@xemahq/authorization-internal-api-client 0.1.0 → 0.1.2

package/dist/models/index.js

@@ -15,11 +15,16 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 // Auto-generated by tooling/codegen/regenerate-models-barrel.js — do not edit manually.
+__exportStar(require("./addResourceShareDto"), exports);
 __exportStar(require("./addRoleGrantDto"), exports);
 __exportStar(require("./addTeamMemberDto"), exports);
+__exportStar(require("./agentProvisionDecision"), exports);
+__exportStar(require("./agentProvisionReason"), exports);
+__exportStar(require("./agentReachTier"), exports);
 __exportStar(require("./assignRoleDto"), exports);
 __exportStar(require("./authorizationCheckRequestDto"), exports);
 __exportStar(require("./authorizationCheckResponseDto"), exports);
+__exportStar(require("./authorizationCheckResponseDtoDataEnvelope"), exports);
 __exportStar(require("./authorizationDecisionCode"), exports);
 __exportStar(require("./authorizationReasonDto"), exports);
 __exportStar(require("./authorizationSuggestionDto"), exports);
@@ -28,7 +33,10 @@ __exportStar(require("./biomePermissionProfile"), exports);
 __exportStar(require("./biomeTrustTier"), exports);
 __exportStar(require("./callerKind"), exports);
 __exportStar(require("./capabilityGrantDto"), exports);
+__exportStar(require("./capabilityGrantDtoDataEnvelope"), exports);
+__exportStar(require("./capabilityGrantDtoPaginatedEnvelope"), exports);
 __exportStar(require("./capabilityGrantRelation"), exports);
+__exportStar(require("./capabilityRiskTier"), exports);
 __exportStar(require("./createExecutionEnvironmentDto"), exports);
 __exportStar(require("./createExecutionEnvironmentDtoAllowedCapabilitiesItem"), exports);
 __exportStar(require("./createExecutionEnvironmentDtoApprovalRulesItem"), exports);
@@ -45,29 +53,48 @@ __exportStar(require("./credentialDefaultsControllerListParams"), exports);
 __exportStar(require("./credentialPrecedenceSource"), exports);
 __exportStar(require("./dataClassification"), exports);
 __exportStar(require("./dataResidency"), exports);
+__exportStar(require("./describeObjectsResponseDto"), exports);
+__exportStar(require("./describeObjectsResponseDtoDataEnvelope"), exports);
 __exportStar(require("./environmentsControllerFindBySlugParams"), exports);
 __exportStar(require("./environmentsControllerListParams"), exports);
 __exportStar(require("./environmentsControllerRemoveParams"), exports);
 __exportStar(require("./environmentsControllerUpdateParams"), exports);
+__exportStar(require("./errorDetailsDto"), exports);
+__exportStar(require("./errorDetailsDtoDetails"), exports);
+__exportStar(require("./errorPayloadDto"), exports);
+__exportStar(require("./errorResponseDto"), exports);
 __exportStar(require("./executionEnvironmentKind"), exports);
 __exportStar(require("./executionEnvironmentResponseDto"), exports);
 __exportStar(require("./executionEnvironmentResponseDtoAllowedCapabilitiesItem"), exports);
 __exportStar(require("./executionEnvironmentResponseDtoApprovalRulesItem"), exports);
+__exportStar(require("./executionEnvironmentResponseDtoDataArrayEnvelope"), exports);
+__exportStar(require("./executionEnvironmentResponseDtoDataEnvelope"), exports);
 __exportStar(require("./executionEnvironmentResponseDtoOrgId"), exports);
 __exportStar(require("./executionEnvironmentResponseDtoRuntimeLimits"), exports);
 __exportStar(require("./grantConstraintsDto"), exports);
+__exportStar(require("./grantVersionResponseDto"), exports);
+__exportStar(require("./grantVersionResponseDtoDataEnvelope"), exports);
 __exportStar(require("./grantsControllerListParams"), exports);
-__exportStar(require("./listGrantsResponseDto"), exports);
-__exportStar(require("./listProfilesResponseDto"), exports);
-__exportStar(require("./listRelationshipsResponseDto"), exports);
+__exportStar(require("./listVisibleResourcesDto"), exports);
+__exportStar(require("./objectLifecycle"), exports);
 __exportStar(require("./openFgaRelationshipDto"), exports);
+__exportStar(require("./openFgaRelationshipDtoPaginatedEnvelope"), exports);
+__exportStar(require("./orgRole"), exports);
+__exportStar(require("./orgRoleSyncDto"), exports);
+__exportStar(require("./orgRoleSyncResultDto"), exports);
+__exportStar(require("./orgRoleSyncResultDtoDataEnvelope"), exports);
+__exportStar(require("./paginationMeta"), exports);
 __exportStar(require("./policyActingForDto"), exports);
 __exportStar(require("./policyBiomeDto"), exports);
 __exportStar(require("./policyCallerDto"), exports);
 __exportStar(require("./policyCapabilityDto"), exports);
+__exportStar(require("./policyCheckBatchRequestDto"), exports);
+__exportStar(require("./policyCheckBatchResponseDto"), exports);
+__exportStar(require("./policyCheckBatchResponseDtoDataEnvelope"), exports);
 __exportStar(require("./policyCheckRequestDto"), exports);
 __exportStar(require("./policyConstraintsDto"), exports);
 __exportStar(require("./policyDecisionDto"), exports);
+__exportStar(require("./policyDecisionDtoDataEnvelope"), exports);
 __exportStar(require("./policyDecisionKind"), exports);
 __exportStar(require("./policyEnvironmentDto"), exports);
 __exportStar(require("./policyObligationDto"), exports);
@@ -78,14 +105,31 @@ __exportStar(require("./policyRouteHintDtoRequiredRunnerLabels"), exports);
 __exportStar(require("./policySpaceRefDto"), exports);
 __exportStar(require("./policySubjectRefDto"), exports);
 __exportStar(require("./profilePolicyTemplateDto"), exports);
+__exportStar(require("./profilePolicyTemplateDtoDataArrayEnvelope"), exports);
 __exportStar(require("./profilePolicyTemplateDtoNotes"), exports);
+__exportStar(require("./provisionAgentRequestDto"), exports);
+__exportStar(require("./provisionAgentResultDto"), exports);
+__exportStar(require("./provisionAgentResultDtoDataEnvelope"), exports);
+__exportStar(require("./provisionedCapabilityDto"), exports);
+__exportStar(require("./registerResourceOwnershipDto"), exports);
 __exportStar(require("./relationshipsControllerListParams"), exports);
+__exportStar(require("./resourceManagedBy"), exports);
+__exportStar(require("./resourceOwnershipDto"), exports);
+__exportStar(require("./resourceOwnershipDtoDataEnvelope"), exports);
+__exportStar(require("./resourceOwnershipEntryDto"), exports);
+__exportStar(require("./resourceOwnershipReadDto"), exports);
+__exportStar(require("./resourceOwnershipReadDtoDataEnvelope"), exports);
+__exportStar(require("./resourceSubjectRefDto"), exports);
+__exportStar(require("./resourceVisibilityPattern"), exports);
 __exportStar(require("./roleAssignmentDto"), exports);
 __exportStar(require("./roleAssignmentDtoDataArrayEnvelope"), exports);
+__exportStar(require("./roleAssignmentDtoDataEnvelope"), exports);
 __exportStar(require("./roleDto"), exports);
 __exportStar(require("./roleDtoDataArrayEnvelope"), exports);
+__exportStar(require("./roleDtoDataEnvelope"), exports);
 __exportStar(require("./roleGrantDto"), exports);
 __exportStar(require("./roleGrantDtoDataArrayEnvelope"), exports);
+__exportStar(require("./roleGrantDtoDataEnvelope"), exports);
 __exportStar(require("./rolesControllerListParams"), exports);
 __exportStar(require("./runnerKind"), exports);
 __exportStar(require("./spaceKind"), exports);
@@ -93,8 +137,10 @@ __exportStar(require("./subjectKind"), exports);
 __exportStar(require("./subjectRefDto"), exports);
 __exportStar(require("./teamDto"), exports);
 __exportStar(require("./teamDtoDataArrayEnvelope"), exports);
+__exportStar(require("./teamDtoDataEnvelope"), exports);
 __exportStar(require("./teamMembershipDto"), exports);
 __exportStar(require("./teamMembershipDtoDataArrayEnvelope"), exports);
+__exportStar(require("./teamMembershipDtoDataEnvelope"), exports);
 __exportStar(require("./teamsControllerListParams"), exports);
 __exportStar(require("./updateExecutionEnvironmentDto"), exports);
 __exportStar(require("./updateExecutionEnvironmentDtoAllowedCapabilitiesItem"), exports);
@@ -104,3 +150,10 @@ __exportStar(require("./updateGrantDto"), exports);
 __exportStar(require("./updateRoleDto"), exports);
 __exportStar(require("./updateTeamDto"), exports);
 __exportStar(require("./upsertCredentialDefaultDto"), exports);
+__exportStar(require("./visibleResourcesDto"), exports);
+__exportStar(require("./visibleResourcesDtoDataEnvelope"), exports);
+__exportStar(require("./xemaObjectKind"), exports);
+__exportStar(require("./xemaObjectResponseDto"), exports);
+__exportStar(require("./xemaObjectResponseDtoPayload"), exports);
+__exportStar(require("./xemaSpaceRefDto"), exports);
+__exportStar(require("./xemaSubjectRefDto"), exports);

package/dist/models/listVisibleResourcesDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+export interface ListVisibleResourcesDto {
+    /** Resource kind/type slug. */
+    resourceType: string;
+    /** The subject whose visible instances are enumerated. */
+    subject: ResourceSubjectRefDto;
+}

package/dist/models/listVisibleResourcesDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/objectLifecycle.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+/**
+ * draft | published | archived.
+ */
+export type ObjectLifecycle = typeof ObjectLifecycle[keyof typeof ObjectLifecycle];
+export declare const ObjectLifecycle: {
+    readonly draft: "draft";
+    readonly published: "published";
+    readonly archived: "archived";
+};

package/dist/models/objectLifecycle.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectLifecycle = void 0;
+exports.ObjectLifecycle = {
+    draft: 'draft',
+    published: 'published',
+    archived: 'archived',
+};

package/dist/models/openFgaRelationshipDto.d.ts

@@ -1,11 +1,11 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { CapabilityGrantRelation } from './capabilityGrantRelation';
+import type { CapabilityGrantRelation } from './capabilityGrantRelation.js';
 export interface OpenFgaRelationshipDto {
     /** OpenFGA user id — `<subjectKind>:<subjectRef>`. */
     user: string;

package/dist/models/openFgaRelationshipDtoPaginatedEnvelope.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { OpenFgaRelationshipDto } from './openFgaRelationshipDto.js';
+import type { PaginationMeta } from './paginationMeta.js';
+export interface OpenFgaRelationshipDtoPaginatedEnvelope {
+    data: OpenFgaRelationshipDto[];
+    pagination?: PaginationMeta;
+}

package/dist/models/openFgaRelationshipDtoPaginatedEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/orgRole.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+/**
+ * The org role the subject holds (owner ⊇ admin ⊇ member).
+ */
+export type OrgRole = typeof OrgRole[keyof typeof OrgRole];
+export declare const OrgRole: {
+    readonly owner: "owner";
+    readonly admin: "admin";
+    readonly member: "member";
+};

package/dist/models/orgRole.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgRole = void 0;
+exports.OrgRole = {
+    owner: 'owner',
+    admin: 'admin',
+    member: 'member',
+};

package/dist/models/orgRoleSyncDto.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { OrgRole } from './orgRole.js';
+import type { SubjectKind } from './subjectKind.js';
+export interface OrgRoleSyncDto {
+    /** Organization the subject is a member of. The role is scoped to it. */
+    orgId: string;
+    subjectKind: SubjectKind;
+    /** Bare per-kind subject identifier (NOT a `kind:ref` composite). */
+    subjectRef: string;
+    /** The org role the subject holds (owner ⊇ admin ⊇ member). */
+    orgRole: OrgRole;
+}

package/dist/models/orgRoleSyncDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/orgRoleSyncResultDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+export interface OrgRoleSyncResultDto {
+    /** Id of the per-org role instance the subject is bound to. */
+    roleId: string;
+}

package/dist/models/{roleDtoDescription.js → orgRoleSyncResultDto.js}

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/orgRoleSyncResultDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { OrgRoleSyncResultDto } from './orgRoleSyncResultDto.js';
+export interface OrgRoleSyncResultDtoDataEnvelope {
+    data: OrgRoleSyncResultDto;
+}

package/dist/models/orgRoleSyncResultDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/paginationMeta.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+export interface PaginationMeta {
+    total?: number;
+    page?: number;
+    totalPages?: number;
+    /** @nullable */
+    nextCursor?: string | null;
+    /** @nullable */
+    previousCursor?: string | null;
+    limit?: number;
+    hasMore?: boolean;
+}

package/dist/models/{roleAssignmentDtoSubjectRef.js → paginationMeta.js}

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyActingForDto.d.ts

@@ -1,11 +1,11 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { SubjectKind } from './subjectKind';
+import type { SubjectKind } from './subjectKind.js';
 export interface PolicyActingForDto {
     kind: SubjectKind;
     id: string;

package/dist/models/policyBiomeDto.d.ts

@@ -1,11 +1,11 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { BiomeTrustTier } from './biomeTrustTier';
+import type { BiomeTrustTier } from './biomeTrustTier.js';
 export interface PolicyBiomeDto {
     id: string;
     version: string;

package/dist/models/policyCallerDto.d.ts

@@ -1,11 +1,11 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { CallerKind } from './callerKind';
+import type { CallerKind } from './callerKind.js';
 export interface PolicyCallerDto {
     kind: CallerKind;
     appId?: string;

package/dist/models/policyCapabilityDto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyCapabilityDto.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyCheckBatchRequestDto.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { PolicyCheckRequestDto } from './policyCheckRequestDto.js';
+export interface PolicyCheckBatchRequestDto {
+    /**
+       * Independent policy checks — each item is the EXACT single `POST /authorization/policy-check` request shape. At most 128 per call (422 beyond).
+       * @maxItems 128
+       */
+    checks: PolicyCheckRequestDto[];
+}

package/dist/models/policyCheckBatchRequestDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckBatchResponseDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { PolicyDecisionDto } from './policyDecisionDto.js';
+export interface PolicyCheckBatchResponseDto {
+    /** Positionally aligned with `checks` — results[i] is the decision for checks[i]. A per-item DENY is a result, never an error; the response is never partial (any infrastructure failure fails the whole call). */
+    results: PolicyDecisionDto[];
+}

package/dist/models/policyCheckBatchResponseDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckBatchResponseDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { PolicyCheckBatchResponseDto } from './policyCheckBatchResponseDto.js';
+export interface PolicyCheckBatchResponseDtoDataEnvelope {
+    data: PolicyCheckBatchResponseDto;
+}

package/dist/models/policyCheckBatchResponseDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckRequestDto.d.ts

@@ -1,18 +1,18 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { PolicyBiomeDto } from './policyBiomeDto';
-import type { PolicyCallerDto } from './policyCallerDto';
-import type { PolicyCapabilityDto } from './policyCapabilityDto';
-import type { PolicyConstraintsDto } from './policyConstraintsDto';
-import type { PolicyEnvironmentDto } from './policyEnvironmentDto';
-import type { PolicyResourceDto } from './policyResourceDto';
-import type { PolicySpaceRefDto } from './policySpaceRefDto';
-import type { PolicySubjectRefDto } from './policySubjectRefDto';
+import type { PolicyBiomeDto } from './policyBiomeDto.js';
+import type { PolicyCallerDto } from './policyCallerDto.js';
+import type { PolicyCapabilityDto } from './policyCapabilityDto.js';
+import type { PolicyConstraintsDto } from './policyConstraintsDto.js';
+import type { PolicyEnvironmentDto } from './policyEnvironmentDto.js';
+import type { PolicyResourceDto } from './policyResourceDto.js';
+import type { PolicySpaceRefDto } from './policySpaceRefDto.js';
+import type { PolicySubjectRefDto } from './policySubjectRefDto.js';
 export interface PolicyCheckRequestDto {
     id: string;
     requestId: string;

package/dist/models/policyConstraintsDto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyConstraintsDto.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyDecisionDto.d.ts

@@ -1,21 +1,21 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { CredentialPrecedenceSource } from './credentialPrecedenceSource';
-import type { PolicyDecisionKind } from './policyDecisionKind';
-import type { PolicyObligationDto } from './policyObligationDto';
-import type { PolicyRouteHintDto } from './policyRouteHintDto';
+import type { CredentialPrecedenceSource } from './credentialPrecedenceSource.js';
+import type { PolicyDecisionKind } from './policyDecisionKind.js';
+import type { PolicyObligationDto } from './policyObligationDto.js';
+import type { PolicyRouteHintDto } from './policyRouteHintDto.js';
 export interface PolicyDecisionDto {
     kind: PolicyDecisionKind;
     /** Stable wire-code denial reason from the OPA bundle / authorization-api decision matrix. Free-form here; closed by the bundle. Surfaced verbatim in audit + capability-router error envelopes. */
     reason?: string;
     obligations?: PolicyObligationDto[];
     routeHints?: PolicyRouteHintDto;
-    /** Credential binding the executing gateway MUST use to resolve the external credential for this invocation (plan §W4 / Pillar 3.2). Present ONLY on an `allow` for a capability that declares an `externalServiceRef`. Opaque id — never a secret; the broker re-validates it before reading custody. */
+    /** Credential binding the executing gateway MUST use to resolve the external credential for this invocation. Present ONLY on an `allow` for a capability that declares an `externalServiceRef`. Opaque id — never a secret; the broker re-validates it before reading custody. */
     credentialBindingId?: string;
     /** Which precedence tier supplied `credentialBindingId` (explicit grant > capability default > project default > org default). Populated iff `credentialBindingId` is present. */
     credentialPrecedenceApplied?: CredentialPrecedenceSource;

package/dist/models/policyDecisionDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { PolicyDecisionDto } from './policyDecisionDto.js';
+export interface PolicyDecisionDtoDataEnvelope {
+    data: PolicyDecisionDto;
+}

package/dist/models/policyDecisionDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyDecisionKind.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyDecisionKind.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyEnvironmentDto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyEnvironmentDto.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).

package/dist/models/policyObligationDto.d.ts

@@ -1,14 +1,14 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { DataClassification } from './dataClassification';
-import type { DataResidency } from './dataResidency';
-import type { PolicyObligationKind } from './policyObligationKind';
-import type { RunnerKind } from './runnerKind';
+import type { DataClassification } from './dataClassification.js';
+import type { DataResidency } from './dataResidency.js';
+import type { PolicyObligationKind } from './policyObligationKind.js';
+import type { RunnerKind } from './runnerKind.js';
 export interface PolicyObligationDto {
     kind: PolicyObligationKind;
     runnerKind?: RunnerKind;
@@ -17,4 +17,8 @@ export interface PolicyObligationDto {
     maxCostUsd?: number;
     maxClassification?: DataClassification;
     residency?: DataResidency;
+    /** Egress allowlist patterns (wildcard host or https:// URL-prefix). Present only when kind=egress-allowlist. */
+    allow?: string[];
+    /** Egress blocklist patterns; a match denies even if `allow` matched. Present only when kind=egress-allowlist. */
+    deny?: string[];
 }

package/dist/models/policyObligationKind.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generated by orval v8.6.2 🍺
+ * Generated by orval v8.16.0 🍺
  * Do not edit manually.
  * Authorization API
  * Authorization API extract (generated for client codegen).
@@ -15,4 +15,5 @@ export declare const PolicyObligationKind: {
     readonly 'max-cost-usd': "max-cost-usd";
     readonly 'restrict-output-classification': "restrict-output-classification";
     readonly 'data-residency': "data-residency";
+    readonly 'egress-allowlist': "egress-allowlist";
 };