@xemahq/authorization-internal-api-client 0.11.0 → 0.11.2

package/dist/endpoints/installed-workload-grants/installed-workload-grants.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ApplyInstalledWorkloadGrantsDto, ApplyInstalledWorkloadGrantsResultDtoDataEnvelope, CheckInstalledWorkloadGrantDto, CheckInstalledWorkloadGrantResultDtoDataEnvelope, InstalledWorkloadGrantsControllerListSelfParams, InstalledWorkloadGrantsControllerRevokeParams, ListHeldInstalledWorkloadGrantsResultDtoDataEnvelope, RevokeInstalledWorkloadGrantsResultDtoDataEnvelope } from '../../models';
+export declare const getInstalledWorkloadGrantsControllerApplyUrl: (installationId: string) => string;
+/**
+ * @summary Store the grants an installation's workloads hold: requested ∩ ceiling, written only against the consent digest when the admission adds authority
+ */
+export declare const installedWorkloadGrantsControllerApply: (installationId: string, applyInstalledWorkloadGrantsDto: ApplyInstalledWorkloadGrantsDto, options?: RequestInit) => Promise<ApplyInstalledWorkloadGrantsResultDtoDataEnvelope>;
+export declare const getInstalledWorkloadGrantsControllerRevokeUrl: (installationId: string, params: InstalledWorkloadGrantsControllerRevokeParams) => string;
+/**
+ * @summary Withdraw every grant of an installation that was uninstalled, disabled or whose owner changed
+ */
+export declare const installedWorkloadGrantsControllerRevoke: (installationId: string, params: InstalledWorkloadGrantsControllerRevokeParams, options?: RequestInit) => Promise<RevokeInstalledWorkloadGrantsResultDtoDataEnvelope>;
+export declare const getInstalledWorkloadGrantsControllerCheckUrl: () => string;
+/**
+ * @summary Does the workload hold the operation for the organization through an active installation? Callable only by a service the deployment granted authorization:installed-workload-grants.check@1
+ */
+export declare const installedWorkloadGrantsControllerCheck: (checkInstalledWorkloadGrantDto: CheckInstalledWorkloadGrantDto, options?: RequestInit) => Promise<CheckInstalledWorkloadGrantResultDtoDataEnvelope>;
+export declare const getInstalledWorkloadGrantsControllerListSelfUrl: (params?: InstalledWorkloadGrantsControllerListSelfParams) => string;
+/**
+ * @summary The active grants the calling workload holds for the organization, or for the System with fence=global
+ */
+export declare const installedWorkloadGrantsControllerListSelf: (params?: InstalledWorkloadGrantsControllerListSelfParams, options?: RequestInit) => Promise<ListHeldInstalledWorkloadGrantsResultDtoDataEnvelope>;

package/dist/endpoints/installed-workload-grants/installed-workload-grants.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installedWorkloadGrantsControllerListSelf = exports.getInstalledWorkloadGrantsControllerListSelfUrl = exports.installedWorkloadGrantsControllerCheck = exports.getInstalledWorkloadGrantsControllerCheckUrl = exports.installedWorkloadGrantsControllerRevoke = exports.getInstalledWorkloadGrantsControllerRevokeUrl = exports.installedWorkloadGrantsControllerApply = exports.getInstalledWorkloadGrantsControllerApplyUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getInstalledWorkloadGrantsControllerApplyUrl = (installationId) => {
+    return `/internal/installed-workload-grants/installations/${installationId}`;
+};
+exports.getInstalledWorkloadGrantsControllerApplyUrl = getInstalledWorkloadGrantsControllerApplyUrl;
+/**
+ * @summary Store the grants an installation's workloads hold: requested ∩ ceiling, written only against the consent digest when the admission adds authority
+ */
+const installedWorkloadGrantsControllerApply = async (installationId, applyInstalledWorkloadGrantsDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getInstalledWorkloadGrantsControllerApplyUrl)(installationId), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(applyInstalledWorkloadGrantsDto)
+    });
+};
+exports.installedWorkloadGrantsControllerApply = installedWorkloadGrantsControllerApply;
+const getInstalledWorkloadGrantsControllerRevokeUrl = (installationId, params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/internal/installed-workload-grants/installations/${installationId}?${stringifiedParams}` : `/internal/installed-workload-grants/installations/${installationId}`;
+};
+exports.getInstalledWorkloadGrantsControllerRevokeUrl = getInstalledWorkloadGrantsControllerRevokeUrl;
+/**
+ * @summary Withdraw every grant of an installation that was uninstalled, disabled or whose owner changed
+ */
+const installedWorkloadGrantsControllerRevoke = async (installationId, params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getInstalledWorkloadGrantsControllerRevokeUrl)(installationId, params), {
+        ...options,
+        method: 'DELETE'
+    });
+};
+exports.installedWorkloadGrantsControllerRevoke = installedWorkloadGrantsControllerRevoke;
+const getInstalledWorkloadGrantsControllerCheckUrl = () => {
+    return `/internal/installed-workload-grants/check`;
+};
+exports.getInstalledWorkloadGrantsControllerCheckUrl = getInstalledWorkloadGrantsControllerCheckUrl;
+/**
+ * @summary Does the workload hold the operation for the organization through an active installation? Callable only by a service the deployment granted authorization:installed-workload-grants.check@1
+ */
+const installedWorkloadGrantsControllerCheck = async (checkInstalledWorkloadGrantDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getInstalledWorkloadGrantsControllerCheckUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(checkInstalledWorkloadGrantDto)
+    });
+};
+exports.installedWorkloadGrantsControllerCheck = installedWorkloadGrantsControllerCheck;
+const getInstalledWorkloadGrantsControllerListSelfUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/internal/installed-workload-grants/self?${stringifiedParams}` : `/internal/installed-workload-grants/self`;
+};
+exports.getInstalledWorkloadGrantsControllerListSelfUrl = getInstalledWorkloadGrantsControllerListSelfUrl;
+/**
+ * @summary The active grants the calling workload holds for the organization, or for the System with fence=global
+ */
+const installedWorkloadGrantsControllerListSelf = async (params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getInstalledWorkloadGrantsControllerListSelfUrl)(params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.installedWorkloadGrantsControllerListSelf = installedWorkloadGrantsControllerListSelf;

package/dist/endpoints/roles/roles.d.ts

@@ -51,6 +51,7 @@ export declare const getRolesControllerListAssignmentsUrl: (id: string) => strin
 export declare const rolesControllerListAssignments: (id: string, options?: RequestInit) => Promise<RoleAssignmentDtoDataArrayEnvelope>;
 export declare const getRolesControllerAssignUrl: (id: string) => string;
 /**
+ * A USER subject is bound under its ACTIVE membership instance of the org; 409 RBAC_SUBJECT_NO_ACTIVE_MEMBERSHIP when it holds none (never joined, left, or a join not yet processed).
  * @summary Assign a role to a subject or a team
  */
 export declare const rolesControllerAssign: (id: string, assignRoleDto: AssignRoleDto, options?: RequestInit) => Promise<RoleAssignmentDtoDataEnvelope>;

package/dist/endpoints/roles/roles.js

@@ -158,6 +158,7 @@ const getRolesControllerAssignUrl = (id) => {
 };
 exports.getRolesControllerAssignUrl = getRolesControllerAssignUrl;
 /**
+ * A USER subject is bound under its ACTIVE membership instance of the org; 409 RBAC_SUBJECT_NO_ACTIVE_MEMBERSHIP when it holds none (never joined, left, or a join not yet processed).
  * @summary Assign a role to a subject or a team
  */
 const rolesControllerAssign = async (id, assignRoleDto, options) => {

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export * from './endpoints/durable-delegations/durable-delegations';
 export * from './endpoints/environments/environments';
 export * from './endpoints/facts/facts';
 export * from './endpoints/grants/grants';
+export * from './endpoints/installed-workload-grants/installed-workload-grants';
 export * from './endpoints/org-erasure/org-erasure';
 export * from './endpoints/output-routes/output-routes';
 export * from './endpoints/resource-revisions/resource-revisions';

package/dist/index.js

@@ -33,6 +33,7 @@ __exportStar(require("./endpoints/durable-delegations/durable-delegations"), exp
 __exportStar(require("./endpoints/environments/environments"), exports);
 __exportStar(require("./endpoints/facts/facts"), exports);
 __exportStar(require("./endpoints/grants/grants"), exports);
+__exportStar(require("./endpoints/installed-workload-grants/installed-workload-grants"), exports);
 __exportStar(require("./endpoints/org-erasure/org-erasure"), exports);
 __exportStar(require("./endpoints/output-routes/output-routes"), exports);
 __exportStar(require("./endpoints/resource-revisions/resource-revisions"), exports);

package/dist/models/applyInstalledWorkloadGrantsDto.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ApplyInstalledWorkloadGrantsDtoRequested } from './applyInstalledWorkloadGrantsDtoRequested.js';
+import type { ApplyInstalledWorkloadGrantsDtoStore } from './applyInstalledWorkloadGrantsDtoStore.js';
+export interface ApplyInstalledWorkloadGrantsDto {
+    /**
+       * The organization that installed the biome; null exactly when the owner Space is the System Space.
+       * @minLength 1
+       * @nullable
+       */
+    orgId: string | null;
+    /**
+       * The installed biome id.
+       * @minLength 1
+       */
+    biome: string;
+    /**
+       * The installed biome version whose admission writes the rows.
+       * @minLength 1
+       */
+    biomeVersion: string;
+    /**
+       * The installation's owner Space: the xema:// URI of the System, an Org, a Project or a User Space.
+       * @minLength 1
+       */
+    ownerSpaceUri: string;
+    /** component -> the operations the installed version requests. */
+    requested: ApplyInstalledWorkloadGrantsDtoRequested;
+    /** Present only for a store biome: { workloads: component -> workload name, ownDomains: the capability domains it declares }. */
+    store?: ApplyInstalledWorkloadGrantsDtoStore;
+    /**
+       * The digest the administrator consented to. Required whenever the admission adds authority.
+       * @minLength 1
+       */
+    consentDigest?: string;
+}

package/dist/models/applyInstalledWorkloadGrantsDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/applyInstalledWorkloadGrantsDtoRequested.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * component -> the operations the installed version requests.
+ */
+export type ApplyInstalledWorkloadGrantsDtoRequested = {
+    [key: string]: string[];
+};

package/dist/models/applyInstalledWorkloadGrantsDtoRequested.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/applyInstalledWorkloadGrantsDtoStore.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Present only for a store biome: { workloads: component -> workload name, ownDomains: the capability domains it declares }.
+ */
+export type ApplyInstalledWorkloadGrantsDtoStore = {
+    [key: string]: unknown;
+};

package/dist/models/applyInstalledWorkloadGrantsDtoStore.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/applyInstalledWorkloadGrantsResultDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ApplyInstalledWorkloadGrantsResultDtoAdmission } from './applyInstalledWorkloadGrantsResultDtoAdmission.js';
+import type { InstalledWorkloadGrantOutcome } from './installedWorkloadGrantOutcome.js';
+export interface ApplyInstalledWorkloadGrantsResultDto {
+    outcome: InstalledWorkloadGrantOutcome;
+    /** The admission: admitted, refused, diff { kept, added, removed } and consentRequired. */
+    admission: ApplyInstalledWorkloadGrantsResultDtoAdmission;
+    /** The digest of the consent document of the admitted set. */
+    consentDigest: string;
+}

package/dist/models/applyInstalledWorkloadGrantsResultDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/applyInstalledWorkloadGrantsResultDtoAdmission.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * The admission: admitted, refused, diff { kept, added, removed } and consentRequired.
+ */
+export type ApplyInstalledWorkloadGrantsResultDtoAdmission = {
+    [key: string]: unknown;
+};

package/dist/models/applyInstalledWorkloadGrantsResultDtoAdmission.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/applyInstalledWorkloadGrantsResultDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ApplyInstalledWorkloadGrantsResultDto } from './applyInstalledWorkloadGrantsResultDto.js';
+export interface ApplyInstalledWorkloadGrantsResultDtoDataEnvelope {
+    data: ApplyInstalledWorkloadGrantsResultDto;
+}

package/dist/models/applyInstalledWorkloadGrantsResultDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/checkInstalledWorkloadGrantDto.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface CheckInstalledWorkloadGrantDto {
+    /**
+       * The organization; null for an org-less question, which only a System-owned grant answers.
+       * @minLength 1
+       * @nullable
+       */
+    orgId: string | null;
+    /**
+       * The workload name the receiver sees as the caller.
+       * @minLength 1
+       */
+    workload: string;
+    /**
+       * The operation id (G1 grammar).
+       * @minLength 1
+       */
+    operation: string;
+    /**
+       * The Space the workload acts on: the xema:// URI of an Org, Project, App or User Space of the organization. Absent: only an organization-owned grant admits. Org-less: only the System Space is covered, by a System-owned grant; absent means the System Space.
+       * @minLength 1
+       */
+    targetSpaceUri?: string;
+}

package/dist/models/checkInstalledWorkloadGrantDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/checkInstalledWorkloadGrantResultDto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CheckInstalledWorkloadGrantResultDtoReceiver } from './checkInstalledWorkloadGrantResultDtoReceiver.js';
+import type { InstalledWorkloadGrantRefusalCode } from './installedWorkloadGrantRefusalCode.js';
+export interface CheckInstalledWorkloadGrantResultDto {
+    admitted: boolean;
+    /** Present when admitted. */
+    installationId?: string;
+    /** Present when admitted. */
+    biome?: string;
+    /** Present when admitted. */
+    component?: string;
+    /** Present when admitted: the receiver. */
+    receiver?: CheckInstalledWorkloadGrantResultDtoReceiver;
+    /** Present when admitted: the owner Space of the covering grant. */
+    ownerSpaceUri?: string;
+    code?: InstalledWorkloadGrantRefusalCode;
+}

package/dist/models/checkInstalledWorkloadGrantResultDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/checkInstalledWorkloadGrantResultDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CheckInstalledWorkloadGrantResultDto } from './checkInstalledWorkloadGrantResultDto.js';
+export interface CheckInstalledWorkloadGrantResultDtoDataEnvelope {
+    data: CheckInstalledWorkloadGrantResultDto;
+}

package/dist/models/checkInstalledWorkloadGrantResultDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/checkInstalledWorkloadGrantResultDtoReceiver.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Present when admitted: the receiver.
+ */
+export type CheckInstalledWorkloadGrantResultDtoReceiver = {
+    [key: string]: unknown;
+};

package/dist/models/checkInstalledWorkloadGrantResultDtoReceiver.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/heldInstalledWorkloadGrantDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { HeldInstalledWorkloadGrantDtoReceiver } from './heldInstalledWorkloadGrantDtoReceiver.js';
+export interface HeldInstalledWorkloadGrantDto {
+    installationId: string;
+    biome: string;
+    component: string;
+    operation: string;
+    receiver: HeldInstalledWorkloadGrantDtoReceiver;
+    ownerSpaceUri: string;
+}

package/dist/models/heldInstalledWorkloadGrantDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/heldInstalledWorkloadGrantDtoReceiver.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type HeldInstalledWorkloadGrantDtoReceiver = {
+    [key: string]: unknown;
+};

package/dist/models/heldInstalledWorkloadGrantDtoReceiver.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/index.d.ts

@@ -3,6 +3,12 @@ export * from './adoptOrgPolicySetDto';
 export * from './agentProvisionDecision';
 export * from './agentProvisionReason';
 export * from './agentReachTier';
+export * from './applyInstalledWorkloadGrantsDto';
+export * from './applyInstalledWorkloadGrantsDtoRequested';
+export * from './applyInstalledWorkloadGrantsDtoStore';
+export * from './applyInstalledWorkloadGrantsResultDto';
+export * from './applyInstalledWorkloadGrantsResultDtoAdmission';
+export * from './applyInstalledWorkloadGrantsResultDtoDataEnvelope';
 export * from './assignRoleDto';
 export * from './authorityRowOwnerSpaceKind';
 export * from './bindChildCarrierDto';
@@ -21,6 +27,10 @@ export * from './capabilityGrantDtoDataEnvelope';
 export * from './capabilityGrantDtoPaginatedEnvelope';
 export * from './capabilityReach';
 export * from './capabilityRiskTier';
+export * from './checkInstalledWorkloadGrantDto';
+export * from './checkInstalledWorkloadGrantResultDto';
+export * from './checkInstalledWorkloadGrantResultDtoDataEnvelope';
+export * from './checkInstalledWorkloadGrantResultDtoReceiver';
 export * from './createChildDurableDelegationDto';
 export * from './createExecutionEnvironmentDto';
 export * from './createExecutionEnvironmentDtoAllowedCapabilitiesItem';
@@ -67,6 +77,15 @@ export * from './grantConstraintsDto';
 export * from './grantVersionResponseDto';
 export * from './grantVersionResponseDtoDataEnvelope';
 export * from './grantsControllerListParams';
+export * from './heldInstalledWorkloadGrantDto';
+export * from './heldInstalledWorkloadGrantDtoReceiver';
+export * from './installedWorkloadGrantOutcome';
+export * from './installedWorkloadGrantRefusalCode';
+export * from './installedWorkloadGrantWithdrawal';
+export * from './installedWorkloadGrantsControllerListSelfParams';
+export * from './installedWorkloadGrantsControllerRevokeParams';
+export * from './listHeldInstalledWorkloadGrantsResultDto';
+export * from './listHeldInstalledWorkloadGrantsResultDtoDataEnvelope';
 export * from './objectLifecycle';
 export * from './openCapabilityAuthorityRequestDto';
 export * from './openCapabilityAuthorityRequestDtoSubjectKind';
@@ -86,6 +105,7 @@ export * from './outputRouteReleaseRequestDtoDataEnvelope';
 export * from './outputRouteReleaseRequestDtoStatus';
 export * from './outputRouteRevisionDto';
 export * from './outputRouteRevisionDtoAllowedOutputSchema';
+export * from './ownerSpaceFence';
 export * from './paginationMeta';
 export * from './policySetTestFileDto';
 export * from './policySetTestFileResultDto';
@@ -119,6 +139,8 @@ export * from './resourceSubjectAccessResult';
 export * from './resourceSubjectRefDto';
 export * from './retiredNamespaceDto';
 export * from './retiredNamespaceDtoDataEnvelope';
+export * from './revokeInstalledWorkloadGrantsResultDto';
+export * from './revokeInstalledWorkloadGrantsResultDtoDataEnvelope';
 export * from './roleAssignmentDto';
 export * from './roleAssignmentDtoDataArrayEnvelope';
 export * from './roleAssignmentDtoDataEnvelope';

package/dist/models/index.js

@@ -20,6 +20,12 @@ __exportStar(require("./adoptOrgPolicySetDto"), exports);
 __exportStar(require("./agentProvisionDecision"), exports);
 __exportStar(require("./agentProvisionReason"), exports);
 __exportStar(require("./agentReachTier"), exports);
+__exportStar(require("./applyInstalledWorkloadGrantsDto"), exports);
+__exportStar(require("./applyInstalledWorkloadGrantsDtoRequested"), exports);
+__exportStar(require("./applyInstalledWorkloadGrantsDtoStore"), exports);
+__exportStar(require("./applyInstalledWorkloadGrantsResultDto"), exports);
+__exportStar(require("./applyInstalledWorkloadGrantsResultDtoAdmission"), exports);
+__exportStar(require("./applyInstalledWorkloadGrantsResultDtoDataEnvelope"), exports);
 __exportStar(require("./assignRoleDto"), exports);
 __exportStar(require("./authorityRowOwnerSpaceKind"), exports);
 __exportStar(require("./bindChildCarrierDto"), exports);
@@ -38,6 +44,10 @@ __exportStar(require("./capabilityGrantDtoDataEnvelope"), exports);
 __exportStar(require("./capabilityGrantDtoPaginatedEnvelope"), exports);
 __exportStar(require("./capabilityReach"), exports);
 __exportStar(require("./capabilityRiskTier"), exports);
+__exportStar(require("./checkInstalledWorkloadGrantDto"), exports);
+__exportStar(require("./checkInstalledWorkloadGrantResultDto"), exports);
+__exportStar(require("./checkInstalledWorkloadGrantResultDtoDataEnvelope"), exports);
+__exportStar(require("./checkInstalledWorkloadGrantResultDtoReceiver"), exports);
 __exportStar(require("./createChildDurableDelegationDto"), exports);
 __exportStar(require("./createExecutionEnvironmentDto"), exports);
 __exportStar(require("./createExecutionEnvironmentDtoAllowedCapabilitiesItem"), exports);
@@ -84,6 +94,15 @@ __exportStar(require("./grantConstraintsDto"), exports);
 __exportStar(require("./grantVersionResponseDto"), exports);
 __exportStar(require("./grantVersionResponseDtoDataEnvelope"), exports);
 __exportStar(require("./grantsControllerListParams"), exports);
+__exportStar(require("./heldInstalledWorkloadGrantDto"), exports);
+__exportStar(require("./heldInstalledWorkloadGrantDtoReceiver"), exports);
+__exportStar(require("./installedWorkloadGrantOutcome"), exports);
+__exportStar(require("./installedWorkloadGrantRefusalCode"), exports);
+__exportStar(require("./installedWorkloadGrantWithdrawal"), exports);
+__exportStar(require("./installedWorkloadGrantsControllerListSelfParams"), exports);
+__exportStar(require("./installedWorkloadGrantsControllerRevokeParams"), exports);
+__exportStar(require("./listHeldInstalledWorkloadGrantsResultDto"), exports);
+__exportStar(require("./listHeldInstalledWorkloadGrantsResultDtoDataEnvelope"), exports);
 __exportStar(require("./objectLifecycle"), exports);
 __exportStar(require("./openCapabilityAuthorityRequestDto"), exports);
 __exportStar(require("./openCapabilityAuthorityRequestDtoSubjectKind"), exports);
@@ -103,6 +122,7 @@ __exportStar(require("./outputRouteReleaseRequestDtoDataEnvelope"), exports);
 __exportStar(require("./outputRouteReleaseRequestDtoStatus"), exports);
 __exportStar(require("./outputRouteRevisionDto"), exports);
 __exportStar(require("./outputRouteRevisionDtoAllowedOutputSchema"), exports);
+__exportStar(require("./ownerSpaceFence"), exports);
 __exportStar(require("./paginationMeta"), exports);
 __exportStar(require("./policySetTestFileDto"), exports);
 __exportStar(require("./policySetTestFileResultDto"), exports);
@@ -136,6 +156,8 @@ __exportStar(require("./resourceSubjectAccessResult"), exports);
 __exportStar(require("./resourceSubjectRefDto"), exports);
 __exportStar(require("./retiredNamespaceDto"), exports);
 __exportStar(require("./retiredNamespaceDtoDataEnvelope"), exports);
+__exportStar(require("./revokeInstalledWorkloadGrantsResultDto"), exports);
+__exportStar(require("./revokeInstalledWorkloadGrantsResultDtoDataEnvelope"), exports);
 __exportStar(require("./roleAssignmentDto"), exports);
 __exportStar(require("./roleAssignmentDtoDataArrayEnvelope"), exports);
 __exportStar(require("./roleAssignmentDtoDataEnvelope"), exports);

package/dist/models/installedWorkloadGrantOutcome.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type InstalledWorkloadGrantOutcome = typeof InstalledWorkloadGrantOutcome[keyof typeof InstalledWorkloadGrantOutcome];
+export declare const InstalledWorkloadGrantOutcome: {
+    readonly applied: "applied";
+    readonly 'consent-required': "consent-required";
+};

package/dist/models/installedWorkloadGrantOutcome.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledWorkloadGrantOutcome = void 0;
+exports.InstalledWorkloadGrantOutcome = {
+    applied: 'applied',
+    'consent-required': 'consent-required',
+};

package/dist/models/installedWorkloadGrantRefusalCode.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type InstalledWorkloadGrantRefusalCode = typeof InstalledWorkloadGrantRefusalCode[keyof typeof InstalledWorkloadGrantRefusalCode];
+export declare const InstalledWorkloadGrantRefusalCode: {
+    readonly 'not-granted': "not-granted";
+    readonly revoked: "revoked";
+    readonly 'target-outside-org': "target-outside-org";
+    readonly 'owner-narrower-than-org': "owner-narrower-than-org";
+    readonly 'owner-not-grantable': "owner-not-grantable";
+};

package/dist/models/installedWorkloadGrantRefusalCode.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledWorkloadGrantRefusalCode = void 0;
+exports.InstalledWorkloadGrantRefusalCode = {
+    'not-granted': 'not-granted',
+    revoked: 'revoked',
+    'target-outside-org': 'target-outside-org',
+    'owner-narrower-than-org': 'owner-narrower-than-org',
+    'owner-not-grantable': 'owner-not-grantable',
+};

package/dist/models/installedWorkloadGrantWithdrawal.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type InstalledWorkloadGrantWithdrawal = typeof InstalledWorkloadGrantWithdrawal[keyof typeof InstalledWorkloadGrantWithdrawal];
+export declare const InstalledWorkloadGrantWithdrawal: {
+    readonly uninstalled: "uninstalled";
+    readonly disabled: "disabled";
+    readonly 'owner-changed': "owner-changed";
+};

package/dist/models/installedWorkloadGrantWithdrawal.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstalledWorkloadGrantWithdrawal = void 0;
+exports.InstalledWorkloadGrantWithdrawal = {
+    uninstalled: 'uninstalled',
+    disabled: 'disabled',
+    'owner-changed': 'owner-changed',
+};

package/dist/models/installedWorkloadGrantsControllerListSelfParams.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { OwnerSpaceFence } from './ownerSpaceFence.js';
+export type InstalledWorkloadGrantsControllerListSelfParams = {
+    /**
+     * The organization. Absent only with fence=global.
+     * @minLength 1
+     */
+    orgId?: string;
+    /**
+     * global: the System fence (no orgId). Absent or tenant: the organization named by orgId.
+     */
+    fence?: OwnerSpaceFence;
+};

package/dist/models/installedWorkloadGrantsControllerListSelfParams.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/installedWorkloadGrantsControllerRevokeParams.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { InstalledWorkloadGrantWithdrawal } from './installedWorkloadGrantWithdrawal.js';
+import type { OwnerSpaceFence } from './ownerSpaceFence.js';
+export type InstalledWorkloadGrantsControllerRevokeParams = {
+    /**
+     * The organization. Absent only with fence=global.
+     * @minLength 1
+     */
+    orgId?: string;
+    /**
+     * global: the System fence (no orgId). Absent or tenant: the organization named by orgId.
+     */
+    fence?: OwnerSpaceFence;
+    reason: InstalledWorkloadGrantWithdrawal;
+};

package/dist/models/installedWorkloadGrantsControllerRevokeParams.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/listHeldInstalledWorkloadGrantsResultDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { HeldInstalledWorkloadGrantDto } from './heldInstalledWorkloadGrantDto.js';
+export interface ListHeldInstalledWorkloadGrantsResultDto {
+    grants: HeldInstalledWorkloadGrantDto[];
+}

package/dist/models/listHeldInstalledWorkloadGrantsResultDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/listHeldInstalledWorkloadGrantsResultDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ListHeldInstalledWorkloadGrantsResultDto } from './listHeldInstalledWorkloadGrantsResultDto.js';
+export interface ListHeldInstalledWorkloadGrantsResultDtoDataEnvelope {
+    data: ListHeldInstalledWorkloadGrantsResultDto;
+}

package/dist/models/listHeldInstalledWorkloadGrantsResultDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/ownerSpaceFence.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type OwnerSpaceFence = typeof OwnerSpaceFence[keyof typeof OwnerSpaceFence];
+export declare const OwnerSpaceFence: {
+    readonly global: "global";
+    readonly tenant: "tenant";
+};

package/dist/models/ownerSpaceFence.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwnerSpaceFence = void 0;
+exports.OwnerSpaceFence = {
+    global: 'global',
+    tenant: 'tenant',
+};

package/dist/models/revokeInstalledWorkloadGrantsResultDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface RevokeInstalledWorkloadGrantsResultDto {
+    /** How many active grants were withdrawn. */
+    revoked: number;
+}

package/dist/models/revokeInstalledWorkloadGrantsResultDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/revokeInstalledWorkloadGrantsResultDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RevokeInstalledWorkloadGrantsResultDto } from './revokeInstalledWorkloadGrantsResultDto.js';
+export interface RevokeInstalledWorkloadGrantsResultDtoDataEnvelope {
+    data: RevokeInstalledWorkloadGrantsResultDto;
+}

package/dist/models/revokeInstalledWorkloadGrantsResultDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -60,6 +60,6 @@
     "build": "tsc -p tsconfig.json"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:48030bd34bd9419de307eaf2373affc54c8e2702675350cacd3524201025dda6"
+    "sourceDigest": "sha256:df39b3b92defa596a451173fe7279c09de027ed089fb6bd928b5ede3a223b1c8"
   }
 }