId": "identity_oauth_metadata",
+        "summary": "OAuth authorization server metadata",
+        "description": "Read the canonical authorization-server metadata, including S256 PKCE and available scopes. A pre-registered MCP client uses the separate protected-resource metadata to select this issuer. No dynamic registration or CIMD is advertised.",
+        "tags": [
+          "Identity"
+        ],
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "Issuer metadata.",
+            "x-lime-zh-CN": "Issuer 元数据。",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Discovery"
+                }
+              }
+            }
+          }
+        },
+        "x-lime-localizations": {
+          "en": {
+            "description": "Read the canonical authorization-server metadata, including S256 PKCE and available scopes. A pre-registered MCP client uses the separate protected-resource metadata to select this issuer. No dynamic registration or CIMD is advertised.",
+            "summary": "OAuth authorization server metadata"
+          },
+          "zh-CN": {
+            "description": "读取规范授权服务器元数据，包括 S256 PKCE 与可用 Scope。预登记 MCP 客户端通过独立受保护资源元数据选定此 Issuer；当前不声明动态注册或 CIMD。",
+            "summary": "OAuth 授权服务器元数据"
+          }
+        },
+        "x-lime-cli": "identity.metadata.get"
+      }
     }
   },
   "components": {
@@ -918,6 +1150,19 @@
         "type": "http",
         "scheme": "bearer",
         "description": "Opaque user access token with openid."
+      },
+      "ResourceServerBasic": {
+        "type": "http",
+        "scheme": "basic",
+        "description": "Dedicated resource-server ID and secret, form-encoded before HTTP Basic. Consumer client credentials and user sessions are rejected. This credential cannot issue, refresh or revoke OAuth tokens.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "Dedicated resource-server ID and secret, form-encoded before HTTP Basic. Consumer client credentials and user sessions are rejected. This credential cannot issue, refresh or revoke OAuth tokens."
+          },
+          "zh-CN": {
+            "description": "资源服务器专用 ID 与 Secret，经表单编码后使用 HTTP Basic。拒绝消费客户端凭据和用户会话。此凭据不能签发、刷新或撤销 OAuth 令牌。"
+          }
+        }
       }
     },
     "schemas": {
@@ -977,6 +1222,20 @@
             "x-lime-zh-CN": "原始随机 PKCE verifier，不得将其发往授权端点。",
             "minLength": 43,
             "maxLength": 128
+          },
+          "resource": {
+            "type": "string",
+            "format": "uri",
+            "maxLength": 2048,
+            "description": "Required exactly once for the dedicated MCP client, matching the original /mcp resource. The token endpoint rejects a missing, duplicate or changed resource before consuming the original code or refresh token. Not a selector for ordinary user-client tokens.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Required exactly once for the dedicated MCP client, matching the original /mcp resource. The token endpoint rejects a missing, duplicate or changed resource before consuming the original code or refresh token. Not a selector for ordinary user-client tokens."
+              },
+              "zh-CN": {
+                "description": "专用 MCP 客户端必须准确提供一次，并与原 /mcp 资源一致。缺失、重复或变化时，在消费原授权码或刷新令牌前拒绝；不能用它选择普通用户客户端令牌的资源。"
+              }
+            }
           }
         },
         "required": [
@@ -1007,6 +1266,20 @@
             "type": "string",
             "description": "Optional subset of the original grant; cannot add scopes.",
             "x-lime-zh-CN": "可选的原授权权限子集，不得扩权。"
+          },
+          "resource": {
+            "type": "string",
+            "format": "uri",
+            "maxLength": 2048,
+            "description": "Required exactly once for the dedicated MCP client, matching the original /mcp resource. The token endpoint rejects a missing, duplicate or changed resource before consuming the original code or refresh token. Not a selector for ordinary user-client tokens.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Required exactly once for the dedicated MCP client, matching the original /mcp resource. The token endpoint rejects a missing, duplicate or changed resource before consuming the original code or refresh token. Not a selector for ordinary user-client tokens."
+              },
+              "zh-CN": {
+                "description": "专用 MCP 客户端必须准确提供一次，并与原 /mcp 资源一致。缺失、重复或变化时，在消费原授权码或刷新令牌前拒绝；不能用它选择普通用户客户端令牌的资源。"
+              }
+            }
           }
         },
         "required": [
@@ -1045,21 +1318,28 @@
           "grant_type": {
             "type": "string",
             "const": "client_credentials"
-          },
-          "audience": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "description": "Optional registered audiences. Repeat the form field for multiple audiences; unregistered values are rejected.",
-            "x-lime-zh-CN": "可选的已登记 Audience。多个值须重复表单字段，未登记值会被拒绝。"
           }
         },
         "required": [
           "grant_type"
         ],
-        "description": "Machine clients only. No user scopes, user identity or generic business API access is granted.",
-        "x-lime-zh-CN": "仅限机器客户端，不授予用户权限、用户身份或通用业务 API 访问权。"
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/OrdinaryMachineTokenRequest"
+          },
+          {
+            "$ref": "#/components/schemas/BusinessMachineTokenRequest"
+          }
+        ],
+        "description": "Machine clients use HTTP Basic. Choose either ordinary registered audiences or an explicit customer-approved business grant. Neither variant provides user identity, ID tokens, refresh tokens or UserInfo access.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "Machine clients use HTTP Basic. Choose either ordinary registered audiences or an explicit customer-approved business grant. Neither variant provides user identity, ID tokens, refresh tokens or UserInfo access."
+          },
+          "zh-CN": {
+            "description": "机器客户端使用 HTTP Basic，选择普通已登记 Audience，或显式绑定客户批准的业务授权。两种请求均不提供用户身份、ID Token、Refresh Token 或 UserInfo 访问权。"
+          }
+        }
       },
       "TokenResponse": {
         "type": "object",
@@ -1074,9 +1354,16 @@
           },
           "expires_in": {
             "type": "integer",
-            "description": "Access token lifetime in seconds. Use the response value.",
-            "x-lime-zh-CN": "访问令牌有效秒数，以响应为准。",
-            "minimum": 0
+            "description": "Access token lifetime in seconds; use the response value. Business machine tokens last at most 300 seconds and cannot outlive their customer ClientGrant.",
+            "minimum": 0,
+            "x-lime-localizations": {
+              "en": {
+                "description": "Access token lifetime in seconds; use the response value. Business machine tokens last at most 300 seconds and cannot outlive their customer ClientGrant."
+              },
+              "zh-CN": {
+                "description": "访问令牌有效秒数，以响应为准。业务机器令牌最多 300 秒，且不超过客户 ClientGrant 的有效期。"
+              }
+            }
           },
           "scope": {
             "type": "string",
@@ -1273,6 +1560,33 @@
           },
           "lime_installation_generation": {
             "type": "integer"
+          },
+          "lime_client_grant_id": {
+            "type": "string",
+            "description": "Original customer ClientGrant ID for an active business machine token. Introspection authenticates the token's own client; this claim does not grant resource access by itself.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Original customer ClientGrant ID for an active business machine token. Introspection authenticates the token's own client; this claim does not grant resource access by itself."
+              },
+              "zh-CN": {
+                "description": "有效业务机器令牌的原客户 ClientGrant ID。内省要求使用令牌所属 Client 认证；该声明本身不授予资源访问权。"
+              }
+            }
+          },
+          "lime_principal_type": {
+            "type": "string",
+            "enum": [
+              "machine"
+            ],
+            "description": "Machine service identity. A machine token cannot impersonate a user or inherit a creator's MFA or consent.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Machine service identity. A machine token cannot impersonate a user or inherit a creator's MFA or consent."
+              },
+              "zh-CN": {
+                "description": "机器服务身份。机器令牌不能冒充用户，也不继承创建人的 MFA 或用户同意。"
+              }
+            }
           }
         },
         "required": [
@@ -1447,6 +1761,461 @@
             "client_credentials": "#/components/schemas/MachineTokenRequest"
           }
         }
+      },
+      "OrdinaryMachineTokenRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "grant_type"
+        ],
+        "properties": {
+          "grant_type": {
+            "type": "string",
+            "const": "client_credentials"
+          },
+          "audience": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Optional registered non-business audiences. Repeat the form field for multiple audiences. Unregistered audiences are rejected.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Optional registered non-business audiences. Repeat the form field for multiple audiences. Unregistered audiences are rejected."
+              },
+              "zh-CN": {
+                "description": "可选的已登记非业务 Audience。多个值须重复表单字段，未登记值会被拒绝。"
+              }
+            }
+          }
+        },
+        "description": "An ordinary machine token is limited to registered non-business audiences. It does not authorize business APIs, user scopes or management /api/v1 entry points.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "An ordinary machine token is limited to registered non-business audiences. It does not authorize business APIs, user scopes or management /api/v1 entry points."
+          },
+          "zh-CN": {
+            "description": "普通机器令牌仅限已登记的非业务 Audience，不授予业务 API、用户 Scope 或管理 /api/v1 入口的访问权。"
+          }
+        }
+      },
+      "BusinessMachineTokenRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "grant_type",
+          "client_grant_id",
+          "audience",
+          "scope"
+        ],
+        "properties": {
+          "grant_type": {
+            "type": "string",
+            "const": "client_credentials"
+          },
+          "client_grant_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,48}$",
+            "description": "The exact customer ClientGrant ID created in Console for this production client. It fixes the original customer, installation, release and security generations; those values cannot be overridden in the request.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The exact customer ClientGrant ID created in Console for this production client. It fixes the original customer, installation, release and security generations; those values cannot be overridden in the request."
+              },
+              "zh-CN": {
+                "description": "在 Console 为该生产 Client 创建的精确客户 ClientGrant ID。原客户、安装、发布及安全代次由批准固定，不能通过请求覆盖。"
+              }
+            }
+          },
+          "audience": {
+            "type": "string",
+            "pattern": "^urn:lime:api:[A-Za-z0-9_-]{1,40}:production:[A-Za-z0-9_-]{1,40}$",
+            "description": "One exact production API Audience from the selected customer approval. Repeated fields, sandbox and other APIs are rejected.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "One exact production API Audience from the selected customer approval. Repeated fields, sandbox and other APIs are rejected."
+              },
+              "zh-CN": {
+                "description": "所选客户批准中的单个精确生产 API Audience。拒绝重复字段、沙箱及其他 API。"
+              }
+            }
+          },
+          "scope": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Explicit space-separated subset of the selected approval: 1–100 distinct business scope codes, each at most 128 characters. Omission, duplicates, identity scopes and unapproved scopes are rejected. Scopes never expand the approved data or fields.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Explicit space-separated subset of the selected approval: 1–100 distinct business scope codes, each at most 128 characters. Omission, duplicates, identity scopes and unapproved scopes are rejected. Scopes never expand the approved data or fields."
+              },
+              "zh-CN": {
+                "description": "所选批准内的显式 Scope 子集，以空格分隔：1–100 个互不重复的业务权限码，每个最多 128 字符。省略、重复、身份 Scope 或未批准的 Scope 均被拒绝；Scope 不能扩大已批准的数据或字段。"
+              }
+            }
+          }
+        },
+        "description": "An active production machine client must select a current customer ClientGrant for that exact client and Audience. Send each field once, with no query parameters or additional form fields. Tokens last at most five minutes and cannot outlive the customer approval. Resource access still requires an implemented resource owner that enforces current scope, data and field limits.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "An active production machine client must select a current customer ClientGrant for that exact client and Audience. Send each field once, with no query parameters or additional form fields. Tokens last at most five minutes and cannot outlive the customer approval. Resource access still requires an implemented resource owner that enforces current scope, data and field limits."
+          },
+          "zh-CN": {
+            "description": "有效生产机器客户端必须选择属于该 Client 和精确 Audience 的当前客户 ClientGrant。每个字段只提交一次，不带查询参数或额外表单字段。令牌最长五分钟，且不超过客户批准期限。资源访问仍需已实现的资源所属领域执行当前 Scope、数据及字段限制。"
+          }
+        }
+      },
+      "ResourceIntrospectionInput": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "token",
+          "audience",
+          "action"
+        ],
+        "properties": {
+          "token": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 4096,
+            "writeOnly": true,
+            "description": "Original opaque business machine access token. User tokens, ID tokens, forged tokens and tokens for another API return only active:false.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Original opaque business machine access token. User tokens, ID tokens, forged tokens and tokens for another API return only active:false."
+              },
+              "zh-CN": {
+                "description": "原业务机器不透明 Access Token。用户令牌、ID Token、伪造令牌及其他 API 的令牌仅返回 active:false。"
+              }
+            }
+          },
+          "audience": {
+            "type": "string",
+            "pattern": "^urn:lime:api:[A-Za-z0-9_-]{1,40}:production:[A-Za-z0-9_-]{1,40}$",
+            "description": "One exact production API Audience bound to this resource server. Query parameters, repeated form fields and additional fields are rejected.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "One exact production API Audience bound to this resource server. Query parameters, repeated form fields and additional fields are rejected."
+              },
+              "zh-CN": {
+                "description": "此资源服务器绑定的单个精确生产 API Audience。拒绝查询参数、重复表单字段和额外字段。"
+              }
+            }
+          },
+          "action": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "description": "One action explicitly allowed by the verifier binding and an actual token scope in the current API definition. An action name does not imply another action.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "One action explicitly allowed by the verifier binding and an actual token scope in the current API definition. An action name does not imply another action."
+              },
+              "zh-CN": {
+                "description": "校验方绑定与当前 API 定义中令牌实际 Scope 同时允许的一个动作。动作名称不隐含其他动作。"
+              }
+            }
+          }
+        }
+      },
+      "ResourceIntrospectionSelection": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "provider_application_id",
+          "api_resource_id",
+          "scope_code",
+          "subject_kind",
+          "data_scope_kind",
+          "resource_ids",
+          "readable_fields",
+          "writable_fields"
+        ],
+        "properties": {
+          "provider_application_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$"
+          },
+          "api_resource_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$"
+          },
+          "scope_code": {
+            "type": "string"
+          },
+          "subject_kind": {
+            "const": "service",
+            "type": "string"
+          },
+          "data_scope_kind": {
+            "type": "string",
+            "enum": [
+              "space",
+              "application",
+              "assigned_resources"
+            ]
+          },
+          "resource_ids": {
+            "type": "array",
+            "maxItems": 100,
+            "uniqueItems": true,
+            "items": {
+              "type": "string",
+              "maxLength": 128
+            },
+            "description": "Original approved data and field limits for token scopes that permit this action. Assigned IDs still require the provider's real customer/resource mapping.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Original approved data and field limits for token scopes that permit this action. Assigned IDs still require the provider's real customer/resource mapping."
+              },
+              "zh-CN": {
+                "description": "允许本次动作的令牌 Scope 对应的原批准数据及字段限制。指定 ID 仍须与提供方真实客户/资源映射核验。"
+              }
+            }
+          },
+          "readable_fields": {
+            "type": "array",
+            "maxItems": 100,
+            "uniqueItems": true,
+            "items": {
+              "type": "string",
+              "maxLength": 128
+            },
+            "description": "Explicit field allowlist, applied before serialization or writes. An empty list grants no fields; it never means all fields.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Explicit field allowlist, applied before serialization or writes. An empty list grants no fields; it never means all fields."
+              },
+              "zh-CN": {
+                "description": "显式字段白名单，须在序列化或写入前执行。空列表不授予任何字段，绝不表示全部字段。"
+              }
+            }
+          },
+          "writable_fields": {
+            "type": "array",
+            "maxItems": 100,
+            "uniqueItems": true,
+            "items": {
+              "type": "string",
+              "maxLength": 128
+            },
+            "description": "Explicit field allowlist, applied before serialization or writes. An empty list grants no fields; it never means all fields.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Explicit field allowlist, applied before serialization or writes. An empty list grants no fields; it never means all fields."
+              },
+              "zh-CN": {
+                "description": "显式字段白名单，须在序列化或写入前执行。空列表不授予任何字段，绝不表示全部字段。"
+              }
+            }
+          }
+        },
+        "description": "Original approved data and field limits for token scopes that permit this action. Assigned IDs still require the provider's real customer/resource mapping.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "Original approved data and field limits for token scopes that permit this action. Assigned IDs still require the provider's real customer/resource mapping."
+          },
+          "zh-CN": {
+            "description": "允许本次动作的令牌 Scope 对应的原批准数据及字段限制。指定 ID 仍须与提供方真实客户/资源映射核验。"
+          }
+        }
+      },
+      "ResourceIntrospectionActive": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "active",
+          "iss",
+          "sub",
+          "client_id",
+          "aud",
+          "exp",
+          "lime_principal_type",
+          "lime_environment",
+          "lime_client_grant_id",
+          "lime_customer_space_id",
+          "lime_installation_id",
+          "lime_release_id",
+          "lime_resource_generation",
+          "lime_runtime_generation",
+          "action",
+          "scope",
+          "selections"
+        ],
+        "properties": {
+          "active": {
+            "type": "boolean",
+            "const": true,
+            "description": "The token is currently permitted for this API and action. Enforce all returned restrictions in the resource owner before querying or writing. Responses use Cache-Control:no-store.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "The token is currently permitted for this API and action. Enforce all returned restrictions in the resource owner before querying or writing. Responses use Cache-Control:no-store."
+              },
+              "zh-CN": {
+                "description": "令牌当前允许访问此 API 和动作。资源所属领域须在查询或写入前执行全部返回限制。响应使用 Cache-Control:no-store。"
+              }
+            }
+          },
+          "iss": {
+            "type": "string",
+            "format": "uri"
+          },
+          "sub": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$"
+          },
+          "client_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$"
+          },
+          "aud": {
+            "type": "string",
+            "description": "One exact production API Audience bound to this resource server. Query parameters, repeated form fields and additional fields are rejected.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "One exact production API Audience bound to this resource server. Query parameters, repeated form fields and additional fields are rejected."
+              },
+              "zh-CN": {
+                "description": "此资源服务器绑定的单个精确生产 API Audience。拒绝查询参数、重复表单字段和额外字段。"
+              }
+            }
+          },
+          "exp": {
+            "type": "integer",
+            "description": "Unix seconds, capped by token and verifier-binding expiry. This does not permit caching allowed results.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Unix seconds, capped by token and verifier-binding expiry. This does not permit caching allowed results."
+              },
+              "zh-CN": {
+                "description": "Unix 秒数，不超过令牌与校验方绑定期限。这不允许缓存成功决策。"
+              }
+            }
+          },
+          "lime_principal_type": {
+            "type": "string",
+            "const": "machine"
+          },
+          "lime_environment": {
+            "type": "string",
+            "const": "production"
+          },
+          "lime_client_grant_id": {
+            "type": "string",
+            "maxLength": 48
+          },
+          "lime_customer_space_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$",
+            "description": "Original installed customer space. Never replace it with a header, host, caller field or the provider application's space.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Original installed customer space. Never replace it with a header, host, caller field or the provider application's space."
+              },
+              "zh-CN": {
+                "description": "原安装客户空间。不得替换为 Header、Host、调用方字段或提供应用自身空间。"
+              }
+            }
+          },
+          "lime_installation_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$"
+          },
+          "lime_release_id": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9_-]{1,40}$"
+          },
+          "lime_resource_generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "lime_runtime_generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "action": {
+            "type": "string",
+            "description": "One action explicitly allowed by the verifier binding and an actual token scope in the current API definition. An action name does not imply another action.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "One action explicitly allowed by the verifier binding and an actual token scope in the current API definition. An action name does not imply another action."
+              },
+              "zh-CN": {
+                "description": "校验方绑定与当前 API 定义中令牌实际 Scope 同时允许的一个动作。动作名称不隐含其他动作。"
+              }
+            }
+          },
+          "scope": {
+            "type": "string",
+            "description": "Space-separated actual token scopes permitting this action. Other token scopes and customer-approved scopes are excluded.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Space-separated actual token scopes permitting this action. Other token scopes and customer-approved scopes are excluded."
+              },
+              "zh-CN": {
+                "description": "允许本次动作的令牌实际 Scope，以空格分隔；排除其他令牌 Scope 和仅客户批准的 Scope。"
+              }
+            }
+          },
+          "selections": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 100,
+            "items": {
+              "$ref": "#/components/schemas/ResourceIntrospectionSelection"
+            },
+            "description": "Original approved data and field limits for token scopes that permit this action. Assigned IDs still require the provider's real customer/resource mapping.",
+            "x-lime-localizations": {
+              "en": {
+                "description": "Original approved data and field limits for token scopes that permit this action. Assigned IDs still require the provider's real customer/resource mapping."
+              },
+              "zh-CN": {
+                "description": "允许本次动作的令牌 Scope 对应的原批准数据及字段限制。指定 ID 仍须与提供方真实客户/资源映射核验。"
+              }
+            }
+          }
+        },
+        "description": "The token is currently permitted for this API and action. Enforce all returned restrictions in the resource owner before querying or writing. Responses use Cache-Control:no-store.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "The token is currently permitted for this API and action. Enforce all returned restrictions in the resource owner before querying or writing. Responses use Cache-Control:no-store."
+          },
+          "zh-CN": {
+            "description": "令牌当前允许访问此 API 和动作。资源所属领域须在查询或写入前执行全部返回限制。响应使用 Cache-Control:no-store。"
+          }
+        }
+      },
+      "ResourceIntrospectionInactive": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "active"
+        ],
+        "properties": {
+          "active": {
+            "type": "boolean",
+            "const": false
+          }
+        },
+        "description": "The token is invalid or no longer permitted. Only active:false is returned, without customer or token claims.",
+        "x-lime-localizations": {
+          "en": {
+            "description": "The token is invalid or no longer permitted. Only active:false is returned, without customer or token claims."
+          },
+          "zh-CN": {
+            "description": "令牌无效或当前已无权。仅返回 active:false，不披露客户或令牌声明。"
+          }
+        }
+      },
+      "ResourceIntrospectionResult": {
+        "oneOf": [
+          {
+            "$ref": "#/components/schemas/ResourceIntrospectionActive"
+          },
+          {
+            "$ref": "#/components/schemas/ResourceIntrospectionInactive"
+          }
+        ]
       }
     }
   }