@xemahq/authorization-internal-api-client 0.5.3 → 0.6.0

package/dist/models/policySetTestFileDto.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface PolicySetTestFileDto {
+    /**
+       * The module the file belongs to (`xema_core`, a biome id).
+       * @minLength 1
+       */
+    owner: string;
+    /**
+       * The file name, e.g. `pai-core.fga.yaml`.
+       * @minLength 1
+       */
+    name: string;
+    /**
+       * The standard OpenFGA test file (`fga model test`) as YAML.
+       * @minLength 1
+       */
+    contents: string;
+}

package/dist/models/policySetTestFileResultDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface PolicySetTestFileResultDto {
+    owner: string;
+    name: string;
+    passed: boolean;
+    output: string;
+}

package/dist/models/policySetTestResultsDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicySetTestFileResultDto } from './policySetTestFileResultDto.js';
+export interface PolicySetTestResultsDto {
+    results: PolicySetTestFileResultDto[];
+}

package/dist/models/policySetTestResultsDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicySetTestResultsDto } from './policySetTestResultsDto.js';
+export interface PolicySetTestResultsDtoDataEnvelope {
+    data: PolicySetTestResultsDto;
+}

package/dist/models/retiredNamespaceDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface RetiredNamespaceDto {
+    /** Tuples deleted by the teardown. */
+    tuplesDeleted: number;
+}

package/dist/models/retiredNamespaceDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RetiredNamespaceDto } from './retiredNamespaceDto.js';
+export interface RetiredNamespaceDtoDataEnvelope {
+    data: RetiredNamespaceDto;
+}

package/dist/models/runPolicySetTestsDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicySetTestFileDto } from './policySetTestFileDto.js';
+import type { RunPolicySetTestsDtoModel } from './runPolicySetTestsDtoModel.js';
+export interface RunPolicySetTestsDto {
+    /** The composed OpenFGA JSON model. */
+    model: RunPolicySetTestsDtoModel;
+    testFiles: PolicySetTestFileDto[];
+}

package/dist/models/runPolicySetTestsDtoModel.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * The composed OpenFGA JSON model.
+ */
+export type RunPolicySetTestsDtoModel = {
+    [key: string]: unknown;
+};

package/dist/models/runtimeModuleContributionDto.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RuntimeModuleContributionDtoManifest } from './runtimeModuleContributionDtoManifest.js';
+export interface RuntimeModuleContributionDto {
+    /**
+       * The signed biome id (the derived namespace).
+       * @minLength 1
+       */
+    biomeId: string;
+    /**
+       * The signed biome version the module was read from.
+       * @minLength 1
+       */
+    biomeVersion: string;
+    /** The stamped authorization-module contribution manifest (envelope, files, tests, signedBiome). */
+    manifest: RuntimeModuleContributionDtoManifest;
+}

package/dist/models/runtimeModuleContributionDtoManifest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * The stamped authorization-module contribution manifest (envelope, files, tests, signedBiome).
+ */
+export type RuntimeModuleContributionDtoManifest = {
+    [key: string]: unknown;
+};

package/dist/models/runtimeModuleContributionDtoManifest.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/spaceKind.d.ts

@@ -3,6 +3,9 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+/**
+ * The ref's tier — what an admin sees this as (a project, an app, the org).
+ */
 export type SpaceKind = typeof SpaceKind[keyof typeof SpaceKind];
 export declare const SpaceKind: {
     readonly system: "system";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [

package/dist/endpoints/resources/resources.d.ts

@@ -1,59 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { AddResourceShareDto, ListRegisteredResourcesDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, RegisteredResourcesDtoDataEnvelope, RemoveResourceShareDto, ReplaceResourceOwnershipDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
-export declare const getResourcesControllerRegisterUrl: () => string;
-/**
- * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
- * @summary Register ownership/visibility of a resource instance
- */
-export declare const resourcesControllerRegister: (registerResourceOwnershipDto: RegisterResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDtoDataEnvelope>;
-export declare const getResourcesControllerListVisibleUrl: () => string;
-/**
- * Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
- *
- * Supplying `minLevel` narrows the question from "may this subject SEE it" to "does this subject hold at least this LEVEL on it": the answer becomes owner ∪ shared at or above that rung, and org-shared instances drop out because org-shared is a visibility pattern rather than a rung. That is the question a BFF asks to decide who may MANAGE an instance, and answering it here is what keeps the caller from having to expand identity groups itself — OpenFGA expands `team#member` and `role#assignee` usersets transitively.
- * @summary List the instances of a resource type a subject may see
- */
-export declare const resourcesControllerListVisible: (listVisibleResourcesDto: ListVisibleResourcesDto, options?: RequestInit) => Promise<VisibleResourcesDtoDataEnvelope>;
-export declare const getResourcesControllerListRegisteredUrl: () => string;
-/**
- * Every registered instance of `resourceType` in the caller org, with the subjects that OWN it. Org scope is forced from the caller context.
- *
- * This is NOT `resource.listVisible` with a privileged subject, and the difference is the reason it exists. `listVisible` answers "what may THIS SUBJECT see"; a service needing "what has this org registered" used to ask it about a subject it had made the owner of everything — which works only for as long as that fixed owner exists, and turns any later ownership change into a silent, total loss of the enumeration. A convergence pass built on the substitute does not just stop registering: it reads every live instance as registered-but-not-live and DEREGISTERS it.
- *
- * A POST rather than a GET because `resource.getOwnership` is mounted at `GET /resources/:type/:id`, which would shadow any `GET /resources/registered/...` shape; the body carries the one input.
- * @summary List the instances of a resource type this ORG has registered
- */
-export declare const resourcesControllerListRegistered: (listRegisteredResourcesDto: ListRegisteredResourcesDto, options?: RequestInit) => Promise<RegisteredResourcesDtoDataEnvelope>;
-export declare const getResourcesControllerGetOwnershipUrl: (type: string, id: string) => string;
-/**
- * Returns the instance visibility and the combined set of registered subjects (owners + shares; the SQL authority does not split them). 404 when the instance was never registered.
- * @summary Read a resource instance’s current visibility + subjects
- */
-export declare const resourcesControllerGetOwnership: (type: string, id: string, options?: RequestInit) => Promise<ResourceOwnershipReadDtoDataEnvelope>;
-export declare const getResourcesControllerReplaceOwnershipUrl: (type: string, id: string) => string;
-/**
- * The whole post-state: after this call the instance’s registered subjects are EXACTLY `owners` ∪ `explicitShares`, and a subject named by neither loses its authority row AND its `shared_with` tuple. This is the ONLY surface that can express a revocation as part of a set write — `resource.register` upserts what it is handed and never touches a subject outside that list, so re-registering with a subject removed reports 200 and leaves both its row and its tuple live. Removals delete the tuple BEFORE the row (a crash between them leaves the subject WITHOUT access); additions write the row before the tuple. Serialised per instance by an advisory lock, so two concurrent replaces cannot interleave into a mixed set. Idempotent. Refuses (409 `RESOURCE_SUBJECT_IS_OWNER`) when a currently-registered OWNER is absent from the new `owners` list — dropping or demoting an owner is `resource.deregister`. Org scope is forced from the caller context. A body naming a `grantor` has every share judged against the level that subject actually holds (read from the tuple store, never from the body); omitting it means the calling service asserts owner authority.
- * @summary REPLACE a resource instance’s ownership set
- */
-export declare const resourcesControllerReplaceOwnership: (type: string, id: string, replaceResourceOwnershipDto: ReplaceResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDtoDataEnvelope>;
-export declare const getResourcesControllerDeregisterUrl: (type: string, id: string) => string;
-/**
- * Idempotent — a no-op when the instance was never registered.
- * @summary Deregister a resource instance (drop ownership rows + tuples)
- */
-export declare const resourcesControllerDeregister: (type: string, id: string, options?: RequestInit) => Promise<void>;
-export declare const getResourcesControllerAddShareUrl: (type: string, id: string) => string;
-/**
- * @summary Add an explicit share to a registered resource instance
- */
-export declare const resourcesControllerAddShare: (type: string, id: string, addResourceShareDto: AddResourceShareDto, options?: RequestInit) => Promise<void>;
-export declare const getResourcesControllerRemoveShareUrl: (type: string, id: string) => string;
-/**
- * The inverse of `resource.addShare`, and the ONLY way to unshare without the deregister-then-register window (during which the instance is UNREGISTERED and the PDP resolves it as a verb-only ALLOW for everyone). Drops the `shared_with` tuple FIRST and the authority row second, so a crash between them leaves the subject WITHOUT access, never with it. Idempotent: removing a share that does not exist is a no-op success. Refuses a subject that holds an `owned_by` tuple (409 `RESOURCE_SUBJECT_IS_OWNER`) — owner removal is `resource.deregister`. Does NOT change the instance visibility, even when this removes the last share: `explicit-share` with zero shares means "shared with nobody".
- * @summary Remove an explicit share from a registered resource instance
- */
-export declare const resourcesControllerRemoveShare: (type: string, id: string, removeResourceShareDto: RemoveResourceShareDto, options?: RequestInit) => Promise<void>;

package/dist/endpoints/resources/resources.js

@@ -1,141 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resourcesControllerRemoveShare = exports.getResourcesControllerRemoveShareUrl = exports.resourcesControllerAddShare = exports.getResourcesControllerAddShareUrl = exports.resourcesControllerDeregister = exports.getResourcesControllerDeregisterUrl = exports.resourcesControllerReplaceOwnership = exports.getResourcesControllerReplaceOwnershipUrl = exports.resourcesControllerGetOwnership = exports.getResourcesControllerGetOwnershipUrl = exports.resourcesControllerListRegistered = exports.getResourcesControllerListRegisteredUrl = exports.resourcesControllerListVisible = exports.getResourcesControllerListVisibleUrl = exports.resourcesControllerRegister = exports.getResourcesControllerRegisterUrl = void 0;
-const custom_fetch_1 = require("../../custom-fetch");
-const getResourcesControllerRegisterUrl = () => {
-    return `/resources`;
-};
-exports.getResourcesControllerRegisterUrl = getResourcesControllerRegisterUrl;
-/**
- * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
- * @summary Register ownership/visibility of a resource instance
- */
-const resourcesControllerRegister = async (registerResourceOwnershipDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerRegisterUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(registerResourceOwnershipDto)
-    });
-};
-exports.resourcesControllerRegister = resourcesControllerRegister;
-const getResourcesControllerListVisibleUrl = () => {
-    return `/resources/visible`;
-};
-exports.getResourcesControllerListVisibleUrl = getResourcesControllerListVisibleUrl;
-/**
- * Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
- *
- * Supplying `minLevel` narrows the question from "may this subject SEE it" to "does this subject hold at least this LEVEL on it": the answer becomes owner ∪ shared at or above that rung, and org-shared instances drop out because org-shared is a visibility pattern rather than a rung. That is the question a BFF asks to decide who may MANAGE an instance, and answering it here is what keeps the caller from having to expand identity groups itself — OpenFGA expands `team#member` and `role#assignee` usersets transitively.
- * @summary List the instances of a resource type a subject may see
- */
-const resourcesControllerListVisible = async (listVisibleResourcesDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerListVisibleUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(listVisibleResourcesDto)
-    });
-};
-exports.resourcesControllerListVisible = resourcesControllerListVisible;
-const getResourcesControllerListRegisteredUrl = () => {
-    return `/resources/registered`;
-};
-exports.getResourcesControllerListRegisteredUrl = getResourcesControllerListRegisteredUrl;
-/**
- * Every registered instance of `resourceType` in the caller org, with the subjects that OWN it. Org scope is forced from the caller context.
- *
- * This is NOT `resource.listVisible` with a privileged subject, and the difference is the reason it exists. `listVisible` answers "what may THIS SUBJECT see"; a service needing "what has this org registered" used to ask it about a subject it had made the owner of everything — which works only for as long as that fixed owner exists, and turns any later ownership change into a silent, total loss of the enumeration. A convergence pass built on the substitute does not just stop registering: it reads every live instance as registered-but-not-live and DEREGISTERS it.
- *
- * A POST rather than a GET because `resource.getOwnership` is mounted at `GET /resources/:type/:id`, which would shadow any `GET /resources/registered/...` shape; the body carries the one input.
- * @summary List the instances of a resource type this ORG has registered
- */
-const resourcesControllerListRegistered = async (listRegisteredResourcesDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerListRegisteredUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(listRegisteredResourcesDto)
-    });
-};
-exports.resourcesControllerListRegistered = resourcesControllerListRegistered;
-const getResourcesControllerGetOwnershipUrl = (type, id) => {
-    return `/resources/${type}/${id}`;
-};
-exports.getResourcesControllerGetOwnershipUrl = getResourcesControllerGetOwnershipUrl;
-/**
- * Returns the instance visibility and the combined set of registered subjects (owners + shares; the SQL authority does not split them). 404 when the instance was never registered.
- * @summary Read a resource instance’s current visibility + subjects
- */
-const resourcesControllerGetOwnership = async (type, id, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerGetOwnershipUrl)(type, id), {
-        ...options,
-        method: 'GET'
-    });
-};
-exports.resourcesControllerGetOwnership = resourcesControllerGetOwnership;
-const getResourcesControllerReplaceOwnershipUrl = (type, id) => {
-    return `/resources/${type}/${id}`;
-};
-exports.getResourcesControllerReplaceOwnershipUrl = getResourcesControllerReplaceOwnershipUrl;
-/**
- * The whole post-state: after this call the instance’s registered subjects are EXACTLY `owners` ∪ `explicitShares`, and a subject named by neither loses its authority row AND its `shared_with` tuple. This is the ONLY surface that can express a revocation as part of a set write — `resource.register` upserts what it is handed and never touches a subject outside that list, so re-registering with a subject removed reports 200 and leaves both its row and its tuple live. Removals delete the tuple BEFORE the row (a crash between them leaves the subject WITHOUT access); additions write the row before the tuple. Serialised per instance by an advisory lock, so two concurrent replaces cannot interleave into a mixed set. Idempotent. Refuses (409 `RESOURCE_SUBJECT_IS_OWNER`) when a currently-registered OWNER is absent from the new `owners` list — dropping or demoting an owner is `resource.deregister`. Org scope is forced from the caller context. A body naming a `grantor` has every share judged against the level that subject actually holds (read from the tuple store, never from the body); omitting it means the calling service asserts owner authority.
- * @summary REPLACE a resource instance’s ownership set
- */
-const resourcesControllerReplaceOwnership = async (type, id, replaceResourceOwnershipDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerReplaceOwnershipUrl)(type, id), {
-        ...options,
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(replaceResourceOwnershipDto)
-    });
-};
-exports.resourcesControllerReplaceOwnership = resourcesControllerReplaceOwnership;
-const getResourcesControllerDeregisterUrl = (type, id) => {
-    return `/resources/${type}/${id}`;
-};
-exports.getResourcesControllerDeregisterUrl = getResourcesControllerDeregisterUrl;
-/**
- * Idempotent — a no-op when the instance was never registered.
- * @summary Deregister a resource instance (drop ownership rows + tuples)
- */
-const resourcesControllerDeregister = async (type, id, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerDeregisterUrl)(type, id), {
-        ...options,
-        method: 'DELETE'
-    });
-};
-exports.resourcesControllerDeregister = resourcesControllerDeregister;
-const getResourcesControllerAddShareUrl = (type, id) => {
-    return `/resources/${type}/${id}/relationships`;
-};
-exports.getResourcesControllerAddShareUrl = getResourcesControllerAddShareUrl;
-/**
- * @summary Add an explicit share to a registered resource instance
- */
-const resourcesControllerAddShare = async (type, id, addResourceShareDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerAddShareUrl)(type, id), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(addResourceShareDto)
-    });
-};
-exports.resourcesControllerAddShare = resourcesControllerAddShare;
-const getResourcesControllerRemoveShareUrl = (type, id) => {
-    return `/resources/${type}/${id}/relationships`;
-};
-exports.getResourcesControllerRemoveShareUrl = getResourcesControllerRemoveShareUrl;
-/**
- * The inverse of `resource.addShare`, and the ONLY way to unshare without the deregister-then-register window (during which the instance is UNREGISTERED and the PDP resolves it as a verb-only ALLOW for everyone). Drops the `shared_with` tuple FIRST and the authority row second, so a crash between them leaves the subject WITHOUT access, never with it. Idempotent: removing a share that does not exist is a no-op success. Refuses a subject that holds an `owned_by` tuple (409 `RESOURCE_SUBJECT_IS_OWNER`) — owner removal is `resource.deregister`. Does NOT change the instance visibility, even when this removes the last share: `explicit-share` with zero shares means "shared with nobody".
- * @summary Remove an explicit share from a registered resource instance
- */
-const resourcesControllerRemoveShare = async (type, id, removeResourceShareDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerRemoveShareUrl)(type, id), {
-        ...options,
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(removeResourceShareDto)
-    });
-};
-exports.resourcesControllerRemoveShare = resourcesControllerRemoveShare;

package/dist/models/addResourceShareDto.d.ts

@@ -1,12 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { ResourceShareRefDto } from './resourceShareRefDto.js';
-import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
-export interface AddResourceShareDto {
-    share: ResourceShareRefDto;
-    /** The subject GRANTING this share, when it is not the instance owner. Used to apply the two delegation rules: a grantor may never confer more than they hold, and re-sharing is itself a level. Omitted means the caller asserts owner authority, which this service verifies against the tuple store — it is never taken on the caller's word. */
-    grantor?: ResourceSubjectRefDto;
-}

package/dist/models/authorizationCheckRequestDto.d.ts

@@ -1,39 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { SubjectRefDto } from './subjectRefDto.js';
-export interface AuthorizationCheckRequestDto {
-    /**
-       * Organization identifier. Scopes the grant lookup to the tenant.
-       * @minLength 1
-       */
-    orgId: string;
-    /**
-       * Canonical CapabilityRef `<domain>:<resource>.<verb>@<major>` from `@xemahq/kernel-contracts/capability`.
-       * @minLength 1
-       */
-    capability: string;
-    subject: SubjectRefDto;
-    /**
-       * ExecutionEnvironmentRef in `environment:<slug>` format (e.g. `"environment:project"`). The service parses the prefix and checks the slug against the ExecutionEnvironmentKind enum.
-       * @minLength 1
-       */
-    environment: string;
-    /**
-       * Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance the capability targets. Optional — omit it for a verb-only check; do not send a placeholder. The legacy `resource:<type>:<id>` form is still accepted, but it cannot express the org scope the canonical form carries. Any other shape is refused at the edge with `400 RESOURCE_REF_MALFORMED`.
-       * @minLength 1
-       */
-    resource?: string;
-    /**
-       * Audience policy slug; Phase 3 ignores this dimension.
-       * @minLength 1
-       */
-    audience?: string;
-    /**
-       * Caller-supplied correlation id surfaced in audit logs.
-       * @minLength 1
-       */
-    correlationId?: string;
-}

package/dist/models/authorizationCheckResponseDto.d.ts

@@ -1,14 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { AuthorizationReasonDto } from './authorizationReasonDto.js';
-import type { AuthorizationSuggestionDto } from './authorizationSuggestionDto.js';
-export interface AuthorizationCheckResponseDto {
-    allowed: boolean;
-    /** Identifier of the `CapabilityGrant` row that matched (allow only). */
-    grantId?: string;
-    reasons: AuthorizationReasonDto[];
-    suggestions: AuthorizationSuggestionDto[];
-}

package/dist/models/authorizationCheckResponseDtoDataEnvelope.d.ts

@@ -1,9 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { AuthorizationCheckResponseDto } from './authorizationCheckResponseDto.js';
-export interface AuthorizationCheckResponseDtoDataEnvelope {
-    data: AuthorizationCheckResponseDto;
-}

package/dist/models/authorizationDecisionCode.d.ts

@@ -1,18 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type AuthorizationDecisionCode = typeof AuthorizationDecisionCode[keyof typeof AuthorizationDecisionCode];
-export declare const AuthorizationDecisionCode: {
-    readonly MATCHED_GRANT: "MATCHED_GRANT";
-    readonly NO_GRANT_FOUND: "NO_GRANT_FOUND";
-    readonly GRANT_REVOKED: "GRANT_REVOKED";
-    readonly CAPABILITY_DENIED_BY_ENVIRONMENT: "CAPABILITY_DENIED_BY_ENVIRONMENT";
-    readonly CAPABILITY_REQUIRES_APPROVAL: "CAPABILITY_REQUIRES_APPROVAL";
-    readonly DELEGATION_GRANT_INSUFFICIENT: "DELEGATION_GRANT_INSUFFICIENT";
-    readonly RESOURCE_NOT_OWNED: "RESOURCE_NOT_OWNED";
-    readonly RESOURCE_SHARE_LEVEL_INSUFFICIENT: "RESOURCE_SHARE_LEVEL_INSUFFICIENT";
-    readonly RESOURCE_UNREGISTERED: "RESOURCE_UNREGISTERED";
-    readonly REACH_TIER_DENIED: "REACH_TIER_DENIED";
-};

package/dist/models/authorizationDecisionCode.js

@@ -1,20 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationDecisionCode = void 0;
-exports.AuthorizationDecisionCode = {
-    MATCHED_GRANT: 'MATCHED_GRANT',
-    NO_GRANT_FOUND: 'NO_GRANT_FOUND',
-    GRANT_REVOKED: 'GRANT_REVOKED',
-    CAPABILITY_DENIED_BY_ENVIRONMENT: 'CAPABILITY_DENIED_BY_ENVIRONMENT',
-    CAPABILITY_REQUIRES_APPROVAL: 'CAPABILITY_REQUIRES_APPROVAL',
-    DELEGATION_GRANT_INSUFFICIENT: 'DELEGATION_GRANT_INSUFFICIENT',
-    RESOURCE_NOT_OWNED: 'RESOURCE_NOT_OWNED',
-    RESOURCE_SHARE_LEVEL_INSUFFICIENT: 'RESOURCE_SHARE_LEVEL_INSUFFICIENT',
-    RESOURCE_UNREGISTERED: 'RESOURCE_UNREGISTERED',
-    REACH_TIER_DENIED: 'REACH_TIER_DENIED',
-};

package/dist/models/authorizationReasonDto.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { AuthorizationDecisionCode } from './authorizationDecisionCode.js';
-export interface AuthorizationReasonDto {
-    code: AuthorizationDecisionCode;
-    /** @minLength 1 */
-    detail: string;
-}

package/dist/models/authorizationSuggestionDto.d.ts

@@ -1,25 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { AuthorizationSuggestionKind } from './authorizationSuggestionKind.js';
-export interface AuthorizationSuggestionDto {
-    kind: AuthorizationSuggestionKind;
-    /** @minLength 1 */
-    capability?: string;
-    /** @minLength 1 */
-    environment?: string;
-    /** @minLength 1 */
-    resource?: string;
-    /**
-       * For `switch-environment`: the environment the request was sent with (denied). For other kinds, undefined.
-       * @minLength 1
-       */
-    from?: string;
-    /**
-       * For `switch-environment`: a environment the caller already holds a matching grant in. For other kinds, undefined.
-       * @minLength 1
-       */
-    to?: string;
-}

package/dist/models/authorizationSuggestionKind.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type AuthorizationSuggestionKind = typeof AuthorizationSuggestionKind[keyof typeof AuthorizationSuggestionKind];
-export declare const AuthorizationSuggestionKind: {
-    readonly 'request-grant': "request-grant";
-    readonly 'switch-environment': "switch-environment";
-    readonly 'request-approval': "request-approval";
-};

package/dist/models/authorizationSuggestionKind.js

@@ -1,13 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationSuggestionKind = void 0;
-exports.AuthorizationSuggestionKind = {
-    'request-grant': 'request-grant',
-    'switch-environment': 'switch-environment',
-    'request-approval': 'request-approval',
-};

package/dist/models/biomeExecutionTrustTier.d.ts

@@ -1,10 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type BiomeExecutionTrustTier = typeof BiomeExecutionTrustTier[keyof typeof BiomeExecutionTrustTier];
-export declare const BiomeExecutionTrustTier: {
-    readonly official: "official";
-    readonly verified: "verified";
-};

package/dist/models/biomeExecutionTrustTier.js

@@ -1,12 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BiomeExecutionTrustTier = void 0;
-exports.BiomeExecutionTrustTier = {
-    official: 'official',
-    verified: 'verified',
-};

package/dist/models/callerKind.d.ts

@@ -1,14 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type CallerKind = typeof CallerKind[keyof typeof CallerKind];
-export declare const CallerKind: {
-    readonly web: "web";
-    readonly api: "api";
-    readonly agent: "agent";
-    readonly workflow: "workflow";
-    readonly shell: "shell";
-    readonly scheduler: "scheduler";
-};

package/dist/models/callerKind.js

@@ -1,16 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CallerKind = void 0;
-exports.CallerKind = {
-    web: 'web',
-    api: 'api',
-    agent: 'agent',
-    workflow: 'workflow',
-    shell: 'shell',
-    scheduler: 'scheduler',
-};

package/dist/models/credentialPrecedenceSource.d.ts

@@ -1,17 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-/**
- * Which precedence tier supplied `credentialBindingId` (explicit grant > capability default > project default > org default). Populated iff `credentialBindingId` is present.
- */
-export type CredentialPrecedenceSource = typeof CredentialPrecedenceSource[keyof typeof CredentialPrecedenceSource];
-export declare const CredentialPrecedenceSource: {
-    readonly explicit: "explicit";
-    readonly capability_default: "capability_default";
-    readonly user_default: "user_default";
-    readonly project_default: "project_default";
-    readonly org_default: "org_default";
-    readonly platform_default: "platform_default";
-};