@xemahq/authorization-internal-api-client 0.1.1 → 0.1.2

package/dist/endpoints/agents/agents.d.ts

@@ -5,10 +5,10 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { ProvisionAgentRequestDto, ProvisionAgentResultDto } from '../../models';
+import type { ProvisionAgentRequestDto, ProvisionAgentResultDtoDataEnvelope } from '../../models';
 export declare const getAgentsControllerProvisionUrl: () => string;
 /**
  * Auto-grants low/medium-risk, owner-held, non-approval-gated capabilities as full grants; writes everything else as approval-gated grants. Idempotent (each grant upserts on its natural tuple). Returns a summary for the Studio review UI.
  * @summary Provision capability grants for an agent
  */
-export declare const agentsControllerProvision: (provisionAgentRequestDto: ProvisionAgentRequestDto, options?: RequestInit) => Promise<ProvisionAgentResultDto>;
+export declare const agentsControllerProvision: (provisionAgentRequestDto: ProvisionAgentRequestDto, options?: RequestInit) => Promise<ProvisionAgentResultDtoDataEnvelope>;

package/dist/endpoints/authorization/authorization.d.ts

@@ -5,22 +5,28 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { AuthorizationCheckRequestDto, AuthorizationCheckResponseDto, PolicyCheckBatchRequestDto, PolicyCheckBatchResponseDto, PolicyCheckRequestDto, PolicyDecisionDto } from '../../models';
+import type { AuthorizationCheckRequestDto, AuthorizationCheckResponseDtoDataEnvelope, GrantVersionResponseDtoDataEnvelope, PolicyCheckBatchRequestDto, PolicyCheckBatchResponseDtoDataEnvelope, PolicyCheckRequestDto, PolicyDecisionDtoDataEnvelope } from '../../models';
 export declare const getAuthorizationControllerCheckUrl: () => string;
 /**
  * Called by xema-capability-router on every invocation. Phase 3 returns `allowed=true` for any non-revoked grant matching `(subject, capability)`; `environment` is stored but not yet enforced. Phase 4 will enforce environment, resource-glob, rate-limit, and approval.
  * @summary Runtime allow/deny decision for a (subject, capability) tuple
  */
-export declare const authorizationControllerCheck: (authorizationCheckRequestDto: AuthorizationCheckRequestDto, options?: RequestInit) => Promise<AuthorizationCheckResponseDto>;
+export declare const authorizationControllerCheck: (authorizationCheckRequestDto: AuthorizationCheckRequestDto, options?: RequestInit) => Promise<AuthorizationCheckResponseDtoDataEnvelope>;
+export declare const getAuthorizationControllerGrantVersionUrl: (orgId: string) => string;
+/**
+ * A cheap read of the per-org grant-version counter — bumped on every grant/environment/membership change. Consumers (e.g. app-platform delegated-session verify) key a short-lived effective-capability cache by it so a revoked role takes effect at the next miss rather than at token expiry. Fail-closed: an unavailable version store surfaces as a 5xx so the caller denies.
+ * @summary Current monotonic grant-version for an org (Wave 8.2)
+ */
+export declare const authorizationControllerGrantVersion: (orgId: string, options?: RequestInit) => Promise<GrantVersionResponseDtoDataEnvelope>;
 export declare const getAuthorizationControllerPolicyCheckUrl: () => string;
 /**
  *  wire surface. Accepts a PolicyRequest (== ExecutionContext) constructed by the capability router at the gateway boundary; returns a typed PolicyDecision { kind, reason?, obligations?, routeHints? }. The same decision matrix that powers POST /authorization/check is reused — this endpoint projects the verdict into the v4.3 envelope so the router can branch structurally on PolicyDecisionKind without parsing strings.
  * @summary Typed PolicyDecision for an ExecutionContext
  */
-export declare const authorizationControllerPolicyCheck: (policyCheckRequestDto: PolicyCheckRequestDto, options?: RequestInit) => Promise<PolicyDecisionDto>;
+export declare const authorizationControllerPolicyCheck: (policyCheckRequestDto: PolicyCheckRequestDto, options?: RequestInit) => Promise<PolicyDecisionDtoDataEnvelope>;
 export declare const getAuthorizationControllerPolicyCheckBatchUrl: () => string;
 /**
  * Wave-4 M1 batch surface. Accepts up to 128 independent PolicyRequests (each the EXACT single policy-check shape; 422 beyond the bound) and returns PolicyDecisions POSITIONALLY aligned with the request (results[i] is the decision for checks[i]). Every item runs the SAME decision pipeline as POST /authorization/policy-check — the batch only amortises HTTP round-trips for enumerating consumers (the capability BFF list path). Never-partial: a per-item DENY is a result, but any infrastructure failure mid-batch fails the whole call with 503. The PDP does not add batch-level caching; consumers own caching.
  * @summary Batch of typed PolicyDecisions for independent ExecutionContexts
  */
-export declare const authorizationControllerPolicyCheckBatch: (policyCheckBatchRequestDto: PolicyCheckBatchRequestDto, options?: RequestInit) => Promise<PolicyCheckBatchResponseDto>;
+export declare const authorizationControllerPolicyCheckBatch: (policyCheckBatchRequestDto: PolicyCheckBatchRequestDto, options?: RequestInit) => Promise<PolicyCheckBatchResponseDtoDataEnvelope>;

package/dist/endpoints/authorization/authorization.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizationControllerPolicyCheckBatch = exports.getAuthorizationControllerPolicyCheckBatchUrl = exports.authorizationControllerPolicyCheck = exports.getAuthorizationControllerPolicyCheckUrl = exports.authorizationControllerCheck = exports.getAuthorizationControllerCheckUrl = void 0;
+exports.authorizationControllerPolicyCheckBatch = exports.getAuthorizationControllerPolicyCheckBatchUrl = exports.authorizationControllerPolicyCheck = exports.getAuthorizationControllerPolicyCheckUrl = exports.authorizationControllerGrantVersion = exports.getAuthorizationControllerGrantVersionUrl = exports.authorizationControllerCheck = exports.getAuthorizationControllerCheckUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getAuthorizationControllerCheckUrl = () => {
     return `/authorization/check`;
@@ -19,6 +19,21 @@ const authorizationControllerCheck = async (authorizationCheckRequestDto, option
     });
 };
 exports.authorizationControllerCheck = authorizationControllerCheck;
+const getAuthorizationControllerGrantVersionUrl = (orgId) => {
+    return `/authorization/grant-version/${orgId}`;
+};
+exports.getAuthorizationControllerGrantVersionUrl = getAuthorizationControllerGrantVersionUrl;
+/**
+ * A cheap read of the per-org grant-version counter — bumped on every grant/environment/membership change. Consumers (e.g. app-platform delegated-session verify) key a short-lived effective-capability cache by it so a revoked role takes effect at the next miss rather than at token expiry. Fail-closed: an unavailable version store surfaces as a 5xx so the caller denies.
+ * @summary Current monotonic grant-version for an org (Wave 8.2)
+ */
+const authorizationControllerGrantVersion = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerGrantVersionUrl)(orgId), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.authorizationControllerGrantVersion = authorizationControllerGrantVersion;
 const getAuthorizationControllerPolicyCheckUrl = () => {
     return `/authorization/policy-check`;
 };

package/dist/endpoints/contribution-sync/contribution-sync.d.ts

@@ -0,0 +1,2 @@
+export declare const getContributionSyncControllerSyncUrl: () => string;
+export declare const contributionSyncControllerSync: (options?: RequestInit) => Promise<void>;

package/dist/endpoints/contribution-sync/contribution-sync.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contributionSyncControllerSync = exports.getContributionSyncControllerSyncUrl = void 0;
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+const custom_fetch_1 = require("../../custom-fetch");
+const getContributionSyncControllerSyncUrl = () => {
+    return `/contributions/sync`;
+};
+exports.getContributionSyncControllerSyncUrl = getContributionSyncControllerSyncUrl;
+const contributionSyncControllerSync = async (options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getContributionSyncControllerSyncUrl)(), {
+        ...options,
+        method: 'PUT'
+    });
+};
+exports.contributionSyncControllerSync = contributionSyncControllerSync;

package/dist/endpoints/describe-objects/describe-objects.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { DescribeObjectsResponseDtoDataEnvelope } from '../../models';
+export declare const getDescribeObjectsControllerDescribeUrl: () => string;
+/**
+ * Wire shape mirrors the `xema.object-registry.projection.published.v1` CloudEvent `data` field. Consumers (object-registry-api) replace their cache slice for `source` atomically on each fetch.
+ * @summary Return this service's slice of the XemaObject universe (capability grants + execution environments).
+ */
+export declare const describeObjectsControllerDescribe: (options?: RequestInit) => Promise<DescribeObjectsResponseDtoDataEnvelope>;

package/dist/endpoints/describe-objects/describe-objects.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeObjectsControllerDescribe = exports.getDescribeObjectsControllerDescribeUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getDescribeObjectsControllerDescribeUrl = () => {
+    return `/describe-objects`;
+};
+exports.getDescribeObjectsControllerDescribeUrl = getDescribeObjectsControllerDescribeUrl;
+/**
+ * Wire shape mirrors the `xema.object-registry.projection.published.v1` CloudEvent `data` field. Consumers (object-registry-api) replace their cache slice for `source` atomically on each fetch.
+ * @summary Return this service's slice of the XemaObject universe (capability grants + execution environments).
+ */
+const describeObjectsControllerDescribe = async (options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDescribeObjectsControllerDescribeUrl)(), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.describeObjectsControllerDescribe = describeObjectsControllerDescribe;

package/dist/endpoints/environments/environments.d.ts

@@ -5,31 +5,31 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { CreateExecutionEnvironmentDto, EnvironmentsControllerFindBySlugParams, EnvironmentsControllerListParams, EnvironmentsControllerRemoveParams, EnvironmentsControllerUpdateParams, ExecutionEnvironmentResponseDto, UpdateExecutionEnvironmentDto } from '../../models';
+import type { CreateExecutionEnvironmentDto, EnvironmentsControllerFindBySlugParams, EnvironmentsControllerListParams, EnvironmentsControllerRemoveParams, EnvironmentsControllerUpdateParams, ExecutionEnvironmentResponseDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataEnvelope, UpdateExecutionEnvironmentDto } from '../../models';
 export declare const getEnvironmentsControllerListUrl: (params?: EnvironmentsControllerListParams) => string;
 /**
  * Returns the kernel-seeded built-in environments. With `orgId` it also includes that org's custom environments; without `orgId` it returns built-ins only (back-compat).
  * @summary List ExecutionEnvironment rows
  */
-export declare const environmentsControllerList: (params?: EnvironmentsControllerListParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDto[]>;
+export declare const environmentsControllerList: (params?: EnvironmentsControllerListParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataArrayEnvelope>;
 export declare const getEnvironmentsControllerCreateUrl: () => string;
 /**
  * Creates an org-scoped custom environment (`isBuiltIn=false`). Fails fast (409) if the slug collides with a built-in or with an existing custom in the same org.
  * @summary Create an org-custom ExecutionEnvironment
  */
-export declare const environmentsControllerCreate: (createExecutionEnvironmentDto: CreateExecutionEnvironmentDto, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDto>;
+export declare const environmentsControllerCreate: (createExecutionEnvironmentDto: CreateExecutionEnvironmentDto, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerFindBySlugUrl: (slug: string, params?: EnvironmentsControllerFindBySlugParams) => string;
 /**
  * Resolves a built-in by slug. With `orgId`, an org-custom slug resolves before the built-in fallback. 404 if unknown.
  * @summary Fetch a single ExecutionEnvironment by slug
  */
-export declare const environmentsControllerFindBySlug: (slug: string, params?: EnvironmentsControllerFindBySlugParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDto>;
+export declare const environmentsControllerFindBySlug: (slug: string, params?: EnvironmentsControllerFindBySlugParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerUpdateUrl: (slug: string, params: EnvironmentsControllerUpdateParams) => string;
 /**
  * Updates the mutable fields (description / allowedCapabilities / approvalRules / runtimeLimits) of an org-custom environment. Refuses built-ins with 403 (immutable). `slug` / `kind` / `orgId` are immutable.
  * @summary Update an org-custom ExecutionEnvironment
  */
-export declare const environmentsControllerUpdate: (slug: string, updateExecutionEnvironmentDto: UpdateExecutionEnvironmentDto, params: EnvironmentsControllerUpdateParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDto>;
+export declare const environmentsControllerUpdate: (slug: string, updateExecutionEnvironmentDto: UpdateExecutionEnvironmentDto, params: EnvironmentsControllerUpdateParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerRemoveUrl: (slug: string, params: EnvironmentsControllerRemoveParams) => string;
 /**
  * Deletes an org-custom environment. Refuses built-ins with 403 (immutable). 404 if no such custom environment exists for the org.

package/dist/endpoints/grants/grants.d.ts

@@ -5,12 +5,12 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { CapabilityGrantDto, CapabilityGrantDtoPaginatedEnvelope, CreateGrantDto, GrantsControllerListParams, UpdateGrantDto } from '../../models';
+import type { CapabilityGrantDtoDataEnvelope, CapabilityGrantDtoPaginatedEnvelope, CreateGrantDto, GrantsControllerListParams, UpdateGrantDto } from '../../models';
 export declare const getGrantsControllerCreateUrl: () => string;
 /**
  * @summary Create a capability grant
  */
-export declare const grantsControllerCreate: (createGrantDto: CreateGrantDto, options?: RequestInit) => Promise<CapabilityGrantDto>;
+export declare const grantsControllerCreate: (createGrantDto: CreateGrantDto, options?: RequestInit) => Promise<CapabilityGrantDtoDataEnvelope>;
 export declare const getGrantsControllerListUrl: (params?: GrantsControllerListParams) => string;
 /**
  * @summary List capability grants (paginated, filterable)
@@ -20,14 +20,14 @@ export declare const getGrantsControllerGetByIdUrl: (id: string) => string;
 /**
  * @summary Get a capability grant by id
  */
-export declare const grantsControllerGetById: (id: string, options?: RequestInit) => Promise<CapabilityGrantDto>;
+export declare const grantsControllerGetById: (id: string, options?: RequestInit) => Promise<CapabilityGrantDtoDataEnvelope>;
 export declare const getGrantsControllerUpdateUrl: (id: string) => string;
 /**
  * @summary Update mutable fields on a capability grant
  */
-export declare const grantsControllerUpdate: (id: string, updateGrantDto: UpdateGrantDto, options?: RequestInit) => Promise<CapabilityGrantDto>;
+export declare const grantsControllerUpdate: (id: string, updateGrantDto: UpdateGrantDto, options?: RequestInit) => Promise<CapabilityGrantDtoDataEnvelope>;
 export declare const getGrantsControllerRevokeUrl: (id: string) => string;
 /**
  * @summary Mark a capability grant as revoked
  */
-export declare const grantsControllerRevoke: (id: string, options?: RequestInit) => Promise<CapabilityGrantDto>;
+export declare const grantsControllerRevoke: (id: string, options?: RequestInit) => Promise<CapabilityGrantDtoDataEnvelope>;

package/dist/endpoints/profiles/profiles.d.ts

@@ -5,10 +5,10 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { ProfilePolicyTemplateDto } from '../../models';
+import type { ProfilePolicyTemplateDtoDataArrayEnvelope } from '../../models';
 export declare const getProfilesControllerListUrl: () => string;
 /**
  * Returns the kernel-seeded `ProfilePolicyTemplate` rows. Used by the biome install UI to populate the profile picker.
  * @summary List built-in BiomePermissionProfile policy templates
  */
-export declare const profilesControllerList: (options?: RequestInit) => Promise<ProfilePolicyTemplateDto[]>;
+export declare const profilesControllerList: (options?: RequestInit) => Promise<ProfilePolicyTemplateDtoDataArrayEnvelope>;

package/dist/endpoints/resources/resources.d.ts

@@ -5,25 +5,25 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { AddResourceShareDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, ResourceOwnershipDto, ResourceOwnershipReadDto, VisibleResourcesDto } from '../../models';
+import type { AddResourceShareDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
 export declare const getResourcesControllerRegisterUrl: () => string;
 /**
  * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
  * @summary Register ownership/visibility of a resource instance
  */
-export declare const resourcesControllerRegister: (registerResourceOwnershipDto: RegisterResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDto>;
+export declare const resourcesControllerRegister: (registerResourceOwnershipDto: RegisterResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDtoDataEnvelope>;
 export declare const getResourcesControllerListVisibleUrl: () => string;
 /**
  * Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
  * @summary List the instances of a resource type a subject may see
  */
-export declare const resourcesControllerListVisible: (listVisibleResourcesDto: ListVisibleResourcesDto, options?: RequestInit) => Promise<VisibleResourcesDto>;
+export declare const resourcesControllerListVisible: (listVisibleResourcesDto: ListVisibleResourcesDto, options?: RequestInit) => Promise<VisibleResourcesDtoDataEnvelope>;
 export declare const getResourcesControllerGetOwnershipUrl: (type: string, id: string) => string;
 /**
  * Returns the instance visibility and the combined set of registered subjects (owners + shares; the SQL authority does not split them). 404 when the instance was never registered.
  * @summary Read a resource instance’s current visibility + subjects
  */
-export declare const resourcesControllerGetOwnership: (type: string, id: string, options?: RequestInit) => Promise<ResourceOwnershipReadDto>;
+export declare const resourcesControllerGetOwnership: (type: string, id: string, options?: RequestInit) => Promise<ResourceOwnershipReadDtoDataEnvelope>;
 export declare const getResourcesControllerDeregisterUrl: (type: string, id: string) => string;
 /**
  * Idempotent — a no-op when the instance was never registered.

package/dist/endpoints/roles/roles.d.ts

@@ -5,12 +5,12 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { AddRoleGrantDto, AssignRoleDto, CreateRoleDto, OrgRoleSyncDto, OrgRoleSyncResultDto, RoleAssignmentDto, RoleAssignmentDtoDataArrayEnvelope, RoleDto, RoleDtoDataArrayEnvelope, RoleGrantDto, RoleGrantDtoDataArrayEnvelope, RolesControllerListParams, UpdateRoleDto } from '../../models';
+import type { AddRoleGrantDto, AssignRoleDto, CreateRoleDto, OrgRoleSyncDto, OrgRoleSyncResultDtoDataEnvelope, RoleAssignmentDtoDataArrayEnvelope, RoleAssignmentDtoDataEnvelope, RoleDtoDataArrayEnvelope, RoleDtoDataEnvelope, RoleGrantDtoDataArrayEnvelope, RoleGrantDtoDataEnvelope, RolesControllerListParams, UpdateRoleDto } from '../../models';
 export declare const getRolesControllerCreateUrl: () => string;
 /**
  * @summary Create a custom role
  */
-export declare const rolesControllerCreate: (createRoleDto: CreateRoleDto, options?: RequestInit) => Promise<RoleDto>;
+export declare const rolesControllerCreate: (createRoleDto: CreateRoleDto, options?: RequestInit) => Promise<RoleDtoDataEnvelope>;
 export declare const getRolesControllerListUrl: (params: RolesControllerListParams) => string;
 /**
  * @summary List roles in an org (custom + built-in)
@@ -20,12 +20,12 @@ export declare const getRolesControllerGetByIdUrl: (id: string) => string;
 /**
  * @summary Get a role by id
  */
-export declare const rolesControllerGetById: (id: string, options?: RequestInit) => Promise<RoleDto>;
+export declare const rolesControllerGetById: (id: string, options?: RequestInit) => Promise<RoleDtoDataEnvelope>;
 export declare const getRolesControllerUpdateUrl: (id: string) => string;
 /**
  * @summary Update a custom role (built-ins are immutable)
  */
-export declare const rolesControllerUpdate: (id: string, updateRoleDto: UpdateRoleDto, options?: RequestInit) => Promise<RoleDto>;
+export declare const rolesControllerUpdate: (id: string, updateRoleDto: UpdateRoleDto, options?: RequestInit) => Promise<RoleDtoDataEnvelope>;
 export declare const getRolesControllerDeleteUrl: (id: string) => string;
 /**
  * @summary Delete a custom role (cascades grants + assignments)
@@ -40,7 +40,7 @@ export declare const getRolesControllerAddGrantUrl: (id: string) => string;
 /**
  * @summary Add a capability grant to a role
  */
-export declare const rolesControllerAddGrant: (id: string, addRoleGrantDto: AddRoleGrantDto, options?: RequestInit) => Promise<RoleGrantDto>;
+export declare const rolesControllerAddGrant: (id: string, addRoleGrantDto: AddRoleGrantDto, options?: RequestInit) => Promise<RoleGrantDtoDataEnvelope>;
 export declare const getRolesControllerRemoveGrantUrl: (id: string, grantId: string) => string;
 /**
  * @summary Remove a capability grant from a role
@@ -55,7 +55,7 @@ export declare const getRolesControllerAssignUrl: (id: string) => string;
 /**
  * @summary Assign a role to a subject or a team
  */
-export declare const rolesControllerAssign: (id: string, assignRoleDto: AssignRoleDto, options?: RequestInit) => Promise<RoleAssignmentDto>;
+export declare const rolesControllerAssign: (id: string, assignRoleDto: AssignRoleDto, options?: RequestInit) => Promise<RoleAssignmentDtoDataEnvelope>;
 export declare const getRolesControllerUnassignUrl: (id: string, assignmentId: string) => string;
 /**
  * @summary Remove a role assignment
@@ -65,4 +65,4 @@ export declare const getOrgRoleSyncControllerSyncUrl: () => string;
 /**
  * @summary Ensure a subject holds the given org role, correctly org-scoped (idempotent).
  */
-export declare const orgRoleSyncControllerSync: (orgRoleSyncDto: OrgRoleSyncDto, options?: RequestInit) => Promise<OrgRoleSyncResultDto>;
+export declare const orgRoleSyncControllerSync: (orgRoleSyncDto: OrgRoleSyncDto, options?: RequestInit) => Promise<OrgRoleSyncResultDtoDataEnvelope>;

package/dist/endpoints/teams/teams.d.ts

@@ -5,12 +5,12 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-import type { AddTeamMemberDto, CreateTeamDto, TeamDto, TeamDtoDataArrayEnvelope, TeamMembershipDto, TeamMembershipDtoDataArrayEnvelope, TeamsControllerListParams, UpdateTeamDto } from '../../models';
+import type { AddTeamMemberDto, CreateTeamDto, TeamDtoDataArrayEnvelope, TeamDtoDataEnvelope, TeamMembershipDtoDataArrayEnvelope, TeamMembershipDtoDataEnvelope, TeamsControllerListParams, UpdateTeamDto } from '../../models';
 export declare const getTeamsControllerCreateUrl: () => string;
 /**
  * @summary Create a team
  */
-export declare const teamsControllerCreate: (createTeamDto: CreateTeamDto, options?: RequestInit) => Promise<TeamDto>;
+export declare const teamsControllerCreate: (createTeamDto: CreateTeamDto, options?: RequestInit) => Promise<TeamDtoDataEnvelope>;
 export declare const getTeamsControllerListUrl: (params: TeamsControllerListParams) => string;
 /**
  * @summary List teams in an org
@@ -20,12 +20,12 @@ export declare const getTeamsControllerGetByIdUrl: (id: string) => string;
 /**
  * @summary Get a team by id
  */
-export declare const teamsControllerGetById: (id: string, options?: RequestInit) => Promise<TeamDto>;
+export declare const teamsControllerGetById: (id: string, options?: RequestInit) => Promise<TeamDtoDataEnvelope>;
 export declare const getTeamsControllerUpdateUrl: (id: string) => string;
 /**
  * @summary Update a team (rename, re-describe, re-parent)
  */
-export declare const teamsControllerUpdate: (id: string, updateTeamDto: UpdateTeamDto, options?: RequestInit) => Promise<TeamDto>;
+export declare const teamsControllerUpdate: (id: string, updateTeamDto: UpdateTeamDto, options?: RequestInit) => Promise<TeamDtoDataEnvelope>;
 export declare const getTeamsControllerDeleteUrl: (id: string) => string;
 /**
  * @summary Delete a team (cascades memberships + assignments)
@@ -40,7 +40,7 @@ export declare const getTeamsControllerAddMemberUrl: (id: string) => string;
 /**
  * @summary Add a subject (user/agent/service/app/external) to a team
  */
-export declare const teamsControllerAddMember: (id: string, addTeamMemberDto: AddTeamMemberDto, options?: RequestInit) => Promise<TeamMembershipDto>;
+export declare const teamsControllerAddMember: (id: string, addTeamMemberDto: AddTeamMemberDto, options?: RequestInit) => Promise<TeamMembershipDtoDataEnvelope>;
 export declare const getTeamsControllerRemoveMemberUrl: (id: string, membershipId: string) => string;
 /**
  * @summary Remove a member from a team

package/dist/index.d.ts

@@ -2,7 +2,9 @@ export { configureClient, getClientConfig, ClientError, customFetch, type Client
 export * from './models';
 export * from './endpoints/agents/agents';
 export * from './endpoints/authorization/authorization';
+export * from './endpoints/contribution-sync/contribution-sync';
 export * from './endpoints/credential-defaults/credential-defaults';
+export * from './endpoints/describe-objects/describe-objects';
 export * from './endpoints/environments/environments';
 export * from './endpoints/grants/grants';
 export * from './endpoints/profiles/profiles';

package/dist/index.js

@@ -24,7 +24,9 @@ Object.defineProperty(exports, "customFetch", { enumerable: true, get: function
 __exportStar(require("./models"), exports);
 __exportStar(require("./endpoints/agents/agents"), exports);
 __exportStar(require("./endpoints/authorization/authorization"), exports);
+__exportStar(require("./endpoints/contribution-sync/contribution-sync"), exports);
 __exportStar(require("./endpoints/credential-defaults/credential-defaults"), exports);
+__exportStar(require("./endpoints/describe-objects/describe-objects"), exports);
 __exportStar(require("./endpoints/environments/environments"), exports);
 __exportStar(require("./endpoints/grants/grants"), exports);
 __exportStar(require("./endpoints/profiles/profiles"), exports);

package/dist/models/authorizationCheckResponseDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { AuthorizationCheckResponseDto } from './authorizationCheckResponseDto.js';
+export interface AuthorizationCheckResponseDtoDataEnvelope {
+    data: AuthorizationCheckResponseDto;
+}

package/dist/models/authorizationCheckResponseDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/biomePermissionProfile.d.ts

@@ -5,9 +5,6 @@
  * Authorization API extract (generated for client codegen).
  * OpenAPI spec version: 0.1.0
  */
-/**
- * Profile template that materialised this row, if any.
- */
 export type BiomePermissionProfile = typeof BiomePermissionProfile[keyof typeof BiomePermissionProfile];
 export declare const BiomePermissionProfile: {
     readonly 'read-only-assistant': "read-only-assistant";

package/dist/models/capabilityGrantDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { CapabilityGrantDto } from './capabilityGrantDto.js';
+export interface CapabilityGrantDtoDataEnvelope {
+    data: CapabilityGrantDto;
+}

package/dist/models/capabilityGrantDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/describeObjectsResponseDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { XemaObjectResponseDto } from './xemaObjectResponseDto.js';
+export interface DescribeObjectsResponseDto {
+    /** Owning-service identifier. The registry replaces the cache slice keyed by this value atomically. */
+    source: string;
+    /** Full set of XemaObjects this service currently owns. */
+    objects: XemaObjectResponseDto[];
+}

package/dist/models/describeObjectsResponseDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/describeObjectsResponseDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { DescribeObjectsResponseDto } from './describeObjectsResponseDto.js';
+export interface DescribeObjectsResponseDtoDataEnvelope {
+    data: DescribeObjectsResponseDto;
+}

package/dist/models/describeObjectsResponseDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/errorDetailsDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ErrorDetailsDtoDetails } from './errorDetailsDtoDetails.js';
+export interface ErrorDetailsDto {
+    /** @nullable */
+    details: ErrorDetailsDtoDetails;
+}

package/dist/models/errorDetailsDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/errorDetailsDtoDetails.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+/**
+ * @nullable
+ */
+export type ErrorDetailsDtoDetails = {
+    [key: string]: unknown;
+} | null;

package/dist/models/errorDetailsDtoDetails.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/errorPayloadDto.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ErrorDetailsDto } from './errorDetailsDto.js';
+export interface ErrorPayloadDto {
+    code: string;
+    message: string;
+    details: ErrorDetailsDto | null;
+}

package/dist/models/errorPayloadDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/errorResponseDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ErrorPayloadDto } from './errorPayloadDto.js';
+export interface ErrorResponseDto {
+    error: ErrorPayloadDto;
+}

package/dist/models/errorResponseDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/executionEnvironmentResponseDtoDataArrayEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ExecutionEnvironmentResponseDto } from './executionEnvironmentResponseDto.js';
+export interface ExecutionEnvironmentResponseDtoDataArrayEnvelope {
+    data: ExecutionEnvironmentResponseDto[];
+}

package/dist/models/executionEnvironmentResponseDtoDataArrayEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/executionEnvironmentResponseDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ExecutionEnvironmentResponseDto } from './executionEnvironmentResponseDto.js';
+export interface ExecutionEnvironmentResponseDtoDataEnvelope {
+    data: ExecutionEnvironmentResponseDto;
+}

package/dist/models/executionEnvironmentResponseDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/grantVersionResponseDto.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+export interface GrantVersionResponseDto {
+    /** Organization the version belongs to. */
+    orgId: string;
+    /** Monotonic per-org grant version. `0` means no grant change has been recorded for the org yet (a valid baseline, not an error). */
+    grantVersion: number;
+}

package/dist/models/grantVersionResponseDto.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/grantVersionResponseDtoDataEnvelope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by orval v8.16.0 🍺
+ * Do not edit manually.
+ * Authorization API
+ * Authorization API extract (generated for client codegen).
+ * OpenAPI spec version: 0.1.0
+ */
+import type { GrantVersionResponseDto } from './grantVersionResponseDto.js';
+export interface GrantVersionResponseDtoDataEnvelope {
+    data: GrantVersionResponseDto;
+}

package/dist/models/grantVersionResponseDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });