@xemahq/authorization-internal-api-client 0.4.20 → 0.4.27

package/dist/models/createGrantDto.d.ts

@@ -7,18 +7,31 @@ import type { BiomePermissionProfile } from './biomePermissionProfile.js';
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 import type { SubjectKind } from './subjectKind.js';
 export interface CreateGrantDto {
-    /** Organization identifier. Scopes the grant to the tenant. */
+    /**
+       * Organization identifier. Scopes the grant to the tenant.
+       * @minLength 1
+       */
     orgId: string;
     subjectKind: SubjectKind;
+    /** @minLength 1 */
     subjectRef: string;
-    /** Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`. */
+    /**
+       * Canonical CapabilityRef from `@xemahq/kernel-contracts/capability`.
+       * @minLength 1
+       */
     capability: string;
-    /** Built-in environment slug. Phase 3 stores but does not enforce. */
+    /**
+       * Built-in environment slug. Phase 3 stores but does not enforce.
+       * @minLength 1
+       */
     environment: string;
     constraints?: GrantConstraintsDto;
     requiresApproval?: boolean;
     /** Profile template that materialised this row, if any. */
     profile?: BiomePermissionProfile;
-    /** Opaque credential-binding pointer. EXPLICIT (highest-precedence) tier of the credential ladder. Not a secret; NOT tuple-affecting. */
+    /**
+       * Opaque credential-binding pointer. EXPLICIT (highest-precedence) tier of the credential ladder. Not a secret; NOT tuple-affecting.
+       * @minLength 1
+       */
     credentialBindingId?: string;
 }

package/dist/models/createRoleDto.d.ts

@@ -4,8 +4,11 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface CreateRoleDto {
+    /** @minLength 1 */
     orgId: string;
+    /** @pattern SLUG_PATTERN */
     slug: string;
+    /** @minLength 1 */
     displayName: string;
     description?: string;
 }

package/dist/models/createTeamDto.d.ts

@@ -4,11 +4,19 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface CreateTeamDto {
+    /** @minLength 1 */
     orgId: string;
-    /** Org-unique stable slug (lowercase alphanumeric + dashes). */
+    /**
+       * Org-unique stable slug (lowercase alphanumeric + dashes).
+       * @pattern SLUG_PATTERN
+       */
     slug: string;
+    /** @minLength 1 */
     displayName: string;
     description?: string;
-    /** Parent team id — ENTERPRISE nesting. The new team becomes a sub-team whose members roll up into the parent. Entitlement-gated at the org-admin BFF (`teams.nested`). */
+    /**
+       * Parent team id — ENTERPRISE nesting. The new team becomes a sub-team whose members roll up into the parent. Entitlement-gated at the org-admin BFF (`teams.nested`).
+       * @minLength 1
+       */
     parentTeamId?: string;
 }

package/dist/models/environmentCeilingSource.d.ts

@@ -4,7 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 /**
- * WHICH generic release authority set `maxDataClassification`: the global `default` channel (`platform-built-in`), this org's `tenant` channel restriction (`org-override`), or an org-custom Environment's `stable` publication (`org-custom-environment`). A tenant restriction that the installation ceiling already swallowed reads as `platform-built-in`, because it is deciding nothing.
+ * WHICH authority set `maxDataClassification`, read from the resolved revision's OWNER and the environment's KIND: an installation-wide built-in with no organisation restriction in force (`platform-built-in`), this org's restriction OF a built-in (`org-override`), or an environment this org declared itself (`org-custom-environment`). An org restriction that the installation ceiling already swallowed reads as `platform-built-in`, because it is deciding nothing.
  */
 export type EnvironmentCeilingSource = typeof EnvironmentCeilingSource[keyof typeof EnvironmentCeilingSource];
 export declare const EnvironmentCeilingSource: {

package/dist/models/environmentsControllerFindBySlugParams.d.ts

@@ -6,6 +6,7 @@
 export type EnvironmentsControllerFindBySlugParams = {
     /**
      * When set, the list includes built-ins PLUS this org's custom environments. When omitted, only built-ins are returned (back-compat).
+     * @minLength 1
      */
     orgId?: string;
 };

package/dist/models/environmentsControllerListParams.d.ts

@@ -6,6 +6,7 @@
 export type EnvironmentsControllerListParams = {
     /**
      * When set, the list includes built-ins PLUS this org's custom environments. When omitted, only built-ins are returned (back-compat).
+     * @minLength 1
      */
     orgId?: string;
 };

package/dist/models/environmentsControllerRemoveParams.d.ts

@@ -6,6 +6,7 @@
 export type EnvironmentsControllerRemoveParams = {
     /**
      * When set, the list includes built-ins PLUS this org's custom environments. When omitted, only built-ins are returned (back-compat).
+     * @minLength 1
      */
     orgId: string;
 };

package/dist/models/environmentsControllerUpdateParams.d.ts

@@ -6,6 +6,7 @@
 export type EnvironmentsControllerUpdateParams = {
     /**
      * When set, the list includes built-ins PLUS this org's custom environments. When omitted, only built-ins are returned (back-compat).
+     * @minLength 1
      */
     orgId: string;
 };

package/dist/models/exactResourceAuthorityDto.d.ts

@@ -6,9 +6,15 @@
 import type { DataClassification } from './dataClassification.js';
 import type { ResourceSubjectAccessResult } from './resourceSubjectAccessResult.js';
 export interface ExactResourceAuthorityDto {
-    /** Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind. */
+    /**
+       * Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind.
+       * @minLength 1
+       */
     ref: string;
-    /** Lowercase SHA-256 of the immutable revision metadata. */
+    /**
+       * Lowercase SHA-256 of the immutable revision metadata.
+       * @pattern SHA256_HEX
+       */
     contentHash: string;
     orgId: string;
     resourceType: string;

package/dist/models/exactResourceBindingDto.d.ts

@@ -4,8 +4,14 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface ExactResourceBindingDto {
-    /** Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind. */
+    /**
+       * Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind.
+       * @minLength 1
+       */
     ref: string;
-    /** Lowercase SHA-256 of the immutable revision metadata. */
+    /**
+       * Lowercase SHA-256 of the immutable revision metadata.
+       * @pattern SHA256_HEX
+       */
     contentHash: string;
 }

package/dist/models/executionEnvironmentResponseDto.d.ts

@@ -54,7 +54,7 @@ export interface ExecutionEnvironmentResponseDto {
     maxDataClassification: DataClassification;
     /** The INSTALLATION-wide ceiling for this environment, before any organisation override. Equal to `maxDataClassification` whenever no override is in force. Present so a screen can say "your org lowered this" rather than showing one number and leaving the reader to guess who set it. */
     platformMaxDataClassification: DataClassification;
-    /** WHICH generic release authority set `maxDataClassification`: the global `default` channel (`platform-built-in`), this org's `tenant` channel restriction (`org-override`), or an org-custom Environment's `stable` publication (`org-custom-environment`). A tenant restriction that the installation ceiling already swallowed reads as `platform-built-in`, because it is deciding nothing. */
+    /** WHICH authority set `maxDataClassification`, read from the resolved revision's OWNER and the environment's KIND: an installation-wide built-in with no organisation restriction in force (`platform-built-in`), this org's restriction OF a built-in (`org-override`), or an environment this org declared itself (`org-custom-environment`). An org restriction that the installation ceiling already swallowed reads as `platform-built-in`, because it is deciding nothing. */
     dataCeilingSource: EnvironmentCeilingSource;
     createdAt: string;
     updatedAt: string;

package/dist/models/grantConstraintsDto.d.ts

@@ -4,8 +4,13 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface GrantConstraintsDto {
+    /** @minimum 0 */
     maxCallsPerHour?: number;
+    /** @minimum 0 */
     maxCostUsd?: number;
-    /** Free-form rate-limit token consumed by the gateway rate-limit module. */
+    /**
+       * Free-form rate-limit token consumed by the gateway rate-limit module.
+       * @minLength 1
+       */
     rateLimit?: string;
 }

package/dist/models/grantsControllerListParams.d.ts

@@ -7,11 +7,21 @@ import type { SubjectKind } from './subjectKind.js';
 export type GrantsControllerListParams = {
     /**
      * Filter grants by organization identifier.
+     * @minLength 1
      */
     orgId?: string;
     subjectKind?: SubjectKind;
+    /**
+     * @minLength 1
+     */
     subjectRef?: string;
+    /**
+     * @minLength 1
+     */
     capability?: string;
+    /**
+     * @minLength 1
+     */
     environment?: string;
     includeRevoked?: boolean;
     /**

package/dist/models/index.d.ts

@@ -15,6 +15,14 @@ export * from './authorizationSuggestionKind';
 export * from './biomeExecutionTrustTier';
 export * from './biomePermissionProfile';
 export * from './callerKind';
+export * from './capabilityAuthorityRequestDto';
+export * from './capabilityAuthorityRequestDtoDataArrayEnvelope';
+export * from './capabilityAuthorityRequestDtoDataEnvelope';
+export * from './capabilityAuthorityRequestDtoDisposition';
+export * from './capabilityAuthorityRequestDtoOutcome';
+export * from './capabilityAuthorityRequestDtoRefusal';
+export * from './capabilityAuthorityRequestsControllerGetByIdParams';
+export * from './capabilityAuthorityRequestsControllerListForSubjectParams';
 export * from './capabilityEffectClass';
 export * from './capabilityGrantDto';
 export * from './capabilityGrantDtoDataEnvelope';
@@ -48,10 +56,6 @@ export * from './environmentsControllerReleaseImpactParams';
 export * from './environmentsControllerRemoveParams';
 export * from './environmentsControllerRollbackParams';
 export * from './environmentsControllerUpdateParams';
-export * from './errorDetailsDto';
-export * from './errorDetailsDtoDetails';
-export * from './errorPayloadDto';
-export * from './errorResponseDto';
 export * from './exactResourceAuthorityDto';
 export * from './exactResourceAuthorityDtoDataEnvelope';
 export * from './exactResourceBindingDto';
@@ -82,12 +86,10 @@ export * from './listRegisteredResourcesDto';
 export * from './listVisibleResourcesDto';
 export * from './object';
 export * from './objectLifecycle';
+export * from './openCapabilityAuthorityRequestDto';
+export * from './openCapabilityAuthorityRequestDtoSubjectKind';
 export * from './openFgaRelationshipDto';
 export * from './openFgaRelationshipDtoPaginatedEnvelope';
-export * from './orgRole';
-export * from './orgRoleSyncDto';
-export * from './orgRoleSyncResultDto';
-export * from './orgRoleSyncResultDtoDataEnvelope';
 export * from './outputRouteAuthorityDto';
 export * from './outputRouteAuthorityDtoAllowedOutputSchema';
 export * from './outputRouteAuthorityDtoDataEnvelope';
@@ -104,6 +106,8 @@ export * from './outputRouteRevisionDto';
 export * from './outputRouteRevisionDtoAllowedOutputSchema';
 export * from './outputRouteRevisionsControllerReleaseHistoryParams';
 export * from './paginationMeta';
+export * from './policyActingAgentDto';
+export * from './policyActingAgentDtoKind';
 export * from './policyActingForDto';
 export * from './policyBiomeDto';
 export * from './policyCallerDto';
@@ -126,6 +130,8 @@ export * from './policyRouteHintDtoRequiredRunnerLabels';
 export * from './policySpaceRefDto';
 export * from './policySubjectRefDto';
 export * from './previewOutputRouteImpactDto';
+export * from './problemDetailsDto';
+export * from './problemFieldIssueDto';
 export * from './profilePolicyTemplateDto';
 export * from './profilePolicyTemplateDtoDataArrayEnvelope';
 export * from './profilePolicyTemplateDtoNotes';
@@ -133,6 +139,7 @@ export * from './provisionAgentRequestDto';
 export * from './provisionAgentResultDto';
 export * from './provisionAgentResultDtoDataEnvelope';
 export * from './provisionedCapabilityDto';
+export * from './recordAgentReachTierRequestDto';
 export * from './registerResourceOwnershipDto';
 export * from './registerResourceRevisionDto';
 export * from './registeredResourceDto';

package/dist/models/index.js

@@ -32,6 +32,14 @@ __exportStar(require("./authorizationSuggestionKind"), exports);
 __exportStar(require("./biomeExecutionTrustTier"), exports);
 __exportStar(require("./biomePermissionProfile"), exports);
 __exportStar(require("./callerKind"), exports);
+__exportStar(require("./capabilityAuthorityRequestDto"), exports);
+__exportStar(require("./capabilityAuthorityRequestDtoDataArrayEnvelope"), exports);
+__exportStar(require("./capabilityAuthorityRequestDtoDataEnvelope"), exports);
+__exportStar(require("./capabilityAuthorityRequestDtoDisposition"), exports);
+__exportStar(require("./capabilityAuthorityRequestDtoOutcome"), exports);
+__exportStar(require("./capabilityAuthorityRequestDtoRefusal"), exports);
+__exportStar(require("./capabilityAuthorityRequestsControllerGetByIdParams"), exports);
+__exportStar(require("./capabilityAuthorityRequestsControllerListForSubjectParams"), exports);
 __exportStar(require("./capabilityEffectClass"), exports);
 __exportStar(require("./capabilityGrantDto"), exports);
 __exportStar(require("./capabilityGrantDtoDataEnvelope"), exports);
@@ -65,10 +73,6 @@ __exportStar(require("./environmentsControllerReleaseImpactParams"), exports);
 __exportStar(require("./environmentsControllerRemoveParams"), exports);
 __exportStar(require("./environmentsControllerRollbackParams"), exports);
 __exportStar(require("./environmentsControllerUpdateParams"), exports);
-__exportStar(require("./errorDetailsDto"), exports);
-__exportStar(require("./errorDetailsDtoDetails"), exports);
-__exportStar(require("./errorPayloadDto"), exports);
-__exportStar(require("./errorResponseDto"), exports);
 __exportStar(require("./exactResourceAuthorityDto"), exports);
 __exportStar(require("./exactResourceAuthorityDtoDataEnvelope"), exports);
 __exportStar(require("./exactResourceBindingDto"), exports);
@@ -99,12 +103,10 @@ __exportStar(require("./listRegisteredResourcesDto"), exports);
 __exportStar(require("./listVisibleResourcesDto"), exports);
 __exportStar(require("./object"), exports);
 __exportStar(require("./objectLifecycle"), exports);
+__exportStar(require("./openCapabilityAuthorityRequestDto"), exports);
+__exportStar(require("./openCapabilityAuthorityRequestDtoSubjectKind"), exports);
 __exportStar(require("./openFgaRelationshipDto"), exports);
 __exportStar(require("./openFgaRelationshipDtoPaginatedEnvelope"), exports);
-__exportStar(require("./orgRole"), exports);
-__exportStar(require("./orgRoleSyncDto"), exports);
-__exportStar(require("./orgRoleSyncResultDto"), exports);
-__exportStar(require("./orgRoleSyncResultDtoDataEnvelope"), exports);
 __exportStar(require("./outputRouteAuthorityDto"), exports);
 __exportStar(require("./outputRouteAuthorityDtoAllowedOutputSchema"), exports);
 __exportStar(require("./outputRouteAuthorityDtoDataEnvelope"), exports);
@@ -121,6 +123,8 @@ __exportStar(require("./outputRouteRevisionDto"), exports);
 __exportStar(require("./outputRouteRevisionDtoAllowedOutputSchema"), exports);
 __exportStar(require("./outputRouteRevisionsControllerReleaseHistoryParams"), exports);
 __exportStar(require("./paginationMeta"), exports);
+__exportStar(require("./policyActingAgentDto"), exports);
+__exportStar(require("./policyActingAgentDtoKind"), exports);
 __exportStar(require("./policyActingForDto"), exports);
 __exportStar(require("./policyBiomeDto"), exports);
 __exportStar(require("./policyCallerDto"), exports);
@@ -143,6 +147,8 @@ __exportStar(require("./policyRouteHintDtoRequiredRunnerLabels"), exports);
 __exportStar(require("./policySpaceRefDto"), exports);
 __exportStar(require("./policySubjectRefDto"), exports);
 __exportStar(require("./previewOutputRouteImpactDto"), exports);
+__exportStar(require("./problemDetailsDto"), exports);
+__exportStar(require("./problemFieldIssueDto"), exports);
 __exportStar(require("./profilePolicyTemplateDto"), exports);
 __exportStar(require("./profilePolicyTemplateDtoDataArrayEnvelope"), exports);
 __exportStar(require("./profilePolicyTemplateDtoNotes"), exports);
@@ -150,6 +156,7 @@ __exportStar(require("./provisionAgentRequestDto"), exports);
 __exportStar(require("./provisionAgentResultDto"), exports);
 __exportStar(require("./provisionAgentResultDtoDataEnvelope"), exports);
 __exportStar(require("./provisionedCapabilityDto"), exports);
+__exportStar(require("./recordAgentReachTierRequestDto"), exports);
 __exportStar(require("./registerResourceOwnershipDto"), exports);
 __exportStar(require("./registerResourceRevisionDto"), exports);
 __exportStar(require("./registeredResourceDto"), exports);

package/dist/models/listRegisteredResourcesDto.d.ts

@@ -4,6 +4,9 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface ListRegisteredResourcesDto {
-    /** Resource kind/type slug. */
+    /**
+       * Resource kind/type slug.
+       * @minLength 1
+       */
     resourceType: string;
 }

package/dist/models/listVisibleResourcesDto.d.ts

@@ -5,9 +5,15 @@
  */
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface ListVisibleResourcesDto {
-    /** Resource kind/type slug. */
+    /**
+       * Resource kind/type slug.
+       * @minLength 1
+       */
     resourceType: string;
-    /** The resource kind's own name for the MINIMUM level the subject must hold. Omitted = the visibility question (owner ∪ shared at any level ∪ org-shared). Present = the authority question (owner ∪ shared at or above this level); org-shared instances are NOT included, because org-shared is a visibility pattern rather than a rung. */
+    /**
+       * The resource kind's own name for the MINIMUM level the subject must hold. Omitted = the visibility question (owner ∪ shared at any level ∪ org-shared). Present = the authority question (owner ∪ shared at or above this level); org-shared instances are NOT included, because org-shared is a visibility pattern rather than a rung.
+       * @minLength 1
+       */
     minLevel?: string;
     /** The subject whose visible instances are enumerated. */
     subject: ResourceSubjectRefDto;

package/dist/models/openCapabilityAuthorityRequestDto.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { OpenCapabilityAuthorityRequestDtoSubjectKind } from './openCapabilityAuthorityRequestDtoSubjectKind.js';
+export interface OpenCapabilityAuthorityRequestDto {
+    /**
+       * The organisation the subject and the grant belong to. Cross-checked against the request context by the door — a body org that disagrees with the authenticated one is refused, never silently preferred.
+       * @minLength 1
+       */
+    orgId: string;
+    /** WHO the authority is for. Only a bounded principal minted against one organisation may hold requested authority — see AUTONOMOUS_AUTHORITY_REQUEST_SUBJECT_KINDS. A request naming a person is refused: authority for a person is conferred by a person. */
+    subjectKind: OpenCapabilityAuthorityRequestDtoSubjectKind;
+    /**
+       * The subject id, as its registry minted it.
+       * @minLength 1
+       */
+    subjectRef: string;
+    /**
+       * The capability ref being asked for.
+       * @minLength 1
+       */
+    capability: string;
+    /**
+       * The execution environment slug the grant would apply in. Validated here so a request cannot become a question whose "yes" is unexecutable.
+       * @minLength 1
+       */
+    environment: string;
+    /**
+       * Why the runtime believes it needs this. Shown verbatim to whoever answers, and read by NO fence — a justification is evidence for a human, never input to a verdict.
+       * @maxLength 2000
+       */
+    justification?: string;
+}

package/dist/models/openCapabilityAuthorityRequestDtoSubjectKind.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * WHO the authority is for. Only a bounded principal minted against one organisation may hold requested authority — see AUTONOMOUS_AUTHORITY_REQUEST_SUBJECT_KINDS. A request naming a person is refused: authority for a person is conferred by a person.
+ */
+export type OpenCapabilityAuthorityRequestDtoSubjectKind = typeof OpenCapabilityAuthorityRequestDtoSubjectKind[keyof typeof OpenCapabilityAuthorityRequestDtoSubjectKind];
+export declare const OpenCapabilityAuthorityRequestDtoSubjectKind: {
+    readonly user: "user";
+    readonly agent: "agent";
+    readonly app: "app";
+    readonly 'app-client': "app-client";
+    readonly service: "service";
+    readonly group: "group";
+    readonly role: "role";
+    readonly runner: "runner";
+    readonly 'external-subject': "external-subject";
+    readonly anon: "anon";
+};

package/dist/models/openCapabilityAuthorityRequestDtoSubjectKind.js

@@ -0,0 +1,20 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenCapabilityAuthorityRequestDtoSubjectKind = void 0;
+exports.OpenCapabilityAuthorityRequestDtoSubjectKind = {
+    user: 'user',
+    agent: 'agent',
+    app: 'app',
+    'app-client': 'app-client',
+    service: 'service',
+    group: 'group',
+    role: 'role',
+    runner: 'runner',
+    'external-subject': 'external-subject',
+    anon: 'anon',
+};

package/dist/models/outputRouteAuthorityDto.d.ts

@@ -9,16 +9,24 @@ import type { OutputRouteAuthorityDtoAllowedOutputSchema } from './outputRouteAu
 import type { OutputRouteDestinationKind } from './outputRouteDestinationKind.js';
 import type { ResourceSubjectAccessResult } from './resourceSubjectAccessResult.js';
 export interface OutputRouteAuthorityDto {
-    /** Canonical versioned OutputRoute identity. */
+    /**
+       * Canonical versioned OutputRoute identity.
+       * @minLength 1
+       */
     ref: string;
+    /** @minLength 1 */
     ownerSpaceKey: string;
     destinationKind: OutputRouteDestinationKind;
-    /** Secret-free destination identity. Credentials are resolved only by the destination service. */
+    /**
+       * Secret-free destination identity. Credentials are resolved only by the destination service.
+       * @minLength 1
+       */
     destinationRef: string;
     classification: DataClassification;
     /** JSON Schema for the only output shape this route accepts. */
     allowedOutputSchema: OutputRouteAuthorityDtoAllowedOutputSchema;
     sideEffectClass: CapabilityEffectClass;
+    /** @minLength 1 */
     decisionCapabilityRef: string;
     orgId: string;
     routeId: string;

package/dist/models/outputRouteRevisionDto.d.ts

@@ -8,16 +8,24 @@ import type { DataClassification } from './dataClassification.js';
 import type { OutputRouteDestinationKind } from './outputRouteDestinationKind.js';
 import type { OutputRouteRevisionDtoAllowedOutputSchema } from './outputRouteRevisionDtoAllowedOutputSchema.js';
 export interface OutputRouteRevisionDto {
-    /** Canonical versioned OutputRoute identity. */
+    /**
+       * Canonical versioned OutputRoute identity.
+       * @minLength 1
+       */
     ref: string;
+    /** @minLength 1 */
     ownerSpaceKey: string;
     destinationKind: OutputRouteDestinationKind;
-    /** Secret-free destination identity. Credentials are resolved only by the destination service. */
+    /**
+       * Secret-free destination identity. Credentials are resolved only by the destination service.
+       * @minLength 1
+       */
     destinationRef: string;
     classification: DataClassification;
     /** JSON Schema for the only output shape this route accepts. */
     allowedOutputSchema: OutputRouteRevisionDtoAllowedOutputSchema;
     sideEffectClass: CapabilityEffectClass;
+    /** @minLength 1 */
     decisionCapabilityRef: string;
     orgId: string;
     routeId: string;

package/dist/models/policyActingAgentDto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicyActingAgentDtoKind } from './policyActingAgentDtoKind.js';
+export interface PolicyActingAgentDto {
+    kind: PolicyActingAgentDtoKind;
+    /**
+       * The agent's stable composition SLUG.
+       * @minLength 1
+       */
+    id: string;
+}

package/dist/models/policyActingAgentDtoKind.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export type PolicyActingAgentDtoKind = typeof PolicyActingAgentDtoKind[keyof typeof PolicyActingAgentDtoKind];
+export declare const PolicyActingAgentDtoKind: {
+    readonly agent: "agent";
+};

package/dist/models/{orgRole.js → policyActingAgentDtoKind.js}

@@ -5,9 +5,7 @@
  * OpenAPI spec version: 0.1.1
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrgRole = void 0;
-exports.OrgRole = {
-    owner: 'owner',
-    admin: 'admin',
-    member: 'member',
+exports.PolicyActingAgentDtoKind = void 0;
+exports.PolicyActingAgentDtoKind = {
+    agent: 'agent',
 };

package/dist/models/policyActingForDto.d.ts

@@ -6,6 +6,14 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface PolicyActingForDto {
     kind: SubjectKind;
+    /** @minLength 1 */
     id: string;
+    /**
+       * Mirrors kernel `ActingForRef.clientId` — the ISSUER-STAMPED OAuth client
+       * identity of this delegation hop (`azp`, else `client_id`). Never
+       * caller-asserted: an OAuth client cannot claim another client's id inside a
+       * token the issuer signed. Absent ⇒ "unknown", never a match.
+       * @minLength 1
+       */
     clientId?: string;
 }

package/dist/models/policyBiomeDto.d.ts

@@ -5,7 +5,9 @@
  */
 import type { BiomeExecutionTrustTier } from './biomeExecutionTrustTier.js';
 export interface PolicyBiomeDto {
+    /** @minLength 1 */
     id: string;
+    /** @minLength 1 */
     version: string;
     trustTier: BiomeExecutionTrustTier;
     signatureVerified: boolean;

package/dist/models/policyCallerDto.d.ts

@@ -6,8 +6,12 @@
 import type { CallerKind } from './callerKind.js';
 export interface PolicyCallerDto {
     kind: CallerKind;
+    /** @minLength 1 */
     appId?: string;
+    /** @minLength 1 */
     sessionId?: string;
+    /** @minLength 1 */
     ip?: string;
+    /** @minLength 1 */
     userAgent?: string;
 }

package/dist/models/policyCapabilityDto.d.ts

@@ -4,7 +4,11 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface PolicyCapabilityDto {
-    /** <biome>:<verb>@<major> canonical CapabilityRef. */
+    /**
+       * <biome>:<verb>@<major> canonical CapabilityRef.
+       * @minLength 1
+       */
     ref: string;
+    /** @minLength 1 */
     inputHash?: string;
 }