@xemahq/authorization-internal-api-client 0.5.2 → 0.6.0

package/dist/endpoints/authorization/authorization.d.ts

@@ -3,28 +3,10 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { AuthorizationCheckRequestDto, AuthorizationCheckResponseDtoDataEnvelope, GrantVersionResponseDtoDataEnvelope, PolicyCheckBatchRequestDto, PolicyCheckBatchResponseDtoDataEnvelope, PolicyCheckRequestDto, PolicyDecisionDtoDataEnvelope } from '../../models';
-export declare const getAuthorizationControllerCheckUrl: () => string;
-/**
- * Called by xema-capability-router on every invocation. The verdict is OpenFGA-authoritative and then narrowed, in order, by the delegation clamp, the agent reach tier, and the ENVIRONMENT reach ceiling (the environment runs last on purpose: it is the outer boundary, so it must see the tier's output — a `connected` tier extends a deny into an allow, and the environment may then take that away). `requiresApproval` denies with APPROVAL_REQUIRED. NOT enforced here: `rateLimit` (accepted on a grant, read by nothing) and `ExecutionEnvironment.allowedCapabilities` (an enumerated per-ref list, deliberately not wired for the built-ins — see `environment-reach-ceiling`; it is enforced only by app-function-broker, for org-custom environments).
- * @summary Runtime allow/deny decision for a (subject, capability) tuple
- */
-export declare const authorizationControllerCheck: (authorizationCheckRequestDto: AuthorizationCheckRequestDto, options?: RequestInit) => Promise<AuthorizationCheckResponseDtoDataEnvelope>;
+import type { GrantVersionResponseDtoDataEnvelope } from '../../models';
 export declare const getAuthorizationControllerGrantVersionUrl: (orgId: string) => string;
 /**
  * A cheap read of the per-org grant-version counter — bumped on every grant/environment/membership change. Consumers (e.g. app-platform delegated-session verify) key a short-lived effective-capability cache by it so a revoked role takes effect at the next miss rather than at token expiry. Fail-closed: an unavailable version store surfaces as a 5xx so the caller denies.
  * @summary Current durable monotonic grant-version for an org
  */
 export declare const authorizationControllerGrantVersion: (orgId: string, options?: RequestInit) => Promise<GrantVersionResponseDtoDataEnvelope>;
-export declare const getAuthorizationControllerPolicyCheckUrl: () => string;
-/**
- *  wire surface. Accepts a PolicyRequest (== ExecutionContext) constructed by the capability router at the gateway boundary; returns a typed PolicyDecision { kind, reason?, obligations?, routeHints? }. The same decision matrix that powers POST /authorization/check is reused — this endpoint projects the verdict into the v4.3 envelope so the router can branch structurally on PolicyDecisionKind without parsing strings.
- * @summary Typed PolicyDecision for an ExecutionContext
- */
-export declare const authorizationControllerPolicyCheck: (policyCheckRequestDto: PolicyCheckRequestDto, options?: RequestInit) => Promise<PolicyDecisionDtoDataEnvelope>;
-export declare const getAuthorizationControllerPolicyCheckBatchUrl: () => string;
-/**
- * Wave-4 M1 batch surface. Accepts up to 128 independent PolicyRequests (each the EXACT single policy-check shape; 422 beyond the bound) and returns PolicyDecisions POSITIONALLY aligned with the request (results[i] is the decision for checks[i]). Every item runs the SAME decision pipeline as POST /authorization/policy-check — the batch only amortises HTTP round-trips for enumerating consumers (the capability BFF list path). Never-partial: a per-item DENY is a result, but any infrastructure failure mid-batch fails the whole call with 503. The PDP does not add batch-level caching; consumers own caching.
- * @summary Batch of typed PolicyDecisions for independent ExecutionContexts
- */
-export declare const authorizationControllerPolicyCheckBatch: (policyCheckBatchRequestDto: PolicyCheckBatchRequestDto, options?: RequestInit) => Promise<PolicyCheckBatchResponseDtoDataEnvelope>;

package/dist/endpoints/authorization/authorization.js

@@ -1,24 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizationControllerPolicyCheckBatch = exports.getAuthorizationControllerPolicyCheckBatchUrl = exports.authorizationControllerPolicyCheck = exports.getAuthorizationControllerPolicyCheckUrl = exports.authorizationControllerGrantVersion = exports.getAuthorizationControllerGrantVersionUrl = exports.authorizationControllerCheck = exports.getAuthorizationControllerCheckUrl = void 0;
+exports.authorizationControllerGrantVersion = exports.getAuthorizationControllerGrantVersionUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
-const getAuthorizationControllerCheckUrl = () => {
-    return `/authorization/check`;
-};
-exports.getAuthorizationControllerCheckUrl = getAuthorizationControllerCheckUrl;
-/**
- * Called by xema-capability-router on every invocation. The verdict is OpenFGA-authoritative and then narrowed, in order, by the delegation clamp, the agent reach tier, and the ENVIRONMENT reach ceiling (the environment runs last on purpose: it is the outer boundary, so it must see the tier's output — a `connected` tier extends a deny into an allow, and the environment may then take that away). `requiresApproval` denies with APPROVAL_REQUIRED. NOT enforced here: `rateLimit` (accepted on a grant, read by nothing) and `ExecutionEnvironment.allowedCapabilities` (an enumerated per-ref list, deliberately not wired for the built-ins — see `environment-reach-ceiling`; it is enforced only by app-function-broker, for org-custom environments).
- * @summary Runtime allow/deny decision for a (subject, capability) tuple
- */
-const authorizationControllerCheck = async (authorizationCheckRequestDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerCheckUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(authorizationCheckRequestDto)
-    });
-};
-exports.authorizationControllerCheck = authorizationControllerCheck;
 const getAuthorizationControllerGrantVersionUrl = (orgId) => {
     return `/authorization/grant-version/${orgId}`;
 };
@@ -34,37 +17,3 @@ const authorizationControllerGrantVersion = async (orgId, options) => {
     });
 };
 exports.authorizationControllerGrantVersion = authorizationControllerGrantVersion;
-const getAuthorizationControllerPolicyCheckUrl = () => {
-    return `/authorization/policy-check`;
-};
-exports.getAuthorizationControllerPolicyCheckUrl = getAuthorizationControllerPolicyCheckUrl;
-/**
- *  wire surface. Accepts a PolicyRequest (== ExecutionContext) constructed by the capability router at the gateway boundary; returns a typed PolicyDecision { kind, reason?, obligations?, routeHints? }. The same decision matrix that powers POST /authorization/check is reused — this endpoint projects the verdict into the v4.3 envelope so the router can branch structurally on PolicyDecisionKind without parsing strings.
- * @summary Typed PolicyDecision for an ExecutionContext
- */
-const authorizationControllerPolicyCheck = async (policyCheckRequestDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerPolicyCheckUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(policyCheckRequestDto)
-    });
-};
-exports.authorizationControllerPolicyCheck = authorizationControllerPolicyCheck;
-const getAuthorizationControllerPolicyCheckBatchUrl = () => {
-    return `/authorization/policy-check/batch`;
-};
-exports.getAuthorizationControllerPolicyCheckBatchUrl = getAuthorizationControllerPolicyCheckBatchUrl;
-/**
- * Wave-4 M1 batch surface. Accepts up to 128 independent PolicyRequests (each the EXACT single policy-check shape; 422 beyond the bound) and returns PolicyDecisions POSITIONALLY aligned with the request (results[i] is the decision for checks[i]). Every item runs the SAME decision pipeline as POST /authorization/policy-check — the batch only amortises HTTP round-trips for enumerating consumers (the capability BFF list path). Never-partial: a per-item DENY is a result, but any infrastructure failure mid-batch fails the whole call with 503. The PDP does not add batch-level caching; consumers own caching.
- * @summary Batch of typed PolicyDecisions for independent ExecutionContexts
- */
-const authorizationControllerPolicyCheckBatch = async (policyCheckBatchRequestDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerPolicyCheckBatchUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(policyCheckBatchRequestDto)
-    });
-};
-exports.authorizationControllerPolicyCheckBatch = authorizationControllerPolicyCheckBatch;

package/dist/endpoints/authorization-policy-sets/authorization-policy-sets.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { AdoptOrgPolicySetDto, OrgPolicySetDtoDataEnvelope, PolicySetTestResultsDtoDataEnvelope, RetiredNamespaceDtoDataEnvelope, RunPolicySetTestsDto } from '../../models';
+export declare const getPolicySetsControllerOrgPolicySetUrl: (orgId: string) => string;
+/**
+ * @summary The org's own policy set, or policySetId null when it runs the sealed base
+ */
+export declare const policySetsControllerOrgPolicySet: (orgId: string, options?: RequestInit) => Promise<OrgPolicySetDtoDataEnvelope>;
+export declare const getPolicySetsControllerAdoptUrl: (orgId: string) => string;
+/**
+ * The PDP composes the base with runtimeModules itself. 422 POLICY_SET_HASH_MISMATCH when that composition is not policySetId; 422 POLICY_SET_COMPOSITION_REFUSED when the kernel composer refuses it; 409 POLICY_SET_SWITCH_CONFLICT when the pointer is no longer expectedCurrentPolicySetId. Identical compositions share one stored model. Moves this org only; an empty set returns it to the base.
+ * @summary Adopt a composed policy set for ONE org (CAS on its pointer)
+ */
+export declare const policySetsControllerAdopt: (orgId: string, adoptOrgPolicySetDto: AdoptOrgPolicySetDto, options?: RequestInit) => Promise<void>;
+export declare const getPolicySetsControllerRetireUrl: (orgId: string, namespace: string) => string;
+/**
+ * @summary Uninstall steps 1–2 for one org: deny the namespace, delete its facts and the parent facts into it
+ */
+export declare const policySetsControllerRetire: (orgId: string, namespace: string, options?: RequestInit) => Promise<RetiredNamespaceDtoDataEnvelope>;
+export declare const getPolicySetsControllerRunTestsUrl: () => string;
+/**
+ * @summary Run a composed model's .fga.yaml tests against the real OpenFGA server, each in an ephemeral store
+ */
+export declare const policySetsControllerRunTests: (runPolicySetTestsDto: RunPolicySetTestsDto, options?: RequestInit) => Promise<PolicySetTestResultsDtoDataEnvelope>;

package/dist/endpoints/authorization-policy-sets/authorization-policy-sets.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policySetsControllerRunTests = exports.getPolicySetsControllerRunTestsUrl = exports.policySetsControllerRetire = exports.getPolicySetsControllerRetireUrl = exports.policySetsControllerAdopt = exports.getPolicySetsControllerAdoptUrl = exports.policySetsControllerOrgPolicySet = exports.getPolicySetsControllerOrgPolicySetUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getPolicySetsControllerOrgPolicySetUrl = (orgId) => {
+    return `/internal/authorization/orgs/${orgId}/policy-set`;
+};
+exports.getPolicySetsControllerOrgPolicySetUrl = getPolicySetsControllerOrgPolicySetUrl;
+/**
+ * @summary The org's own policy set, or policySetId null when it runs the sealed base
+ */
+const policySetsControllerOrgPolicySet = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerOrgPolicySetUrl)(orgId), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.policySetsControllerOrgPolicySet = policySetsControllerOrgPolicySet;
+const getPolicySetsControllerAdoptUrl = (orgId) => {
+    return `/internal/authorization/orgs/${orgId}/policy-set`;
+};
+exports.getPolicySetsControllerAdoptUrl = getPolicySetsControllerAdoptUrl;
+/**
+ * The PDP composes the base with runtimeModules itself. 422 POLICY_SET_HASH_MISMATCH when that composition is not policySetId; 422 POLICY_SET_COMPOSITION_REFUSED when the kernel composer refuses it; 409 POLICY_SET_SWITCH_CONFLICT when the pointer is no longer expectedCurrentPolicySetId. Identical compositions share one stored model. Moves this org only; an empty set returns it to the base.
+ * @summary Adopt a composed policy set for ONE org (CAS on its pointer)
+ */
+const policySetsControllerAdopt = async (orgId, adoptOrgPolicySetDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerAdoptUrl)(orgId), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(adoptOrgPolicySetDto)
+    });
+};
+exports.policySetsControllerAdopt = policySetsControllerAdopt;
+const getPolicySetsControllerRetireUrl = (orgId, namespace) => {
+    return `/internal/authorization/orgs/${orgId}/module-namespaces/${namespace}/retire`;
+};
+exports.getPolicySetsControllerRetireUrl = getPolicySetsControllerRetireUrl;
+/**
+ * @summary Uninstall steps 1–2 for one org: deny the namespace, delete its facts and the parent facts into it
+ */
+const policySetsControllerRetire = async (orgId, namespace, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerRetireUrl)(orgId, namespace), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.policySetsControllerRetire = policySetsControllerRetire;
+const getPolicySetsControllerRunTestsUrl = () => {
+    return `/internal/authorization/policy-sets/test`;
+};
+exports.getPolicySetsControllerRunTestsUrl = getPolicySetsControllerRunTestsUrl;
+/**
+ * @summary Run a composed model's .fga.yaml tests against the real OpenFGA server, each in an ephemeral store
+ */
+const policySetsControllerRunTests = async (runPolicySetTestsDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerRunTestsUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(runPolicySetTestsDto)
+    });
+};
+exports.policySetsControllerRunTests = policySetsControllerRunTests;

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { configureClient, getClientConfig, ClientError, customFetch, type Client
 export * from './models';
 export * from './endpoints/agents/agents';
 export * from './endpoints/authorization/authorization';
+export * from './endpoints/authorization-policy-sets/authorization-policy-sets';
 export * from './endpoints/capability-authority-requests/capability-authority-requests';
 export * from './endpoints/contribution-sync/contribution-sync';
 export * from './endpoints/credential-defaults/credential-defaults';
@@ -13,6 +14,5 @@ export * from './endpoints/output-routes/output-routes';
 export * from './endpoints/profiles/profiles';
 export * from './endpoints/relationships/relationships';
 export * from './endpoints/resource-revisions/resource-revisions';
-export * from './endpoints/resources/resources';
 export * from './endpoints/roles/roles';
 export * from './endpoints/teams/teams';

package/dist/index.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "customFetch", { enumerable: true, get: function
 __exportStar(require("./models"), exports);
 __exportStar(require("./endpoints/agents/agents"), exports);
 __exportStar(require("./endpoints/authorization/authorization"), exports);
+__exportStar(require("./endpoints/authorization-policy-sets/authorization-policy-sets"), exports);
 __exportStar(require("./endpoints/capability-authority-requests/capability-authority-requests"), exports);
 __exportStar(require("./endpoints/contribution-sync/contribution-sync"), exports);
 __exportStar(require("./endpoints/credential-defaults/credential-defaults"), exports);
@@ -35,6 +36,5 @@ __exportStar(require("./endpoints/output-routes/output-routes"), exports);
 __exportStar(require("./endpoints/profiles/profiles"), exports);
 __exportStar(require("./endpoints/relationships/relationships"), exports);
 __exportStar(require("./endpoints/resource-revisions/resource-revisions"), exports);
-__exportStar(require("./endpoints/resources/resources"), exports);
 __exportStar(require("./endpoints/roles/roles"), exports);
 __exportStar(require("./endpoints/teams/teams"), exports);

package/dist/models/adoptOrgPolicySetDto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RuntimeModuleContributionDto } from './runtimeModuleContributionDto.js';
+export interface AdoptOrgPolicySetDto {
+    /**
+       * The composer modelHash biome-host composed and tested for base + runtimeModules.
+       * @pattern SHA256_HEX
+       */
+    policySetId: string;
+    /** The org's COMPLETE runtime module set; empty moves the org back to the base. */
+    runtimeModules: RuntimeModuleContributionDto[];
+    /**
+       * The pointer the caller composed against; null when it read the base.
+       * @nullable
+       * @pattern SHA256_HEX
+       */
+    expectedCurrentPolicySetId: string | null;
+}

package/dist/models/dataClassification.d.ts

@@ -3,6 +3,9 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+/**
+ * The environment's DATA ceiling: the most restrictive `DataClassification` an invocation may carry and still run here. The PDP compares it against `join(space floor, resource tag)` and DENIES when it is exceeded. `regulated` (the top of the rank) admits everything and is the default, so the ceiling refuses nothing until it is lowered.
+ */
 export type DataClassification = typeof DataClassification[keyof typeof DataClassification];
 export declare const DataClassification: {
     readonly public: "public";

package/dist/models/executionEnvironmentKind.d.ts

@@ -4,7 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 /**
- * Closed set of built-in execution-environment classifications. Environment IDENTITY is a separate `environment:<slug>` ref — an org-custom environment carries its own slug there, and is still classified by one of these kinds.
+ * Every execution environment in which the subject holds this capability (closed enum).
  */
 export type ExecutionEnvironmentKind = typeof ExecutionEnvironmentKind[keyof typeof ExecutionEnvironmentKind];
 export declare const ExecutionEnvironmentKind: {

package/dist/models/index.d.ts

@@ -1,21 +1,12 @@
-export * from './addResourceShareDto';
 export * from './addRoleGrantDto';
 export * from './addTeamMemberDto';
+export * from './adoptOrgPolicySetDto';
 export * from './agentProvisionDecision';
 export * from './agentProvisionReason';
 export * from './agentReachTier';
 export * from './assignRoleDto';
 export * from './authorityRowOwnerSpaceKind';
-export * from './authorizationCheckRequestDto';
-export * from './authorizationCheckResponseDto';
-export * from './authorizationCheckResponseDtoDataEnvelope';
-export * from './authorizationDecisionCode';
-export * from './authorizationReasonDto';
-export * from './authorizationSuggestionDto';
-export * from './authorizationSuggestionKind';
-export * from './biomeExecutionTrustTier';
 export * from './biomePermissionProfile';
-export * from './callerKind';
 export * from './capabilityAuthorityRequestDto';
 export * from './capabilityAuthorityRequestDtoDataArrayEnvelope';
 export * from './capabilityAuthorityRequestDtoDataEnvelope';
@@ -44,9 +35,7 @@ export * from './credentialDefaultDtoDataEnvelope';
 export * from './credentialDefaultsControllerDeleteParams';
 export * from './credentialDefaultsControllerGetParams';
 export * from './credentialDefaultsControllerListParams';
-export * from './credentialPrecedenceSource';
 export * from './dataClassification';
-export * from './dataResidency';
 export * from './describeObjectsResponseDto';
 export * from './describeObjectsResponseDtoDataEnvelope';
 export * from './environmentCeilingSource';
@@ -83,14 +72,16 @@ export * from './grantVersionResponseDtoDataEnvelope';
 export * from './grantsControllerListParams';
 export * from './impactedOutputRouteConsumerDto';
 export * from './impactedOutputRouteConsumerDtoDataArrayEnvelope';
-export * from './listRegisteredResourcesDto';
-export * from './listVisibleResourcesDto';
 export * from './object';
 export * from './objectLifecycle';
 export * from './openCapabilityAuthorityRequestDto';
 export * from './openCapabilityAuthorityRequestDtoSubjectKind';
 export * from './openFgaRelationshipDto';
 export * from './openFgaRelationshipDtoPaginatedEnvelope';
+export * from './orgPolicySetDto';
+export * from './orgPolicySetDtoDataEnvelope';
+export * from './orgPolicySetDtoModel';
+export * from './orgPolicySetDtoModules';
 export * from './outputRouteAuthorityDto';
 export * from './outputRouteAuthorityDtoAllowedOutputSchema';
 export * from './outputRouteAuthorityDtoDataEnvelope';
@@ -107,33 +98,17 @@ export * from './outputRouteRevisionDto';
 export * from './outputRouteRevisionDtoAllowedOutputSchema';
 export * from './outputRouteRevisionsControllerReleaseHistoryParams';
 export * from './paginationMeta';
-export * from './policyActingAgentDto';
-export * from './policyActingAgentDtoKind';
-export * from './policyActingForDto';
-export * from './policyBiomeDto';
-export * from './policyCallerDto';
-export * from './policyCapabilityDto';
-export * from './policyCheckBatchRequestDto';
-export * from './policyCheckBatchResponseDto';
-export * from './policyCheckBatchResponseDtoDataEnvelope';
-export * from './policyCheckRequestDto';
-export * from './policyCheckRequestDtoAperture';
-export * from './policyConstraintsDto';
-export * from './policyDecisionDto';
-export * from './policyDecisionDtoDataEnvelope';
-export * from './policyDecisionKind';
-export * from './policyDelegatedAuthorityDto';
-export * from './policyEnvironmentDto';
-export * from './policyObligationDto';
-export * from './policyObligationKind';
-export * from './policyResourceDto';
-export * from './policyRouteHintDto';
-export * from './policyRouteHintDtoRequiredRunnerLabels';
-export * from './policySpaceRefDto';
-export * from './policySubjectRefDto';
+export * from './policySetTestFileDto';
+export * from './policySetTestFileResultDto';
+export * from './policySetTestResultsDto';
+export * from './policySetTestResultsDtoDataEnvelope';
 export * from './previewOutputRouteImpactDto';
+export * from './problemActionableBy';
 export * from './problemDetailsDto';
+export * from './problemDetailsDtoParams';
 export * from './problemFieldIssueDto';
+export * from './problemFieldIssueDtoParams';
+export * from './problemRetry';
 export * from './profilePolicyTemplateDto';
 export * from './profilePolicyTemplateDtoDataArrayEnvelope';
 export * from './profilePolicyTemplateDtoNotes';
@@ -142,16 +117,10 @@ export * from './provisionAgentResultDto';
 export * from './provisionAgentResultDtoDataEnvelope';
 export * from './provisionedCapabilityDto';
 export * from './recordAgentReachTierRequestDto';
-export * from './registerResourceOwnershipDto';
 export * from './registerResourceRevisionDto';
-export * from './registeredResourceDto';
 export * from './registeredResourceRevisionDto';
 export * from './registeredResourceRevisionDtoDataEnvelope';
-export * from './registeredResourcesDto';
-export * from './registeredResourcesDtoDataEnvelope';
 export * from './relationshipsControllerListParams';
-export * from './removeResourceShareDto';
-export * from './replaceResourceOwnershipDto';
 export * from './requestOutputRouteRetirementDto';
 export * from './requestOutputRouteRevisionReleaseDto';
 export * from './requestOutputRouteRevisionReleaseDtoAllowedOutputSchema';
@@ -160,15 +129,10 @@ export * from './resolveExactOutputRouteDto';
 export * from './resolveExactResourceRevisionDto';
 export * from './resolveOutputRouteChannelDto';
 export * from './resourceManagedBy';
-export * from './resourceOwnershipDto';
-export * from './resourceOwnershipDtoDataEnvelope';
-export * from './resourceOwnershipEntryDto';
-export * from './resourceOwnershipReadDto';
-export * from './resourceOwnershipReadDtoDataEnvelope';
-export * from './resourceShareRefDto';
 export * from './resourceSubjectAccessResult';
 export * from './resourceSubjectRefDto';
-export * from './resourceVisibilityPattern';
+export * from './retiredNamespaceDto';
+export * from './retiredNamespaceDtoDataEnvelope';
 export * from './roleAssignmentDto';
 export * from './roleAssignmentDtoDataArrayEnvelope';
 export * from './roleAssignmentDtoDataEnvelope';
@@ -180,11 +144,12 @@ export * from './roleGrantDtoDataArrayEnvelope';
 export * from './roleGrantDtoDataEnvelope';
 export * from './rolesControllerListParams';
 export * from './rollbackExecutionEnvironmentDto';
-export * from './runnerKind';
-export * from './sessionParticipantRole';
+export * from './runPolicySetTestsDto';
+export * from './runPolicySetTestsDtoModel';
+export * from './runtimeModuleContributionDto';
+export * from './runtimeModuleContributionDtoManifest';
 export * from './spaceKind';
 export * from './subjectKind';
-export * from './subjectRefDto';
 export * from './teamDto';
 export * from './teamDtoDataArrayEnvelope';
 export * from './teamDtoDataEnvelope';
@@ -200,8 +165,6 @@ export * from './updateGrantDto';
 export * from './updateRoleDto';
 export * from './updateTeamDto';
 export * from './upsertCredentialDefaultDto';
-export * from './visibleResourcesDto';
-export * from './visibleResourcesDtoDataEnvelope';
 export * from './xemaObjectKind';
 export * from './xemaObjectResponseDto';
 export * from './xemaObjectResponseDtoPayload';

package/dist/models/index.js

@@ -15,24 +15,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 // Auto-generated by tooling/codegen/regenerate-models-barrel.js — do not edit manually.
-__exportStar(require("./addResourceShareDto"), exports);
 __exportStar(require("./addRoleGrantDto"), exports);
 __exportStar(require("./addTeamMemberDto"), exports);
+__exportStar(require("./adoptOrgPolicySetDto"), exports);
 __exportStar(require("./agentProvisionDecision"), exports);
 __exportStar(require("./agentProvisionReason"), exports);
 __exportStar(require("./agentReachTier"), exports);
 __exportStar(require("./assignRoleDto"), exports);
 __exportStar(require("./authorityRowOwnerSpaceKind"), exports);
-__exportStar(require("./authorizationCheckRequestDto"), exports);
-__exportStar(require("./authorizationCheckResponseDto"), exports);
-__exportStar(require("./authorizationCheckResponseDtoDataEnvelope"), exports);
-__exportStar(require("./authorizationDecisionCode"), exports);
-__exportStar(require("./authorizationReasonDto"), exports);
-__exportStar(require("./authorizationSuggestionDto"), exports);
-__exportStar(require("./authorizationSuggestionKind"), exports);
-__exportStar(require("./biomeExecutionTrustTier"), exports);
 __exportStar(require("./biomePermissionProfile"), exports);
-__exportStar(require("./callerKind"), exports);
 __exportStar(require("./capabilityAuthorityRequestDto"), exports);
 __exportStar(require("./capabilityAuthorityRequestDtoDataArrayEnvelope"), exports);
 __exportStar(require("./capabilityAuthorityRequestDtoDataEnvelope"), exports);
@@ -61,9 +52,7 @@ __exportStar(require("./credentialDefaultDtoDataEnvelope"), exports);
 __exportStar(require("./credentialDefaultsControllerDeleteParams"), exports);
 __exportStar(require("./credentialDefaultsControllerGetParams"), exports);
 __exportStar(require("./credentialDefaultsControllerListParams"), exports);
-__exportStar(require("./credentialPrecedenceSource"), exports);
 __exportStar(require("./dataClassification"), exports);
-__exportStar(require("./dataResidency"), exports);
 __exportStar(require("./describeObjectsResponseDto"), exports);
 __exportStar(require("./describeObjectsResponseDtoDataEnvelope"), exports);
 __exportStar(require("./environmentCeilingSource"), exports);
@@ -100,14 +89,16 @@ __exportStar(require("./grantVersionResponseDtoDataEnvelope"), exports);
 __exportStar(require("./grantsControllerListParams"), exports);
 __exportStar(require("./impactedOutputRouteConsumerDto"), exports);
 __exportStar(require("./impactedOutputRouteConsumerDtoDataArrayEnvelope"), exports);
-__exportStar(require("./listRegisteredResourcesDto"), exports);
-__exportStar(require("./listVisibleResourcesDto"), exports);
 __exportStar(require("./object"), exports);
 __exportStar(require("./objectLifecycle"), exports);
 __exportStar(require("./openCapabilityAuthorityRequestDto"), exports);
 __exportStar(require("./openCapabilityAuthorityRequestDtoSubjectKind"), exports);
 __exportStar(require("./openFgaRelationshipDto"), exports);
 __exportStar(require("./openFgaRelationshipDtoPaginatedEnvelope"), exports);
+__exportStar(require("./orgPolicySetDto"), exports);
+__exportStar(require("./orgPolicySetDtoDataEnvelope"), exports);
+__exportStar(require("./orgPolicySetDtoModel"), exports);
+__exportStar(require("./orgPolicySetDtoModules"), exports);
 __exportStar(require("./outputRouteAuthorityDto"), exports);
 __exportStar(require("./outputRouteAuthorityDtoAllowedOutputSchema"), exports);
 __exportStar(require("./outputRouteAuthorityDtoDataEnvelope"), exports);
@@ -124,33 +115,17 @@ __exportStar(require("./outputRouteRevisionDto"), exports);
 __exportStar(require("./outputRouteRevisionDtoAllowedOutputSchema"), exports);
 __exportStar(require("./outputRouteRevisionsControllerReleaseHistoryParams"), exports);
 __exportStar(require("./paginationMeta"), exports);
-__exportStar(require("./policyActingAgentDto"), exports);
-__exportStar(require("./policyActingAgentDtoKind"), exports);
-__exportStar(require("./policyActingForDto"), exports);
-__exportStar(require("./policyBiomeDto"), exports);
-__exportStar(require("./policyCallerDto"), exports);
-__exportStar(require("./policyCapabilityDto"), exports);
-__exportStar(require("./policyCheckBatchRequestDto"), exports);
-__exportStar(require("./policyCheckBatchResponseDto"), exports);
-__exportStar(require("./policyCheckBatchResponseDtoDataEnvelope"), exports);
-__exportStar(require("./policyCheckRequestDto"), exports);
-__exportStar(require("./policyCheckRequestDtoAperture"), exports);
-__exportStar(require("./policyConstraintsDto"), exports);
-__exportStar(require("./policyDecisionDto"), exports);
-__exportStar(require("./policyDecisionDtoDataEnvelope"), exports);
-__exportStar(require("./policyDecisionKind"), exports);
-__exportStar(require("./policyDelegatedAuthorityDto"), exports);
-__exportStar(require("./policyEnvironmentDto"), exports);
-__exportStar(require("./policyObligationDto"), exports);
-__exportStar(require("./policyObligationKind"), exports);
-__exportStar(require("./policyResourceDto"), exports);
-__exportStar(require("./policyRouteHintDto"), exports);
-__exportStar(require("./policyRouteHintDtoRequiredRunnerLabels"), exports);
-__exportStar(require("./policySpaceRefDto"), exports);
-__exportStar(require("./policySubjectRefDto"), exports);
+__exportStar(require("./policySetTestFileDto"), exports);
+__exportStar(require("./policySetTestFileResultDto"), exports);
+__exportStar(require("./policySetTestResultsDto"), exports);
+__exportStar(require("./policySetTestResultsDtoDataEnvelope"), exports);
 __exportStar(require("./previewOutputRouteImpactDto"), exports);
+__exportStar(require("./problemActionableBy"), exports);
 __exportStar(require("./problemDetailsDto"), exports);
+__exportStar(require("./problemDetailsDtoParams"), exports);
 __exportStar(require("./problemFieldIssueDto"), exports);
+__exportStar(require("./problemFieldIssueDtoParams"), exports);
+__exportStar(require("./problemRetry"), exports);
 __exportStar(require("./profilePolicyTemplateDto"), exports);
 __exportStar(require("./profilePolicyTemplateDtoDataArrayEnvelope"), exports);
 __exportStar(require("./profilePolicyTemplateDtoNotes"), exports);
@@ -159,16 +134,10 @@ __exportStar(require("./provisionAgentResultDto"), exports);
 __exportStar(require("./provisionAgentResultDtoDataEnvelope"), exports);
 __exportStar(require("./provisionedCapabilityDto"), exports);
 __exportStar(require("./recordAgentReachTierRequestDto"), exports);
-__exportStar(require("./registerResourceOwnershipDto"), exports);
 __exportStar(require("./registerResourceRevisionDto"), exports);
-__exportStar(require("./registeredResourceDto"), exports);
 __exportStar(require("./registeredResourceRevisionDto"), exports);
 __exportStar(require("./registeredResourceRevisionDtoDataEnvelope"), exports);
-__exportStar(require("./registeredResourcesDto"), exports);
-__exportStar(require("./registeredResourcesDtoDataEnvelope"), exports);
 __exportStar(require("./relationshipsControllerListParams"), exports);
-__exportStar(require("./removeResourceShareDto"), exports);
-__exportStar(require("./replaceResourceOwnershipDto"), exports);
 __exportStar(require("./requestOutputRouteRetirementDto"), exports);
 __exportStar(require("./requestOutputRouteRevisionReleaseDto"), exports);
 __exportStar(require("./requestOutputRouteRevisionReleaseDtoAllowedOutputSchema"), exports);
@@ -177,15 +146,10 @@ __exportStar(require("./resolveExactOutputRouteDto"), exports);
 __exportStar(require("./resolveExactResourceRevisionDto"), exports);
 __exportStar(require("./resolveOutputRouteChannelDto"), exports);
 __exportStar(require("./resourceManagedBy"), exports);
-__exportStar(require("./resourceOwnershipDto"), exports);
-__exportStar(require("./resourceOwnershipDtoDataEnvelope"), exports);
-__exportStar(require("./resourceOwnershipEntryDto"), exports);
-__exportStar(require("./resourceOwnershipReadDto"), exports);
-__exportStar(require("./resourceOwnershipReadDtoDataEnvelope"), exports);
-__exportStar(require("./resourceShareRefDto"), exports);
 __exportStar(require("./resourceSubjectAccessResult"), exports);
 __exportStar(require("./resourceSubjectRefDto"), exports);
-__exportStar(require("./resourceVisibilityPattern"), exports);
+__exportStar(require("./retiredNamespaceDto"), exports);
+__exportStar(require("./retiredNamespaceDtoDataEnvelope"), exports);
 __exportStar(require("./roleAssignmentDto"), exports);
 __exportStar(require("./roleAssignmentDtoDataArrayEnvelope"), exports);
 __exportStar(require("./roleAssignmentDtoDataEnvelope"), exports);
@@ -197,11 +161,12 @@ __exportStar(require("./roleGrantDtoDataArrayEnvelope"), exports);
 __exportStar(require("./roleGrantDtoDataEnvelope"), exports);
 __exportStar(require("./rolesControllerListParams"), exports);
 __exportStar(require("./rollbackExecutionEnvironmentDto"), exports);
-__exportStar(require("./runnerKind"), exports);
-__exportStar(require("./sessionParticipantRole"), exports);
+__exportStar(require("./runPolicySetTestsDto"), exports);
+__exportStar(require("./runPolicySetTestsDtoModel"), exports);
+__exportStar(require("./runtimeModuleContributionDto"), exports);
+__exportStar(require("./runtimeModuleContributionDtoManifest"), exports);
 __exportStar(require("./spaceKind"), exports);
 __exportStar(require("./subjectKind"), exports);
-__exportStar(require("./subjectRefDto"), exports);
 __exportStar(require("./teamDto"), exports);
 __exportStar(require("./teamDtoDataArrayEnvelope"), exports);
 __exportStar(require("./teamDtoDataEnvelope"), exports);
@@ -217,8 +182,6 @@ __exportStar(require("./updateGrantDto"), exports);
 __exportStar(require("./updateRoleDto"), exports);
 __exportStar(require("./updateTeamDto"), exports);
 __exportStar(require("./upsertCredentialDefaultDto"), exports);
-__exportStar(require("./visibleResourcesDto"), exports);
-__exportStar(require("./visibleResourcesDtoDataEnvelope"), exports);
 __exportStar(require("./xemaObjectKind"), exports);
 __exportStar(require("./xemaObjectResponseDto"), exports);
 __exportStar(require("./xemaObjectResponseDtoPayload"), exports);

package/dist/models/orgPolicySetDto.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { OrgPolicySetDtoModel } from './orgPolicySetDtoModel.js';
+import type { OrgPolicySetDtoModules } from './orgPolicySetDtoModules.js';
+export interface OrgPolicySetDto {
+    /**
+       * The policy set content address, or null for the base.
+       * @nullable
+       */
+    policySetId: string | null;
+    /** The OpenFGA JSON model. */
+    model?: OrgPolicySetDtoModel;
+    /** namespace → { moduleVersion, contentHash }. */
+    modules?: OrgPolicySetDtoModules;
+}

package/dist/models/orgPolicySetDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { OrgPolicySetDto } from './orgPolicySetDto.js';
+export interface OrgPolicySetDtoDataEnvelope {
+    data: OrgPolicySetDto;
+}

package/dist/models/{policyRouteHintDtoRequiredRunnerLabels.d.ts → orgPolicySetDtoModel.d.ts}

@@ -3,6 +3,9 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-export type PolicyRouteHintDtoRequiredRunnerLabels = {
-    [key: string]: string;
+/**
+ * The OpenFGA JSON model.
+ */
+export type OrgPolicySetDtoModel = {
+    [key: string]: unknown;
 };

package/dist/models/orgPolicySetDtoModules.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * namespace → { moduleVersion, contentHash }.
+ */
+export type OrgPolicySetDtoModules = {
+    [key: string]: unknown;
+};