@xemahq/authorization-internal-api-client 0.3.10 → 0.4.12

package/dist/models/requestOutputRouteRetirementDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/requestOutputRouteRevisionReleaseDto.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CapabilityEffectClass } from './capabilityEffectClass.js';
+import type { DataClassification } from './dataClassification.js';
+import type { OutputRouteDestinationKind } from './outputRouteDestinationKind.js';
+import type { RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema } from './requestOutputRouteRevisionReleaseDtoAllowedOutputSchema.js';
+export interface RequestOutputRouteRevisionReleaseDto {
+    /** Canonical versioned OutputRoute identity. */
+    ref: string;
+    ownerSpaceKey: string;
+    destinationKind: OutputRouteDestinationKind;
+    /** Secret-free destination identity. Credentials are resolved only by the destination service. */
+    destinationRef: string;
+    classification: DataClassification;
+    /** JSON Schema for the only output shape this route accepts. */
+    allowedOutputSchema: RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema;
+    sideEffectClass: CapabilityEffectClass;
+    decisionCapabilityRef: string;
+    /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
+    channel: string;
+    /**
+       * @minimum 0
+       * @maximum 2147483647
+       */
+    expectedChannelVersion: number;
+    /** @maxLength 2048 */
+    reason: string;
+}

package/dist/models/requestOutputRouteRevisionReleaseDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/requestOutputRouteRevisionReleaseDtoAllowedOutputSchema.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * JSON Schema for the only output shape this route accepts.
+ */
+export type RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema = {
+    [key: string]: unknown;
+};

package/dist/models/requestOutputRouteRevisionReleaseDtoAllowedOutputSchema.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/requestOutputRouteRollbackDto.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface RequestOutputRouteRollbackDto {
+    /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
+    channel: string;
+    /**
+       * @minimum 0
+       * @maximum 2147483647
+       */
+    expectedChannelVersion: number;
+    /** @maxLength 2048 */
+    reason: string;
+    priorReleaseSetId: string;
+}

package/dist/models/requestOutputRouteRollbackDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/resolveExactOutputRouteDto.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+export interface ResolveExactOutputRouteDto {
+    ref: string;
+    subject: ResourceSubjectRefDto;
+}

package/dist/models/resolveExactOutputRouteDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/resolveExactResourceRevisionDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ExactResourceBindingDto } from './exactResourceBindingDto.js';
+import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+export interface ResolveExactResourceRevisionDto {
+    binding: ExactResourceBindingDto;
+    subject: ResourceSubjectRefDto;
+}

package/dist/models/resolveExactResourceRevisionDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/resolveOutputRouteChannelDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+export interface ResolveOutputRouteChannelDto {
+    routeId: string;
+    /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
+    channel: string;
+    subject: ResourceSubjectRefDto;
+}

package/dist/models/resolveOutputRouteChannelDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/resourceOwnershipEntryDto.d.ts

@@ -8,4 +8,10 @@ export interface ResourceOwnershipEntryDto {
     id: string;
     ownerKind: SubjectKind;
     ownerRef: string;
+    /** The level this share confers, in the resource kind's vocabulary. ABSENT on an owner row — ownership is not a rung. */
+    level?: string;
+    /** When the share stops granting. Absent = never. */
+    expiresAt?: string;
+    /** `<subjectKind>:<subjectRef>` of whoever granted this share. Absent on an owner row. */
+    grantedBy?: string;
 }

package/dist/models/resourceOwnershipReadDto.d.ts

@@ -3,12 +3,14 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+import type { ResourceOwnershipEntryDto } from './resourceOwnershipEntryDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ResourceOwnershipReadDto {
     resourceType: string;
     resourceId: string;
     visibility: ResourceVisibilityPattern;
-    /** All registered subjects (owners + shares combined; the SQL authority does not split the two). */
-    subjects: ResourceSubjectRefDto[];
+    /** Subjects that OWN the instance. */
+    owners: ResourceOwnershipEntryDto[];
+    /** Subjects the instance is SHARED with, each with its level, expiry and grantor. */
+    shares: ResourceOwnershipEntryDto[];
 }

package/dist/models/resourceShareRefDto.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { SubjectKind } from './subjectKind.js';
+export interface ResourceShareRefDto {
+    kind: SubjectKind;
+    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    ref: string;
+    /** The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest. */
+    level?: string;
+    /** ISO-8601 instant after which the share stops granting. Enforced by an OpenFGA condition evaluated at DECISION time, not by a sweeper — a sweeper leaves a window in which a lapsed share still passes. Omitted means the share does not expire. An instant in the past is a 400. */
+    expiresAt?: string;
+}

package/dist/models/resourceShareRefDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/resourceSubjectAccessResult.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type ResourceSubjectAccessResult = typeof ResourceSubjectAccessResult[keyof typeof ResourceSubjectAccessResult];
+export declare const ResourceSubjectAccessResult: {
+    readonly allowed: "allowed";
+    readonly denied: "denied";
+};

package/dist/models/resourceSubjectAccessResult.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceSubjectAccessResult = void 0;
+exports.ResourceSubjectAccessResult = {
+    allowed: 'allowed',
+    denied: 'denied',
+};

package/dist/models/roleGrantDto.d.ts

@@ -8,7 +8,6 @@ export interface RoleGrantDto {
     id: string;
     roleId: string;
     capability: string;
-    resourceGlob: string;
     environment: string;
     constraints?: GrantConstraintsDto | null;
     requiresApproval: boolean;

package/dist/models/rollbackExecutionEnvironmentDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface RollbackExecutionEnvironmentDto {
+    /** Immutable prior generic ReleaseSet identifier. */
+    priorReleaseSetId: string;
+    /** True selects this tenant's built-in override channel; false selects the identity default/stable channel. */
+    tenantOverride: boolean;
+}

package/dist/models/rollbackExecutionEnvironmentDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/updateGrantDto.d.ts

@@ -6,7 +6,6 @@
 import type { BiomePermissionProfile } from './biomePermissionProfile.js';
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface UpdateGrantDto {
-    resourceGlob?: string;
     environment?: string;
     constraints?: GrantConstraintsDto;
     requiresApproval?: boolean;

package/dist/models/upsertCredentialDefaultDto.d.ts

@@ -8,6 +8,8 @@ export interface UpsertCredentialDefaultDto {
     orgId: string;
     /** Project identifier. Omit (or null) for the ORG-wide default; set for a per-project default. */
     projectId?: string;
+    /** The EXTERNAL PROVIDER this default is for — `github`, `slack`, an MCP server's provider slug. A default is per (scope, provider): without it an organisation would have one default binding for every provider at once. Must be a value a capability ref can derive (lowercase kebab), because the ladder looks it up by exactly that derivation. */
+    provider: string;
     /** Opaque credential-binding pointer the gateway resolves the external credential from. Not a secret. */
     credentialBindingId: string;
 }

package/dist/models/xemaObjectKind.d.ts

@@ -27,10 +27,10 @@ export declare const XemaObjectKind: {
     readonly 'mount-source': "mount-source";
     readonly 'artifact-type': "artifact-type";
     readonly artifact: "artifact";
+    readonly 'output-route': "output-route";
+    readonly resource: "resource";
     readonly 'knowledge-space': "knowledge-space";
     readonly 'knowledge-page': "knowledge-page";
-    readonly 'document-template': "document-template";
-    readonly 'document-theme': "document-theme";
     readonly 'chart-runtime': "chart-runtime";
     readonly 'presentation-runtime': "presentation-runtime";
     readonly 'widget-kind': "widget-kind";

package/dist/models/xemaObjectKind.js

@@ -26,10 +26,10 @@ exports.XemaObjectKind = {
     'mount-source': 'mount-source',
     'artifact-type': 'artifact-type',
     artifact: 'artifact',
+    'output-route': 'output-route',
+    resource: 'resource',
     'knowledge-space': 'knowledge-space',
     'knowledge-page': 'knowledge-page',
-    'document-template': 'document-template',
-    'document-theme': 'document-theme',
     'chart-runtime': 'chart-runtime',
     'presentation-runtime': 'presentation-runtime',
     'widget-kind': 'widget-kind',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.3.10",
+  "version": "0.4.12",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "authorization-api",
     "biome": "authorization",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.13.0",
+    "generator": "@xemahq/api-client-generator@0.14.1",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",