@xemahq/authorization-internal-api-client 0.5.3 → 0.6.0

package/dist/models/credentialPrecedenceSource.js

@@ -1,16 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialPrecedenceSource = void 0;
-exports.CredentialPrecedenceSource = {
-    explicit: 'explicit',
-    capability_default: 'capability_default',
-    user_default: 'user_default',
-    project_default: 'project_default',
-    org_default: 'org_default',
-    platform_default: 'platform_default',
-};

package/dist/models/dataResidency.d.ts

@@ -1,9 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type DataResidency = typeof DataResidency[keyof typeof DataResidency];
-export declare const DataResidency: {
-    readonly 'customer-private': "customer-private";
-};

package/dist/models/dataResidency.js

@@ -1,11 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DataResidency = void 0;
-exports.DataResidency = {
-    'customer-private': 'customer-private',
-};

package/dist/models/listRegisteredResourcesDto.d.ts

@@ -1,12 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export interface ListRegisteredResourcesDto {
-    /**
-       * Resource kind/type slug.
-       * @minLength 1
-       */
-    resourceType: string;
-}

package/dist/models/listVisibleResourcesDto.d.ts

@@ -1,20 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
-export interface ListVisibleResourcesDto {
-    /**
-       * Resource kind/type slug.
-       * @minLength 1
-       */
-    resourceType: string;
-    /**
-       * The resource kind's own name for the MINIMUM level the subject must hold. Omitted = the visibility question (owner ∪ shared at any level ∪ org-shared). Present = the authority question (owner ∪ shared at or above this level); org-shared instances are NOT included, because org-shared is a visibility pattern rather than a rung.
-       * @minLength 1
-       */
-    minLevel?: string;
-    /** The subject whose visible instances are enumerated. */
-    subject: ResourceSubjectRefDto;
-}

package/dist/models/policyActingAgentDto.d.ts

@@ -1,14 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyActingAgentDtoKind } from './policyActingAgentDtoKind.js';
-export interface PolicyActingAgentDto {
-    kind: PolicyActingAgentDtoKind;
-    /**
-       * The agent's stable composition SLUG.
-       * @minLength 1
-       */
-    id: string;
-}

package/dist/models/policyActingAgentDtoKind.d.ts

@@ -1,9 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type PolicyActingAgentDtoKind = typeof PolicyActingAgentDtoKind[keyof typeof PolicyActingAgentDtoKind];
-export declare const PolicyActingAgentDtoKind: {
-    readonly agent: "agent";
-};

package/dist/models/policyActingAgentDtoKind.js

@@ -1,11 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyActingAgentDtoKind = void 0;
-exports.PolicyActingAgentDtoKind = {
-    agent: 'agent',
-};

package/dist/models/policyActingForDto.d.ts

@@ -1,29 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { SubjectKind } from './subjectKind.js';
-export interface PolicyActingForDto {
-    kind: SubjectKind;
-    /** @minLength 1 */
-    id: string;
-    /**
-       * Mirrors kernel `ActingForRef.clientId` — the ISSUER-STAMPED OAuth client
-       * identity of this delegation hop (`azp`, else `client_id`). Never
-       * caller-asserted: an OAuth client cannot claim another client's id inside a
-       * token the issuer signed. Absent ⇒ "unknown", never a match.
-       * @minLength 1
-       */
-    clientId?: string;
-    /**
-       * Mirrors kernel `ActingForRef.principalId` — the ISSUER-STAMPED,
-       * rotation-stable identity-api principal id of this hop (`principal_id`).
-       * `resolveActorChainFromClaims` stamps it on every hop whose claims carry
-       * one, so a gateway forwarding a verified chain sends it. Undeclared here,
-       * `forbidNonWhitelisted` refused the whole policy check with a 400 — which
-       * the gateway fails closed on — for any chain containing such a hop.
-       * @minLength 1
-       */
-    principalId?: string;
-}

package/dist/models/policyActingForDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyBiomeDto.d.ts

@@ -1,14 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { BiomeExecutionTrustTier } from './biomeExecutionTrustTier.js';
-export interface PolicyBiomeDto {
-    /** @minLength 1 */
-    id: string;
-    /** @minLength 1 */
-    version: string;
-    trustTier: BiomeExecutionTrustTier;
-    signatureVerified: boolean;
-}

package/dist/models/policyBiomeDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCallerDto.d.ts

@@ -1,17 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { CallerKind } from './callerKind.js';
-export interface PolicyCallerDto {
-    kind: CallerKind;
-    /** @minLength 1 */
-    appId?: string;
-    /** @minLength 1 */
-    sessionId?: string;
-    /** @minLength 1 */
-    ip?: string;
-    /** @minLength 1 */
-    userAgent?: string;
-}

package/dist/models/policyCallerDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCapabilityDto.d.ts

@@ -1,14 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export interface PolicyCapabilityDto {
-    /**
-       * <biome>:<verb>@<major> canonical CapabilityRef.
-       * @minLength 1
-       */
-    ref: string;
-    /** @minLength 1 */
-    inputHash?: string;
-}

package/dist/models/policyCheckBatchRequestDto.d.ts

@@ -1,13 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyCheckRequestDto } from './policyCheckRequestDto.js';
-export interface PolicyCheckBatchRequestDto {
-    /**
-       * Independent policy checks — each item is the EXACT single `POST /authorization/policy-check` request shape. At most 128 per call (422 beyond).
-       * @maxItems 128
-       */
-    checks: PolicyCheckRequestDto[];
-}

package/dist/models/policyCheckBatchRequestDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckBatchResponseDto.d.ts

@@ -1,10 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyDecisionDto } from './policyDecisionDto.js';
-export interface PolicyCheckBatchResponseDto {
-    /** Positionally aligned with `checks` — results[i] is the decision for checks[i]. A per-item DENY is a result, never an error; the response is never partial (any infrastructure failure fails the whole call). */
-    results: PolicyDecisionDto[];
-}

package/dist/models/policyCheckBatchResponseDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckBatchResponseDtoDataEnvelope.d.ts

@@ -1,9 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyCheckBatchResponseDto } from './policyCheckBatchResponseDto.js';
-export interface PolicyCheckBatchResponseDtoDataEnvelope {
-    data: PolicyCheckBatchResponseDto;
-}

package/dist/models/policyCheckBatchResponseDtoDataEnvelope.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckRequestDto.d.ts

@@ -1,96 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyActingAgentDto } from './policyActingAgentDto.js';
-import type { PolicyActingForDto } from './policyActingForDto.js';
-import type { PolicyBiomeDto } from './policyBiomeDto.js';
-import type { PolicyCallerDto } from './policyCallerDto.js';
-import type { PolicyCapabilityDto } from './policyCapabilityDto.js';
-import type { PolicyCheckRequestDtoAperture } from './policyCheckRequestDtoAperture.js';
-import type { PolicyConstraintsDto } from './policyConstraintsDto.js';
-import type { PolicyDelegatedAuthorityDto } from './policyDelegatedAuthorityDto.js';
-import type { PolicyEnvironmentDto } from './policyEnvironmentDto.js';
-import type { PolicyResourceDto } from './policyResourceDto.js';
-import type { PolicySpaceRefDto } from './policySpaceRefDto.js';
-import type { PolicySubjectRefDto } from './policySubjectRefDto.js';
-import type { SessionParticipantRole } from './sessionParticipantRole.js';
-export interface PolicyCheckRequestDto {
-    /** @minLength 1 */
-    id: string;
-    /** @minLength 1 */
-    requestId: string;
-    /** @minLength 1 */
-    traceId: string;
-    subject: PolicySubjectRefDto;
-    caller: PolicyCallerDto;
-    space: PolicySpaceRefDto;
-    environment: PolicyEnvironmentDto;
-    biome?: PolicyBiomeDto;
-    capability: PolicyCapabilityDto;
-    resource?: PolicyResourceDto;
-    constraints?: PolicyConstraintsDto;
-    actorChain?: PolicyActingForDto[];
-    /**
-       * The caller's VERIFIED delegated authority (kernel
-       * `ExecutionContext.delegation`). A CEILING, never a grant — see
-       * {@link PolicyDelegatedAuthorityDto} and the PDP stage that reads it
-       * (`AuthorizationService.applyDelegatedAuthorityCeiling`).
-       */
-    delegation?: PolicyDelegatedAuthorityDto;
-    /**
-       * Opaque credential-binding id already selected for this invocation. Carried
-       * on the kernel envelope (a re-checked / replayed context round-trips it), so
-       * the wire must accept it. NEVER a secret. The PDP re-resolves the binding
-       * itself via the precedence ladder and returns it on `PolicyDecision` — it
-       * does not trust an inbound value.
-       * @minLength 1
-       */
-    credentialBindingId?: string;
-    /**
-       * WHICH AGENT is acting — an IDENTITY, never an authority value.
-       *
-       * ── WHAT IT REPLACED, AND WHY THAT FIELD IS GONE (04-critical-defects B5) ──
-       *
-       * `reachTier` used to be declared here: the acting agent's permission
-       * CEILING, taken off the request body. This endpoint is fenced by
-       * `ServiceActorGuard`, so any platform service token could name one — and the
-       * tier is not narrowing-only. `connected` turns a DENY into an ALLOW for
-       * integration-reach capabilities and `full` LIFTS the delegation clamp, so a
-       * caller could ask this service to stop attenuating an agent to its
-       * delegators. That is the caller-supplied security input
-       * `.claude/rules/public-and-internal-route-guarding.md` forbids outright.
-       *
-       * The property is DELETED rather than ignored, and the deletion is the
-       * enforcement: the canonical pipe runs `forbidNonWhitelisted: true`, so a
-       * body still carrying `reachTier` is a `400 property reachTier should not
-       * exist`. There is no path that accepts it and drops it quietly.
-       *
-       * ── THE ANSWER IS RESOLVED HERE, FROM THIS SERVICE'S OWN RECORDS ──────────
-       *
-       * `AuthorizationService.resolveEffectiveReachTier` reads the ceiling from
-       * `agent_reach_tier_projection` — LOCAL rows keyed by the agent slug this
-       * field carries. A caller naming another agent therefore gets THAT agent's
-       * declaration, never one it invented, and a caller naming no agent gets the
-       * platform default.
-       *
-       * ── WHY THE AGENT NEEDS ITS OWN FIELD AND `subject` WILL NOT DO ───────────
-       *
-       * `subject` names the agent only on an AUTONOMOUS invocation. A DELEGATED one
-       * arrives as `subject = { kind: user, id: <owner> }` — the agent acts as its
-       * owner — so the acting agent is not on the envelope at all, and a ceiling
-       * keyed on `subject.id` silently stops applying the moment a human is in the
-       * session. That is precisely the path where a `sandbox` agent must stay
-       * sandboxed.
-       *
-       * Stamped by the surface that owns the agent's identity from its own verified
-       * credential (the MCP bridge-token claims), forwarded in-process by
-       * `xema-capability-router`, and never supplied by an agent.
-       */
-    actingAgent?: PolicyActingAgentDto;
-    /** Role the acting subject holds in the originating agent session. Precedence `owner > editor > viewer`. Absent for non-session invocations (workflow steps, service calls). */
-    participantRole?: SessionParticipantRole;
-    /** The acting agent's capability aperture (kernel `CapabilityAperture`): `{ kind: "unrestricted" }` or `{ kind: "armed", refs: string[] }`. Enforced at the capability-router funnel, carried here for the audit trail. */
-    aperture?: PolicyCheckRequestDtoAperture;
-}

package/dist/models/policyCheckRequestDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyCheckRequestDtoAperture.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-/**
- * The acting agent's capability aperture (kernel `CapabilityAperture`): `{ kind: "unrestricted" }` or `{ kind: "armed", refs: string[] }`. Enforced at the capability-router funnel, carried here for the audit trail.
- */
-export type PolicyCheckRequestDtoAperture = {
-    [key: string]: unknown;
-};

package/dist/models/policyConstraintsDto.d.ts

@@ -1,12 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export interface PolicyConstraintsDto {
-    maxCostUsd?: number;
-    maxDurationSeconds?: number;
-    requireApproval?: boolean;
-    requireAudit?: boolean;
-    requireCustomerEdge?: boolean;
-}

package/dist/models/policyDecisionDto.d.ts

@@ -1,26 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { CredentialPrecedenceSource } from './credentialPrecedenceSource.js';
-import type { PolicyDecisionKind } from './policyDecisionKind.js';
-import type { PolicyObligationDto } from './policyObligationDto.js';
-import type { PolicyRouteHintDto } from './policyRouteHintDto.js';
-export interface PolicyDecisionDto {
-    kind: PolicyDecisionKind;
-    /**
-       * Stable wire-code denial reason from the OPA bundle / authorization-api decision matrix. Free-form here; closed by the bundle. Surfaced verbatim in audit + capability-router error envelopes.
-       * @minLength 1
-       */
-    reason?: string;
-    obligations?: PolicyObligationDto[];
-    routeHints?: PolicyRouteHintDto;
-    /**
-       * Credential binding the executing gateway MUST use to resolve the external credential for this invocation. Present ONLY on an `allow` for a capability that declares an `externalServiceRef`. Opaque id — never a secret; the broker re-validates it before reading custody.
-       * @minLength 1
-       */
-    credentialBindingId?: string;
-    /** Which precedence tier supplied `credentialBindingId` (explicit grant > capability default > project default > org default). Populated iff `credentialBindingId` is present. */
-    credentialPrecedenceApplied?: CredentialPrecedenceSource;
-}

package/dist/models/policyDecisionDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyDecisionDtoDataEnvelope.d.ts

@@ -1,9 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyDecisionDto } from './policyDecisionDto.js';
-export interface PolicyDecisionDtoDataEnvelope {
-    data: PolicyDecisionDto;
-}

package/dist/models/policyDecisionDtoDataEnvelope.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyDecisionKind.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type PolicyDecisionKind = typeof PolicyDecisionKind[keyof typeof PolicyDecisionKind];
-export declare const PolicyDecisionKind: {
-    readonly allow: "allow";
-    readonly deny: "deny";
-    readonly needs_approval: "needs_approval";
-};

package/dist/models/policyDecisionKind.js

@@ -1,13 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyDecisionKind = void 0;
-exports.PolicyDecisionKind = {
-    allow: 'allow',
-    deny: 'deny',
-    needs_approval: 'needs_approval',
-};

package/dist/models/policyDelegatedAuthorityDto.d.ts

@@ -1,25 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyActingForDto } from './policyActingForDto.js';
-export interface PolicyDelegatedAuthorityDto {
-    /** @minLength 1 */
-    delegationId: string;
-    actor: PolicyActingForDto;
-    /** @minItems 1 */
-    actorChain: PolicyActingForDto[];
-    /**
-       * @minItems 1
-       * @items.minLength 1
-       */
-    capabilities: string[];
-    /**
-       * @minItems 1
-       * @items.minLength 1
-       */
-    resourceScope?: string[];
-    /** @minLength 1 */
-    authorizedBy?: string;
-}

package/dist/models/policyDelegatedAuthorityDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyEnvironmentDto.d.ts

@@ -1,15 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { ExecutionEnvironmentKind } from './executionEnvironmentKind.js';
-export interface PolicyEnvironmentDto {
-    /**
-       * environment:<slug> ref string.
-       * @minLength 1
-       */
-    id: string;
-    /** Closed set of built-in execution-environment classifications. Environment IDENTITY is a separate `environment:<slug>` ref — an org-custom environment carries its own slug there, and is still classified by one of these kinds. */
-    kind: ExecutionEnvironmentKind;
-}

package/dist/models/policyEnvironmentDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyObligationDto.d.ts

@@ -1,29 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { DataClassification } from './dataClassification.js';
-import type { DataResidency } from './dataResidency.js';
-import type { PolicyObligationKind } from './policyObligationKind.js';
-import type { RunnerKind } from './runnerKind.js';
-export interface PolicyObligationDto {
-    kind: PolicyObligationKind;
-    runnerKind?: RunnerKind;
-    /** @minLength 1 */
-    approverRole?: string;
-    maxDurationSeconds?: number;
-    maxCostUsd?: number;
-    maxClassification?: DataClassification;
-    residency?: DataResidency;
-    /**
-       * Egress allowlist patterns (wildcard host or https:// URL-prefix). Present only when kind=egress-allowlist.
-       * @items.minLength 1
-       */
-    allow?: string[];
-    /**
-       * Egress blocklist patterns; a match denies even if `allow` matched. Present only when kind=egress-allowlist.
-       * @items.minLength 1
-       */
-    deny?: string[];
-}

package/dist/models/policyObligationDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyObligationKind.d.ts

@@ -1,17 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-export type PolicyObligationKind = typeof PolicyObligationKind[keyof typeof PolicyObligationKind];
-export declare const PolicyObligationKind: {
-    readonly audit: "audit";
-    readonly 'redact-secrets': "redact-secrets";
-    readonly 'require-runner-kind': "require-runner-kind";
-    readonly 'require-human-approval': "require-human-approval";
-    readonly 'max-duration-seconds': "max-duration-seconds";
-    readonly 'max-cost-usd': "max-cost-usd";
-    readonly 'restrict-output-classification': "restrict-output-classification";
-    readonly 'data-residency': "data-residency";
-    readonly 'egress-allowlist': "egress-allowlist";
-};

package/dist/models/policyObligationKind.js

@@ -1,19 +0,0 @@
-"use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyObligationKind = void 0;
-exports.PolicyObligationKind = {
-    audit: 'audit',
-    'redact-secrets': 'redact-secrets',
-    'require-runner-kind': 'require-runner-kind',
-    'require-human-approval': 'require-human-approval',
-    'max-duration-seconds': 'max-duration-seconds',
-    'max-cost-usd': 'max-cost-usd',
-    'restrict-output-classification': 'restrict-output-classification',
-    'data-residency': 'data-residency',
-    'egress-allowlist': 'egress-allowlist',
-};

package/dist/models/policyResourceDto.d.ts

@@ -1,15 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { DataClassification } from './dataClassification.js';
-export interface PolicyResourceDto {
-    /**
-       * Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance this invocation targets. Exact Agent bindings always carry the version. The server answers `400 RESOURCE_REF_MALFORMED` for any other shape. Omit the whole `resource` block for a verb-only check; do not send a placeholder.
-       * @minLength 1
-       */
-    ref: string;
-    /** The classification the target resource carries. OMIT IT when the producer has none to declare — the effective classification is then the Space floor alone, and the request still gets the resource-ownership clamp. Omitting the whole `resource` block is NOT the same thing: that downgrades the call to a verb-only check and discards the ownership clamp. Never send a placeholder value. */
-    classification?: DataClassification;
-}

package/dist/models/policyResourceDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/policyRouteHintDto.d.ts

@@ -1,14 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { PolicyRouteHintDtoRequiredRunnerLabels } from './policyRouteHintDtoRequiredRunnerLabels.js';
-import type { RunnerKind } from './runnerKind.js';
-export interface PolicyRouteHintDto {
-    requiredRunnerLabels?: PolicyRouteHintDtoRequiredRunnerLabels;
-    preferredRunnerKind?: RunnerKind;
-    /** @minLength 1 */
-    requiredRegion?: string;
-    requireCustomerEdge?: boolean;
-}

package/dist/models/policyRouteHintDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });