@xemahq/authorization-internal-api-client 0.4.20 → 0.4.27

package/dist/custom-fetch.js

@@ -223,14 +223,66 @@ const customFetch = async (url, options) => {
     }
 };
 exports.customFetch = customFetch;
-async function parseBody(response) {
-    const contentType = response.headers.get('content-type');
-    if (contentType?.includes('application/json')) {
-        return response.json();
+/**
+ * Does this media type carry JSON?
+ *
+ * ── THE OUTAGE THIS FIXES ────────────────────────────────────────────────
+ *
+ * This used to be `contentType?.includes('application/json')`, and EVERY error
+ * this fleet returns failed that test. The platform's `GlobalExceptionFilter`
+ * emits RFC 9457 problem documents and sets the media type explicitly —
+ * `.type(PROBLEM_DETAILS_CONTENT_TYPE)` before `.json()`, so it cannot be
+ * overridden — and that constant is `application/problem+json`, which does NOT
+ * contain the substring `application/json`: after `application/` comes
+ * `problem+json`.
+ *
+ * So every non-2xx body fell through to `response.text()` and reached the
+ * caller as an UNPARSED STRING. `ClientError.body` is typed `unknown`, so
+ * nothing complained; every consumer that reads a machine-readable code off an
+ * error — `error.body.code`, `error.body.details.code` — silently read
+ * `undefined` instead, for every error, in every service.
+ *
+ * Measured in production on 2026-09-15: skill-registry-api's
+ * `resolveOrNull()` absorbs `RELEASE_CHANNEL_NOT_FOUND` into `null` by exactly
+ * that read. With the code unreadable the absorb never fired, a routine "no
+ * pointer on this channel" 404 became a 500 on `GET /skills` and
+ * `GET /describe-objects`, and agent-session-api's `apply_control_bundle` step
+ * aborted EVERY session launch in the organisation — 7,871 failed resolutions
+ * an hour. A fix written for that exact page months earlier was present in the
+ * running image and could not help, because the classifier it repaired was
+ * being handed a string.
+ *
+ * ── WHY THE STRUCTURED SUFFIX, NOT A SECOND SUBSTRING ────────────────────
+ *
+ * Adding `|| includes('application/problem+json')` would fix this one media
+ * type and leave the next one — `application/vnd.api+json`, and anything else
+ * a service legitimately emits. RFC 6839 defines `+json` as the structured
+ * syntax suffix meaning "this is JSON"; that is the actual rule, so it is the
+ * rule implemented. Parameters are stripped first, because
+ * `application/problem+json; charset=utf-8` is the same media type.
+ */
+function isJsonMediaType(contentType) {
+    if (contentType === null) {
+        return false;
     }
+    const essence = contentType.split(';')[0]?.trim().toLowerCase() ?? '';
+    return essence === 'application/json' || essence.endsWith('+json');
+}
+async function parseBody(response) {
+    // 204 FIRST, and deliberately — this ORDER is carried from `develop`, which
+    // fixed the same defect independently and got this half right where `main`
+    // did not. A 204 carries no body, so `response.json()` on one throws
+    // SyntaxError; and a 204 whose headers STILL declare a JSON content type is
+    // ordinary, because the framework sets the header before the handler returns
+    // nothing. With the JSON branch first, a documented `undefined` becomes a
+    // thrown parse error. Pinned by a case in `transport-problem-json.test.cjs`.
     if (response.status === 204) {
         return undefined;
     }
+    const contentType = response.headers.get('content-type');
+    if (isJsonMediaType(contentType)) {
+        return response.json();
+    }
     return response.text();
 }
 function parseRetryAfter(value) {

package/dist/endpoints/agents/agents.d.ts

@@ -3,7 +3,13 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { ProvisionAgentRequestDto, ProvisionAgentResultDtoDataEnvelope } from '../../models';
+import type { ProvisionAgentRequestDto, ProvisionAgentResultDtoDataEnvelope, RecordAgentReachTierRequestDto } from '../../models';
+export declare const getAgentsControllerRecordReachTierUrl: () => string;
+/**
+ * Projects `(orgId, agentSlug) -> reachTier` into this service's own store, which is what the verdict path resolves an agent ceiling from. A `null` `orgId` declares a GLOBALLY-owned agent (system-seeded or biome-contributed) and is stored slug-keyed, applying in every org; an org row always wins over it. An OMITTED `orgId` is a 400, never read as global. Idempotent (upsert on the key), so a re-save, a retry and a concurrent save from another replica all converge. Writes NO grant — that is `POST /agents/provision`, and keeping the two apart is the point: a ceiling is a restriction, a grant is an authority, and fusing them put the restriction behind the grant feature flag.
+ * @summary Record an agent's DECLARED reach-tier ceiling
+ */
+export declare const agentsControllerRecordReachTier: (recordAgentReachTierRequestDto: RecordAgentReachTierRequestDto, options?: RequestInit) => Promise<void>;
 export declare const getAgentsControllerProvisionUrl: () => string;
 /**
  * Auto-grants low/medium-risk, owner-held, non-approval-gated capabilities as full grants; writes everything else as approval-gated grants. Idempotent (each grant upserts on its natural tuple). Returns a summary for the Studio review UI.

package/dist/endpoints/agents/agents.js

@@ -1,7 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.agentsControllerProvision = exports.getAgentsControllerProvisionUrl = void 0;
+exports.agentsControllerProvision = exports.getAgentsControllerProvisionUrl = exports.agentsControllerRecordReachTier = exports.getAgentsControllerRecordReachTierUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
+const getAgentsControllerRecordReachTierUrl = () => {
+    return `/agents/reach-tier`;
+};
+exports.getAgentsControllerRecordReachTierUrl = getAgentsControllerRecordReachTierUrl;
+/**
+ * Projects `(orgId, agentSlug) -> reachTier` into this service's own store, which is what the verdict path resolves an agent ceiling from. A `null` `orgId` declares a GLOBALLY-owned agent (system-seeded or biome-contributed) and is stored slug-keyed, applying in every org; an org row always wins over it. An OMITTED `orgId` is a 400, never read as global. Idempotent (upsert on the key), so a re-save, a retry and a concurrent save from another replica all converge. Writes NO grant — that is `POST /agents/provision`, and keeping the two apart is the point: a ceiling is a restriction, a grant is an authority, and fusing them put the restriction behind the grant feature flag.
+ * @summary Record an agent's DECLARED reach-tier ceiling
+ */
+const agentsControllerRecordReachTier = async (recordAgentReachTierRequestDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getAgentsControllerRecordReachTierUrl)(), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(recordAgentReachTierRequestDto)
+    });
+};
+exports.agentsControllerRecordReachTier = agentsControllerRecordReachTier;
 const getAgentsControllerProvisionUrl = () => {
     return `/agents/provision`;
 };

package/dist/endpoints/capability-authority-requests/capability-authority-requests.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CapabilityAuthorityRequestDtoDataArrayEnvelope, CapabilityAuthorityRequestDtoDataEnvelope, CapabilityAuthorityRequestsControllerGetByIdParams, CapabilityAuthorityRequestsControllerListForSubjectParams, OpenCapabilityAuthorityRequestDto } from '../../models';
+export declare const getCapabilityAuthorityRequestsControllerOpenUrl: () => string;
+/**
+ * The organisation policy answers immediately with one of three dispositions. `auto-allow` means the grant already exists by the time this returns and the runtime may retry its invocation. `decision-required` means a human has been asked and the runtime must poll or wait — it is NOT a denial. `refuse` is terminal and carries a machine-readable reason. A request for a capability the subject already holds is a 409 rather than a silent no-op, and a second live request for the same capability is a 409 rather than a second question in front of an administrator.
+ * @summary Request capability authority for an App or agent
+ */
+export declare const capabilityAuthorityRequestsControllerOpen: (openCapabilityAuthorityRequestDto: OpenCapabilityAuthorityRequestDto, options?: RequestInit) => Promise<CapabilityAuthorityRequestDtoDataEnvelope>;
+export declare const getCapabilityAuthorityRequestsControllerListForSubjectUrl: (params: CapabilityAuthorityRequestsControllerListForSubjectParams) => string;
+/**
+ * The list a runtime reads to learn what happened to an ask it opened. Deliberately keyed on the SUBJECT rather than on the caller: the runtime relaying the request is not the subject of it, and a "requests I made" list would answer for the service instead of for the App.
+ * @summary One subject's own authority requests
+ */
+export declare const capabilityAuthorityRequestsControllerListForSubject: (params: CapabilityAuthorityRequestsControllerListForSubjectParams, options?: RequestInit) => Promise<CapabilityAuthorityRequestDtoDataArrayEnvelope>;
+export declare const getCapabilityAuthorityRequestsControllerGetByIdUrl: (id: string, params: CapabilityAuthorityRequestsControllerGetByIdParams) => string;
+/**
+ * The live status of an ask. Read from THIS plane's row; the decision's own lifecycle is decision-api's to report, and this service does not mirror it — a settled ask cannot show as pending here because the row is written by the same handler that acts on the answer.
+ * @summary One authority request
+ */
+export declare const capabilityAuthorityRequestsControllerGetById: (id: string, params: CapabilityAuthorityRequestsControllerGetByIdParams, options?: RequestInit) => Promise<CapabilityAuthorityRequestDtoDataEnvelope>;

package/dist/endpoints/capability-authority-requests/capability-authority-requests.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capabilityAuthorityRequestsControllerGetById = exports.getCapabilityAuthorityRequestsControllerGetByIdUrl = exports.capabilityAuthorityRequestsControllerListForSubject = exports.getCapabilityAuthorityRequestsControllerListForSubjectUrl = exports.capabilityAuthorityRequestsControllerOpen = exports.getCapabilityAuthorityRequestsControllerOpenUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getCapabilityAuthorityRequestsControllerOpenUrl = () => {
+    return `/internal/capability-authority-requests`;
+};
+exports.getCapabilityAuthorityRequestsControllerOpenUrl = getCapabilityAuthorityRequestsControllerOpenUrl;
+/**
+ * The organisation policy answers immediately with one of three dispositions. `auto-allow` means the grant already exists by the time this returns and the runtime may retry its invocation. `decision-required` means a human has been asked and the runtime must poll or wait — it is NOT a denial. `refuse` is terminal and carries a machine-readable reason. A request for a capability the subject already holds is a 409 rather than a silent no-op, and a second live request for the same capability is a 409 rather than a second question in front of an administrator.
+ * @summary Request capability authority for an App or agent
+ */
+const capabilityAuthorityRequestsControllerOpen = async (openCapabilityAuthorityRequestDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getCapabilityAuthorityRequestsControllerOpenUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(openCapabilityAuthorityRequestDto)
+    });
+};
+exports.capabilityAuthorityRequestsControllerOpen = capabilityAuthorityRequestsControllerOpen;
+const getCapabilityAuthorityRequestsControllerListForSubjectUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/internal/capability-authority-requests?${stringifiedParams}` : `/internal/capability-authority-requests`;
+};
+exports.getCapabilityAuthorityRequestsControllerListForSubjectUrl = getCapabilityAuthorityRequestsControllerListForSubjectUrl;
+/**
+ * The list a runtime reads to learn what happened to an ask it opened. Deliberately keyed on the SUBJECT rather than on the caller: the runtime relaying the request is not the subject of it, and a "requests I made" list would answer for the service instead of for the App.
+ * @summary One subject's own authority requests
+ */
+const capabilityAuthorityRequestsControllerListForSubject = async (params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getCapabilityAuthorityRequestsControllerListForSubjectUrl)(params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.capabilityAuthorityRequestsControllerListForSubject = capabilityAuthorityRequestsControllerListForSubject;
+const getCapabilityAuthorityRequestsControllerGetByIdUrl = (id, params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/internal/capability-authority-requests/${id}?${stringifiedParams}` : `/internal/capability-authority-requests/${id}`;
+};
+exports.getCapabilityAuthorityRequestsControllerGetByIdUrl = getCapabilityAuthorityRequestsControllerGetByIdUrl;
+/**
+ * The live status of an ask. Read from THIS plane's row; the decision's own lifecycle is decision-api's to report, and this service does not mirror it — a settled ask cannot show as pending here because the row is written by the same handler that acts on the answer.
+ * @summary One authority request
+ */
+const capabilityAuthorityRequestsControllerGetById = async (id, params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getCapabilityAuthorityRequestsControllerGetByIdUrl)(id, params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.capabilityAuthorityRequestsControllerGetById = capabilityAuthorityRequestsControllerGetById;

package/dist/endpoints/roles/roles.d.ts

@@ -3,7 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { AddRoleGrantDto, AssignRoleDto, CreateRoleDto, OrgRoleSyncDto, OrgRoleSyncResultDtoDataEnvelope, RoleAssignmentDtoDataArrayEnvelope, RoleAssignmentDtoDataEnvelope, RoleDtoDataArrayEnvelope, RoleDtoDataEnvelope, RoleGrantDtoDataArrayEnvelope, RoleGrantDtoDataEnvelope, RolesControllerListParams, UpdateRoleDto } from '../../models';
+import type { AddRoleGrantDto, AssignRoleDto, CreateRoleDto, RoleAssignmentDtoDataArrayEnvelope, RoleAssignmentDtoDataEnvelope, RoleDtoDataArrayEnvelope, RoleDtoDataEnvelope, RoleGrantDtoDataArrayEnvelope, RoleGrantDtoDataEnvelope, RolesControllerListParams, UpdateRoleDto } from '../../models';
 export declare const getRolesControllerCreateUrl: () => string;
 /**
  * @summary Create a custom role
@@ -59,8 +59,3 @@ export declare const getRolesControllerUnassignUrl: (id: string, assignmentId: s
  * @summary Remove a role assignment
  */
 export declare const rolesControllerUnassign: (id: string, assignmentId: string, options?: RequestInit) => Promise<void>;
-export declare const getOrgRoleSyncControllerSyncUrl: () => string;
-/**
- * @summary Ensure a subject holds the given org role, correctly org-scoped (idempotent).
- */
-export declare const orgRoleSyncControllerSync: (orgRoleSyncDto: OrgRoleSyncDto, options?: RequestInit) => Promise<OrgRoleSyncResultDtoDataEnvelope>;

package/dist/endpoints/roles/roles.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.orgRoleSyncControllerSync = exports.getOrgRoleSyncControllerSyncUrl = exports.rolesControllerUnassign = exports.getRolesControllerUnassignUrl = exports.rolesControllerAssign = exports.getRolesControllerAssignUrl = exports.rolesControllerListAssignments = exports.getRolesControllerListAssignmentsUrl = exports.rolesControllerRemoveGrant = exports.getRolesControllerRemoveGrantUrl = exports.rolesControllerAddGrant = exports.getRolesControllerAddGrantUrl = exports.rolesControllerListGrants = exports.getRolesControllerListGrantsUrl = exports.rolesControllerDelete = exports.getRolesControllerDeleteUrl = exports.rolesControllerUpdate = exports.getRolesControllerUpdateUrl = exports.rolesControllerGetById = exports.getRolesControllerGetByIdUrl = exports.rolesControllerList = exports.getRolesControllerListUrl = exports.rolesControllerCreate = exports.getRolesControllerCreateUrl = void 0;
+exports.rolesControllerUnassign = exports.getRolesControllerUnassignUrl = exports.rolesControllerAssign = exports.getRolesControllerAssignUrl = exports.rolesControllerListAssignments = exports.getRolesControllerListAssignmentsUrl = exports.rolesControllerRemoveGrant = exports.getRolesControllerRemoveGrantUrl = exports.rolesControllerAddGrant = exports.getRolesControllerAddGrantUrl = exports.rolesControllerListGrants = exports.getRolesControllerListGrantsUrl = exports.rolesControllerDelete = exports.getRolesControllerDeleteUrl = exports.rolesControllerUpdate = exports.getRolesControllerUpdateUrl = exports.rolesControllerGetById = exports.getRolesControllerGetByIdUrl = exports.rolesControllerList = exports.getRolesControllerListUrl = exports.rolesControllerCreate = exports.getRolesControllerCreateUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getRolesControllerCreateUrl = () => {
     return `/roles`;
@@ -183,19 +183,3 @@ const rolesControllerUnassign = async (id, assignmentId, options) => {
     });
 };
 exports.rolesControllerUnassign = rolesControllerUnassign;
-const getOrgRoleSyncControllerSyncUrl = () => {
-    return `/internal/org-role-sync`;
-};
-exports.getOrgRoleSyncControllerSyncUrl = getOrgRoleSyncControllerSyncUrl;
-/**
- * @summary Ensure a subject holds the given org role, correctly org-scoped (idempotent).
- */
-const orgRoleSyncControllerSync = async (orgRoleSyncDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getOrgRoleSyncControllerSyncUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(orgRoleSyncDto)
-    });
-};
-exports.orgRoleSyncControllerSync = orgRoleSyncControllerSync;

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { configureClient, getClientConfig, ClientError, customFetch, type Client
 export * from './models';
 export * from './endpoints/agents/agents';
 export * from './endpoints/authorization/authorization';
+export * from './endpoints/capability-authority-requests/capability-authority-requests';
 export * from './endpoints/contribution-sync/contribution-sync';
 export * from './endpoints/credential-defaults/credential-defaults';
 export * from './endpoints/describe-objects/describe-objects';

package/dist/index.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "customFetch", { enumerable: true, get: function
 __exportStar(require("./models"), exports);
 __exportStar(require("./endpoints/agents/agents"), exports);
 __exportStar(require("./endpoints/authorization/authorization"), exports);
+__exportStar(require("./endpoints/capability-authority-requests/capability-authority-requests"), exports);
 __exportStar(require("./endpoints/contribution-sync/contribution-sync"), exports);
 __exportStar(require("./endpoints/credential-defaults/credential-defaults"), exports);
 __exportStar(require("./endpoints/describe-objects/describe-objects"), exports);

package/dist/models/addRoleGrantDto.d.ts

@@ -5,9 +5,15 @@
  */
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 export interface AddRoleGrantDto {
-    /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
+    /**
+       * Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`.
+       * @minLength 1
+       */
     capability: string;
-    /** Built-in environment slug. */
+    /**
+       * Built-in environment slug.
+       * @minLength 1
+       */
     environment: string;
     constraints?: GrantConstraintsDto;
     requiresApproval?: boolean;

package/dist/models/addTeamMemberDto.d.ts

@@ -6,5 +6,6 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface AddTeamMemberDto {
     subjectKind: SubjectKind;
+    /** @minLength 1 */
     subjectRef: string;
 }

package/dist/models/agentReachTier.d.ts

@@ -4,7 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 /**
- * The agent's permission CEILING — ordered supersets `sandbox ⊂ as-owner ⊂ connected ⊂ full`. Intersected with the agent's armed tools and its owner's authority at resolution, so it can only RESTRICT, never amplify. Absent ⇒ `as-owner`.
+ * The agent's permission CEILING — ordered supersets `sandbox ⊂ as-owner ⊂ connected ⊂ full`. Intersected with the agent's armed tools and its owner's authority at resolution, so it can only RESTRICT, never amplify.
  */
 export type AgentReachTier = typeof AgentReachTier[keyof typeof AgentReachTier];
 export declare const AgentReachTier: {

package/dist/models/assignRoleDto.d.ts

@@ -5,10 +5,17 @@
  */
 import type { SubjectKind } from './subjectKind.js';
 export interface AssignRoleDto {
-    /** The org this assignment is scoped to. For a custom role it must equal the role’s org; for a built-in role (system sentinel) it is the real consuming org. */
+    /**
+       * The org this assignment is scoped to. For a custom role it must equal the role’s org; for a built-in role (system sentinel) it is the real consuming org.
+       * @minLength 1
+       */
     orgId: string;
     subjectKind?: SubjectKind;
+    /** @minLength 1 */
     subjectRef?: string;
-    /** Assign the role to every member of this team. */
+    /**
+       * Assign the role to every member of this team.
+       * @minLength 1
+       */
     teamId?: string;
 }

package/dist/models/authorizationCheckRequestDto.d.ts

@@ -5,17 +5,35 @@
  */
 import type { SubjectRefDto } from './subjectRefDto.js';
 export interface AuthorizationCheckRequestDto {
-    /** Organization identifier. Scopes the grant lookup to the tenant. */
+    /**
+       * Organization identifier. Scopes the grant lookup to the tenant.
+       * @minLength 1
+       */
     orgId: string;
-    /** Canonical CapabilityRef `<domain>:<resource>.<verb>@<major>` from `@xemahq/kernel-contracts/capability`. */
+    /**
+       * Canonical CapabilityRef `<domain>:<resource>.<verb>@<major>` from `@xemahq/kernel-contracts/capability`.
+       * @minLength 1
+       */
     capability: string;
     subject: SubjectRefDto;
-    /** ExecutionEnvironmentRef in `environment:<slug>` format (e.g. `"environment:project"`). The service parses the prefix and checks the slug against the ExecutionEnvironmentKind enum. */
+    /**
+       * ExecutionEnvironmentRef in `environment:<slug>` format (e.g. `"environment:project"`). The service parses the prefix and checks the slug against the ExecutionEnvironmentKind enum.
+       * @minLength 1
+       */
     environment: string;
-    /** CANONICAL kernel resource-instance ref `resource:<type>:<id>` naming the instance the capability targets. Optional — omit it for a verb-only check. When PRESENT it must be canonical: the service resolves it with `parseResourceRef` and answers `400 RESOURCE_REF_MALFORMED` for any other shape. Build it with `composeResourceRef(type, id)` from `@xemahq/kernel-contracts/resource`; a bare `<type>:<id>` and an `xema://…` path are BOTH rejected. */
+    /**
+       * Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance the capability targets. Optional — omit it for a verb-only check; do not send a placeholder. The legacy `resource:<type>:<id>` form is still accepted, but it cannot express the org scope the canonical form carries. Any other shape is refused at the edge with `400 RESOURCE_REF_MALFORMED`.
+       * @minLength 1
+       */
     resource?: string;
-    /** Audience policy slug; Phase 3 ignores this dimension. */
+    /**
+       * Audience policy slug; Phase 3 ignores this dimension.
+       * @minLength 1
+       */
     audience?: string;
-    /** Caller-supplied correlation id surfaced in audit logs. */
+    /**
+       * Caller-supplied correlation id surfaced in audit logs.
+       * @minLength 1
+       */
     correlationId?: string;
 }

package/dist/models/authorizationReasonDto.d.ts

@@ -6,5 +6,6 @@
 import type { AuthorizationDecisionCode } from './authorizationDecisionCode.js';
 export interface AuthorizationReasonDto {
     code: AuthorizationDecisionCode;
+    /** @minLength 1 */
     detail: string;
 }

package/dist/models/authorizationSuggestionDto.d.ts

@@ -6,11 +6,20 @@
 import type { AuthorizationSuggestionKind } from './authorizationSuggestionKind.js';
 export interface AuthorizationSuggestionDto {
     kind: AuthorizationSuggestionKind;
+    /** @minLength 1 */
     capability?: string;
+    /** @minLength 1 */
     environment?: string;
+    /** @minLength 1 */
     resource?: string;
-    /** For `switch-environment`: the environment the request was sent with (denied). For other kinds, undefined. */
+    /**
+       * For `switch-environment`: the environment the request was sent with (denied). For other kinds, undefined.
+       * @minLength 1
+       */
     from?: string;
-    /** For `switch-environment`: a environment the caller already holds a matching grant in. For other kinds, undefined. */
+    /**
+       * For `switch-environment`: a environment the caller already holds a matching grant in. For other kinds, undefined.
+       * @minLength 1
+       */
     to?: string;
 }

package/dist/models/capabilityAuthorityRequestDto.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CapabilityAuthorityRequestDtoDisposition } from './capabilityAuthorityRequestDtoDisposition.js';
+import type { CapabilityAuthorityRequestDtoOutcome } from './capabilityAuthorityRequestDtoOutcome.js';
+import type { CapabilityAuthorityRequestDtoRefusal } from './capabilityAuthorityRequestDtoRefusal.js';
+export interface CapabilityAuthorityRequestDto {
+    id: string;
+    orgId: string;
+    subjectKind: string;
+    subjectRef: string;
+    capability: string;
+    environment: string;
+    justification?: string;
+    /** What the organisation policy decided. */
+    disposition: CapabilityAuthorityRequestDtoDisposition;
+    /** Set iff the disposition is `refuse`. */
+    refusal?: CapabilityAuthorityRequestDtoRefusal;
+    /** The decision-api ask, set iff a human is being asked. Its live status is read from decision-api rather than mirrored here, so a settled ask cannot show as pending because an event was lost. */
+    decisionId?: string;
+    /** Terminal state. Absent while the ask is live. */
+    outcome?: CapabilityAuthorityRequestDtoOutcome;
+    /** The grant this request produced, if any. A POINTER for the audit trail — authority itself lives in `capability_grants`, and nothing reads this field as permission. */
+    grantId?: string;
+    createdAt: string;
+    settledAt?: string;
+}

package/dist/models/capabilityAuthorityRequestDtoDataArrayEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CapabilityAuthorityRequestDto } from './capabilityAuthorityRequestDto.js';
+export interface CapabilityAuthorityRequestDtoDataArrayEnvelope {
+    data: CapabilityAuthorityRequestDto[];
+}

package/dist/models/capabilityAuthorityRequestDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CapabilityAuthorityRequestDto } from './capabilityAuthorityRequestDto.js';
+export interface CapabilityAuthorityRequestDtoDataEnvelope {
+    data: CapabilityAuthorityRequestDto;
+}

package/dist/models/capabilityAuthorityRequestDtoDisposition.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * What the organisation policy decided.
+ */
+export type CapabilityAuthorityRequestDtoDisposition = typeof CapabilityAuthorityRequestDtoDisposition[keyof typeof CapabilityAuthorityRequestDtoDisposition];
+export declare const CapabilityAuthorityRequestDtoDisposition: {
+    readonly 'auto-allow': "auto-allow";
+    readonly 'decision-required': "decision-required";
+    readonly refuse: "refuse";
+};

package/dist/models/capabilityAuthorityRequestDtoDisposition.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityAuthorityRequestDtoDisposition = void 0;
+exports.CapabilityAuthorityRequestDtoDisposition = {
+    'auto-allow': 'auto-allow',
+    'decision-required': 'decision-required',
+    refuse: 'refuse',
+};

package/dist/models/capabilityAuthorityRequestDtoOutcome.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Terminal state. Absent while the ask is live.
+ */
+export type CapabilityAuthorityRequestDtoOutcome = typeof CapabilityAuthorityRequestDtoOutcome[keyof typeof CapabilityAuthorityRequestDtoOutcome];
+export declare const CapabilityAuthorityRequestDtoOutcome: {
+    readonly granted: "granted";
+    readonly refused: "refused";
+    readonly refused_by_policy: "refused_by_policy";
+    readonly no_judgement: "no_judgement";
+    readonly grant_write_refused: "grant_write_refused";
+};

package/dist/models/capabilityAuthorityRequestDtoOutcome.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityAuthorityRequestDtoOutcome = void 0;
+exports.CapabilityAuthorityRequestDtoOutcome = {
+    granted: 'granted',
+    refused: 'refused',
+    refused_by_policy: 'refused_by_policy',
+    no_judgement: 'no_judgement',
+    grant_write_refused: 'grant_write_refused',
+};

package/dist/models/capabilityAuthorityRequestDtoRefusal.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Set iff the disposition is `refuse`.
+ */
+export type CapabilityAuthorityRequestDtoRefusal = typeof CapabilityAuthorityRequestDtoRefusal[keyof typeof CapabilityAuthorityRequestDtoRefusal];
+export declare const CapabilityAuthorityRequestDtoRefusal: {
+    readonly SUBJECT_KIND_MAY_NOT_REQUEST: "SUBJECT_KIND_MAY_NOT_REQUEST";
+    readonly REACH_EXCEEDS_ORG_AUTHORITY: "REACH_EXCEEDS_ORG_AUTHORITY";
+    readonly ORG_REFUSED_CAPABILITY: "ORG_REFUSED_CAPABILITY";
+};

package/dist/models/capabilityAuthorityRequestDtoRefusal.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityAuthorityRequestDtoRefusal = void 0;
+exports.CapabilityAuthorityRequestDtoRefusal = {
+    SUBJECT_KIND_MAY_NOT_REQUEST: 'SUBJECT_KIND_MAY_NOT_REQUEST',
+    REACH_EXCEEDS_ORG_AUTHORITY: 'REACH_EXCEEDS_ORG_AUTHORITY',
+    ORG_REFUSED_CAPABILITY: 'ORG_REFUSED_CAPABILITY',
+};

package/dist/models/{errorDetailsDtoDetails.d.ts → capabilityAuthorityRequestsControllerGetByIdParams.d.ts}

@@ -3,9 +3,6 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-/**
- * @nullable
- */
-export type ErrorDetailsDtoDetails = {
-    [key: string]: unknown;
-} | null;
+export type CapabilityAuthorityRequestsControllerGetByIdParams = {
+    orgId: string;
+};

package/dist/models/capabilityAuthorityRequestsControllerListForSubjectParams.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type CapabilityAuthorityRequestsControllerListForSubjectParams = {
+    orgId: string;
+    subjectKind: string;
+    subjectRef: string;
+};

package/dist/models/createExecutionEnvironmentDto.d.ts

@@ -9,12 +9,19 @@ import type { CreateExecutionEnvironmentDtoRuntimeLimits } from './createExecuti
 import type { DataClassification } from './dataClassification.js';
 import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
 export interface CreateExecutionEnvironmentDto {
-    /** Owning organization. Scopes the custom environment to the tenant. */
+    /**
+       * Owning organization. Scopes the custom environment to the tenant.
+       * @minLength 1
+       */
     orgId: string;
-    /** Environment slug (lowercase kebab, must start with a letter). Unique per org; must not collide with a built-in slug. */
+    /**
+       * Environment slug (lowercase kebab, must start with a letter). Unique per org; must not collide with a built-in slug.
+       * @pattern ENVIRONMENT_SLUG_REGEX
+       */
     slug: string;
     /** ExecutionEnvironmentKind classification for this environment. */
     kind: ExecutionEnvironmentKind;
+    /** @minLength 1 */
     description: string;
     /** Per-environment capability allow-list (`CapabilityPolicy[]`). Defaults to `[]`. */
     allowedCapabilities?: CreateExecutionEnvironmentDtoAllowedCapabilitiesItem[];