@xemahq/authorization-internal-api-client 0.4.20 → 0.4.27

package/dist/models/policyCheckRequestDto.d.ts

@@ -3,7 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { AgentReachTier } from './agentReachTier.js';
+import type { PolicyActingAgentDto } from './policyActingAgentDto.js';
 import type { PolicyActingForDto } from './policyActingForDto.js';
 import type { PolicyBiomeDto } from './policyBiomeDto.js';
 import type { PolicyCallerDto } from './policyCallerDto.js';
@@ -16,8 +16,11 @@ import type { PolicySpaceRefDto } from './policySpaceRefDto.js';
 import type { PolicySubjectRefDto } from './policySubjectRefDto.js';
 import type { SessionParticipantRole } from './sessionParticipantRole.js';
 export interface PolicyCheckRequestDto {
+    /** @minLength 1 */
     id: string;
+    /** @minLength 1 */
     requestId: string;
+    /** @minLength 1 */
     traceId: string;
     subject: PolicySubjectRefDto;
     caller: PolicyCallerDto;
@@ -28,9 +31,56 @@ export interface PolicyCheckRequestDto {
     resource?: PolicyResourceDto;
     constraints?: PolicyConstraintsDto;
     actorChain?: PolicyActingForDto[];
+    /**
+       * Opaque credential-binding id already selected for this invocation. Carried
+       * on the kernel envelope (a re-checked / replayed context round-trips it), so
+       * the wire must accept it. NEVER a secret. The PDP re-resolves the binding
+       * itself via the precedence ladder and returns it on `PolicyDecision` — it
+       * does not trust an inbound value.
+       * @minLength 1
+       */
     credentialBindingId?: string;
-    /** The agent's permission CEILING — ordered supersets `sandbox ⊂ as-owner ⊂ connected ⊂ full`. Intersected with the agent's armed tools and its owner's authority at resolution, so it can only RESTRICT, never amplify. Absent ⇒ `as-owner`. */
-    reachTier?: AgentReachTier;
+    /**
+       * WHICH AGENT is acting — an IDENTITY, never an authority value.
+       *
+       * ── WHAT IT REPLACED, AND WHY THAT FIELD IS GONE (04-critical-defects B5) ──
+       *
+       * `reachTier` used to be declared here: the acting agent's permission
+       * CEILING, taken off the request body. This endpoint is fenced by
+       * `ServiceActorGuard`, so any platform service token could name one — and the
+       * tier is not narrowing-only. `connected` turns a DENY into an ALLOW for
+       * integration-reach capabilities and `full` LIFTS the delegation clamp, so a
+       * caller could ask this service to stop attenuating an agent to its
+       * delegators. That is the caller-supplied security input
+       * `.claude/rules/public-and-internal-route-guarding.md` forbids outright.
+       *
+       * The property is DELETED rather than ignored, and the deletion is the
+       * enforcement: the canonical pipe runs `forbidNonWhitelisted: true`, so a
+       * body still carrying `reachTier` is a `400 property reachTier should not
+       * exist`. There is no path that accepts it and drops it quietly.
+       *
+       * ── THE ANSWER IS RESOLVED HERE, FROM THIS SERVICE'S OWN RECORDS ──────────
+       *
+       * `AuthorizationService.resolveEffectiveReachTier` reads the ceiling from
+       * `agent_reach_tier_projection` — LOCAL rows keyed by the agent slug this
+       * field carries. A caller naming another agent therefore gets THAT agent's
+       * declaration, never one it invented, and a caller naming no agent gets the
+       * platform default.
+       *
+       * ── WHY THE AGENT NEEDS ITS OWN FIELD AND `subject` WILL NOT DO ───────────
+       *
+       * `subject` names the agent only on an AUTONOMOUS invocation. A DELEGATED one
+       * arrives as `subject = { kind: user, id: <owner> }` — the agent acts as its
+       * owner — so the acting agent is not on the envelope at all, and a ceiling
+       * keyed on `subject.id` silently stops applying the moment a human is in the
+       * session. That is precisely the path where a `sandbox` agent must stay
+       * sandboxed.
+       *
+       * Stamped by the surface that owns the agent's identity from its own verified
+       * credential (the MCP bridge-token claims), forwarded in-process by
+       * `xema-capability-router`, and never supplied by an agent.
+       */
+    actingAgent?: PolicyActingAgentDto;
     /** Role the acting subject holds in the originating agent session. Precedence `owner > editor > viewer`. Absent for non-session invocations (workflow steps, service calls). */
     participantRole?: SessionParticipantRole;
     /** The acting agent's capability aperture (kernel `CapabilityAperture`): `{ kind: "unrestricted" }` or `{ kind: "armed", refs: string[] }`. Enforced at the capability-router funnel, carried here for the audit trail. */

package/dist/models/policyDecisionDto.d.ts

@@ -9,11 +9,17 @@ import type { PolicyObligationDto } from './policyObligationDto.js';
 import type { PolicyRouteHintDto } from './policyRouteHintDto.js';
 export interface PolicyDecisionDto {
     kind: PolicyDecisionKind;
-    /** Stable wire-code denial reason from the OPA bundle / authorization-api decision matrix. Free-form here; closed by the bundle. Surfaced verbatim in audit + capability-router error envelopes. */
+    /**
+       * Stable wire-code denial reason from the OPA bundle / authorization-api decision matrix. Free-form here; closed by the bundle. Surfaced verbatim in audit + capability-router error envelopes.
+       * @minLength 1
+       */
     reason?: string;
     obligations?: PolicyObligationDto[];
     routeHints?: PolicyRouteHintDto;
-    /** Credential binding the executing gateway MUST use to resolve the external credential for this invocation. Present ONLY on an `allow` for a capability that declares an `externalServiceRef`. Opaque id — never a secret; the broker re-validates it before reading custody. */
+    /**
+       * Credential binding the executing gateway MUST use to resolve the external credential for this invocation. Present ONLY on an `allow` for a capability that declares an `externalServiceRef`. Opaque id — never a secret; the broker re-validates it before reading custody.
+       * @minLength 1
+       */
     credentialBindingId?: string;
     /** Which precedence tier supplied `credentialBindingId` (explicit grant > capability default > project default > org default). Populated iff `credentialBindingId` is present. */
     credentialPrecedenceApplied?: CredentialPrecedenceSource;

package/dist/models/policyEnvironmentDto.d.ts

@@ -5,7 +5,10 @@
  */
 import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
 export interface PolicyEnvironmentDto {
-    /** environment:<slug> ref string. */
+    /**
+       * environment:<slug> ref string.
+       * @minLength 1
+       */
     id: string;
     /** Closed set of built-in execution-environment classifications. Environment IDENTITY is a separate `environment:<slug>` ref — an org-custom environment carries its own slug there, and is still classified by one of these kinds. */
     kind: ExecutionEnvironmentKind;

package/dist/models/policyObligationDto.d.ts

@@ -10,13 +10,20 @@ import type { RunnerKind } from './runnerKind.js';
 export interface PolicyObligationDto {
     kind: PolicyObligationKind;
     runnerKind?: RunnerKind;
+    /** @minLength 1 */
     approverRole?: string;
     maxDurationSeconds?: number;
     maxCostUsd?: number;
     maxClassification?: DataClassification;
     residency?: DataResidency;
-    /** Egress allowlist patterns (wildcard host or https:// URL-prefix). Present only when kind=egress-allowlist. */
+    /**
+       * Egress allowlist patterns (wildcard host or https:// URL-prefix). Present only when kind=egress-allowlist.
+       * @items.minLength 1
+       */
     allow?: string[];
-    /** Egress blocklist patterns; a match denies even if `allow` matched. Present only when kind=egress-allowlist. */
+    /**
+       * Egress blocklist patterns; a match denies even if `allow` matched. Present only when kind=egress-allowlist.
+       * @items.minLength 1
+       */
     deny?: string[];
 }

package/dist/models/policyResourceDto.d.ts

@@ -5,7 +5,10 @@
  */
 import type { DataClassification } from './dataClassification.js';
 export interface PolicyResourceDto {
-    /** Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance this invocation targets. Exact Agent bindings always carry the version. The server answers `400 RESOURCE_REF_MALFORMED` for any other shape. Omit the whole `resource` block for a verb-only check; do not send a placeholder. */
+    /**
+       * Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance this invocation targets. Exact Agent bindings always carry the version. The server answers `400 RESOURCE_REF_MALFORMED` for any other shape. Omit the whole `resource` block for a verb-only check; do not send a placeholder.
+       * @minLength 1
+       */
     ref: string;
     /** The classification the target resource carries. OMIT IT when the producer has none to declare — the effective classification is then the Space floor alone, and the request still gets the resource-ownership clamp. Omitting the whole `resource` block is NOT the same thing: that downgrades the call to a verb-only check and discards the ownership clamp. Never send a placeholder value. */
     classification?: DataClassification;

package/dist/models/policyRouteHintDto.d.ts

@@ -8,6 +8,7 @@ import type { RunnerKind } from './runnerKind.js';
 export interface PolicyRouteHintDto {
     requiredRunnerLabels?: PolicyRouteHintDtoRequiredRunnerLabels;
     preferredRunnerKind?: RunnerKind;
+    /** @minLength 1 */
     requiredRegion?: string;
     requireCustomerEdge?: boolean;
 }

package/dist/models/policySpaceRefDto.d.ts

@@ -6,11 +6,18 @@
 import type { SpaceKind } from './spaceKind.js';
 export interface PolicySpaceRefDto {
     tier: SpaceKind;
+    /** @minLength 1 */
     orgId?: string;
+    /** @minLength 1 */
     projectId?: string;
+    /** @minLength 1 */
     appId?: string;
+    /** @minLength 1 */
     sessionId?: string;
+    /** @minLength 1 */
     biomeId?: string;
+    /** @minLength 1 */
     userId?: string;
+    /** @minLength 1 */
     path?: string;
 }

package/dist/models/policySubjectRefDto.d.ts

@@ -7,6 +7,7 @@ import type { PolicyActingForDto } from './policyActingForDto.js';
 import type { SubjectKind } from './subjectKind.js';
 export interface PolicySubjectRefDto {
     kind: SubjectKind;
+    /** @minLength 1 */
     id: string;
     roles?: string[];
     actingFor?: PolicyActingForDto;

package/dist/models/previewOutputRouteImpactDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface PreviewOutputRouteImpactDto {
+    /** @minLength 1 */
     ref: string;
     /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
     channel: string;

package/dist/models/problemDetailsDto.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ProblemFieldIssueDto } from './problemFieldIssueDto.js';
+/**
+ * RFC 9457 problem document. The declared members are the reserved core; extension members are TOP-LEVEL and OPEN, owned by the refusing plane.
+ */
+export interface ProblemDetailsDto {
+    /** Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`. */
+    type: string;
+    /** Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`. */
+    title: string;
+    /** The HTTP status code, repeated in the body so a logged document is self-contained. */
+    status: number;
+    /** SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name. */
+    code: string;
+    /** Human-readable and specific to THIS occurrence. */
+    detail?: string;
+    /** URI reference identifying the occurrence — a request path, a run, a row. */
+    instance?: string;
+    /** W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not. */
+    traceId?: string;
+    /** Field-level issues, when the refusal is about the request body. */
+    errors?: ProblemFieldIssueDto[];
+    [key: string]: unknown;
+}

package/dist/models/problemDetailsDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/problemFieldIssueDto.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface ProblemFieldIssueDto {
+    /** RFC 6901 JSON Pointer into the request body. Root is "/". */
+    pointer: string;
+    detail: string;
+}

package/dist/models/problemFieldIssueDto.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/provisionAgentRequestDto.d.ts

@@ -5,11 +5,20 @@
  */
 import type { AgentReachTier } from './agentReachTier.js';
 export interface ProvisionAgentRequestDto {
-    /** Organization the agent + its capability grants are scoped to. */
+    /**
+       * Organization the agent + its capability grants are scoped to.
+       * @minLength 1
+       */
     orgId: string;
-    /** The agent subject ref the grants are written for (subjectKind=agent). */
+    /**
+       * The agent subject ref the grants are written for (subjectKind=agent).
+       * @minLength 1
+       */
     agentSubjectRef: string;
-    /** The owning user subject ref. Auto-grant requires the OWNER to currently hold the capability (a full, non-pending grant in the agent's environment). */
+    /**
+       * The owning user subject ref. Auto-grant requires the OWNER to currently hold the capability (a full, non-pending grant in the agent's environment).
+       * @minLength 1
+       */
     ownerSubjectRef: string;
     /** The agent reach-tier ceiling. Selects the execution environment the owner-held check + grants resolve under. */
     reachTier: AgentReachTier;

package/dist/models/provisionedCapabilityDto.d.ts

@@ -8,7 +8,10 @@ import type { AgentProvisionReason } from './agentProvisionReason.js';
 import type { CapabilityRiskTier } from './capabilityRiskTier.js';
 import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
 export interface ProvisionedCapabilityDto {
-    /** The canonical CapabilityRef this entry describes. */
+    /**
+       * The canonical CapabilityRef this entry describes.
+       * @minLength 1
+       */
     capability: string;
     decision: AgentProvisionDecision;
     reason: AgentProvisionReason;

package/dist/models/recordAgentReachTierRequestDto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { AgentReachTier } from './agentReachTier.js';
+export interface RecordAgentReachTierRequestDto {
+    /**
+       * Organization that OWNS the agent, or `null` when the agent is GLOBALLY owned (system-seeded or biome-contributed) and its ceiling applies in every org. The field must be PRESENT either way — an omitted `orgId` is refused rather than read as global, because global is the wider scope.
+       * @minLength 1
+       * @nullable
+       */
+    orgId: string | null;
+    /**
+       * The agent's stable composition SLUG — the same identity its capability grants are written under, and the same identity a policy-check envelope carries on `actingAgent`.
+       * @minLength 1
+       */
+    agentSlug: string;
+    /** The agent's permission CEILING — ordered supersets `sandbox ⊂ as-owner ⊂ connected ⊂ full`. Intersected with the agent's armed tools and its owner's authority at resolution, so it can only RESTRICT, never amplify. */
+    reachTier: AgentReachTier;
+}

package/dist/models/recordAgentReachTierRequestDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/registerResourceOwnershipDto.d.ts

@@ -7,15 +7,27 @@ import type { ResourceShareRefDto } from './resourceShareRefDto.js';
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface RegisterResourceOwnershipDto {
-    /** Resource kind/type slug. */
+    /**
+       * Resource kind/type slug.
+       * @minLength 1
+       */
     resourceType: string;
-    /** Resource instance id. */
+    /**
+       * Resource instance id.
+       * @minLength 1
+       */
     resourceId: string;
     /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
     visibility: ResourceVisibilityPattern;
-    /** The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner. */
+    /**
+       * The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner.
+       * @minLength 1
+       */
     ownerSpaceUri?: string;
-    /** Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces. */
+    /**
+       * Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces.
+       * @minItems 1
+       */
     owners?: ResourceSubjectRefDto[];
     /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
     explicitShares?: ResourceShareRefDto[];

package/dist/models/registerResourceRevisionDto.d.ts

@@ -5,13 +5,25 @@
  */
 import type { DataClassification } from './dataClassification.js';
 export interface RegisterResourceRevisionDto {
-    /** Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind. */
+    /**
+       * Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind.
+       * @minLength 1
+       */
     ref: string;
-    /** Lowercase SHA-256 of the immutable revision metadata. */
+    /**
+       * Lowercase SHA-256 of the immutable revision metadata.
+       * @pattern SHA256_HEX
+       */
     contentHash: string;
-    /** Canonical OwnerSpace key produced by formatOwnerSpaceKey. It must carry the caller tenant fence. */
+    /**
+       * Canonical OwnerSpace key produced by formatOwnerSpaceKey. It must carry the caller tenant fence.
+       * @minLength 1
+       */
     ownerSpaceKey: string;
     classification: DataClassification;
-    /** Canonical capability ref the unified Decision must evaluate. */
+    /**
+       * Canonical capability ref the unified Decision must evaluate.
+       * @minLength 1
+       */
     decisionCapabilityRef: string;
 }

package/dist/models/registeredResourceRevisionDto.d.ts

@@ -5,9 +5,15 @@
  */
 import type { DataClassification } from './dataClassification.js';
 export interface RegisteredResourceRevisionDto {
-    /** Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind. */
+    /**
+       * Canonical version-pinned Xema Resource ref. The first slug segment is the registered resource kind.
+       * @minLength 1
+       */
     ref: string;
-    /** Lowercase SHA-256 of the immutable revision metadata. */
+    /**
+       * Lowercase SHA-256 of the immutable revision metadata.
+       * @pattern SHA256_HEX
+       */
     contentHash: string;
     orgId: string;
     resourceType: string;

package/dist/models/relationshipsControllerListParams.d.ts

@@ -8,6 +8,7 @@ import type { SubjectKind } from './subjectKind.js';
 export type RelationshipsControllerListParams = {
     /**
      * Filter to relationships within a single organization.
+     * @minLength 1
      */
     orgId?: string;
     /**
@@ -16,14 +17,17 @@ export type RelationshipsControllerListParams = {
     subjectKind?: SubjectKind;
     /**
      * Filter by subject ref (the user-id half of the tuple).
+     * @minLength 1
      */
     subjectRef?: string;
     /**
      * Filter by the canonical CapabilityRef the object encodes.
+     * @minLength 1
      */
     capability?: string;
     /**
      * Filter by the environment slug the capability object is scoped to.
+     * @minLength 1
      */
     environment?: string;
     /**

package/dist/models/replaceResourceOwnershipDto.d.ts

@@ -9,9 +9,15 @@ import type { ResourceVisibilityPattern } from './resourceVisibilityPattern.js';
 export interface ReplaceResourceOwnershipDto {
     /** Instance visibility pattern. The PDP ANDs the verb verdict with the ownership check resolved per this pattern. */
     visibility: ResourceVisibilityPattern;
-    /** The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner. */
+    /**
+       * The `xema://` SPACE that owns the instance — an ADDRESS, which this service expands into the owner SUBJECTS its own vocabulary resolves it to (`xema://orgs/<id>` → the org-owner and org-admin role usersets; `xema://users/<id>` → that user). A producer knows the owning Space (`App.ownerSpaceUri`, `Skill.ownerSpaceUri`) and CANNOT know which subjects it resolves to, because those role instances are this service's own rows. Refused (400 `RESOURCE_OWNER_SPACE_NOT_ADMISSIBLE`) when the address is unparseable, names a tier the resource kind does not admit, names another organisation, or names a tier with no owner-subject expansion. May be combined with `owners`; the effective owner set is the UNION, de-duplicated. At least one of the two must yield an owner.
+       * @minLength 1
+       */
     ownerSpaceUri?: string;
-    /** Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces. */
+    /**
+       * Subjects that OWN the instance (full visibility), named explicitly. OPTIONAL only because `ownerSpaceUri` is the other way to say it — the service still refuses a request that yields no owner at all, so the ≥ 1-owner rule is unchanged. It moved from the DTO to the service because validation runs BEFORE the expansion and therefore cannot see the owners the address produces.
+       * @minItems 1
+       */
     owners?: ResourceSubjectRefDto[];
     /** Subjects explicitly granted visibility, each at a LEVEL and with an optional expiry. */
     explicitShares?: ResourceShareRefDto[];

package/dist/models/requestOutputRouteRetirementDto.d.ts

@@ -11,6 +11,9 @@ export interface RequestOutputRouteRetirementDto {
        * @maximum 2147483647
        */
     expectedChannelVersion: number;
-    /** @maxLength 2048 */
+    /**
+       * @minLength 1
+       * @maxLength 2048
+       */
     reason: string;
 }

package/dist/models/requestOutputRouteRevisionReleaseDto.d.ts

@@ -8,16 +8,24 @@ import type { DataClassification } from './dataClassification.js';
 import type { OutputRouteDestinationKind } from './outputRouteDestinationKind.js';
 import type { RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema } from './requestOutputRouteRevisionReleaseDtoAllowedOutputSchema.js';
 export interface RequestOutputRouteRevisionReleaseDto {
-    /** Canonical versioned OutputRoute identity. */
+    /**
+       * Canonical versioned OutputRoute identity.
+       * @minLength 1
+       */
     ref: string;
+    /** @minLength 1 */
     ownerSpaceKey: string;
     destinationKind: OutputRouteDestinationKind;
-    /** Secret-free destination identity. Credentials are resolved only by the destination service. */
+    /**
+       * Secret-free destination identity. Credentials are resolved only by the destination service.
+       * @minLength 1
+       */
     destinationRef: string;
     classification: DataClassification;
     /** JSON Schema for the only output shape this route accepts. */
     allowedOutputSchema: RequestOutputRouteRevisionReleaseDtoAllowedOutputSchema;
     sideEffectClass: CapabilityEffectClass;
+    /** @minLength 1 */
     decisionCapabilityRef: string;
     /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
     channel: string;
@@ -26,6 +34,9 @@ export interface RequestOutputRouteRevisionReleaseDto {
        * @maximum 2147483647
        */
     expectedChannelVersion: number;
-    /** @maxLength 2048 */
+    /**
+       * @minLength 1
+       * @maxLength 2048
+       */
     reason: string;
 }

package/dist/models/requestOutputRouteRollbackDto.d.ts

@@ -11,7 +11,11 @@ export interface RequestOutputRouteRollbackDto {
        * @maximum 2147483647
        */
     expectedChannelVersion: number;
-    /** @maxLength 2048 */
+    /**
+       * @minLength 1
+       * @maxLength 2048
+       */
     reason: string;
+    /** @minLength 1 */
     priorReleaseSetId: string;
 }

package/dist/models/resolveExactOutputRouteDto.d.ts

@@ -5,6 +5,7 @@
  */
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface ResolveExactOutputRouteDto {
+    /** @minLength 1 */
     ref: string;
     subject: ResourceSubjectRefDto;
 }

package/dist/models/resolveOutputRouteChannelDto.d.ts

@@ -5,6 +5,7 @@
  */
 import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
 export interface ResolveOutputRouteChannelDto {
+    /** @minLength 1 */
     routeId: string;
     /** @pattern ^[a-z][a-z0-9-]{0,62}$ */
     channel: string;

package/dist/models/resourceShareRefDto.d.ts

@@ -6,9 +6,15 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface ResourceShareRefDto {
     kind: SubjectKind;
-    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    /**
+       * Subject id (the `<id>` in `<kind>:<id>`).
+       * @minLength 1
+       */
     ref: string;
-    /** The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest. */
+    /**
+       * The resource kind's own name for the level this share confers. Levels are declared per kind (a document has `viewer < editor < manager`; a mailbox's `editor` is not a meaningful authority) and are totally ordered with monotone verb expansion. OMITTED means the LOWEST level the kind declares — never the highest.
+       * @minLength 1
+       */
     level?: string;
     /** ISO-8601 instant after which the share stops granting. Enforced by an OpenFGA condition evaluated at DECISION time, not by a sweeper — a sweeper leaves a window in which a lapsed share still passes. Omitted means the share does not expire. An instant in the past is a 400. */
     expiresAt?: string;

package/dist/models/resourceSubjectRefDto.d.ts

@@ -6,6 +6,9 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface ResourceSubjectRefDto {
     kind: SubjectKind;
-    /** Subject id (the `<id>` in `<kind>:<id>`). */
+    /**
+       * Subject id (the `<id>` in `<kind>:<id>`).
+       * @minLength 1
+       */
     ref: string;
 }

package/dist/models/rolesControllerListParams.d.ts

@@ -4,6 +4,9 @@
  * OpenAPI spec version: 0.1.1
  */
 export type RolesControllerListParams = {
+    /**
+     * @minLength 1
+     */
     orgId: string;
     /**
      * Include kernel-seeded built-in roles (default true).

package/dist/models/rollbackExecutionEnvironmentDto.d.ts

@@ -4,8 +4,11 @@
  * OpenAPI spec version: 0.1.1
  */
 export interface RollbackExecutionEnvironmentDto {
-    /** Immutable prior generic ReleaseSet identifier. */
+    /**
+       * Immutable prior generic ReleaseSet identifier.
+       * @minLength 1
+       */
     priorReleaseSetId: string;
-    /** True selects this tenant's built-in override channel; false selects the identity default/stable channel. */
+    /** Selects the OWNER of the release address to roll back, never a channel. True rolls back this org's restriction OF a built-in; false rolls back the environment's own identity — an installation-wide built-in under the global owner, or this org's own custom environment. All three addresses are published on the `stable` channel (owner ruling D-09-3), and they stay distinct because the release pointer is keyed on the owner. */
     tenantOverride: boolean;
 }

package/dist/models/subjectRefDto.d.ts

@@ -7,6 +7,9 @@ import type { SubjectKind } from './subjectKind.js';
 export interface SubjectRefDto {
     /** Discriminator over the kinds of subject that may hold a grant. */
     kind: SubjectKind;
-    /** Opaque ref for the subject; authorization-api owns interpretation per `kind`. */
+    /**
+       * Opaque ref for the subject; authorization-api owns interpretation per `kind`.
+       * @minLength 1
+       */
     ref: string;
 }

package/dist/models/teamsControllerListParams.d.ts

@@ -6,10 +6,12 @@
 export type TeamsControllerListParams = {
     /**
      * Required — teams are always listed within a single org.
+     * @minLength 1
      */
     orgId: string;
     /**
      * Filter to the direct children of this parent team id.
+     * @minLength 1
      */
     parentTeamId?: string;
 };

package/dist/models/updateExecutionEnvironmentDto.d.ts

@@ -8,6 +8,7 @@ import type { UpdateExecutionEnvironmentDtoAllowedCapabilitiesItem } from './upd
 import type { UpdateExecutionEnvironmentDtoApprovalRulesItem } from './updateExecutionEnvironmentDtoApprovalRulesItem.js';
 import type { UpdateExecutionEnvironmentDtoRuntimeLimits } from './updateExecutionEnvironmentDtoRuntimeLimits.js';
 export interface UpdateExecutionEnvironmentDto {
+    /** @minLength 1 */
     description?: string;
     /** Per-environment capability allow-list (`CapabilityPolicy[]`). */
     allowedCapabilities?: UpdateExecutionEnvironmentDtoAllowedCapabilitiesItem[];