@xemahq/authorization-internal-api-client 0.4.20 → 0.4.26

package/dist/models/policyObligationDto.d.ts

@@ -10,13 +10,20 @@ import type { RunnerKind } from './runnerKind.js';
 export interface PolicyObligationDto {
     kind: PolicyObligationKind;
     runnerKind?: RunnerKind;
+    /** @minLength 1 */
     approverRole?: string;
     maxDurationSeconds?: number;
     maxCostUsd?: number;
     maxClassification?: DataClassification;
     residency?: DataResidency;
-    /** Egress allowlist patterns (wildcard host or https:// URL-prefix). Present only when kind=egress-allowlist. */
+    /**
+       * Egress allowlist patterns (wildcard host or https:// URL-prefix). Present only when kind=egress-allowlist.
+       * @items.minLength 1
+       */
     allow?: string[];
-    /** Egress blocklist patterns; a match denies even if `allow` matched. Present only when kind=egress-allowlist. */
+    /**
+       * Egress blocklist patterns; a match denies even if `allow` matched. Present only when kind=egress-allowlist.
+       * @items.minLength 1
+       */
     deny?: string[];
 }

package/dist/models/policyResourceDto.d.ts

@@ -5,7 +5,10 @@
  */
 import type { DataClassification } from './dataClassification.js';
 export interface PolicyResourceDto {
-    /** Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance this invocation targets. Exact Agent bindings always carry the version. The server answers `400 RESOURCE_REF_MALFORMED` for any other shape. Omit the whole `resource` block for a verb-only check; do not send a placeholder. */
+    /**
+       * Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance this invocation targets. Exact Agent bindings always carry the version. The server answers `400 RESOURCE_REF_MALFORMED` for any other shape. Omit the whole `resource` block for a verb-only check; do not send a placeholder.
+       * @minLength 1
+       */
     ref: string;
     /** The classification the target resource carries. OMIT IT when the producer has none to declare — the effective classification is then the Space floor alone, and the request still gets the resource-ownership clamp. Omitting the whole `resource` block is NOT the same thing: that downgrades the call to a verb-only check and discards the ownership clamp. Never send a placeholder value. */
     classification?: DataClassification;

package/dist/models/policyRouteHintDto.d.ts

@@ -8,6 +8,7 @@ import type { RunnerKind } from './runnerKind.js';
 export interface PolicyRouteHintDto {
     requiredRunnerLabels?: PolicyRouteHintDtoRequiredRunnerLabels;
     preferredRunnerKind?: RunnerKind;
+    /** @minLength 1 */
     requiredRegion?: string;
     requireCustomerEdge?: boolean;
 }

package/dist/models/policySpaceRefDto.d.ts

@@ -6,11 +6,18 @@
 import type { SpaceKind } from './spaceKind.js';
 export interface PolicySpaceRefDto {
     tier: SpaceKind;
+    /** @minLength 1 */
     orgId?: string;
+    /** @minLength 1 */
     projectId?: string;
+    /** @minLength 1 */
     appId?: string;
+    /** @minLength 1 */
     sessionId?: string;
+    /** @minLength 1 */
     biomeId?: string;
+    /** @minLength 1 */
     userId?: string;
+    /** @minLength 1 */
     path?: string;
 }

package/dist/models/policySubjectRefDto.d.ts

@@ -7,6 +7,7 @@ import type { PolicyActingForDto } from './policyActingForDto.js';
 import type { SubjectKind } from './subjectKind.js';
 export interface PolicySubjectRefDto {
     kind: SubjectKind;
+    /** @minLength 1 */
     id: string;
     roles?: string[];
     actingFor?: PolicyActingForDto;

package/dist/models/previewOutputRouteImpactDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface PreviewOutputRouteImpactDto {
+    /** @minLength 1 */
     ref: string;
     /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
     channel: string;

package/dist/models/problemDetailsDto.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ProblemFieldIssueDto } from './problemFieldIssueDto.js';
+export interface ProblemDetailsDto {
+    /** Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`. */
+    type: string;
+    /** Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`. */
+    title: string;
+    /** The HTTP status code, repeated in the body so a logged document is self-contained. */
+    status: number;
+    /** SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name. */
+    code: string;
+    /** Human-readable and specific to THIS occurrence. */
+    detail?: string;
+    /** URI reference identifying the occurrence — a request path, a run, a row. */
+    instance?: string;
+    /** W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not. */
+    traceId?: string;
+    /** Field-level issues, when the refusal is about the request body. */
+    errors?: ProblemFieldIssueDto[];
+}

package/dist/models/problemDetailsDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/problemFieldIssueDto.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface ProblemFieldIssueDto {
+    /** RFC 6901 JSON Pointer into the request body. Root is "/". */
+    pointer: string;
+    detail: string;
+}

package/dist/models/problemFieldIssueDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/provisionAgentRequestDto.d.ts

@@ -5,11 +5,20 @@
  */
 import type { AgentReachTier } from './agentReachTier.js';
 export interface ProvisionAgentRequestDto {
-    /** Organization the agent + its capability grants are scoped to. */
+    /**
+       * Organization the agent + its capability grants are scoped to.
+       * @minLength 1
+       */
     orgId: string;
-    /** The agent subject ref the grants are written for (subjectKind=agent). */
+    /**
+       * The agent subject ref the grants are written for (subjectKind=agent).
+       * @minLength 1
+       */
     agentSubjectRef: string;
-    /** The owning user subject ref. Auto-grant requires the OWNER to currently hold the capability (a full, non-pending grant in the agent's environment). */
+    /**
+       * The owning user subject ref. Auto-grant requires the OWNER to currently hold the capability (a full, non-pending grant in the agent's environment).
+       * @minLength 1
+       */
     ownerSubjectRef: string;
     /** The agent reach-tier ceiling. Selects the execution environment the owner-held check + grants resolve under. */
     reachTier: AgentReachTier;

package/dist/models/provisionedCapabilityDto.d.ts

@@ -8,7 +8,10 @@ import type { AgentProvisionReason } from './agentProvisionReason.js';
 import type { CapabilityRiskTier } from './capabilityRiskTier.js';
 import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
 export interface ProvisionedCapabilityDto {
-    /** The canonical CapabilityRef this entry describes. */
+    /**
+       * The canonical CapabilityRef this entry describes.
+       * @minLength 1
+       */
     capability: string;
     decision: AgentProvisionDecision;
     reason: AgentProvisionReason;

package/dist/models/recordAgentReachTierRequestDto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { AgentReachTier } from './agentReachTier.js';
+export interface RecordAgentReachTierRequestDto {
+    /**
+       * Organization that OWNS the agent, or `null` when the agent is GLOBALLY owned (system-seeded or biome-contributed) and its ceiling applies in every org. The field must be PRESENT either way — an omitted `orgId` is refused rather than read as global, because global is the wider scope.
+       * @minLength 1
+       * @nullable
+       */
+    orgId: string | null;
+    /**
+       * The agent's stable composition SLUG — the same identity its capability grants are written under, and the same identity a policy-check envelope carries on `actingAgent`.
+       * @minLength 1
+       */
+    agentSlug: string;
+    /** The agent's permission CEILING — ordered supersets `sandbox ⊂ as-owner ⊂ connected ⊂ full`. Intersected with the agent's armed tools and its owner's authority at resolution, so it can only RESTRICT, never amplify. */
+    reachTier: AgentReachTier;
+}

package/dist/models/recordAgentReachTierRequestDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/registerResourceOwnershipDto.d.ts

@@ -7,15 +7,27 @@ import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface RegisterResourceOwnershipDto {
-    /** Resource kind/type slug. */
+    /**
+       * Resource kind/type slug.
+       * @minLength 1
+       */
     resourceType: string;
-    /** Resource instance id. */
+    /**
+       * Resource instance id.
+       * @minLength 1
+       */
     resourceId: string;
     /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
     visibility: ResourceVisibilityPattern;
-    /** The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner. */
+    /**
+       * The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner.
+       * @minLength 1
+       */
     ownerSpaceUri?: string;
-    /** Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces. */
+    /**
+       * Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces.
+       * @minItems 1
+       */
     owners?: ResourceSubjectRefDto[];
     /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
     explicitShares?: ResourceShareRefDto[];

package/dist/models/registerResourceRevisionDto.d.ts

@@ -5,13 +5,25 @@
  */
 import type { DataClassification } from './dataClassification.js';
 export interface RegisterResourceRevisionDto {
-    /** Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind. */
+    /**
+       * Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind.
+       * @minLength 1
+       */
     ref: string;
-    /** Lowercase SHA-256 of the immutable revision metadata. */
+    /**
+       * Lowercase SHA-256 of the immutable revision metadata.
+       * @pattern SHA256_HEX
+       */
     contentHash: string;
-    /** Canonical OwnerSpace key produced by formatOwnerSpaceKey. It must carry the caller tenant fence. */
+    /**
+       * Canonical OwnerSpace key produced by formatOwnerSpaceKey. It must carry the caller tenant fence.
+       * @minLength 1
+       */
     ownerSpaceKey: string;
     classification: DataClassification;
-    /** Canonical capability ref the unified Decision must evaluate. */
+    /**
+       * Canonical capability ref the unified Decision must evaluate.
+       * @minLength 1
+       */
     decisionCapabilityRef: string;
 }

package/dist/models/registeredResourceRevisionDto.d.ts

@@ -5,9 +5,15 @@
  */
 import type { DataClassification } from './dataClassification.js';
 export interface RegisteredResourceRevisionDto {
-    /** Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind. */
+    /**
+       * Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind.
+       * @minLength 1
+       */
     ref: string;
-    /** Lowercase SHA-256 of the immutable revision metadata. */
+    /**
+       * Lowercase SHA-256 of the immutable revision metadata.
+       * @pattern SHA256_HEX
+       */
     contentHash: string;
     orgId: string;
     resourceType: string;

package/dist/models/relationshipsControllerListParams.d.ts

@@ -8,6 +8,7 @@ import type { SubjectKind } from './subjectKind.js';
 export type RelationshipsControllerListParams = {
     /**
      * Filter to relationships within a single organization.
+     * @minLength 1
      */
     orgId?: string;
     /**
@@ -16,14 +17,17 @@ export type RelationshipsControllerListParams = {
     subjectKind?: SubjectKind;
     /**
      * Filter by subject ref (the user-id half of the tuple).
+     * @minLength 1
      */
     subjectRef?: string;
     /**
      * Filter by the canonical CapabilityRef the object encodes.
+     * @minLength 1
      */
     capability?: string;
     /**
      * Filter by the environment slug the capability object is scoped to.
+     * @minLength 1
      */
     environment?: string;
     /**

package/dist/models/replaceResourceOwnershipDto.d.ts

@@ -9,9 +9,15 @@ import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ReplaceResourceOwnershipDto {
     /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
     visibility: ResourceVisibilityPattern;
-    /** The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner. */
+    /**
+       * The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner.
+       * @minLength 1
+       */
     ownerSpaceUri?: string;
-    /** Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces. */
+    /**
+       * Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces.
+       * @minItems 1
+       */
     owners?: ResourceSubjectRefDto[];
     /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
     explicitShares?: ResourceShareRefDto[];

package/dist/models/requestOutputRouteRetirementDto.d.ts

@@ -11,6 +11,9 @@ export interface RequestOutputRouteRetirementDto {
        * @maximum 2147483647
        */
     expectedChannelVersion: number;
-    /** @maxLength 2048 */
+    /**
+       * @minLength 1
+       * @maxLength 2048
+       */
     reason: string;
 }

package/dist/models/requestOutputRouteRevisionReleaseDto.d.ts

@@ -8,16 +8,24 @@ import type { DataClassification } from './dataClassification.js';
 import type { OutputRouteDestinationKind } from './outputRouteDestinationKind.js';
 import type { RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema } from './requestOutputRouteRevisionReleaseDtoAllowedOutputSchema.js';
 export interface RequestOutputRouteRevisionReleaseDto {
-    /** Canonical versioned OutputRoute identity. */
+    /**
+       * Canonical versioned OutputRoute identity.
+       * @minLength 1
+       */
     ref: string;
+    /** @minLength 1 */
     ownerSpaceKey: string;
     destinationKind: OutputRouteDestinationKind;
-    /** Secret-free destination identity. Credentials are resolved only by the destination service. */
+    /**
+       * Secret-free destination identity. Credentials are resolved only by the destination service.
+       * @minLength 1
+       */
     destinationRef: string;
     classification: DataClassification;
     /** JSON Schema for the only output shape this route accepts. */
     allowedOutputSchema: RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema;
     sideEffectClass: CapabilityEffectClass;
+    /** @minLength 1 */
     decisionCapabilityRef: string;
     /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
     channel: string;
@@ -26,6 +34,9 @@ export interface RequestOutputRouteRevisionReleaseDto {
        * @maximum 2147483647
        */
     expectedChannelVersion: number;
-    /** @maxLength 2048 */
+    /**
+       * @minLength 1
+       * @maxLength 2048
+       */
     reason: string;
 }

package/dist/models/requestOutputRouteRollbackDto.d.ts

@@ -11,7 +11,11 @@ export interface RequestOutputRouteRollbackDto {
        * @maximum 2147483647
        */
     expectedChannelVersion: number;
-    /** @maxLength 2048 */
+    /**
+       * @minLength 1
+       * @maxLength 2048
+       */
     reason: string;
+    /** @minLength 1 */
     priorReleaseSetId: string;
 }

package/dist/models/resolveExactOutputRouteDto.d.ts

@@ -5,6 +5,7 @@
  */
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface ResolveExactOutputRouteDto {
+    /** @minLength 1 */
     ref: string;
     subject: ResourceSubjectRefDto;
 }

package/dist/models/resolveOutputRouteChannelDto.d.ts

@@ -5,6 +5,7 @@
  */
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface ResolveOutputRouteChannelDto {
+    /** @minLength 1 */
     routeId: string;
     /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
     channel: string;

package/dist/models/resourceShareRefDto.d.ts

@@ -6,9 +6,15 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface ResourceShareRefDto {
     kind: SubjectKind;
-    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    /**
+       * Subject id (the `<id>` in `<kind>:<id>`).
+       * @minLength 1
+       */
     ref: string;
-    /** The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest. */
+    /**
+       * The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest.
+       * @minLength 1
+       */
     level?: string;
     /** ISO-8601 instant after which the share stops granting. Enforced by an OpenFGA condition evaluated at DECISION time, not by a sweeper — a sweeper leaves a window in which a lapsed share still passes. Omitted means the share does not expire. An instant in the past is a 400. */
     expiresAt?: string;

package/dist/models/resourceSubjectRefDto.d.ts

@@ -6,6 +6,9 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface ResourceSubjectRefDto {
     kind: SubjectKind;
-    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    /**
+       * Subject id (the `<id>` in `<kind>:<id>`).
+       * @minLength 1
+       */
     ref: string;
 }

package/dist/models/rolesControllerListParams.d.ts

@@ -4,6 +4,9 @@
  * OpenAPI spec version: 0.1.1
  */
 export type RolesControllerListParams = {
+    /**
+     * @minLength 1
+     */
     orgId: string;
     /**
      * Include kernel-seeded built-in roles (default true).

package/dist/models/rollbackExecutionEnvironmentDto.d.ts

@@ -4,8 +4,11 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface RollbackExecutionEnvironmentDto {
-    /** Immutable prior generic ReleaseSet identifier. */
+    /**
+       * Immutable prior generic ReleaseSet identifier.
+       * @minLength 1
+       */
     priorReleaseSetId: string;
-    /** True selects this tenant's built-in override channel; false selects the identity default/stable channel. */
+    /** Selects the OWNER of the release address to roll back, never a channel. True rolls back this org's restriction OF a built-in; false rolls back the environment's own identity — an installation-wide built-in under the global owner, or this org's own custom environment. All three addresses are published on the `stable` channel (owner ruling D-09-3), and they stay distinct because the release pointer is keyed on the owner. */
     tenantOverride: boolean;
 }

package/dist/models/subjectRefDto.d.ts

@@ -7,6 +7,9 @@ import type { SubjectKind } from './subjectKind.js';
 export interface SubjectRefDto {
     /** Discriminator over the kinds of subject that may hold a grant. */
     kind: SubjectKind;
-    /** Opaque ref for the subject; authorization-api owns interpretation per `kind`. */
+    /**
+       * Opaque ref for the subject; authorization-api owns interpretation per `kind`.
+       * @minLength 1
+       */
     ref: string;
 }

package/dist/models/teamsControllerListParams.d.ts

@@ -6,10 +6,12 @@
 export type TeamsControllerListParams = {
     /**
      * Required — teams are always listed within a single org.
+     * @minLength 1
      */
     orgId: string;
     /**
      * Filter to the direct children of this parent team id.
+     * @minLength 1
      */
     parentTeamId?: string;
 };

package/dist/models/updateExecutionEnvironmentDto.d.ts

@@ -8,6 +8,7 @@ import type { UpdateExecutionEnvironmentDtoAllowedCapabilitiesItem } from './upd
 import type { UpdateExecutionEnvironmentDtoApprovalRulesItem } from './updateExecutionEnvironmentDtoApprovalRulesItem.js';
 import type { UpdateExecutionEnvironmentDtoRuntimeLimits } from './updateExecutionEnvironmentDtoRuntimeLimits.js';
 export interface UpdateExecutionEnvironmentDto {
+    /** @minLength 1 */
     description?: string;
     /** Per-environment capability allow-list (`CapabilityPolicy[]`). */
     allowedCapabilities?: UpdateExecutionEnvironmentDtoAllowedCapabilitiesItem[];

package/dist/models/updateGrantDto.d.ts

@@ -6,10 +6,14 @@
 import type { BiomePermissionProfile } from './biomePermissionProfile.js';
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface UpdateGrantDto {
+    /** @minLength 1 */
     environment?: string;
     constraints?: GrantConstraintsDto;
     requiresApproval?: boolean;
     profile?: BiomePermissionProfile;
-    /** Opaque credential-binding pointer. EXPLICIT tier of the credential ladder. Updating it is NOT tuple-affecting — no OpenFGA reconcile. */
+    /**
+       * Opaque credential-binding pointer. EXPLICIT tier of the credential ladder. Updating it is NOT tuple-affecting — no OpenFGA reconcile.
+       * @minLength 1
+       */
     credentialBindingId?: string;
 }

package/dist/models/updateRoleDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface UpdateRoleDto {
+    /** @minLength 1 */
     displayName?: string;
     description?: string;
 }

package/dist/models/updateTeamDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface UpdateTeamDto {
+    /** @minLength 1 */
     displayName?: string;
     description?: string;
     /**

package/dist/models/upsertCredentialDefaultDto.d.ts

@@ -4,12 +4,24 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface UpsertCredentialDefaultDto {
-    /** Organization identifier the default is scoped to. */
+    /**
+       * Organization identifier the default is scoped to.
+       * @minLength 1
+       */
     orgId: string;
-    /** Project identifier. Omit (or null) for the ORG-wide default; set for a per-project default. */
+    /**
+       * Project identifier. Omit (or null) for the ORG-wide default; set for a per-project default.
+       * @minLength 1
+       */
     projectId?: string;
-    /** The EXTERNAL PROVIDER this default is for — `github`, `slack`, an MCP server's provider slug. A default is per (scope, provider): without it an organisation would have one default binding for every provider at once. Must be a value a capability ref can derive (lowercase kebab), because the ladder looks it up by exactly that derivation. */
+    /**
+       * The EXTERNAL PROVIDER this default is for — `github`, `slack`, an MCP server's provider slug. A default is per (scope, provider): without it an organisation would have one default binding for every provider at once. Must be a value a capability ref can derive (lowercase kebab), because the ladder looks it up by exactly that derivation.
+       * @minLength 1
+       */
     provider: string;
-    /** Opaque credential-binding pointer the gateway resolves the external credential from. Not a secret. */
+    /**
+       * Opaque credential-binding pointer the gateway resolves the external credential from. Not a secret.
+       * @minLength 1
+       */
     credentialBindingId: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.4.20",
+  "version": "0.4.26",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "authorization-api",
     "biome": "authorization",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.15.2",
+    "generator": "@xemahq/api-client-generator@0.19.0",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",
@@ -32,6 +32,30 @@
     "directory": "packages/clients/authorization-internal-api"
   },
   "description": "Generated internal API client for the Xema authorization-api service.",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./models": {
+      "types": "./dist/models/index.d.ts",
+      "default": "./dist/models/index.js"
+    },
+    "./models/*": {
+      "types": "./dist/models/*.d.ts",
+      "default": "./dist/models/*.js"
+    },
+    "./endpoints/*": {
+      "types": "./dist/endpoints/*.d.ts",
+      "default": "./dist/endpoints/*.js"
+    },
+    "./custom-fetch": {
+      "types": "./dist/custom-fetch.d.ts",
+      "default": "./dist/custom-fetch.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
   "scripts": {
     "build": "tsc -p tsconfig.json"
   }

package/dist/models/errorDetailsDto.d.ts

@@ -1,10 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { ErrorDetailsDtoDetails } from './errorDetailsDtoDetails.js';
-export interface ErrorDetailsDto {
-    /** @nullable */
-    details: ErrorDetailsDtoDetails;
-}