@xemahq/authorization-internal-api-client 0.4.14 → 0.4.15

package/dist/endpoints/resources/resources.d.ts

@@ -3,7 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { AddResourceShareDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, RemoveResourceShareDto, ReplaceResourceOwnershipDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
+import type { AddResourceShareDto, ListRegisteredResourcesDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, RegisteredResourcesDtoDataEnvelope, RemoveResourceShareDto, ReplaceResourceOwnershipDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
 export declare const getResourcesControllerRegisterUrl: () => string;
 /**
  * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
@@ -16,6 +16,16 @@ export declare const getResourcesControllerListVisibleUrl: () => string;
  * @summary List the instances of a resource type a subject may see
  */
 export declare const resourcesControllerListVisible: (listVisibleResourcesDto: ListVisibleResourcesDto, options?: RequestInit) => Promise<VisibleResourcesDtoDataEnvelope>;
+export declare const getResourcesControllerListRegisteredUrl: () => string;
+/**
+ * Every registered instance of `resourceType` in the caller org, with the subjects that OWN it. Org scope is forced from the caller context.
+ *
+ * This is NOT `resource.listVisible` with a privileged subject, and the difference is the reason it exists. `listVisible` answers "what may THIS SUBJECT see"; a service needing "what has this org registered" used to ask it about a subject it had made the owner of everything — which works only for as long as that fixed owner exists, and turns any later ownership change into a silent, total loss of the enumeration. A convergence pass built on the substitute does not just stop registering: it reads every live instance as registered-but-not-live and DEREGISTERS it.
+ *
+ * A POST rather than a GET because `resource.getOwnership` is mounted at `GET /resources/:type/:id`, which would shadow any `GET /resources/registered/...` shape; the body carries the one input.
+ * @summary List the instances of a resource type this ORG has registered
+ */
+export declare const resourcesControllerListRegistered: (listRegisteredResourcesDto: ListRegisteredResourcesDto, options?: RequestInit) => Promise<RegisteredResourcesDtoDataEnvelope>;
 export declare const getResourcesControllerGetOwnershipUrl: (type: string, id: string) => string;
 /**
  * Returns the instance visibility and the combined set of registered subjects (owners + shares; the SQL authority does not split them). 404 when the instance was never registered.

package/dist/endpoints/resources/resources.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resourcesControllerRemoveShare = exports.getResourcesControllerRemoveShareUrl = exports.resourcesControllerAddShare = exports.getResourcesControllerAddShareUrl = exports.resourcesControllerDeregister = exports.getResourcesControllerDeregisterUrl = exports.resourcesControllerReplaceOwnership = exports.getResourcesControllerReplaceOwnershipUrl = exports.resourcesControllerGetOwnership = exports.getResourcesControllerGetOwnershipUrl = exports.resourcesControllerListVisible = exports.getResourcesControllerListVisibleUrl = exports.resourcesControllerRegister = exports.getResourcesControllerRegisterUrl = void 0;
+exports.resourcesControllerRemoveShare = exports.getResourcesControllerRemoveShareUrl = exports.resourcesControllerAddShare = exports.getResourcesControllerAddShareUrl = exports.resourcesControllerDeregister = exports.getResourcesControllerDeregisterUrl = exports.resourcesControllerReplaceOwnership = exports.getResourcesControllerReplaceOwnershipUrl = exports.resourcesControllerGetOwnership = exports.getResourcesControllerGetOwnershipUrl = exports.resourcesControllerListRegistered = exports.getResourcesControllerListRegisteredUrl = exports.resourcesControllerListVisible = exports.getResourcesControllerListVisibleUrl = exports.resourcesControllerRegister = exports.getResourcesControllerRegisterUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getResourcesControllerRegisterUrl = () => {
     return `/resources`;
@@ -36,6 +36,27 @@ const resourcesControllerListVisible = async (listVisibleResourcesDto, options)
     });
 };
 exports.resourcesControllerListVisible = resourcesControllerListVisible;
+const getResourcesControllerListRegisteredUrl = () => {
+    return `/resources/registered`;
+};
+exports.getResourcesControllerListRegisteredUrl = getResourcesControllerListRegisteredUrl;
+/**
+ * Every registered instance of `resourceType` in the caller org, with the subjects that OWN it. Org scope is forced from the caller context.
+ *
+ * This is NOT `resource.listVisible` with a privileged subject, and the difference is the reason it exists. `listVisible` answers "what may THIS SUBJECT see"; a service needing "what has this org registered" used to ask it about a subject it had made the owner of everything — which works only for as long as that fixed owner exists, and turns any later ownership change into a silent, total loss of the enumeration. A convergence pass built on the substitute does not just stop registering: it reads every live instance as registered-but-not-live and DEREGISTERS it.
+ *
+ * A POST rather than a GET because `resource.getOwnership` is mounted at `GET /resources/:type/:id`, which would shadow any `GET /resources/registered/...` shape; the body carries the one input.
+ * @summary List the instances of a resource type this ORG has registered
+ */
+const resourcesControllerListRegistered = async (listRegisteredResourcesDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerListRegisteredUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(listRegisteredResourcesDto)
+    });
+};
+exports.resourcesControllerListRegistered = resourcesControllerListRegistered;
 const getResourcesControllerGetOwnershipUrl = (type, id) => {
     return `/resources/${type}/${id}`;
 };

package/dist/models/index.d.ts

@@ -78,6 +78,7 @@ export * from './grantVersionResponseDtoDataEnvelope';
 export * from './grantsControllerListParams';
 export * from './impactedOutputRouteConsumerDto';
 export * from './impactedOutputRouteConsumerDtoDataArrayEnvelope';
+export * from './listRegisteredResourcesDto';
 export * from './listVisibleResourcesDto';
 export * from './object';
 export * from './objectLifecycle';
@@ -134,8 +135,11 @@ export * from './provisionAgentResultDtoDataEnvelope';
 export * from './provisionedCapabilityDto';
 export * from './registerResourceOwnershipDto';
 export * from './registerResourceRevisionDto';
+export * from './registeredResourceDto';
 export * from './registeredResourceRevisionDto';
 export * from './registeredResourceRevisionDtoDataEnvelope';
+export * from './registeredResourcesDto';
+export * from './registeredResourcesDtoDataEnvelope';
 export * from './relationshipsControllerListParams';
 export * from './removeResourceShareDto';
 export * from './replaceResourceOwnershipDto';

package/dist/models/index.js

@@ -95,6 +95,7 @@ __exportStar(require("./grantVersionResponseDtoDataEnvelope"), exports);
 __exportStar(require("./grantsControllerListParams"), exports);
 __exportStar(require("./impactedOutputRouteConsumerDto"), exports);
 __exportStar(require("./impactedOutputRouteConsumerDtoDataArrayEnvelope"), exports);
+__exportStar(require("./listRegisteredResourcesDto"), exports);
 __exportStar(require("./listVisibleResourcesDto"), exports);
 __exportStar(require("./object"), exports);
 __exportStar(require("./objectLifecycle"), exports);
@@ -151,8 +152,11 @@ __exportStar(require("./provisionAgentResultDtoDataEnvelope"), exports);
 __exportStar(require("./provisionedCapabilityDto"), exports);
 __exportStar(require("./registerResourceOwnershipDto"), exports);
 __exportStar(require("./registerResourceRevisionDto"), exports);
+__exportStar(require("./registeredResourceDto"), exports);
 __exportStar(require("./registeredResourceRevisionDto"), exports);
 __exportStar(require("./registeredResourceRevisionDtoDataEnvelope"), exports);
+__exportStar(require("./registeredResourcesDto"), exports);
+__exportStar(require("./registeredResourcesDtoDataEnvelope"), exports);
 __exportStar(require("./relationshipsControllerListParams"), exports);
 __exportStar(require("./removeResourceShareDto"), exports);
 __exportStar(require("./replaceResourceOwnershipDto"), exports);

package/dist/models/listRegisteredResourcesDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface ListRegisteredResourcesDto {
+    /** Resource kind/type slug. */
+    resourceType: string;
+}

package/dist/models/listRegisteredResourcesDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/registerResourceOwnershipDto.d.ts

@@ -13,8 +13,10 @@ export interface RegisterResourceOwnershipDto {
     resourceId: string;
     /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
     visibility: ResourceVisibilityPattern;
-    /** Subjects that OWN the instance (full visibility). */
-    owners: ResourceSubjectRefDto[];
+    /** The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner. */
+    ownerSpaceUri?: string;
+    /** Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces. */
+    owners?: ResourceSubjectRefDto[];
     /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
     explicitShares?: ResourceShareRefDto[];
 }

package/dist/models/registeredResourceDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
+export interface RegisteredResourceDto {
+    /** The registered instance id. */
+    resourceId: string;
+    /** Subjects holding an `owned_by` relation on the instance. Never empty: the write path refuses a registration with no owner. */
+    owners: ResourceSubjectRefDto[];
+}

package/dist/models/registeredResourceDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/registeredResourcesDto.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RegisteredResourceDto } from './registeredResourceDto.js';
+export interface RegisteredResourcesDto {
+    /** Every registered instance of the requested kind in the caller org, ordered by instance id. */
+    resources: RegisteredResourceDto[];
+}

package/dist/models/registeredResourcesDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/registeredResourcesDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RegisteredResourcesDto } from './registeredResourcesDto.js';
+export interface RegisteredResourcesDtoDataEnvelope {
+    data: RegisteredResourcesDto;
+}

package/dist/models/registeredResourcesDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/replaceResourceOwnershipDto.d.ts

@@ -9,8 +9,18 @@ import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ReplaceResourceOwnershipDto {
     /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
     visibility: ResourceVisibilityPattern;
-    /** Subjects that OWN the instance (full visibility). */
-    owners: ResourceSubjectRefDto[];
+    /** The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner. */
+    ownerSpaceUri?: string;
+    /** Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces. */
+    owners?: ResourceSubjectRefDto[];
     /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
     explicitShares?: ResourceShareRefDto[];
+    /**
+       * Owners the caller is deliberately RETIRING. Named, never inferred.
+       *
+       * A replace normally REFUSES (409 `RESOURCE_SUBJECT_IS_OWNER`) to drop a registered owner, and that refusal is right: an owner silently absent from a replacement set is a caller bug, and the remedy is deregistering the instance. But deregister-then-register is not available for an ownership MIGRATION — the instance is UNREGISTERED in the window between them, and an unregistered instance resolves at the PDP as a verb-only ALLOW for everybody.
+       *
+       * So the exemption is per-SUBJECT and explicit: an owner named here is exempt from that probe and has its `owned_by` tuple dropped in the same call that writes the new owners. Naming a subject that is not a registered owner is a no-op, not an error — the migration is then idempotent on replay. A subject named in BOTH `retiringOwners` and `owners` is refused: that is two contradictory instructions about one subject, and either reading is a guess.
+       */
+    retiringOwners?: ResourceSubjectRefDto[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.4.14",
+  "version": "0.4.15",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "authorization-api",
     "biome": "authorization",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.15.0",
+    "generator": "@xemahq/api-client-generator@0.15.2",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",