@xemahq/authorization-internal-api-client 0.4.28 → 0.5.0

package/dist/custom-fetch.d.ts

@@ -1,11 +1,21 @@
 /**
  * Configurable fetch wrapper for Orval-generated clients.
  *
- * GENERATED by `@xemahq/api-client-generator` — do not edit. Every client in
- * the fleet ships this file byte-for-byte; a local edit is erased by the next
- * `pnpm refresh` and, until then, makes this one client speak to the platform
- * differently from all of its siblings. Change the template instead:
- * `api-client-generator/src/lib/custom-fetch-template.ts`.
+ * AUTO-GENERATED by `@xemahq/api-client-generator` — DO NOT EDIT. Every client
+ * in the fleet ships this file byte-for-byte; a hand edit is erased by the next
+ * regeneration and, until then, makes this one client speak to the platform
+ * differently from all of its siblings.
+ *
+ * Canonical source: `CANONICAL_CUSTOM_FETCH` in
+ * `packages/sdks/api-client-generator/src/lib/custom-fetch-template.ts`
+ * (repository `xema-kernel-sdk`). Change it there.
+ *
+ * Regenerate, from the root of THIS repository:
+ *   pnpm --filter <owning-service> run openapi
+ *   pnpm --filter <owning-service> run client:generate
+ * A mirror of this client under `xema-host-web` is not regenerated there: it
+ * is written by the frontend bridge, `tooling/frontend-bridge` in the
+ * xema-monorepo aggregator.
  *
  * Consumers must call `configureClient()` before using any endpoint function.
  * The baseUrl is prepended to the relative paths generated by Orval.
@@ -31,6 +41,21 @@ export interface RetryNotice {
     /** HTTP method being re-requested. */
     method: string;
 }
+/**
+ * Per-request context handed to the callbacks this transport awaits BEFORE it
+ * sends the request.
+ *
+ * `signal` is the request's own `AbortSignal` (`options.signal`). It is the
+ * CALLER's cancellation: a callback may use it to stop work that is private to
+ * this request, but a callback serving several requests from one shared,
+ * single-flight acquisition (a token refresh) must NOT abort that shared work
+ * because one caller stopped — every other caller waiting on it would fail.
+ * The transport stops WAITING on its own regardless, so a callback that
+ * ignores the signal still cannot hold an aborted request.
+ */
+export interface ClientCallbackOptions {
+    signal?: AbortSignal;
+}
 export interface ClientConfig {
     /**
      * Static base URL (e.g. 'http://localhost:3140') — no trailing slash.
@@ -42,9 +67,13 @@ export interface ClientConfig {
      * the service registry on EVERY request (boot-order-safe). Wired by
      * `configureOrvalClientResolved` from `@xemahq/platform-common`.
      */
-    baseUrlResolver?: () => string | Promise<string>;
-    /** Optional async callback to get an auth token. Auto-sets Authorization header on every request. */
-    getAuthToken?: () => Promise<string>;
+    baseUrlResolver?: (options?: ClientCallbackOptions) => string | Promise<string>;
+    /**
+     * Optional async callback to get an auth token. Auto-sets Authorization
+     * header on every request. Receives the request's signal — see
+     * {@link ClientCallbackOptions} for what it may and may not abort.
+     */
+    getAuthToken?: (options?: ClientCallbackOptions) => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
     /**
@@ -97,6 +126,7 @@ export declare class ClientError extends Error {
     readonly url: string;
     readonly body: unknown;
     constructor(status: number, url: string, body: unknown);
+    static [Symbol.hasInstance](candidate: unknown): boolean;
 }
 export declare function configureClient(config: ClientConfig): void;
 export declare function getClientConfig(): ClientConfig;

package/dist/custom-fetch.js

@@ -2,11 +2,21 @@
 /**
  * Configurable fetch wrapper for Orval-generated clients.
  *
- * GENERATED by `@xemahq/api-client-generator` — do not edit. Every client in
- * the fleet ships this file byte-for-byte; a local edit is erased by the next
- * `pnpm refresh` and, until then, makes this one client speak to the platform
- * differently from all of its siblings. Change the template instead:
- * `api-client-generator/src/lib/custom-fetch-template.ts`.
+ * AUTO-GENERATED by `@xemahq/api-client-generator` — DO NOT EDIT. Every client
+ * in the fleet ships this file byte-for-byte; a hand edit is erased by the next
+ * regeneration and, until then, makes this one client speak to the platform
+ * differently from all of its siblings.
+ *
+ * Canonical source: `CANONICAL_CUSTOM_FETCH` in
+ * `packages/sdks/api-client-generator/src/lib/custom-fetch-template.ts`
+ * (repository `xema-kernel-sdk`). Change it there.
+ *
+ * Regenerate, from the root of THIS repository:
+ *   pnpm --filter <owning-service> run openapi
+ *   pnpm --filter <owning-service> run client:generate
+ * A mirror of this client under `xema-host-web` is not regenerated there: it
+ * is written by the frontend bridge, `tooling/frontend-bridge` in the
+ * xema-monorepo aggregator.
  *
  * Consumers must call `configureClient()` before using any endpoint function.
  * The baseUrl is prepended to the relative paths generated by Orval.
@@ -19,6 +29,50 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.customFetch = exports.ClientError = void 0;
 exports.configureClient = configureClient;
 exports.getClientConfig = getClientConfig;
+/**
+ * Cross-package identity for `ClientError`.
+ *
+ * ── THE OUTAGE THIS IS FOR ────────────────────────────────────────────────
+ *
+ * PRODUCTION, 2026-09-22. A session launch aborted on
+ * `HTTP 503 from http://skill-registry-api…/skills`. A 503 is the archetypal
+ * TRANSIENT — agent-session's launch taxonomy already listed it as retryable —
+ * but it was classified PERMANENT and the launch was abandoned.
+ *
+ * The cause was this file. Every generated client package gets its OWN copy of
+ * `ClientError`, so there are as many classes as there are clients (81 at the
+ * time of writing), all byte-identical and all DIFFERENT OBJECTS. A consumer
+ * naturally writes `err instanceof ClientError` against the one client it
+ * imported — which reads as obviously correct and is silently package-local. An
+ * error from any OTHER client fails it, falls past every status check, and lands
+ * on whatever the default is.
+ *
+ * That was not the first time: biome-host had already switched to structural
+ * detection for the same reason, and canopy imports TWO `ClientError` classes
+ * and tests both. Three more call sites elsewhere carry the same shape.
+ *
+ * ── WHY A BRAND AND NOT A SHARED PACKAGE ─────────────────────────────────
+ *
+ * The obvious fix is one shared runtime class every client imports. It was
+ * rejected on measurement: the 81 generated clients are DEPENDENCY-FREE by
+ * design (exactly one has any dependency at all), and a shared class would have
+ * to be a PEER dependency to be safe — a normal dependency can be installed
+ * twice under version skew, which reinstates this identical bug in a form that
+ * is HARDER to see, because the classes then look like they ought to match.
+ *
+ * `Symbol.for` is a process-wide registry keyed by STRING, so every copy of
+ * this template resolves the same symbol without importing anything. The brand
+ * costs no dependency, cannot skew, and needs no new package.
+ *
+ * `Symbol.hasInstance` then makes plain `instanceof` mean the right thing
+ * fleet-wide: an error from ANY generated client satisfies `instanceof
+ * ClientError` in ANY other. A helper would have made the safe pattern
+ * available; this makes the dangerous pattern impossible.
+ *
+ * Narrow on purpose — the brand is set only by this constructor, so an unrelated
+ * error carrying a `status` is not admitted.
+ */
+const CLIENT_ERROR_BRAND = Symbol.for('xema.generatedClientError');
 class ClientError extends Error {
     status;
     url;
@@ -29,10 +83,67 @@ class ClientError extends Error {
         this.url = url;
         this.body = body;
         this.name = 'ClientError';
+        // Non-enumerable: it must not appear in JSON, logs or snapshots — it is an
+        // identity marker, not payload.
+        Object.defineProperty(this, CLIENT_ERROR_BRAND, { value: true });
+    }
+    // `override` because the member shadows `Function.prototype[Symbol.hasInstance]`,
+    // which a class constructor inherits: TypeScript 5.9+ reports TS4114 without it
+    // under `noImplicitOverride`. Measured to compile on 5.5.4, 5.9.3, 6.0.3 and
+    // 7.0.2 with the flag on AND off — pinned by
+    // tests/custom-fetch-compiles-standalone.test.cjs.
+    static [Symbol.hasInstance](candidate) {
+        return (typeof candidate === 'object' &&
+            candidate !== null &&
+            CLIENT_ERROR_BRAND in candidate);
     }
 }
 exports.ClientError = ClientError;
 let clientConfig = null;
+/**
+ * THE MOUNT SCOPE — how one process can host several services without their
+ * clients speaking for each other.
+ *
+ * `clientConfig` below is a MODULE global, and in a single-service process
+ * that is correct: one writer, one configuration. Compose two services into one
+ * process and both call `configureClient` on THIS SAME module instance, so the
+ * second overwrites the first and every outbound call from BOTH services leaves
+ * as whichever wired itself last — wrong base URL, and, because
+ * `getAuthToken` is part of the config, WRONG BEARER. That is one tenant's
+ * service calling a peer holding another tenant's credential, and it is silent.
+ *
+ * A composing host installs a hook under this well-known symbol that answers
+ * one question: WHICH MOUNT is currently on the stack. Nothing else crosses.
+ * `configureClient` then files the config under that mount, and
+ * `getClientConfig` reads it back out under the same key.
+ *
+ * Three properties make this safe rather than clever:
+ *
+ *   - The CONFIG is still built by the mount's own wiring, exactly as today.
+ *     The hook never supplies one. So a mount's base URL and bearer are
+ *     resolved FROM THE MOUNT; the scope only decides which drawer they go in.
+ *     A hook that RETURNED configuration would be a mount taking its identity
+ *     from ambient storage a neighbour can write — the inversion to refuse.
+ *   - The key is an OPAQUE OBJECT and the store is a `WeakMap`, so a mount's
+ *     configuration becomes unreachable when the host drops the mount, and no
+ *     client can enumerate the mounts or reach a sibling's entry.
+ *   - With NO hook installed — every process in the fleet today — both
+ *     functions behave exactly as they did before this existed.
+ *
+ * `Symbol.for` is the seam because a generated client must keep its
+ * dependency surface at zero and a host cannot enumerate the clients a process
+ * happens to load. It is the same instrument, and the same reasoning, as the
+ * `ClientError` brand above.
+ */
+const XEMA_CLIENT_CONFIG_SCOPE = Symbol.for('xema.client-config-scope');
+function mountScopeHook() {
+    const hook = globalThis[XEMA_CLIENT_CONFIG_SCOPE];
+    return typeof hook === 'function' ? hook : undefined;
+}
+function currentMountKey() {
+    return mountScopeHook()?.();
+}
+const perMountConfig = new WeakMap();
 function configureClient(config) {
     // Fail at WIRING time, not on the request that happens to be retried. A
     // client configured to retry without an observer is the exact defect this
@@ -42,9 +153,38 @@ function configureClient(config) {
             'reports is indistinguishable from a slow server, which is how two ' +
             'silent re-attempts were read as a 3,312ms call.');
     }
+    const hook = mountScopeHook();
+    if (hook !== undefined) {
+        const mount = hook();
+        if (mount === undefined) {
+            // A composing host is installed and no member is on the stack, so this
+            // configuration belongs to NO member. Filing it in the module global
+            // would hand it to every member that did not configure this client —
+            // someone else's base URL and bearer, silently.
+            throw new Error('configureClient: called in a composed process outside every member. ' +
+                'Configure the client inside the member that uses it (its providers ' +
+                'and factories already run there).');
+        }
+        perMountConfig.set(mount, config);
+        return;
+    }
     clientConfig = config;
 }
 function getClientConfig() {
+    const mount = currentMountKey();
+    if (mount !== undefined) {
+        const scoped = perMountConfig.get(mount);
+        if (scoped) {
+            return scoped;
+        }
+        // A member that never configured THIS client behaves exactly like a
+        // dedicated service that did not either: it is refused. It used to fall
+        // through to the module global, which in a composed process can only have
+        // been written by some OTHER code — so the member called peers under a
+        // base URL and bearer that were never its own.
+        throw new Error('Client not configured for this member. Call configureClient({ baseUrl }) ' +
+            'inside the member before using endpoint functions.');
+    }
     if (!clientConfig) {
         throw new Error('Client not configured. Call configureClient({ baseUrl }) before using endpoint functions.');
     }
@@ -103,11 +243,64 @@ const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
 const MAX_BACKOFF_MS = 30_000;
-async function buildHeaders(config, callerHeaders) {
+/*
+ * CALLER CANCELLATION REACHES EVERY WAIT BEFORE THE REQUEST IS SENT.
+ *
+ * `fetch` always honoured `options.signal`, but everything this transport
+ * awaits BEFORE `fetch` — base-URL resolution, the header callbacks, the auth
+ * token — did not, so a caller that aborted while a token was being minted sat
+ * out the mint and then, at best, had its request refused. The only way to
+ * cancel that wait was a process-wide interceptor aborting every outbound
+ * request, which also aborts a SHARED single-flight token refresh and so fails
+ * every other caller waiting on it.
+ *
+ * So each pre-send wait is RACED against the signal: the caller stops waiting
+ * at once, and the work it was waiting on carries on for anybody else. The
+ * rejection is the signal's own reason — exactly what `fetch` rejects with —
+ * so a caller sees ONE abort shape whenever it aborts. An aborted request is
+ * never retried. Without a signal nothing here changes.
+ */
+function abortedReason(signal) {
+    // `abort()` with no argument sets a DOMException reason, so this is only
+    // ever `undefined` for a hand-built signal; say so rather than throw it.
+    return signal.reason ?? new DOMException('This operation was aborted', 'AbortError');
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted) {
+        throw abortedReason(signal);
+    }
+}
+function raceAbort(pending, signal) {
+    const promise = Promise.resolve(pending);
+    if (!signal) {
+        return promise;
+    }
+    if (signal.aborted) {
+        promise.catch(() => undefined);
+        return Promise.reject(abortedReason(signal));
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            // The pending work may be shared; it carries on, and its eventual
+            // rejection must not surface as an unhandled one on this side.
+            promise.catch(() => undefined);
+            reject(abortedReason(signal));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (err) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(err);
+        });
+    });
+}
+async function buildHeaders(config, callerHeaders, signal) {
     const headers = new Headers(callerHeaders);
     // Global headers from config (caller-provided headers take precedence)
     if (config.getHeaders) {
-        const globalHeaders = await Promise.resolve(config.getHeaders());
+        const globalHeaders = await raceAbort(config.getHeaders(), signal);
         for (const [key, value] of Object.entries(globalHeaders)) {
             if (!headers.has(key)) {
                 headers.set(key, value);
@@ -126,14 +319,14 @@ async function buildHeaders(config, callerHeaders) {
     // receiver mints and a new trace begins, which is the truthful outcome when
     // there is nothing to continue.
     if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
-        const correlationId = await Promise.resolve(config.getCorrelationId());
+        const correlationId = await raceAbort(config.getCorrelationId(), signal);
         if (correlationId) {
             headers.set(CORRELATION_ID_HEADER, correlationId);
         }
     }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
-        const token = await config.getAuthToken();
+        const token = await raceAbort(config.getAuthToken(signal ? { signal } : undefined), signal);
         headers.set('Authorization', `Bearer ${token}`);
     }
     return headers;
@@ -163,8 +356,10 @@ async function buildHeaders(config, callerHeaders) {
  */
 const customFetch = async (url, options) => {
     const config = getClientConfig();
+    const signal = options.signal ?? undefined;
+    throwIfAborted(signal);
     const base = config.baseUrlResolver
-        ? await config.baseUrlResolver()
+        ? await raceAbort(config.baseUrlResolver(signal ? { signal } : undefined), signal)
         : config.baseUrl;
     if (base === undefined) {
         throw new Error('Client not configured: set baseUrl or baseUrlResolver via configureClient().');
@@ -176,7 +371,7 @@ const customFetch = async (url, options) => {
     // re-sending would replay the identical failing request with the identical
     // credential: one wasted round trip, plus a global refresh nobody asked for.
     const callerSuppliedAuth = new Headers(options.headers).has('Authorization');
-    const headers = await buildHeaders(config, options.headers);
+    const headers = await buildHeaders(config, options.headers, signal);
     const requestInit = { ...options, headers };
     let delay = BASE_BACKOFF_MS;
     for (let attempt = 0;; attempt++) {
@@ -185,8 +380,8 @@ const customFetch = async (url, options) => {
             config.onUnauthorized &&
             !callerSuppliedAuth &&
             attempt === 0) {
-            await config.onUnauthorized();
-            const refreshedHeaders = await buildHeaders(config, options.headers);
+            await raceAbort(config.onUnauthorized(), signal);
+            const refreshedHeaders = await buildHeaders(config, options.headers, signal);
             const retryResponse = await fetch(fullUrl, {
                 ...options,
                 headers: refreshedHeaders,
@@ -218,7 +413,7 @@ const customFetch = async (url, options) => {
             url: fullUrl,
             method: options.method ?? 'GET',
         });
-        await sleep(waitMs);
+        await sleep(waitMs, signal);
         delay = Math.min(delay * 2, MAX_BACKOFF_MS);
     }
 };
@@ -299,7 +494,24 @@ function parseRetryAfter(value) {
 function addJitter(delay) {
     return delay + (Math.random() * 2 - 1) * delay * 0.25;
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+/** A retry backoff; the caller's signal ends it at once and is never retried. */
+function sleep(ms, signal) {
+    if (!signal) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    if (signal.aborted) {
+        return Promise.reject(abortedReason(signal));
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(abortedReason(signal));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
 }
 exports.default = exports.customFetch;

package/dist/models/assignRoleDto.d.ts

@@ -6,7 +6,7 @@
 import type { SubjectKind } from './subjectKind.js';
 export interface AssignRoleDto {
     /**
-       * The org this assignment is scoped to. For a custom role it must equal the role’s org; for a built-in role (system sentinel) it is the real consuming org.
+       * The org this assignment is scoped to. For a custom role it must equal the role’s org; for a built-in (platform-owned) role it is the real consuming org.
        * @minLength 1
        */
     orgId: string;

package/dist/models/authorityRowOwnerSpaceKind.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Who owns this grant: `system` (the platform — kernel-seeded, shared by every org) or `org`. The admissible subset of the kernel `SpaceKind` for a role or a capability grant.
+ */
+export type AuthorityRowOwnerSpaceKind = typeof AuthorityRowOwnerSpaceKind[keyof typeof AuthorityRowOwnerSpaceKind];
+export declare const AuthorityRowOwnerSpaceKind: {
+    readonly system: "system";
+    readonly org: "org";
+};

package/dist/models/authorityRowOwnerSpaceKind.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorityRowOwnerSpaceKind = void 0;
+exports.AuthorityRowOwnerSpaceKind = {
+    system: 'system',
+    org: 'org',
+};

package/dist/models/capabilityGrantDto.d.ts

@@ -3,13 +3,19 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { AuthorityRowOwnerSpaceKind } from './authorityRowOwnerSpaceKind.js';
 import type { BiomePermissionProfile } from './biomePermissionProfile.js';
 import type { GrantConstraintsDto } from './grantConstraintsDto.js';
 import type { SubjectKind } from './subjectKind.js';
 export interface CapabilityGrantDto {
     id: string;
-    /** Organization identifier this grant is scoped to. */
-    orgId: string;
+    /**
+       * The owning organisation, or null when the PLATFORM owns this grant (`ownerSpaceKind` = system).
+       * @nullable
+       */
+    orgId: string | null;
+    /** Who owns this grant: `system` (the platform — kernel-seeded, shared by every org) or `org`. The admissible subset of the kernel `SpaceKind` for a role or a capability grant. */
+    ownerSpaceKind: AuthorityRowOwnerSpaceKind;
     subjectKind: SubjectKind;
     subjectRef: string;
     capability: string;

package/dist/models/index.d.ts

@@ -5,6 +5,7 @@ export * from './agentProvisionDecision';
 export * from './agentProvisionReason';
 export * from './agentReachTier';
 export * from './assignRoleDto';
+export * from './authorityRowOwnerSpaceKind';
 export * from './authorizationCheckRequestDto';
 export * from './authorizationCheckResponseDto';
 export * from './authorizationCheckResponseDtoDataEnvelope';
@@ -121,6 +122,7 @@ export * from './policyConstraintsDto';
 export * from './policyDecisionDto';
 export * from './policyDecisionDtoDataEnvelope';
 export * from './policyDecisionKind';
+export * from './policyDelegatedAuthorityDto';
 export * from './policyEnvironmentDto';
 export * from './policyObligationDto';
 export * from './policyObligationKind';

package/dist/models/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./agentProvisionDecision"), exports);
 __exportStar(require("./agentProvisionReason"), exports);
 __exportStar(require("./agentReachTier"), exports);
 __exportStar(require("./assignRoleDto"), exports);
+__exportStar(require("./authorityRowOwnerSpaceKind"), exports);
 __exportStar(require("./authorizationCheckRequestDto"), exports);
 __exportStar(require("./authorizationCheckResponseDto"), exports);
 __exportStar(require("./authorizationCheckResponseDtoDataEnvelope"), exports);
@@ -138,6 +139,7 @@ __exportStar(require("./policyConstraintsDto"), exports);
 __exportStar(require("./policyDecisionDto"), exports);
 __exportStar(require("./policyDecisionDtoDataEnvelope"), exports);
 __exportStar(require("./policyDecisionKind"), exports);
+__exportStar(require("./policyDelegatedAuthorityDto"), exports);
 __exportStar(require("./policyEnvironmentDto"), exports);
 __exportStar(require("./policyObligationDto"), exports);
 __exportStar(require("./policyObligationKind"), exports);

package/dist/models/openCapabilityAuthorityRequestDtoSubjectKind.d.ts

@@ -18,4 +18,5 @@ export declare const OpenCapabilityAuthorityRequestDtoSubjectKind: {
     readonly runner: "runner";
     readonly 'external-subject': "external-subject";
     readonly anon: "anon";
+    readonly organization: "organization";
 };

package/dist/models/openCapabilityAuthorityRequestDtoSubjectKind.js

@@ -17,4 +17,5 @@ exports.OpenCapabilityAuthorityRequestDtoSubjectKind = {
     runner: 'runner',
     'external-subject': 'external-subject',
     anon: 'anon',
+    organization: 'organization',
 };

package/dist/models/policyCheckRequestDto.d.ts

@@ -10,6 +10,7 @@ import type { PolicyCallerDto } from './policyCallerDto.js';
 import type { PolicyCapabilityDto } from './policyCapabilityDto.js';
 import type { PolicyCheckRequestDtoAperture } from './policyCheckRequestDtoAperture.js';
 import type { PolicyConstraintsDto } from './policyConstraintsDto.js';
+import type { PolicyDelegatedAuthorityDto } from './policyDelegatedAuthorityDto.js';
 import type { PolicyEnvironmentDto } from './policyEnvironmentDto.js';
 import type { PolicyResourceDto } from './policyResourceDto.js';
 import type { PolicySpaceRefDto } from './policySpaceRefDto.js';
@@ -31,6 +32,13 @@ export interface PolicyCheckRequestDto {
     resource?: PolicyResourceDto;
     constraints?: PolicyConstraintsDto;
     actorChain?: PolicyActingForDto[];
+    /**
+       * The caller's VERIFIED delegated authority (kernel
+       * `ExecutionContext.delegation`). A CEILING, never a grant — see
+       * {@link PolicyDelegatedAuthorityDto} and the PDP stage that reads it
+       * (`AuthorizationService.applyDelegatedAuthorityCeiling`).
+       */
+    delegation?: PolicyDelegatedAuthorityDto;
     /**
        * Opaque credential-binding id already selected for this invocation. Carried
        * on the kernel envelope (a re-checked / replayed context round-trips it), so

package/dist/models/policyDelegatedAuthorityDto.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicyActingForDto } from './policyActingForDto.js';
+export interface PolicyDelegatedAuthorityDto {
+    /** @minLength 1 */
+    delegationId: string;
+    actor: PolicyActingForDto;
+    /** @minItems 1 */
+    actorChain: PolicyActingForDto[];
+    /**
+       * @minItems 1
+       * @items.minLength 1
+       */
+    capabilities: string[];
+    /**
+       * @minItems 1
+       * @items.minLength 1
+       */
+    resourceScope?: string[];
+    /** @minLength 1 */
+    authorizedBy?: string;
+}

package/dist/models/policyDelegatedAuthorityDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/roleDto.d.ts

@@ -3,10 +3,17 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+import type { AuthorityRowOwnerSpaceKind } from './authorityRowOwnerSpaceKind.js';
 import type { ResourceManagedBy } from './resourceManagedBy.js';
 export interface RoleDto {
     id: string;
-    orgId: string;
+    /**
+       * The owning organisation, or null when the PLATFORM owns this role (`ownerSpaceKind` = system).
+       * @nullable
+       */
+    orgId: string | null;
+    /** Who owns this role: `system` (the platform — kernel-seeded, shared by every org) or `org`. The admissible subset of the kernel `SpaceKind` for a role or a capability grant. */
+    ownerSpaceKind: AuthorityRowOwnerSpaceKind;
     slug: string;
     displayName: string;
     /** @nullable */

package/dist/models/subjectKind.d.ts

@@ -15,4 +15,5 @@ export declare const SubjectKind: {
     readonly runner: "runner";
     readonly 'external-subject': "external-subject";
     readonly anon: "anon";
+    readonly organization: "organization";
 };

package/dist/models/subjectKind.js

@@ -17,4 +17,5 @@ exports.SubjectKind = {
     runner: 'runner',
     'external-subject': 'external-subject',
     anon: 'anon',
+    organization: 'organization',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.4.28",
+  "version": "0.5.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "authorization-api",
     "biome": "authorization",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.21.0",
+    "generator": "@xemahq/api-client-generator@2.1.1",
     "source": "openapi.internal.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",