@xemahq/authorization-internal-api-client 0.3.10 → 0.4.12

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/endpoints/environments/environments.d.ts

@@ -3,7 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { CreateExecutionEnvironmentDto, EnvironmentsControllerFindBySlugParams, EnvironmentsControllerListParams, EnvironmentsControllerRemoveParams, EnvironmentsControllerUpdateParams, ExecutionEnvironmentResponseDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataEnvelope, UpdateExecutionEnvironmentDto } from '../../models';
+import type { CreateExecutionEnvironmentDto, EnvironmentsControllerFindBySlugParams, EnvironmentsControllerListParams, EnvironmentsControllerReleaseHistoryParams, EnvironmentsControllerReleaseImpactParams, EnvironmentsControllerRemoveParams, EnvironmentsControllerRollbackParams, EnvironmentsControllerUpdateParams, ExecutionEnvironmentReleaseHistoryDtoDataArrayEnvelope, ExecutionEnvironmentReleaseImpactDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataEnvelope, RollbackExecutionEnvironmentDto, UpdateExecutionEnvironmentDto } from '../../models';
 export declare const getEnvironmentsControllerListUrl: (params?: EnvironmentsControllerListParams) => string;
 /**
  * Returns the kernel-seeded built-in environments. With `orgId` it also includes that org's custom environments; without `orgId` it returns built-ins only (back-compat).
@@ -16,6 +16,27 @@ export declare const getEnvironmentsControllerCreateUrl: () => string;
  * @summary Create an org-custom ExecutionEnvironment
  */
 export declare const environmentsControllerCreate: (createExecutionEnvironmentDto: CreateExecutionEnvironmentDto, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
+export declare const getEnvironmentsControllerResolveExactPolicyUrl: (slug: string, contentHash: string) => string;
+/**
+ * Service-only authority read. Tenant scope comes exclusively from the verified request context; the response includes the exact revision/hash and complete canonical Environment policy ceilings.
+ * @summary Resolve one exact immutable Environment policy publication
+ */
+export declare const environmentsControllerResolveExactPolicy: (slug: string, contentHash: string, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
+export declare const getEnvironmentsControllerReleaseHistoryUrl: (slug: string, params?: EnvironmentsControllerReleaseHistoryParams) => string;
+/**
+ * @summary List immutable generic ReleaseSet history for an Environment
+ */
+export declare const environmentsControllerReleaseHistory: (slug: string, params?: EnvironmentsControllerReleaseHistoryParams, options?: RequestInit) => Promise<ExecutionEnvironmentReleaseHistoryDtoDataArrayEnvelope>;
+export declare const getEnvironmentsControllerReleaseImpactUrl: (slug: string, params?: EnvironmentsControllerReleaseImpactParams) => string;
+/**
+ * @summary Preview reverse-transitive impact of the selected Environment release
+ */
+export declare const environmentsControllerReleaseImpact: (slug: string, params?: EnvironmentsControllerReleaseImpactParams, options?: RequestInit) => Promise<ExecutionEnvironmentReleaseImpactDtoDataArrayEnvelope>;
+export declare const getEnvironmentsControllerRollbackUrl: (slug: string, params?: EnvironmentsControllerRollbackParams) => string;
+/**
+ * @summary CAS-rollback an Environment channel to a prior ReleaseSet
+ */
+export declare const environmentsControllerRollback: (slug: string, rollbackExecutionEnvironmentDto: RollbackExecutionEnvironmentDto, params?: EnvironmentsControllerRollbackParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerFindBySlugUrl: (slug: string, params?: EnvironmentsControllerFindBySlugParams) => string;
 /**
  * Resolves a built-in by slug. With `orgId`, an org-custom slug resolves before the built-in fallback. 404 if unknown.
@@ -24,7 +45,7 @@ export declare const getEnvironmentsControllerFindBySlugUrl: (slug: string, para
 export declare const environmentsControllerFindBySlug: (slug: string, params?: EnvironmentsControllerFindBySlugParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerUpdateUrl: (slug: string, params: EnvironmentsControllerUpdateParams) => string;
 /**
- * Updates the mutable fields (description / allowedCapabilities / approvalRules / runtimeLimits) of an org-custom environment. Refuses built-ins with 403 (immutable). `slug` / `kind` / `orgId` are immutable.
+ * Updates identity description and authors an immutable policy revision for allowedCapabilities / approvalRules / runtimeLimits, then CAS-promotes its generic stable channel. Refuses built-ins with 403. `slug` / `kind` / `orgId` are immutable.
  * @summary Update an org-custom ExecutionEnvironment
  */
 export declare const environmentsControllerUpdate: (slug: string, updateExecutionEnvironmentDto: UpdateExecutionEnvironmentDto, params: EnvironmentsControllerUpdateParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;

package/dist/endpoints/environments/environments.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.environmentsControllerRemove = exports.getEnvironmentsControllerRemoveUrl = exports.environmentsControllerUpdate = exports.getEnvironmentsControllerUpdateUrl = exports.environmentsControllerFindBySlug = exports.getEnvironmentsControllerFindBySlugUrl = exports.environmentsControllerCreate = exports.getEnvironmentsControllerCreateUrl = exports.environmentsControllerList = exports.getEnvironmentsControllerListUrl = void 0;
+exports.environmentsControllerRemove = exports.getEnvironmentsControllerRemoveUrl = exports.environmentsControllerUpdate = exports.getEnvironmentsControllerUpdateUrl = exports.environmentsControllerFindBySlug = exports.getEnvironmentsControllerFindBySlugUrl = exports.environmentsControllerRollback = exports.getEnvironmentsControllerRollbackUrl = exports.environmentsControllerReleaseImpact = exports.getEnvironmentsControllerReleaseImpactUrl = exports.environmentsControllerReleaseHistory = exports.getEnvironmentsControllerReleaseHistoryUrl = exports.environmentsControllerResolveExactPolicy = exports.getEnvironmentsControllerResolveExactPolicyUrl = exports.environmentsControllerCreate = exports.getEnvironmentsControllerCreateUrl = exports.environmentsControllerList = exports.getEnvironmentsControllerListUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getEnvironmentsControllerListUrl = (params) => {
     const normalizedParams = new URLSearchParams();
@@ -53,6 +53,122 @@ const environmentsControllerCreate = async (createExecutionEnvironmentDto, optio
     });
 };
 exports.environmentsControllerCreate = environmentsControllerCreate;
+const getEnvironmentsControllerResolveExactPolicyUrl = (slug, contentHash) => {
+    return `/environments/${slug}/revisions/${contentHash}`;
+};
+exports.getEnvironmentsControllerResolveExactPolicyUrl = getEnvironmentsControllerResolveExactPolicyUrl;
+/**
+ * Service-only authority read. Tenant scope comes exclusively from the verified request context; the response includes the exact revision/hash and complete canonical Environment policy ceilings.
+ * @summary Resolve one exact immutable Environment policy publication
+ */
+const environmentsControllerResolveExactPolicy = async (slug, contentHash, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getEnvironmentsControllerResolveExactPolicyUrl)(slug, contentHash), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.environmentsControllerResolveExactPolicy = environmentsControllerResolveExactPolicy;
+const getEnvironmentsControllerReleaseHistoryUrl = (slug, params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/environments/${slug}/release-history?${stringifiedParams}` : `/environments/${slug}/release-history`;
+};
+exports.getEnvironmentsControllerReleaseHistoryUrl = getEnvironmentsControllerReleaseHistoryUrl;
+/**
+ * @summary List immutable generic ReleaseSet history for an Environment
+ */
+const environmentsControllerReleaseHistory = async (slug, params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getEnvironmentsControllerReleaseHistoryUrl)(slug, params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.environmentsControllerReleaseHistory = environmentsControllerReleaseHistory;
+const getEnvironmentsControllerReleaseImpactUrl = (slug, params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/environments/${slug}/release-impact?${stringifiedParams}` : `/environments/${slug}/release-impact`;
+};
+exports.getEnvironmentsControllerReleaseImpactUrl = getEnvironmentsControllerReleaseImpactUrl;
+/**
+ * @summary Preview reverse-transitive impact of the selected Environment release
+ */
+const environmentsControllerReleaseImpact = async (slug, params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getEnvironmentsControllerReleaseImpactUrl)(slug, params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.environmentsControllerReleaseImpact = environmentsControllerReleaseImpact;
+const getEnvironmentsControllerRollbackUrl = (slug, params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/environments/${slug}/rollback?${stringifiedParams}` : `/environments/${slug}/rollback`;
+};
+exports.getEnvironmentsControllerRollbackUrl = getEnvironmentsControllerRollbackUrl;
+/**
+ * @summary CAS-rollback an Environment channel to a prior ReleaseSet
+ */
+const environmentsControllerRollback = async (slug, rollbackExecutionEnvironmentDto, params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getEnvironmentsControllerRollbackUrl)(slug, params), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(rollbackExecutionEnvironmentDto)
+    });
+};
+exports.environmentsControllerRollback = environmentsControllerRollback;
 const getEnvironmentsControllerFindBySlugUrl = (slug, params) => {
     const normalizedParams = new URLSearchParams();
     Object.entries(params || {}).forEach(([key, value]) => {
@@ -111,7 +227,7 @@ const getEnvironmentsControllerUpdateUrl = (slug, params) => {
 };
 exports.getEnvironmentsControllerUpdateUrl = getEnvironmentsControllerUpdateUrl;
 /**
- * Updates the mutable fields (description / allowedCapabilities / approvalRules / runtimeLimits) of an org-custom environment. Refuses built-ins with 403 (immutable). `slug` / `kind` / `orgId` are immutable.
+ * Updates identity description and authors an immutable policy revision for allowedCapabilities / approvalRules / runtimeLimits, then CAS-promotes its generic stable channel. Refuses built-ins with 403. `slug` / `kind` / `orgId` are immutable.
  * @summary Update an org-custom ExecutionEnvironment
  */
 const environmentsControllerUpdate = async (slug, updateExecutionEnvironmentDto, params, options) => {

package/dist/endpoints/org-erasure/org-erasure.d.ts

@@ -0,0 +1,5 @@
+export declare const getOrgErasureControllerEraseUrl: (orgId: string) => string;
+/**
+ * @summary Erase every row belonging to an org across this service's org-scoped models
+ */
+export declare const orgErasureControllerErase: (orgId: string, options?: RequestInit) => Promise<void>;

package/dist/endpoints/org-erasure/org-erasure.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgErasureControllerErase = exports.getOrgErasureControllerEraseUrl = void 0;
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+const custom_fetch_1 = require("../../custom-fetch");
+const getOrgErasureControllerEraseUrl = (orgId) => {
+    return `/internal/org-erasure/${orgId}`;
+};
+exports.getOrgErasureControllerEraseUrl = getOrgErasureControllerEraseUrl;
+/**
+ * @summary Erase every row belonging to an org across this service's org-scoped models
+ */
+const orgErasureControllerErase = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOrgErasureControllerEraseUrl)(orgId), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.orgErasureControllerErase = orgErasureControllerErase;

package/dist/endpoints/output-routes/output-routes.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ImpactedOutputRouteConsumerDtoDataArrayEnvelope, OutputRouteAuthorityDtoDataEnvelope, OutputRoutePublicationRequestDtoDataEnvelope, OutputRouteReleaseHistoryDtoDataArrayEnvelope, OutputRouteReleaseRequestDtoDataEnvelope, OutputRouteRevisionsControllerReleaseHistoryParams, PreviewOutputRouteImpactDto, RequestOutputRouteRetirementDto, RequestOutputRouteRevisionReleaseDto, RequestOutputRouteRollbackDto, ResolveExactOutputRouteDto, ResolveOutputRouteChannelDto } from '../../models';
+export declare const getOutputRouteRevisionsControllerRequestRevisionReleaseUrl: () => string;
+/**
+ * @summary Publish an immutable OutputRoute revision and request its governed channel release
+ */
+export declare const outputRouteRevisionsControllerRequestRevisionRelease: (requestOutputRouteRevisionReleaseDto: RequestOutputRouteRevisionReleaseDto, options?: RequestInit) => Promise<OutputRoutePublicationRequestDtoDataEnvelope>;
+export declare const getOutputRouteRevisionsControllerResolveExactUrl: () => string;
+/**
+ * @summary Resolve one exact OutputRoute revision and current subject access
+ */
+export declare const outputRouteRevisionsControllerResolveExact: (resolveExactOutputRouteDto: ResolveExactOutputRouteDto, options?: RequestInit) => Promise<OutputRouteAuthorityDtoDataEnvelope>;
+export declare const getOutputRouteRevisionsControllerResolveChannelUrl: () => string;
+/**
+ * @summary Resolve a governed OutputRoute channel to the exact pin a new binding must persist
+ */
+export declare const outputRouteRevisionsControllerResolveChannel: (resolveOutputRouteChannelDto: ResolveOutputRouteChannelDto, options?: RequestInit) => Promise<OutputRouteAuthorityDtoDataEnvelope>;
+export declare const getOutputRouteRevisionsControllerRequestRetirementUrl: (routeId: string) => string;
+/**
+ * @summary Request governed OutputRoute channel retirement without invalidating exact historical pins
+ */
+export declare const outputRouteRevisionsControllerRequestRetirement: (routeId: string, requestOutputRouteRetirementDto: RequestOutputRouteRetirementDto, options?: RequestInit) => Promise<OutputRouteReleaseRequestDtoDataEnvelope>;
+export declare const getOutputRouteRevisionsControllerRequestRollbackUrl: (routeId: string) => string;
+/**
+ * @summary Request rollback to an immutable prior ReleaseSet
+ */
+export declare const outputRouteRevisionsControllerRequestRollback: (routeId: string, requestOutputRouteRollbackDto: RequestOutputRouteRollbackDto, options?: RequestInit) => Promise<OutputRouteReleaseRequestDtoDataEnvelope>;
+export declare const getOutputRouteRevisionsControllerReleaseHistoryUrl: (routeId: string, params: OutputRouteRevisionsControllerReleaseHistoryParams) => string;
+/**
+ * @summary List immutable governed OutputRoute release history
+ */
+export declare const outputRouteRevisionsControllerReleaseHistory: (routeId: string, params: OutputRouteRevisionsControllerReleaseHistoryParams, options?: RequestInit) => Promise<OutputRouteReleaseHistoryDtoDataArrayEnvelope>;
+export declare const getOutputRouteRevisionsControllerPreviewImpactUrl: (routeId: string) => string;
+/**
+ * @summary Preview reverse impact of a channel advance
+ */
+export declare const outputRouteRevisionsControllerPreviewImpact: (routeId: string, previewOutputRouteImpactDto: PreviewOutputRouteImpactDto, options?: RequestInit) => Promise<ImpactedOutputRouteConsumerDtoDataArrayEnvelope>;

package/dist/endpoints/output-routes/output-routes.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.outputRouteRevisionsControllerPreviewImpact = exports.getOutputRouteRevisionsControllerPreviewImpactUrl = exports.outputRouteRevisionsControllerReleaseHistory = exports.getOutputRouteRevisionsControllerReleaseHistoryUrl = exports.outputRouteRevisionsControllerRequestRollback = exports.getOutputRouteRevisionsControllerRequestRollbackUrl = exports.outputRouteRevisionsControllerRequestRetirement = exports.getOutputRouteRevisionsControllerRequestRetirementUrl = exports.outputRouteRevisionsControllerResolveChannel = exports.getOutputRouteRevisionsControllerResolveChannelUrl = exports.outputRouteRevisionsControllerResolveExact = exports.getOutputRouteRevisionsControllerResolveExactUrl = exports.outputRouteRevisionsControllerRequestRevisionRelease = exports.getOutputRouteRevisionsControllerRequestRevisionReleaseUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getOutputRouteRevisionsControllerRequestRevisionReleaseUrl = () => {
+    return `/output-routes/revisions`;
+};
+exports.getOutputRouteRevisionsControllerRequestRevisionReleaseUrl = getOutputRouteRevisionsControllerRequestRevisionReleaseUrl;
+/**
+ * @summary Publish an immutable OutputRoute revision and request its governed channel release
+ */
+const outputRouteRevisionsControllerRequestRevisionRelease = async (requestOutputRouteRevisionReleaseDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerRequestRevisionReleaseUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(requestOutputRouteRevisionReleaseDto)
+    });
+};
+exports.outputRouteRevisionsControllerRequestRevisionRelease = outputRouteRevisionsControllerRequestRevisionRelease;
+const getOutputRouteRevisionsControllerResolveExactUrl = () => {
+    return `/output-routes/resolve-exact`;
+};
+exports.getOutputRouteRevisionsControllerResolveExactUrl = getOutputRouteRevisionsControllerResolveExactUrl;
+/**
+ * @summary Resolve one exact OutputRoute revision and current subject access
+ */
+const outputRouteRevisionsControllerResolveExact = async (resolveExactOutputRouteDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerResolveExactUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(resolveExactOutputRouteDto)
+    });
+};
+exports.outputRouteRevisionsControllerResolveExact = outputRouteRevisionsControllerResolveExact;
+const getOutputRouteRevisionsControllerResolveChannelUrl = () => {
+    return `/output-routes/resolve-channel`;
+};
+exports.getOutputRouteRevisionsControllerResolveChannelUrl = getOutputRouteRevisionsControllerResolveChannelUrl;
+/**
+ * @summary Resolve a governed OutputRoute channel to the exact pin a new binding must persist
+ */
+const outputRouteRevisionsControllerResolveChannel = async (resolveOutputRouteChannelDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerResolveChannelUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(resolveOutputRouteChannelDto)
+    });
+};
+exports.outputRouteRevisionsControllerResolveChannel = outputRouteRevisionsControllerResolveChannel;
+const getOutputRouteRevisionsControllerRequestRetirementUrl = (routeId) => {
+    return `/output-routes/${routeId}/retire-requests`;
+};
+exports.getOutputRouteRevisionsControllerRequestRetirementUrl = getOutputRouteRevisionsControllerRequestRetirementUrl;
+/**
+ * @summary Request governed OutputRoute channel retirement without invalidating exact historical pins
+ */
+const outputRouteRevisionsControllerRequestRetirement = async (routeId, requestOutputRouteRetirementDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerRequestRetirementUrl)(routeId), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(requestOutputRouteRetirementDto)
+    });
+};
+exports.outputRouteRevisionsControllerRequestRetirement = outputRouteRevisionsControllerRequestRetirement;
+const getOutputRouteRevisionsControllerRequestRollbackUrl = (routeId) => {
+    return `/output-routes/${routeId}/rollback-requests`;
+};
+exports.getOutputRouteRevisionsControllerRequestRollbackUrl = getOutputRouteRevisionsControllerRequestRollbackUrl;
+/**
+ * @summary Request rollback to an immutable prior ReleaseSet
+ */
+const outputRouteRevisionsControllerRequestRollback = async (routeId, requestOutputRouteRollbackDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerRequestRollbackUrl)(routeId), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(requestOutputRouteRollbackDto)
+    });
+};
+exports.outputRouteRevisionsControllerRequestRollback = outputRouteRevisionsControllerRequestRollback;
+const getOutputRouteRevisionsControllerReleaseHistoryUrl = (routeId, params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/output-routes/${routeId}/release-history?${stringifiedParams}` : `/output-routes/${routeId}/release-history`;
+};
+exports.getOutputRouteRevisionsControllerReleaseHistoryUrl = getOutputRouteRevisionsControllerReleaseHistoryUrl;
+/**
+ * @summary List immutable governed OutputRoute release history
+ */
+const outputRouteRevisionsControllerReleaseHistory = async (routeId, params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerReleaseHistoryUrl)(routeId, params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.outputRouteRevisionsControllerReleaseHistory = outputRouteRevisionsControllerReleaseHistory;
+const getOutputRouteRevisionsControllerPreviewImpactUrl = (routeId) => {
+    return `/output-routes/${routeId}/release-impact`;
+};
+exports.getOutputRouteRevisionsControllerPreviewImpactUrl = getOutputRouteRevisionsControllerPreviewImpactUrl;
+/**
+ * @summary Preview reverse impact of a channel advance
+ */
+const outputRouteRevisionsControllerPreviewImpact = async (routeId, previewOutputRouteImpactDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerPreviewImpactUrl)(routeId), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(previewOutputRouteImpactDto)
+    });
+};
+exports.outputRouteRevisionsControllerPreviewImpact = outputRouteRevisionsControllerPreviewImpact;

package/dist/endpoints/resource-revisions/resource-revisions.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ExactResourceAuthorityDtoDataEnvelope, RegisterResourceRevisionDto, RegisteredResourceRevisionDtoDataEnvelope, ResolveExactResourceRevisionDto } from '../../models';
+export declare const getResourceRevisionsControllerRegisterUrl: () => string;
+/**
+ * @summary Register immutable resource revision metadata
+ */
+export declare const resourceRevisionsControllerRegister: (registerResourceRevisionDto: RegisterResourceRevisionDto, options?: RequestInit) => Promise<RegisteredResourceRevisionDtoDataEnvelope>;
+export declare const getResourceRevisionsControllerResolveExactUrl: () => string;
+/**
+ * @summary Resolve exact resource metadata and current subject access
+ */
+export declare const resourceRevisionsControllerResolveExact: (resolveExactResourceRevisionDto: ResolveExactResourceRevisionDto, options?: RequestInit) => Promise<ExactResourceAuthorityDtoDataEnvelope>;

package/dist/endpoints/resource-revisions/resource-revisions.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceRevisionsControllerResolveExact = exports.getResourceRevisionsControllerResolveExactUrl = exports.resourceRevisionsControllerRegister = exports.getResourceRevisionsControllerRegisterUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getResourceRevisionsControllerRegisterUrl = () => {
+    return `/resource-revisions`;
+};
+exports.getResourceRevisionsControllerRegisterUrl = getResourceRevisionsControllerRegisterUrl;
+/**
+ * @summary Register immutable resource revision metadata
+ */
+const resourceRevisionsControllerRegister = async (registerResourceRevisionDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getResourceRevisionsControllerRegisterUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(registerResourceRevisionDto)
+    });
+};
+exports.resourceRevisionsControllerRegister = resourceRevisionsControllerRegister;
+const getResourceRevisionsControllerResolveExactUrl = () => {
+    return `/resource-revisions/resolve-exact`;
+};
+exports.getResourceRevisionsControllerResolveExactUrl = getResourceRevisionsControllerResolveExactUrl;
+/**
+ * @summary Resolve exact resource metadata and current subject access
+ */
+const resourceRevisionsControllerResolveExact = async (resolveExactResourceRevisionDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getResourceRevisionsControllerResolveExactUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(resolveExactResourceRevisionDto)
+    });
+};
+exports.resourceRevisionsControllerResolveExact = resourceRevisionsControllerResolveExact;

package/dist/index.d.ts

@@ -7,8 +7,11 @@ export * from './endpoints/credential-defaults/credential-defaults';
 export * from './endpoints/describe-objects/describe-objects';
 export * from './endpoints/environments/environments';
 export * from './endpoints/grants/grants';
+export * from './endpoints/org-erasure/org-erasure';
+export * from './endpoints/output-routes/output-routes';
 export * from './endpoints/profiles/profiles';
 export * from './endpoints/relationships/relationships';
+export * from './endpoints/resource-revisions/resource-revisions';
 export * from './endpoints/resources/resources';
 export * from './endpoints/roles/roles';
 export * from './endpoints/teams/teams';

package/dist/index.js

@@ -29,8 +29,11 @@ __exportStar(require("./endpoints/credential-defaults/credential-defaults"), exp
 __exportStar(require("./endpoints/describe-objects/describe-objects"), exports);
 __exportStar(require("./endpoints/environments/environments"), exports);
 __exportStar(require("./endpoints/grants/grants"), exports);
+__exportStar(require("./endpoints/org-erasure/org-erasure"), exports);
+__exportStar(require("./endpoints/output-routes/output-routes"), exports);
 __exportStar(require("./endpoints/profiles/profiles"), exports);
 __exportStar(require("./endpoints/relationships/relationships"), exports);
+__exportStar(require("./endpoints/resource-revisions/resource-revisions"), exports);
 __exportStar(require("./endpoints/resources/resources"), exports);
 __exportStar(require("./endpoints/roles/roles"), exports);
 __exportStar(require("./endpoints/teams/teams"), exports);

package/dist/models/addResourceShareDto.d.ts

@@ -3,7 +3,10 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface AddResourceShareDto {
-    share: ResourceSubjectRefDto;
+    share: ResourceShareRefDto;
+    /** The subject GRANTING this share, when it is not the instance owner. Used to apply the two delegation rules: a grantor may never confer more than they hold, and re-sharing is itself a level. Omitted means the caller asserts owner authority, which this service verifies against the tuple store — it is never taken on the caller's word. */
+    grantor?: ResourceSubjectRefDto;
 }

package/dist/models/addRoleGrantDto.d.ts

@@ -7,7 +7,6 @@ import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface AddRoleGrantDto {
     /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
     capability: string;
-    resourceGlob?: string;
     /** Built-in environment slug. */
     environment: string;
     constraints?: GrantConstraintsDto;

package/dist/models/capabilityEffectClass.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type CapabilityEffectClass = typeof CapabilityEffectClass[keyof typeof CapabilityEffectClass];
+export declare const CapabilityEffectClass: {
+    readonly read: "read";
+    readonly write: "write";
+    readonly admin: "admin";
+};

package/dist/models/capabilityEffectClass.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityEffectClass = void 0;
+exports.CapabilityEffectClass = {
+    read: 'read',
+    write: 'write',
+    admin: 'admin',
+};

package/dist/models/capabilityGrantDto.d.ts

@@ -13,7 +13,6 @@ export interface CapabilityGrantDto {
     subjectKind: SubjectKind;
     subjectRef: string;
     capability: string;
-    resourceGlob: string;
     environment: string;
     constraints?: GrantConstraintsDto | null;
     requiresApproval: boolean;

package/dist/models/capabilityReach.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Canonical capability reach ceiling derived from `kind`.
+ */
+export type CapabilityReach = typeof CapabilityReach[keyof typeof CapabilityReach];
+export declare const CapabilityReach: {
+    readonly owner: "owner";
+    readonly integration: "integration";
+    readonly platform: "platform";
+};

package/dist/models/capabilityReach.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityReach = void 0;
+exports.CapabilityReach = {
+    owner: 'owner',
+    integration: 'integration',
+    platform: 'platform',
+};