@xemahq/authorization-internal-api-client 0.3.10 → 0.4.3

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/models/addResourceShareDto.d.ts

@@ -3,7 +3,10 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface AddResourceShareDto {
-    share: ResourceSubjectRefDto;
+    share: ResourceShareRefDto;
+    /** The subject GRANTING this share, when it is not the instance owner. Used to apply the two delegation rules: a grantor may never confer more than they hold, and re-sharing is itself a level. Omitted means the caller asserts owner authority, which this service verifies against the tuple store — it is never taken on the caller's word. */
+    grantor?: ResourceSubjectRefDto;
 }

package/dist/models/addRoleGrantDto.d.ts

@@ -7,7 +7,6 @@ import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface AddRoleGrantDto {
     /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
     capability: string;
-    resourceGlob?: string;
     /** Built-in environment slug. */
     environment: string;
     constraints?: GrantConstraintsDto;

package/dist/models/capabilityGrantDto.d.ts

@@ -13,7 +13,6 @@ export interface CapabilityGrantDto {
     subjectKind: SubjectKind;
     subjectRef: string;
     capability: string;
-    resourceGlob: string;
     environment: string;
     constraints?: GrantConstraintsDto | null;
     requiresApproval: boolean;

package/dist/models/createGrantDto.d.ts

@@ -13,8 +13,6 @@ export interface CreateGrantDto {
     subjectRef: string;
     /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
     capability: string;
-    /** Resource-scope glob for this grant. STORED ONLY — it is part of the grant uniqueness key and nothing in the decision path reads it, so a value narrower than `**` grants exactly what `**` grants today and must not be relied on to restrict anything. The vocabulary it will be matched against is deliberately NOT specified: instance refs are the canonical `resource:<type>:<id>` (see `PolicyResourceDto.ref`), and whether this glob matches those or a different addressing scheme is the decision of the phase that makes it enforceable. It previously advertised `xema://orgs/acme/projects/support/kb/**` — an XVFS path form the platform rejects wherever it IS parsed, and that stale vocabulary is what led five producers to send refs the PDP refuses. */
-    resourceGlob?: string;
     /** Built-in environment slug. Phase 3 stores but does not enforce. */
     environment: string;
     constraints?: GrantConstraintsDto;

package/dist/models/credentialDefaultDto.d.ts

@@ -12,6 +12,8 @@ export interface CredentialDefaultDto {
        * @nullable
        */
     projectId?: string | null;
+    /** The external provider this default is for. */
+    provider: string;
     /** Opaque credential-binding pointer. Not a secret. */
     credentialBindingId: string;
     createdAt: string;

package/dist/models/credentialDefaultsControllerDeleteParams.d.ts

@@ -12,4 +12,8 @@ export type CredentialDefaultsControllerDeleteParams = {
      * Project identifier. Omit for the ORG-wide default; set for a per-project default.
      */
     projectId?: string;
+    /**
+     * The external provider whose default is being addressed. Required: a default is per (scope, provider), so a scope alone does not name one.
+     */
+    provider: string;
 };

package/dist/models/credentialDefaultsControllerGetParams.d.ts

@@ -12,4 +12,8 @@ export type CredentialDefaultsControllerGetParams = {
      * Project identifier. Omit for the ORG-wide default; set for a per-project default.
      */
     projectId?: string;
+    /**
+     * The external provider whose default is being addressed. Required: a default is per (scope, provider), so a scope alone does not name one.
+     */
+    provider: string;
 };

package/dist/models/dataResidency.d.ts

@@ -5,7 +5,5 @@
  */
 export type DataResidency = typeof DataResidency[keyof typeof DataResidency];
 export declare const DataResidency: {
-    readonly eu: "eu";
-    readonly us: "us";
     readonly 'customer-private': "customer-private";
 };

package/dist/models/dataResidency.js

@@ -7,7 +7,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataResidency = void 0;
 exports.DataResidency = {
-    eu: 'eu',
-    us: 'us',
     'customer-private': 'customer-private',
 };

package/dist/models/index.d.ts

@@ -106,6 +106,7 @@ export * from './resourceOwnershipDtoDataEnvelope';
 export * from './resourceOwnershipEntryDto';
 export * from './resourceOwnershipReadDto';
 export * from './resourceOwnershipReadDtoDataEnvelope';
+export * from './resourceShareRefDto';
 export * from './resourceSubjectRefDto';
 export * from './resourceVisibilityPattern';
 export * from './roleAssignmentDto';

package/dist/models/index.js

@@ -123,6 +123,7 @@ __exportStar(require("./resourceOwnershipDtoDataEnvelope"), exports);
 __exportStar(require("./resourceOwnershipEntryDto"), exports);
 __exportStar(require("./resourceOwnershipReadDto"), exports);
 __exportStar(require("./resourceOwnershipReadDtoDataEnvelope"), exports);
+__exportStar(require("./resourceShareRefDto"), exports);
 __exportStar(require("./resourceSubjectRefDto"), exports);
 __exportStar(require("./resourceVisibilityPattern"), exports);
 __exportStar(require("./roleAssignmentDto"), exports);

package/dist/models/registerResourceOwnershipDto.d.ts

@@ -3,6 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface RegisterResourceOwnershipDto {
@@ -14,6 +15,6 @@ export interface RegisterResourceOwnershipDto {
     visibility: ResourceVisibilityPattern;
     /** Subjects that OWN the instance (full visibility). */
     owners: ResourceSubjectRefDto[];
-    /** Subjects explicitly granted visibility (shared-with). */
-    explicitShares?: ResourceSubjectRefDto[];
+    /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
+    explicitShares?: ResourceShareRefDto[];
 }

package/dist/models/replaceResourceOwnershipDto.d.ts

@@ -3,6 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ReplaceResourceOwnershipDto {
@@ -10,6 +11,6 @@ export interface ReplaceResourceOwnershipDto {
     visibility: ResourceVisibilityPattern;
     /** Subjects that OWN the instance (full visibility). */
     owners: ResourceSubjectRefDto[];
-    /** Subjects explicitly granted visibility (shared-with). */
-    explicitShares?: ResourceSubjectRefDto[];
+    /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
+    explicitShares?: ResourceShareRefDto[];
 }

package/dist/models/resourceOwnershipEntryDto.d.ts

@@ -8,4 +8,10 @@ export interface ResourceOwnershipEntryDto {
     id: string;
     ownerKind: SubjectKind;
     ownerRef: string;
+    /** The level this share confers, in the resource kind's vocabulary. ABSENT on an owner row — ownership is not a rung. */
+    level?: string;
+    /** When the share stops granting. Absent = never. */
+    expiresAt?: string;
+    /** `<subjectKind>:<subjectRef>` of whoever granted this share. Absent on an owner row. */
+    grantedBy?: string;
 }

package/dist/models/resourceOwnershipReadDto.d.ts

@@ -3,12 +3,14 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+import type { ResourceOwnershipEntryDto } from './resourceOwnershipEntryDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ResourceOwnershipReadDto {
     resourceType: string;
     resourceId: string;
     visibility: ResourceVisibilityPattern;
-    /** All registered subjects (owners + shares combined; the SQL authority does not split the two). */
-    subjects: ResourceSubjectRefDto[];
+    /** Subjects that OWN the instance. */
+    owners: ResourceOwnershipEntryDto[];
+    /** Subjects the instance is SHARED with, each with its level, expiry and grantor. */
+    shares: ResourceOwnershipEntryDto[];
 }

package/dist/models/resourceShareRefDto.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { SubjectKind } from './subjectKind.js';
+export interface ResourceShareRefDto {
+    kind: SubjectKind;
+    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    ref: string;
+    /** The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest. */
+    level?: string;
+    /** ISO-8601 instant after which the share stops granting. Enforced by an OpenFGA condition evaluated at DECISION time, not by a sweeper — a sweeper leaves a window in which a lapsed share still passes. Omitted means the share does not expire. An instant in the past is a 400. */
+    expiresAt?: string;
+}

package/dist/models/resourceShareRefDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/roleGrantDto.d.ts

@@ -8,7 +8,6 @@ export interface RoleGrantDto {
     id: string;
     roleId: string;
     capability: string;
-    resourceGlob: string;
     environment: string;
     constraints?: GrantConstraintsDto | null;
     requiresApproval: boolean;

package/dist/models/updateGrantDto.d.ts

@@ -6,7 +6,6 @@
 import type { BiomePermissionProfile } from './biomePermissionProfile.js';
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface UpdateGrantDto {
-    resourceGlob?: string;
     environment?: string;
     constraints?: GrantConstraintsDto;
     requiresApproval?: boolean;

package/dist/models/upsertCredentialDefaultDto.d.ts

@@ -8,6 +8,8 @@ export interface UpsertCredentialDefaultDto {
     orgId: string;
     /** Project identifier. Omit (or null) for the ORG-wide default; set for a per-project default. */
     projectId?: string;
+    /** The EXTERNAL PROVIDER this default is for — `github`, `slack`, an MCP server's provider slug. A default is per (scope, provider): without it an organisation would have one default binding for every provider at once. Must be a value a capability ref can derive (lowercase kebab), because the ladder looks it up by exactly that derivation. */
+    provider: string;
     /** Opaque credential-binding pointer the gateway resolves the external credential from. Not a secret. */
     credentialBindingId: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.3.10",
+  "version": "0.4.3",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "authorization-api",
     "biome": "authorization",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.13.0",
+    "generator": "@xemahq/api-client-generator@0.14.1",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",