@xemahq/authorization-internal-api-client 0.3.4 → 0.4.3

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/endpoints/authorization/authorization.d.ts

@@ -6,14 +6,14 @@
 import type { AuthorizationCheckRequestDto, AuthorizationCheckResponseDtoDataEnvelope, GrantVersionResponseDtoDataEnvelope, PolicyCheckBatchRequestDto, PolicyCheckBatchResponseDtoDataEnvelope, PolicyCheckRequestDto, PolicyDecisionDtoDataEnvelope } from '../../models';
 export declare const getAuthorizationControllerCheckUrl: () => string;
 /**
- * Called by xema-capability-router on every invocation. Phase 3 returns `allowed=true` for any non-revoked grant matching `(subject, capability)`; `environment` is stored but not yet enforced. Phase 4 will enforce environment, resource-glob, rate-limit, and approval.
+ * Called by xema-capability-router on every invocation. The verdict is OpenFGA-authoritative and then narrowed, in order, by the delegation clamp, the agent reach tier, and the ENVIRONMENT reach ceiling (the environment runs last on purpose: it is the outer boundary, so it must see the tier's output — a `connected` tier extends a deny into an allow, and the environment may then take that away). `requiresApproval` denies with APPROVAL_REQUIRED. NOT enforced here: `rateLimit` (accepted on a grant, read by nothing) and `ExecutionEnvironment.allowedCapabilities` (an enumerated per-ref list, deliberately not wired for the built-ins — see `environment-reach-ceiling`; it is enforced only by app-function-broker, for org-custom environments).
  * @summary Runtime allow/deny decision for a (subject, capability) tuple
  */
 export declare const authorizationControllerCheck: (authorizationCheckRequestDto: AuthorizationCheckRequestDto, options?: RequestInit) => Promise<AuthorizationCheckResponseDtoDataEnvelope>;
 export declare const getAuthorizationControllerGrantVersionUrl: (orgId: string) => string;
 /**
  * A cheap read of the per-org grant-version counter — bumped on every grant/environment/membership change. Consumers (e.g. app-platform delegated-session verify) key a short-lived effective-capability cache by it so a revoked role takes effect at the next miss rather than at token expiry. Fail-closed: an unavailable version store surfaces as a 5xx so the caller denies.
- * @summary Current monotonic grant-version for an org (Wave 8.2)
+ * @summary Current durable monotonic grant-version for an org
  */
 export declare const authorizationControllerGrantVersion: (orgId: string, options?: RequestInit) => Promise<GrantVersionResponseDtoDataEnvelope>;
 export declare const getAuthorizationControllerPolicyCheckUrl: () => string;

package/dist/endpoints/authorization/authorization.js

@@ -7,7 +7,7 @@ const getAuthorizationControllerCheckUrl = () => {
 };
 exports.getAuthorizationControllerCheckUrl = getAuthorizationControllerCheckUrl;
 /**
- * Called by xema-capability-router on every invocation. Phase 3 returns `allowed=true` for any non-revoked grant matching `(subject, capability)`; `environment` is stored but not yet enforced. Phase 4 will enforce environment, resource-glob, rate-limit, and approval.
+ * Called by xema-capability-router on every invocation. The verdict is OpenFGA-authoritative and then narrowed, in order, by the delegation clamp, the agent reach tier, and the ENVIRONMENT reach ceiling (the environment runs last on purpose: it is the outer boundary, so it must see the tier's output — a `connected` tier extends a deny into an allow, and the environment may then take that away). `requiresApproval` denies with APPROVAL_REQUIRED. NOT enforced here: `rateLimit` (accepted on a grant, read by nothing) and `ExecutionEnvironment.allowedCapabilities` (an enumerated per-ref list, deliberately not wired for the built-ins — see `environment-reach-ceiling`; it is enforced only by app-function-broker, for org-custom environments).
  * @summary Runtime allow/deny decision for a (subject, capability) tuple
  */
 const authorizationControllerCheck = async (authorizationCheckRequestDto, options) => {
@@ -25,7 +25,7 @@ const getAuthorizationControllerGrantVersionUrl = (orgId) => {
 exports.getAuthorizationControllerGrantVersionUrl = getAuthorizationControllerGrantVersionUrl;
 /**
  * A cheap read of the per-org grant-version counter — bumped on every grant/environment/membership change. Consumers (e.g. app-platform delegated-session verify) key a short-lived effective-capability cache by it so a revoked role takes effect at the next miss rather than at token expiry. Fail-closed: an unavailable version store surfaces as a 5xx so the caller denies.
- * @summary Current monotonic grant-version for an org (Wave 8.2)
+ * @summary Current durable monotonic grant-version for an org
  */
 const authorizationControllerGrantVersion = async (orgId, options) => {
     return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerGrantVersionUrl)(orgId), {

package/dist/endpoints/resources/resources.d.ts

@@ -3,7 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { AddResourceShareDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, RemoveResourceShareDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
+import type { AddResourceShareDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, RemoveResourceShareDto, ReplaceResourceOwnershipDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
 export declare const getResourcesControllerRegisterUrl: () => string;
 /**
  * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
@@ -22,6 +22,12 @@ export declare const getResourcesControllerGetOwnershipUrl: (type: string, id: s
  * @summary Read a resource instance’s current visibility + subjects
  */
 export declare const resourcesControllerGetOwnership: (type: string, id: string, options?: RequestInit) => Promise<ResourceOwnershipReadDtoDataEnvelope>;
+export declare const getResourcesControllerReplaceOwnershipUrl: (type: string, id: string) => string;
+/**
+ * The whole post-state: after this call the instance’s registered subjects are EXACTLY `owners` ∪ `explicitShares`, and a subject named by neither loses its authority row AND its `shared_with` tuple. This is the ONLY surface that can express a revocation as part of a set write — `resource.register` upserts what it is handed and never touches a subject outside that list, so re-registering with a subject removed reports 200 and leaves both its row and its tuple live. Removals delete the tuple BEFORE the row (a crash between them leaves the subject WITHOUT access); additions write the row before the tuple. Serialised per instance by an advisory lock, so two concurrent replaces cannot interleave into a mixed set. Idempotent. Refuses (409 `RESOURCE_SUBJECT_IS_OWNER`) when a currently-registered OWNER is absent from the new `owners` list — dropping or demoting an owner is `resource.deregister`. Org scope is forced from the caller context.
+ * @summary REPLACE a resource instance’s ownership set
+ */
+export declare const resourcesControllerReplaceOwnership: (type: string, id: string, replaceResourceOwnershipDto: ReplaceResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDtoDataEnvelope>;
 export declare const getResourcesControllerDeregisterUrl: (type: string, id: string) => string;
 /**
  * Idempotent — a no-op when the instance was never registered.

package/dist/endpoints/resources/resources.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resourcesControllerRemoveShare = exports.getResourcesControllerRemoveShareUrl = exports.resourcesControllerAddShare = exports.getResourcesControllerAddShareUrl = exports.resourcesControllerDeregister = exports.getResourcesControllerDeregisterUrl = exports.resourcesControllerGetOwnership = exports.getResourcesControllerGetOwnershipUrl = exports.resourcesControllerListVisible = exports.getResourcesControllerListVisibleUrl = exports.resourcesControllerRegister = exports.getResourcesControllerRegisterUrl = void 0;
+exports.resourcesControllerRemoveShare = exports.getResourcesControllerRemoveShareUrl = exports.resourcesControllerAddShare = exports.getResourcesControllerAddShareUrl = exports.resourcesControllerDeregister = exports.getResourcesControllerDeregisterUrl = exports.resourcesControllerReplaceOwnership = exports.getResourcesControllerReplaceOwnershipUrl = exports.resourcesControllerGetOwnership = exports.getResourcesControllerGetOwnershipUrl = exports.resourcesControllerListVisible = exports.getResourcesControllerListVisibleUrl = exports.resourcesControllerRegister = exports.getResourcesControllerRegisterUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getResourcesControllerRegisterUrl = () => {
     return `/resources`;
@@ -51,6 +51,23 @@ const resourcesControllerGetOwnership = async (type, id, options) => {
     });
 };
 exports.resourcesControllerGetOwnership = resourcesControllerGetOwnership;
+const getResourcesControllerReplaceOwnershipUrl = (type, id) => {
+    return `/resources/${type}/${id}`;
+};
+exports.getResourcesControllerReplaceOwnershipUrl = getResourcesControllerReplaceOwnershipUrl;
+/**
+ * The whole post-state: after this call the instance’s registered subjects are EXACTLY `owners` ∪ `explicitShares`, and a subject named by neither loses its authority row AND its `shared_with` tuple. This is the ONLY surface that can express a revocation as part of a set write — `resource.register` upserts what it is handed and never touches a subject outside that list, so re-registering with a subject removed reports 200 and leaves both its row and its tuple live. Removals delete the tuple BEFORE the row (a crash between them leaves the subject WITHOUT access); additions write the row before the tuple. Serialised per instance by an advisory lock, so two concurrent replaces cannot interleave into a mixed set. Idempotent. Refuses (409 `RESOURCE_SUBJECT_IS_OWNER`) when a currently-registered OWNER is absent from the new `owners` list — dropping or demoting an owner is `resource.deregister`. Org scope is forced from the caller context.
+ * @summary REPLACE a resource instance’s ownership set
+ */
+const resourcesControllerReplaceOwnership = async (type, id, replaceResourceOwnershipDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerReplaceOwnershipUrl)(type, id), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(replaceResourceOwnershipDto)
+    });
+};
+exports.resourcesControllerReplaceOwnership = resourcesControllerReplaceOwnership;
 const getResourcesControllerDeregisterUrl = (type, id) => {
     return `/resources/${type}/${id}`;
 };

package/dist/models/addResourceShareDto.d.ts

@@ -3,7 +3,10 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface AddResourceShareDto {
-    share: ResourceSubjectRefDto;
+    share: ResourceShareRefDto;
+    /** The subject GRANTING this share, when it is not the instance owner. Used to apply the two delegation rules: a grantor may never confer more than they hold, and re-sharing is itself a level. Omitted means the caller asserts owner authority, which this service verifies against the tuple store — it is never taken on the caller's word. */
+    grantor?: ResourceSubjectRefDto;
 }

package/dist/models/addRoleGrantDto.d.ts

@@ -7,7 +7,6 @@ import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface AddRoleGrantDto {
     /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
     capability: string;
-    resourceGlob?: string;
     /** Built-in environment slug. */
     environment: string;
     constraints?: GrantConstraintsDto;

package/dist/models/{biomeTrustTier.d.ts → biomeExecutionTrustTier.d.ts}

@@ -3,10 +3,8 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-export type BiomeTrustTier = typeof BiomeTrustTier[keyof typeof BiomeTrustTier];
-export declare const BiomeTrustTier: {
+export type BiomeExecutionTrustTier = typeof BiomeExecutionTrustTier[keyof typeof BiomeExecutionTrustTier];
+export declare const BiomeExecutionTrustTier: {
     readonly official: "official";
     readonly verified: "verified";
-    readonly community: "community";
-    readonly untrusted: "untrusted";
 };

package/dist/models/{biomeTrustTier.js → biomeExecutionTrustTier.js}

@@ -5,10 +5,8 @@
  * OpenAPI spec version: 0.1.1
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BiomeTrustTier = void 0;
-exports.BiomeTrustTier = {
+exports.BiomeExecutionTrustTier = void 0;
+exports.BiomeExecutionTrustTier = {
     official: 'official',
     verified: 'verified',
-    community: 'community',
-    untrusted: 'untrusted',
 };

package/dist/models/capabilityGrantDto.d.ts

@@ -13,7 +13,6 @@ export interface CapabilityGrantDto {
     subjectKind: SubjectKind;
     subjectRef: string;
     capability: string;
-    resourceGlob: string;
     environment: string;
     constraints?: GrantConstraintsDto | null;
     requiresApproval: boolean;

package/dist/models/createExecutionEnvironmentDto.d.ts

@@ -6,6 +6,7 @@
 import type { CreateExecutionEnvironmentDtoAllowedCapabilitiesItem } from './createExecutionEnvironmentDtoAllowedCapabilitiesItem.js';
 import type { CreateExecutionEnvironmentDtoApprovalRulesItem } from './createExecutionEnvironmentDtoApprovalRulesItem.js';
 import type { CreateExecutionEnvironmentDtoRuntimeLimits } from './createExecutionEnvironmentDtoRuntimeLimits.js';
+import type { DataClassification } from './dataClassification.js';
 import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
 export interface CreateExecutionEnvironmentDto {
     /** Owning organization. Scopes the custom environment to the tenant. */
@@ -21,4 +22,6 @@ export interface CreateExecutionEnvironmentDto {
     approvalRules?: CreateExecutionEnvironmentDtoApprovalRulesItem[];
     /** Runtime limits (`RuntimeLimits`). Defaults to `{}`. */
     runtimeLimits?: CreateExecutionEnvironmentDtoRuntimeLimits;
+    /** The environment's DATA ceiling: the most restrictive `DataClassification` an invocation may carry and still run here. The PDP compares it against `join(space floor, resource tag)` and DENIES when it is exceeded. `regulated` (the top of the rank) admits everything and is the default, so the ceiling refuses nothing until it is lowered. Defaults to `regulated`. */
+    maxDataClassification?: DataClassification;
 }

package/dist/models/createGrantDto.d.ts

@@ -13,8 +13,6 @@ export interface CreateGrantDto {
     subjectRef: string;
     /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
     capability: string;
-    /** Resource-scope glob for this grant. STORED ONLY — it is part of the grant uniqueness key and nothing in the decision path reads it, so a value narrower than `**` grants exactly what `**` grants today and must not be relied on to restrict anything. The vocabulary it will be matched against is deliberately NOT specified: instance refs are the canonical `resource:<type>:<id>` (see `PolicyResourceDto.ref`), and whether this glob matches those or a different addressing scheme is the decision of the phase that makes it enforceable. It previously advertised `xema://orgs/acme/projects/support/kb/**` — an XVFS path form the platform rejects wherever it IS parsed, and that stale vocabulary is what led five producers to send refs the PDP refuses. */
-    resourceGlob?: string;
     /** Built-in environment slug. Phase 3 stores but does not enforce. */
     environment: string;
     constraints?: GrantConstraintsDto;

package/dist/models/credentialDefaultDto.d.ts

@@ -12,6 +12,8 @@ export interface CredentialDefaultDto {
        * @nullable
        */
     projectId?: string | null;
+    /** The external provider this default is for. */
+    provider: string;
     /** Opaque credential-binding pointer. Not a secret. */
     credentialBindingId: string;
     createdAt: string;

package/dist/models/credentialDefaultsControllerDeleteParams.d.ts

@@ -12,4 +12,8 @@ export type CredentialDefaultsControllerDeleteParams = {
      * Project identifier. Omit for the ORG-wide default; set for a per-project default.
      */
     projectId?: string;
+    /**
+     * The external provider whose default is being addressed. Required: a default is per (scope, provider), so a scope alone does not name one.
+     */
+    provider: string;
 };

package/dist/models/credentialDefaultsControllerGetParams.d.ts

@@ -12,4 +12,8 @@ export type CredentialDefaultsControllerGetParams = {
      * Project identifier. Omit for the ORG-wide default; set for a per-project default.
      */
     projectId?: string;
+    /**
+     * The external provider whose default is being addressed. Required: a default is per (scope, provider), so a scope alone does not name one.
+     */
+    provider: string;
 };

package/dist/models/credentialPrecedenceSource.d.ts

@@ -10,6 +10,7 @@ export type CredentialPrecedenceSource = typeof CredentialPrecedenceSource[keyof
 export declare const CredentialPrecedenceSource: {
     readonly explicit: "explicit";
     readonly capability_default: "capability_default";
+    readonly user_default: "user_default";
     readonly project_default: "project_default";
     readonly org_default: "org_default";
     readonly platform_default: "platform_default";

package/dist/models/credentialPrecedenceSource.js

@@ -9,6 +9,7 @@ exports.CredentialPrecedenceSource = void 0;
 exports.CredentialPrecedenceSource = {
     explicit: 'explicit',
     capability_default: 'capability_default',
+    user_default: 'user_default',
     project_default: 'project_default',
     org_default: 'org_default',
     platform_default: 'platform_default',

package/dist/models/dataResidency.d.ts

@@ -5,7 +5,5 @@
  */
 export type DataResidency = typeof DataResidency[keyof typeof DataResidency];
 export declare const DataResidency: {
-    readonly eu: "eu";
-    readonly us: "us";
     readonly 'customer-private': "customer-private";
 };

package/dist/models/dataResidency.js

@@ -7,7 +7,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataResidency = void 0;
 exports.DataResidency = {
-    eu: 'eu',
-    us: 'us',
     'customer-private': 'customer-private',
 };

package/dist/models/environmentCeilingSource.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * WHICH row set `maxDataClassification`: the kernel-seeded global row (`platform-built-in`), this org's override of it (`org-override`), or an org-custom environment's own column (`org-custom-environment`). An override that the installation ceiling already swallowed reads as `platform-built-in`, because it is deciding nothing.
+ */
+export type EnvironmentCeilingSource = typeof EnvironmentCeilingSource[keyof typeof EnvironmentCeilingSource];
+export declare const EnvironmentCeilingSource: {
+    readonly 'platform-built-in': "platform-built-in";
+    readonly 'org-override': "org-override";
+    readonly 'org-custom-environment': "org-custom-environment";
+};

package/dist/models/environmentCeilingSource.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvironmentCeilingSource = void 0;
+exports.EnvironmentCeilingSource = {
+    'platform-built-in': 'platform-built-in',
+    'org-override': 'org-override',
+    'org-custom-environment': 'org-custom-environment',
+};

package/dist/models/executionEnvironmentResponseDto.d.ts

@@ -3,6 +3,8 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { DataClassification } from './dataClassification.js';
+import type { EnvironmentCeilingSource } from './environmentCeilingSource.js';
 import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
 import type { ExecutionEnvironmentResponseDtoAllowedCapabilitiesItem } from './executionEnvironmentResponseDtoAllowedCapabilitiesItem.js';
 import type { ExecutionEnvironmentResponseDtoApprovalRulesItem } from './executionEnvironmentResponseDtoApprovalRulesItem.js';
@@ -30,6 +32,12 @@ export interface ExecutionEnvironmentResponseDto {
     approvalRules: ExecutionEnvironmentResponseDtoApprovalRulesItem[];
     /** Runtime limits (`RuntimeLimits` from the kernel contracts). */
     runtimeLimits: ExecutionEnvironmentResponseDtoRuntimeLimits;
+    /** The environment's DATA ceiling: the most restrictive `DataClassification` an invocation may carry and still run here. The PDP compares it against `join(space floor, resource tag)` and DENIES when it is exceeded. `regulated` (the top of the rank) admits everything and is the default, so the ceiling refuses nothing until it is lowered. */
+    maxDataClassification: DataClassification;
+    /** The INSTALLATION-wide ceiling for this environment, before any organisation override. Equal to `maxDataClassification` whenever no override is in force. Present so a screen can say "your org lowered this" rather than showing one number and leaving the reader to guess who set it. */
+    platformMaxDataClassification: DataClassification;
+    /** WHICH row set `maxDataClassification`: the kernel-seeded global row (`platform-built-in`), this org's override of it (`org-override`), or an org-custom environment's own column (`org-custom-environment`). An override that the installation ceiling already swallowed reads as `platform-built-in`, because it is deciding nothing. */
+    dataCeilingSource: EnvironmentCeilingSource;
     createdAt: string;
     updatedAt: string;
 }

package/dist/models/grantVersionResponseDto.d.ts

@@ -6,6 +6,6 @@
 export interface GrantVersionResponseDto {
     /** Organization the version belongs to. */
     orgId: string;
-    /** Monotonic grant version for this org, folding in changes to org-independent (global) grants. `0` means no relevant grant change has been recorded yet (a valid baseline, not an error). Compare only against a previous value for the SAME org. */
+    /** Durable monotonic grant version for this org, folding in changes to org-independent (global) grants. It is an opaque comparison token, not a count: the baseline is a large offset rather than `0`. Compare only against a previous value for the SAME org. */
     grantVersion: number;
 }

package/dist/models/index.d.ts

@@ -12,8 +12,8 @@ export * from './authorizationDecisionCode';
 export * from './authorizationReasonDto';
 export * from './authorizationSuggestionDto';
 export * from './authorizationSuggestionKind';
+export * from './biomeExecutionTrustTier';
 export * from './biomePermissionProfile';
-export * from './biomeTrustTier';
 export * from './callerKind';
 export * from './capabilityGrantDto';
 export * from './capabilityGrantDtoDataEnvelope';
@@ -38,6 +38,7 @@ export * from './dataClassification';
 export * from './dataResidency';
 export * from './describeObjectsResponseDto';
 export * from './describeObjectsResponseDtoDataEnvelope';
+export * from './environmentCeilingSource';
 export * from './environmentsControllerFindBySlugParams';
 export * from './environmentsControllerListParams';
 export * from './environmentsControllerRemoveParams';
@@ -75,6 +76,7 @@ export * from './policyCheckBatchRequestDto';
 export * from './policyCheckBatchResponseDto';
 export * from './policyCheckBatchResponseDtoDataEnvelope';
 export * from './policyCheckRequestDto';
+export * from './policyCheckRequestDtoAperture';
 export * from './policyConstraintsDto';
 export * from './policyDecisionDto';
 export * from './policyDecisionDtoDataEnvelope';
@@ -97,12 +99,14 @@ export * from './provisionedCapabilityDto';
 export * from './registerResourceOwnershipDto';
 export * from './relationshipsControllerListParams';
 export * from './removeResourceShareDto';
+export * from './replaceResourceOwnershipDto';
 export * from './resourceManagedBy';
 export * from './resourceOwnershipDto';
 export * from './resourceOwnershipDtoDataEnvelope';
 export * from './resourceOwnershipEntryDto';
 export * from './resourceOwnershipReadDto';
 export * from './resourceOwnershipReadDtoDataEnvelope';
+export * from './resourceShareRefDto';
 export * from './resourceSubjectRefDto';
 export * from './resourceVisibilityPattern';
 export * from './roleAssignmentDto';

package/dist/models/index.js

@@ -29,8 +29,8 @@ __exportStar(require("./authorizationDecisionCode"), exports);
 __exportStar(require("./authorizationReasonDto"), exports);
 __exportStar(require("./authorizationSuggestionDto"), exports);
 __exportStar(require("./authorizationSuggestionKind"), exports);
+__exportStar(require("./biomeExecutionTrustTier"), exports);
 __exportStar(require("./biomePermissionProfile"), exports);
-__exportStar(require("./biomeTrustTier"), exports);
 __exportStar(require("./callerKind"), exports);
 __exportStar(require("./capabilityGrantDto"), exports);
 __exportStar(require("./capabilityGrantDtoDataEnvelope"), exports);
@@ -55,6 +55,7 @@ __exportStar(require("./dataClassification"), exports);
 __exportStar(require("./dataResidency"), exports);
 __exportStar(require("./describeObjectsResponseDto"), exports);
 __exportStar(require("./describeObjectsResponseDtoDataEnvelope"), exports);
+__exportStar(require("./environmentCeilingSource"), exports);
 __exportStar(require("./environmentsControllerFindBySlugParams"), exports);
 __exportStar(require("./environmentsControllerListParams"), exports);
 __exportStar(require("./environmentsControllerRemoveParams"), exports);
@@ -92,6 +93,7 @@ __exportStar(require("./policyCheckBatchRequestDto"), exports);
 __exportStar(require("./policyCheckBatchResponseDto"), exports);
 __exportStar(require("./policyCheckBatchResponseDtoDataEnvelope"), exports);
 __exportStar(require("./policyCheckRequestDto"), exports);
+__exportStar(require("./policyCheckRequestDtoAperture"), exports);
 __exportStar(require("./policyConstraintsDto"), exports);
 __exportStar(require("./policyDecisionDto"), exports);
 __exportStar(require("./policyDecisionDtoDataEnvelope"), exports);
@@ -114,12 +116,14 @@ __exportStar(require("./provisionedCapabilityDto"), exports);
 __exportStar(require("./registerResourceOwnershipDto"), exports);
 __exportStar(require("./relationshipsControllerListParams"), exports);
 __exportStar(require("./removeResourceShareDto"), exports);
+__exportStar(require("./replaceResourceOwnershipDto"), exports);
 __exportStar(require("./resourceManagedBy"), exports);
 __exportStar(require("./resourceOwnershipDto"), exports);
 __exportStar(require("./resourceOwnershipDtoDataEnvelope"), exports);
 __exportStar(require("./resourceOwnershipEntryDto"), exports);
 __exportStar(require("./resourceOwnershipReadDto"), exports);
 __exportStar(require("./resourceOwnershipReadDtoDataEnvelope"), exports);
+__exportStar(require("./resourceShareRefDto"), exports);
 __exportStar(require("./resourceSubjectRefDto"), exports);
 __exportStar(require("./resourceVisibilityPattern"), exports);
 __exportStar(require("./roleAssignmentDto"), exports);

package/dist/models/policyBiomeDto.d.ts

@@ -3,10 +3,10 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { BiomeTrustTier } from './biomeTrustTier.js';
+import type { BiomeExecutionTrustTier } from './biomeExecutionTrustTier.js';
 export interface PolicyBiomeDto {
     id: string;
     version: string;
-    trustTier: BiomeTrustTier;
+    trustTier: BiomeExecutionTrustTier;
     signatureVerified: boolean;
 }

package/dist/models/policyCheckRequestDto.d.ts

@@ -8,6 +8,7 @@ import type { PolicyActingForDto } from './policyActingForDto.js';
 import type { PolicyBiomeDto } from './policyBiomeDto.js';
 import type { PolicyCallerDto } from './policyCallerDto.js';
 import type { PolicyCapabilityDto } from './policyCapabilityDto.js';
+import type { PolicyCheckRequestDtoAperture } from './policyCheckRequestDtoAperture.js';
 import type { PolicyConstraintsDto } from './policyConstraintsDto.js';
 import type { PolicyEnvironmentDto } from './policyEnvironmentDto.js';
 import type { PolicyResourceDto } from './policyResourceDto.js';
@@ -32,4 +33,6 @@ export interface PolicyCheckRequestDto {
     reachTier?: AgentReachTier;
     /** Role the acting subject holds in the originating agent session. Precedence `owner > editor > viewer`. Absent for non-session invocations (workflow steps, service calls). */
     participantRole?: SessionParticipantRole;
+    /** The acting agent's capability aperture (kernel `CapabilityAperture`): `{ kind: "unrestricted" }` or `{ kind: "armed", refs: string[] }`. Enforced at the capability-router funnel, carried here for the audit trail. */
+    aperture?: PolicyCheckRequestDtoAperture;
 }

package/dist/models/policyCheckRequestDtoAperture.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * The acting agent's capability aperture (kernel `CapabilityAperture`): `{ kind: "unrestricted" }` or `{ kind: "armed", refs: string[] }`. Enforced at the capability-router funnel, carried here for the audit trail.
+ */
+export type PolicyCheckRequestDtoAperture = {
+    [key: string]: unknown;
+};

package/dist/models/policyCheckRequestDtoAperture.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyResourceDto.d.ts

@@ -7,5 +7,6 @@ import type { DataClassification } from './dataClassification.js';
 export interface PolicyResourceDto {
     /** Canonical kernel resource-instance ref `resource:<type>:<id>` naming the instance this invocation targets. Build it with `composeResourceRef(type, id)` from `@xemahq/kernel-contracts/resource`. The server resolves it with `parseResourceRef` and answers `400 RESOURCE_REF_MALFORMED` for any other shape — a bare `<type>:<id>` and an `xema://…` path are BOTH rejected. Omit the whole `resource` block for a verb-only check; do not send a placeholder. */
     ref: string;
-    classification: DataClassification;
+    /** The classification the target resource carries. OMIT IT when the producer has none to declare — the effective classification is then the Space floor alone, and the request still gets the resource-ownership clamp. Omitting the whole `resource` block is NOT the same thing: that downgrades the call to a verb-only check and discards the ownership clamp. Never send a placeholder value. */
+    classification?: DataClassification;
 }

package/dist/models/registerResourceOwnershipDto.d.ts

@@ -3,6 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface RegisterResourceOwnershipDto {
@@ -14,6 +15,6 @@ export interface RegisterResourceOwnershipDto {
     visibility: ResourceVisibilityPattern;
     /** Subjects that OWN the instance (full visibility). */
     owners: ResourceSubjectRefDto[];
-    /** Subjects explicitly granted visibility (shared-with). */
-    explicitShares?: ResourceSubjectRefDto[];
+    /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
+    explicitShares?: ResourceShareRefDto[];
 }

package/dist/models/replaceResourceOwnershipDto.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ResourceShareRefDto } from './resourceShareRefDto.js';
+import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
+export interface ReplaceResourceOwnershipDto {
+    /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
+    visibility: ResourceVisibilityPattern;
+    /** Subjects that OWN the instance (full visibility). */
+    owners: ResourceSubjectRefDto[];
+    /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
+    explicitShares?: ResourceShareRefDto[];
+}

package/dist/models/replaceResourceOwnershipDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/resourceOwnershipEntryDto.d.ts

@@ -8,4 +8,10 @@ export interface ResourceOwnershipEntryDto {
     id: string;
     ownerKind: SubjectKind;
     ownerRef: string;
+    /** The level this share confers, in the resource kind's vocabulary. ABSENT on an owner row — ownership is not a rung. */
+    level?: string;
+    /** When the share stops granting. Absent = never. */
+    expiresAt?: string;
+    /** `<subjectKind>:<subjectRef>` of whoever granted this share. Absent on an owner row. */
+    grantedBy?: string;
 }

package/dist/models/resourceOwnershipReadDto.d.ts

@@ -3,12 +3,14 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+import type { ResourceOwnershipEntryDto } from './resourceOwnershipEntryDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ResourceOwnershipReadDto {
     resourceType: string;
     resourceId: string;
     visibility: ResourceVisibilityPattern;
-    /** All registered subjects (owners + shares combined; the SQL authority does not split the two). */
-    subjects: ResourceSubjectRefDto[];
+    /** Subjects that OWN the instance. */
+    owners: ResourceOwnershipEntryDto[];
+    /** Subjects the instance is SHARED with, each with its level, expiry and grantor. */
+    shares: ResourceOwnershipEntryDto[];
 }

package/dist/models/resourceShareRefDto.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { SubjectKind } from './subjectKind.js';
+export interface ResourceShareRefDto {
+    kind: SubjectKind;
+    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    ref: string;
+    /** The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest. */
+    level?: string;
+    /** ISO-8601 instant after which the share stops granting. Enforced by an OpenFGA condition evaluated at DECISION time, not by a sweeper — a sweeper leaves a window in which a lapsed share still passes. Omitted means the share does not expire. An instant in the past is a 400. */
+    expiresAt?: string;
+}

package/dist/models/resourceShareRefDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/roleGrantDto.d.ts

@@ -8,7 +8,6 @@ export interface RoleGrantDto {
     id: string;
     roleId: string;
     capability: string;
-    resourceGlob: string;
     environment: string;
     constraints?: GrantConstraintsDto | null;
     requiresApproval: boolean;

package/dist/models/updateExecutionEnvironmentDto.d.ts

@@ -3,6 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { DataClassification } from './dataClassification.js';
 import type { UpdateExecutionEnvironmentDtoAllowedCapabilitiesItem } from './updateExecutionEnvironmentDtoAllowedCapabilitiesItem.js';
 import type { UpdateExecutionEnvironmentDtoApprovalRulesItem } from './updateExecutionEnvironmentDtoApprovalRulesItem.js';
 import type { UpdateExecutionEnvironmentDtoRuntimeLimits } from './updateExecutionEnvironmentDtoRuntimeLimits.js';
@@ -14,4 +15,6 @@ export interface UpdateExecutionEnvironmentDto {
     approvalRules?: UpdateExecutionEnvironmentDtoApprovalRulesItem[];
     /** Runtime limits (`RuntimeLimits`). */
     runtimeLimits?: UpdateExecutionEnvironmentDtoRuntimeLimits;
+    /** The environment's DATA ceiling: the most restrictive `DataClassification` an invocation may carry and still run here. The PDP compares it against `join(space floor, resource tag)` and DENIES when it is exceeded. `regulated` (the top of the rank) admits everything and is the default, so the ceiling refuses nothing until it is lowered. Lowering it is what ARMS the control for this environment. */
+    maxDataClassification?: DataClassification;
 }

package/dist/models/updateGrantDto.d.ts

@@ -6,7 +6,6 @@
 import type { BiomePermissionProfile } from './biomePermissionProfile.js';
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface UpdateGrantDto {
-    resourceGlob?: string;
     environment?: string;
     constraints?: GrantConstraintsDto;
     requiresApproval?: boolean;

package/dist/models/upsertCredentialDefaultDto.d.ts

@@ -8,6 +8,8 @@ export interface UpsertCredentialDefaultDto {
     orgId: string;
     /** Project identifier. Omit (or null) for the ORG-wide default; set for a per-project default. */
     projectId?: string;
+    /** The EXTERNAL PROVIDER this default is for — `github`, `slack`, an MCP server's provider slug. A default is per (scope, provider): without it an organisation would have one default binding for every provider at once. Must be a value a capability ref can derive (lowercase kebab), because the ladder looks it up by exactly that derivation. */
+    provider: string;
     /** Opaque credential-binding pointer the gateway resolves the external credential from. Not a secret. */
     credentialBindingId: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.3.4",
+  "version": "0.4.3",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "authorization-api",
     "biome": "authorization",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.12.1",
+    "generator": "@xemahq/api-client-generator@0.14.1",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",