@xemahq/authorization-internal-api-client 0.5.3 → 0.8.0

package/dist/endpoints/authorization/authorization.d.ts

@@ -3,28 +3,10 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { AuthorizationCheckRequestDto, AuthorizationCheckResponseDtoDataEnvelope, GrantVersionResponseDtoDataEnvelope, PolicyCheckBatchRequestDto, PolicyCheckBatchResponseDtoDataEnvelope, PolicyCheckRequestDto, PolicyDecisionDtoDataEnvelope } from '../../models';
-export declare const getAuthorizationControllerCheckUrl: () => string;
-/**
- * Called by xema-capability-router on every invocation. The verdict is OpenFGA-authoritative and then narrowed, in order, by the delegation clamp, the agent reach tier, and the ENVIRONMENT reach ceiling (the environment runs last on purpose: it is the outer boundary, so it must see the tier's output — a `connected` tier extends a deny into an allow, and the environment may then take that away). `requiresApproval` denies with APPROVAL_REQUIRED. NOT enforced here: `rateLimit` (accepted on a grant, read by nothing) and `ExecutionEnvironment.allowedCapabilities` (an enumerated per-ref list, deliberately not wired for the built-ins — see `environment-reach-ceiling`; it is enforced only by app-function-broker, for org-custom environments).
- * @summary Runtime allow/deny decision for a (subject, capability) tuple
- */
-export declare const authorizationControllerCheck: (authorizationCheckRequestDto: AuthorizationCheckRequestDto, options?: RequestInit) => Promise<AuthorizationCheckResponseDtoDataEnvelope>;
+import type { GrantVersionResponseDtoDataEnvelope } from '../../models';
 export declare const getAuthorizationControllerGrantVersionUrl: (orgId: string) => string;
 /**
  * A cheap read of the per-org grant-version counter — bumped on every grant/environment/membership change. Consumers (e.g. app-platform delegated-session verify) key a short-lived effective-capability cache by it so a revoked role takes effect at the next miss rather than at token expiry. Fail-closed: an unavailable version store surfaces as a 5xx so the caller denies.
  * @summary Current durable monotonic grant-version for an org
  */
 export declare const authorizationControllerGrantVersion: (orgId: string, options?: RequestInit) => Promise<GrantVersionResponseDtoDataEnvelope>;
-export declare const getAuthorizationControllerPolicyCheckUrl: () => string;
-/**
- *  wire surface. Accepts a PolicyRequest (== ExecutionContext) constructed by the capability router at the gateway boundary; returns a typed PolicyDecision { kind, reason?, obligations?, routeHints? }. The same decision matrix that powers POST /authorization/check is reused — this endpoint projects the verdict into the v4.3 envelope so the router can branch structurally on PolicyDecisionKind without parsing strings.
- * @summary Typed PolicyDecision for an ExecutionContext
- */
-export declare const authorizationControllerPolicyCheck: (policyCheckRequestDto: PolicyCheckRequestDto, options?: RequestInit) => Promise<PolicyDecisionDtoDataEnvelope>;
-export declare const getAuthorizationControllerPolicyCheckBatchUrl: () => string;
-/**
- * Wave-4 M1 batch surface. Accepts up to 128 independent PolicyRequests (each the EXACT single policy-check shape; 422 beyond the bound) and returns PolicyDecisions POSITIONALLY aligned with the request (results[i] is the decision for checks[i]). Every item runs the SAME decision pipeline as POST /authorization/policy-check — the batch only amortises HTTP round-trips for enumerating consumers (the capability BFF list path). Never-partial: a per-item DENY is a result, but any infrastructure failure mid-batch fails the whole call with 503. The PDP does not add batch-level caching; consumers own caching.
- * @summary Batch of typed PolicyDecisions for independent ExecutionContexts
- */
-export declare const authorizationControllerPolicyCheckBatch: (policyCheckBatchRequestDto: PolicyCheckBatchRequestDto, options?: RequestInit) => Promise<PolicyCheckBatchResponseDtoDataEnvelope>;

package/dist/endpoints/authorization/authorization.js

@@ -1,24 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizationControllerPolicyCheckBatch = exports.getAuthorizationControllerPolicyCheckBatchUrl = exports.authorizationControllerPolicyCheck = exports.getAuthorizationControllerPolicyCheckUrl = exports.authorizationControllerGrantVersion = exports.getAuthorizationControllerGrantVersionUrl = exports.authorizationControllerCheck = exports.getAuthorizationControllerCheckUrl = void 0;
+exports.authorizationControllerGrantVersion = exports.getAuthorizationControllerGrantVersionUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
-const getAuthorizationControllerCheckUrl = () => {
-    return `/authorization/check`;
-};
-exports.getAuthorizationControllerCheckUrl = getAuthorizationControllerCheckUrl;
-/**
- * Called by xema-capability-router on every invocation. The verdict is OpenFGA-authoritative and then narrowed, in order, by the delegation clamp, the agent reach tier, and the ENVIRONMENT reach ceiling (the environment runs last on purpose: it is the outer boundary, so it must see the tier's output — a `connected` tier extends a deny into an allow, and the environment may then take that away). `requiresApproval` denies with APPROVAL_REQUIRED. NOT enforced here: `rateLimit` (accepted on a grant, read by nothing) and `ExecutionEnvironment.allowedCapabilities` (an enumerated per-ref list, deliberately not wired for the built-ins — see `environment-reach-ceiling`; it is enforced only by app-function-broker, for org-custom environments).
- * @summary Runtime allow/deny decision for a (subject, capability) tuple
- */
-const authorizationControllerCheck = async (authorizationCheckRequestDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerCheckUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(authorizationCheckRequestDto)
-    });
-};
-exports.authorizationControllerCheck = authorizationControllerCheck;
 const getAuthorizationControllerGrantVersionUrl = (orgId) => {
     return `/authorization/grant-version/${orgId}`;
 };
@@ -34,37 +17,3 @@ const authorizationControllerGrantVersion = async (orgId, options) => {
     });
 };
 exports.authorizationControllerGrantVersion = authorizationControllerGrantVersion;
-const getAuthorizationControllerPolicyCheckUrl = () => {
-    return `/authorization/policy-check`;
-};
-exports.getAuthorizationControllerPolicyCheckUrl = getAuthorizationControllerPolicyCheckUrl;
-/**
- *  wire surface. Accepts a PolicyRequest (== ExecutionContext) constructed by the capability router at the gateway boundary; returns a typed PolicyDecision { kind, reason?, obligations?, routeHints? }. The same decision matrix that powers POST /authorization/check is reused — this endpoint projects the verdict into the v4.3 envelope so the router can branch structurally on PolicyDecisionKind without parsing strings.
- * @summary Typed PolicyDecision for an ExecutionContext
- */
-const authorizationControllerPolicyCheck = async (policyCheckRequestDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerPolicyCheckUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(policyCheckRequestDto)
-    });
-};
-exports.authorizationControllerPolicyCheck = authorizationControllerPolicyCheck;
-const getAuthorizationControllerPolicyCheckBatchUrl = () => {
-    return `/authorization/policy-check/batch`;
-};
-exports.getAuthorizationControllerPolicyCheckBatchUrl = getAuthorizationControllerPolicyCheckBatchUrl;
-/**
- * Wave-4 M1 batch surface. Accepts up to 128 independent PolicyRequests (each the EXACT single policy-check shape; 422 beyond the bound) and returns PolicyDecisions POSITIONALLY aligned with the request (results[i] is the decision for checks[i]). Every item runs the SAME decision pipeline as POST /authorization/policy-check — the batch only amortises HTTP round-trips for enumerating consumers (the capability BFF list path). Never-partial: a per-item DENY is a result, but any infrastructure failure mid-batch fails the whole call with 503. The PDP does not add batch-level caching; consumers own caching.
- * @summary Batch of typed PolicyDecisions for independent ExecutionContexts
- */
-const authorizationControllerPolicyCheckBatch = async (policyCheckBatchRequestDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getAuthorizationControllerPolicyCheckBatchUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(policyCheckBatchRequestDto)
-    });
-};
-exports.authorizationControllerPolicyCheckBatch = authorizationControllerPolicyCheckBatch;

package/dist/endpoints/authorization-policy-sets/authorization-policy-sets.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { AdoptOrgPolicySetDto, OrgPolicySetDtoDataEnvelope, PolicySetTestResultsDtoDataEnvelope, RetiredNamespaceDtoDataEnvelope, RunPolicySetTestsDto } from '../../models';
+export declare const getPolicySetsControllerOrgPolicySetUrl: (orgId: string) => string;
+/**
+ * @summary The org's own policy set, or policySetId null when it runs the sealed base
+ */
+export declare const policySetsControllerOrgPolicySet: (orgId: string, options?: RequestInit) => Promise<OrgPolicySetDtoDataEnvelope>;
+export declare const getPolicySetsControllerAdoptUrl: (orgId: string) => string;
+/**
+ * The PDP composes the base with runtimeModules itself. 422 POLICY_SET_HASH_MISMATCH when that composition is not policySetId; 422 POLICY_SET_COMPOSITION_REFUSED when the kernel composer refuses it; 409 POLICY_SET_SWITCH_CONFLICT when the pointer is no longer expectedCurrentPolicySetId. Identical compositions share one stored model. Moves this org only; an empty set returns it to the base.
+ * @summary Adopt a composed policy set for ONE org (CAS on its pointer)
+ */
+export declare const policySetsControllerAdopt: (orgId: string, adoptOrgPolicySetDto: AdoptOrgPolicySetDto, options?: RequestInit) => Promise<void>;
+export declare const getPolicySetsControllerRetireUrl: (orgId: string, namespace: string) => string;
+/**
+ * @summary Uninstall steps 1–2 for one org: deny the namespace, delete its facts and the parent facts into it
+ */
+export declare const policySetsControllerRetire: (orgId: string, namespace: string, options?: RequestInit) => Promise<RetiredNamespaceDtoDataEnvelope>;
+export declare const getPolicySetsControllerRunTestsUrl: () => string;
+/**
+ * @summary Run a composed model's .fga.yaml tests against the real OpenFGA server, each in an ephemeral store
+ */
+export declare const policySetsControllerRunTests: (runPolicySetTestsDto: RunPolicySetTestsDto, options?: RequestInit) => Promise<PolicySetTestResultsDtoDataEnvelope>;

package/dist/endpoints/authorization-policy-sets/authorization-policy-sets.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policySetsControllerRunTests = exports.getPolicySetsControllerRunTestsUrl = exports.policySetsControllerRetire = exports.getPolicySetsControllerRetireUrl = exports.policySetsControllerAdopt = exports.getPolicySetsControllerAdoptUrl = exports.policySetsControllerOrgPolicySet = exports.getPolicySetsControllerOrgPolicySetUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getPolicySetsControllerOrgPolicySetUrl = (orgId) => {
+    return `/internal/authorization/orgs/${orgId}/policy-set`;
+};
+exports.getPolicySetsControllerOrgPolicySetUrl = getPolicySetsControllerOrgPolicySetUrl;
+/**
+ * @summary The org's own policy set, or policySetId null when it runs the sealed base
+ */
+const policySetsControllerOrgPolicySet = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerOrgPolicySetUrl)(orgId), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.policySetsControllerOrgPolicySet = policySetsControllerOrgPolicySet;
+const getPolicySetsControllerAdoptUrl = (orgId) => {
+    return `/internal/authorization/orgs/${orgId}/policy-set`;
+};
+exports.getPolicySetsControllerAdoptUrl = getPolicySetsControllerAdoptUrl;
+/**
+ * The PDP composes the base with runtimeModules itself. 422 POLICY_SET_HASH_MISMATCH when that composition is not policySetId; 422 POLICY_SET_COMPOSITION_REFUSED when the kernel composer refuses it; 409 POLICY_SET_SWITCH_CONFLICT when the pointer is no longer expectedCurrentPolicySetId. Identical compositions share one stored model. Moves this org only; an empty set returns it to the base.
+ * @summary Adopt a composed policy set for ONE org (CAS on its pointer)
+ */
+const policySetsControllerAdopt = async (orgId, adoptOrgPolicySetDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerAdoptUrl)(orgId), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(adoptOrgPolicySetDto)
+    });
+};
+exports.policySetsControllerAdopt = policySetsControllerAdopt;
+const getPolicySetsControllerRetireUrl = (orgId, namespace) => {
+    return `/internal/authorization/orgs/${orgId}/module-namespaces/${namespace}/retire`;
+};
+exports.getPolicySetsControllerRetireUrl = getPolicySetsControllerRetireUrl;
+/**
+ * @summary Uninstall steps 1–2 for one org: deny the namespace, delete its facts and the parent facts into it
+ */
+const policySetsControllerRetire = async (orgId, namespace, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerRetireUrl)(orgId, namespace), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.policySetsControllerRetire = policySetsControllerRetire;
+const getPolicySetsControllerRunTestsUrl = () => {
+    return `/internal/authorization/policy-sets/test`;
+};
+exports.getPolicySetsControllerRunTestsUrl = getPolicySetsControllerRunTestsUrl;
+/**
+ * @summary Run a composed model's .fga.yaml tests against the real OpenFGA server, each in an ephemeral store
+ */
+const policySetsControllerRunTests = async (runPolicySetTestsDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getPolicySetsControllerRunTestsUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(runPolicySetTestsDto)
+    });
+};
+exports.policySetsControllerRunTests = policySetsControllerRunTests;

package/dist/endpoints/environments/environments.d.ts

@@ -16,12 +16,6 @@ export declare const getEnvironmentsControllerCreateUrl: () => string;
  * @summary Create an org-custom ExecutionEnvironment
  */
 export declare const environmentsControllerCreate: (createExecutionEnvironmentDto: CreateExecutionEnvironmentDto, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
-export declare const getEnvironmentsControllerResolveExactPolicyUrl: (slug: string, contentHash: string) => string;
-/**
- * Service-only authority read. A verified tenant context resolves that tenant's visible publication; a request without tenant context can resolve only a global built-in publication. The response includes the exact revision/hash and complete canonical Environment policy ceilings.
- * @summary Resolve one exact immutable Environment policy publication
- */
-export declare const environmentsControllerResolveExactPolicy: (slug: string, contentHash: string, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerReleaseHistoryUrl: (slug: string, params?: EnvironmentsControllerReleaseHistoryParams) => string;
 /**
  * @summary List immutable generic ReleaseSet history for an Environment
@@ -55,3 +49,9 @@ export declare const getEnvironmentsControllerRemoveUrl: (slug: string, params:
  * @summary Delete an org-custom ExecutionEnvironment
  */
 export declare const environmentsControllerRemove: (slug: string, params: EnvironmentsControllerRemoveParams, options?: RequestInit) => Promise<void>;
+export declare const getEnvironmentPolicyReadControllerResolveExactPolicyUrl: (slug: string, contentHash: string) => string;
+/**
+ * Service-only authority read. A verified tenant context resolves that tenant's visible publication; a request without tenant context can resolve only a global built-in publication. The response includes the exact revision/hash and complete canonical Environment policy ceilings.
+ * @summary Resolve one exact immutable Environment policy publication
+ */
+export declare const environmentPolicyReadControllerResolveExactPolicy: (slug: string, contentHash: string, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;

package/dist/endpoints/environments/environments.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.environmentsControllerRemove = exports.getEnvironmentsControllerRemoveUrl = exports.environmentsControllerUpdate = exports.getEnvironmentsControllerUpdateUrl = exports.environmentsControllerFindBySlug = exports.getEnvironmentsControllerFindBySlugUrl = exports.environmentsControllerRollback = exports.getEnvironmentsControllerRollbackUrl = exports.environmentsControllerReleaseImpact = exports.getEnvironmentsControllerReleaseImpactUrl = exports.environmentsControllerReleaseHistory = exports.getEnvironmentsControllerReleaseHistoryUrl = exports.environmentsControllerResolveExactPolicy = exports.getEnvironmentsControllerResolveExactPolicyUrl = exports.environmentsControllerCreate = exports.getEnvironmentsControllerCreateUrl = exports.environmentsControllerList = exports.getEnvironmentsControllerListUrl = void 0;
+exports.environmentPolicyReadControllerResolveExactPolicy = exports.getEnvironmentPolicyReadControllerResolveExactPolicyUrl = exports.environmentsControllerRemove = exports.getEnvironmentsControllerRemoveUrl = exports.environmentsControllerUpdate = exports.getEnvironmentsControllerUpdateUrl = exports.environmentsControllerFindBySlug = exports.getEnvironmentsControllerFindBySlugUrl = exports.environmentsControllerRollback = exports.getEnvironmentsControllerRollbackUrl = exports.environmentsControllerReleaseImpact = exports.getEnvironmentsControllerReleaseImpactUrl = exports.environmentsControllerReleaseHistory = exports.getEnvironmentsControllerReleaseHistoryUrl = exports.environmentsControllerCreate = exports.getEnvironmentsControllerCreateUrl = exports.environmentsControllerList = exports.getEnvironmentsControllerListUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getEnvironmentsControllerListUrl = (params) => {
     const normalizedParams = new URLSearchParams();
@@ -53,21 +53,6 @@ const environmentsControllerCreate = async (createExecutionEnvironmentDto, optio
     });
 };
 exports.environmentsControllerCreate = environmentsControllerCreate;
-const getEnvironmentsControllerResolveExactPolicyUrl = (slug, contentHash) => {
-    return `/environments/${slug}/revisions/${contentHash}`;
-};
-exports.getEnvironmentsControllerResolveExactPolicyUrl = getEnvironmentsControllerResolveExactPolicyUrl;
-/**
- * Service-only authority read. A verified tenant context resolves that tenant's visible publication; a request without tenant context can resolve only a global built-in publication. The response includes the exact revision/hash and complete canonical Environment policy ceilings.
- * @summary Resolve one exact immutable Environment policy publication
- */
-const environmentsControllerResolveExactPolicy = async (slug, contentHash, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getEnvironmentsControllerResolveExactPolicyUrl)(slug, contentHash), {
-        ...options,
-        method: 'GET'
-    });
-};
-exports.environmentsControllerResolveExactPolicy = environmentsControllerResolveExactPolicy;
 const getEnvironmentsControllerReleaseHistoryUrl = (slug, params) => {
     const normalizedParams = new URLSearchParams();
     Object.entries(params || {}).forEach(([key, value]) => {
@@ -273,3 +258,18 @@ const environmentsControllerRemove = async (slug, params, options) => {
     });
 };
 exports.environmentsControllerRemove = environmentsControllerRemove;
+const getEnvironmentPolicyReadControllerResolveExactPolicyUrl = (slug, contentHash) => {
+    return `/environments/${slug}/revisions/${contentHash}`;
+};
+exports.getEnvironmentPolicyReadControllerResolveExactPolicyUrl = getEnvironmentPolicyReadControllerResolveExactPolicyUrl;
+/**
+ * Service-only authority read. A verified tenant context resolves that tenant's visible publication; a request without tenant context can resolve only a global built-in publication. The response includes the exact revision/hash and complete canonical Environment policy ceilings.
+ * @summary Resolve one exact immutable Environment policy publication
+ */
+const environmentPolicyReadControllerResolveExactPolicy = async (slug, contentHash, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getEnvironmentPolicyReadControllerResolveExactPolicyUrl)(slug, contentHash), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.environmentPolicyReadControllerResolveExactPolicy = environmentPolicyReadControllerResolveExactPolicy;

package/dist/endpoints/output-routes/output-routes.d.ts

@@ -9,11 +9,6 @@ export declare const getOutputRouteRevisionsControllerRequestRevisionReleaseUrl:
  * @summary Publish an immutable OutputRoute revision and request its governed channel release
  */
 export declare const outputRouteRevisionsControllerRequestRevisionRelease: (requestOutputRouteRevisionReleaseDto: RequestOutputRouteRevisionReleaseDto, options?: RequestInit) => Promise<OutputRoutePublicationRequestDtoDataEnvelope>;
-export declare const getOutputRouteRevisionsControllerResolveExactUrl: () => string;
-/**
- * @summary Resolve one exact OutputRoute revision and current subject access
- */
-export declare const outputRouteRevisionsControllerResolveExact: (resolveExactOutputRouteDto: ResolveExactOutputRouteDto, options?: RequestInit) => Promise<OutputRouteAuthorityDtoDataEnvelope>;
 export declare const getOutputRouteRevisionsControllerResolveChannelUrl: () => string;
 /**
  * @summary Resolve a governed OutputRoute channel to the exact pin a new binding must persist
@@ -39,3 +34,8 @@ export declare const getOutputRouteRevisionsControllerPreviewImpactUrl: (routeId
  * @summary Preview reverse impact of a channel advance
  */
 export declare const outputRouteRevisionsControllerPreviewImpact: (routeId: string, previewOutputRouteImpactDto: PreviewOutputRouteImpactDto, options?: RequestInit) => Promise<ImpactedOutputRouteConsumerDtoDataArrayEnvelope>;
+export declare const getOutputRouteExactReadControllerResolveExactUrl: () => string;
+/**
+ * @summary Resolve one exact OutputRoute revision and current subject access
+ */
+export declare const outputRouteExactReadControllerResolveExact: (resolveExactOutputRouteDto: ResolveExactOutputRouteDto, options?: RequestInit) => Promise<OutputRouteAuthorityDtoDataEnvelope>;

package/dist/endpoints/output-routes/output-routes.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.outputRouteRevisionsControllerPreviewImpact = exports.getOutputRouteRevisionsControllerPreviewImpactUrl = exports.outputRouteRevisionsControllerReleaseHistory = exports.getOutputRouteRevisionsControllerReleaseHistoryUrl = exports.outputRouteRevisionsControllerRequestRollback = exports.getOutputRouteRevisionsControllerRequestRollbackUrl = exports.outputRouteRevisionsControllerRequestRetirement = exports.getOutputRouteRevisionsControllerRequestRetirementUrl = exports.outputRouteRevisionsControllerResolveChannel = exports.getOutputRouteRevisionsControllerResolveChannelUrl = exports.outputRouteRevisionsControllerResolveExact = exports.getOutputRouteRevisionsControllerResolveExactUrl = exports.outputRouteRevisionsControllerRequestRevisionRelease = exports.getOutputRouteRevisionsControllerRequestRevisionReleaseUrl = void 0;
+exports.outputRouteExactReadControllerResolveExact = exports.getOutputRouteExactReadControllerResolveExactUrl = exports.outputRouteRevisionsControllerPreviewImpact = exports.getOutputRouteRevisionsControllerPreviewImpactUrl = exports.outputRouteRevisionsControllerReleaseHistory = exports.getOutputRouteRevisionsControllerReleaseHistoryUrl = exports.outputRouteRevisionsControllerRequestRollback = exports.getOutputRouteRevisionsControllerRequestRollbackUrl = exports.outputRouteRevisionsControllerRequestRetirement = exports.getOutputRouteRevisionsControllerRequestRetirementUrl = exports.outputRouteRevisionsControllerResolveChannel = exports.getOutputRouteRevisionsControllerResolveChannelUrl = exports.outputRouteRevisionsControllerRequestRevisionRelease = exports.getOutputRouteRevisionsControllerRequestRevisionReleaseUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getOutputRouteRevisionsControllerRequestRevisionReleaseUrl = () => {
     return `/output-routes/revisions`;
@@ -18,22 +18,6 @@ const outputRouteRevisionsControllerRequestRevisionRelease = async (requestOutpu
     });
 };
 exports.outputRouteRevisionsControllerRequestRevisionRelease = outputRouteRevisionsControllerRequestRevisionRelease;
-const getOutputRouteRevisionsControllerResolveExactUrl = () => {
-    return `/output-routes/resolve-exact`;
-};
-exports.getOutputRouteRevisionsControllerResolveExactUrl = getOutputRouteRevisionsControllerResolveExactUrl;
-/**
- * @summary Resolve one exact OutputRoute revision and current subject access
- */
-const outputRouteRevisionsControllerResolveExact = async (resolveExactOutputRouteDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteRevisionsControllerResolveExactUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(resolveExactOutputRouteDto)
-    });
-};
-exports.outputRouteRevisionsControllerResolveExact = outputRouteRevisionsControllerResolveExact;
 const getOutputRouteRevisionsControllerResolveChannelUrl = () => {
     return `/output-routes/resolve-channel`;
 };
@@ -131,3 +115,19 @@ const outputRouteRevisionsControllerPreviewImpact = async (routeId, previewOutpu
     });
 };
 exports.outputRouteRevisionsControllerPreviewImpact = outputRouteRevisionsControllerPreviewImpact;
+const getOutputRouteExactReadControllerResolveExactUrl = () => {
+    return `/output-routes/resolve-exact`;
+};
+exports.getOutputRouteExactReadControllerResolveExactUrl = getOutputRouteExactReadControllerResolveExactUrl;
+/**
+ * @summary Resolve one exact OutputRoute revision and current subject access
+ */
+const outputRouteExactReadControllerResolveExact = async (resolveExactOutputRouteDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOutputRouteExactReadControllerResolveExactUrl)(), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(resolveExactOutputRouteDto)
+    });
+};
+exports.outputRouteExactReadControllerResolveExact = outputRouteExactReadControllerResolveExact;

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { configureClient, getClientConfig, ClientError, customFetch, type Client
 export * from './models';
 export * from './endpoints/agents/agents';
 export * from './endpoints/authorization/authorization';
+export * from './endpoints/authorization-policy-sets/authorization-policy-sets';
 export * from './endpoints/capability-authority-requests/capability-authority-requests';
 export * from './endpoints/contribution-sync/contribution-sync';
 export * from './endpoints/credential-defaults/credential-defaults';
@@ -13,6 +14,5 @@ export * from './endpoints/output-routes/output-routes';
 export * from './endpoints/profiles/profiles';
 export * from './endpoints/relationships/relationships';
 export * from './endpoints/resource-revisions/resource-revisions';
-export * from './endpoints/resources/resources';
 export * from './endpoints/roles/roles';
 export * from './endpoints/teams/teams';

package/dist/index.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "customFetch", { enumerable: true, get: function
 __exportStar(require("./models"), exports);
 __exportStar(require("./endpoints/agents/agents"), exports);
 __exportStar(require("./endpoints/authorization/authorization"), exports);
+__exportStar(require("./endpoints/authorization-policy-sets/authorization-policy-sets"), exports);
 __exportStar(require("./endpoints/capability-authority-requests/capability-authority-requests"), exports);
 __exportStar(require("./endpoints/contribution-sync/contribution-sync"), exports);
 __exportStar(require("./endpoints/credential-defaults/credential-defaults"), exports);
@@ -35,6 +36,5 @@ __exportStar(require("./endpoints/output-routes/output-routes"), exports);
 __exportStar(require("./endpoints/profiles/profiles"), exports);
 __exportStar(require("./endpoints/relationships/relationships"), exports);
 __exportStar(require("./endpoints/resource-revisions/resource-revisions"), exports);
-__exportStar(require("./endpoints/resources/resources"), exports);
 __exportStar(require("./endpoints/roles/roles"), exports);
 __exportStar(require("./endpoints/teams/teams"), exports);

package/dist/models/adoptOrgPolicySetDto.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RuntimeModuleContributionDto } from './runtimeModuleContributionDto.js';
+export interface AdoptOrgPolicySetDto {
+    /**
+       * The composer modelHash biome-host composed and tested for base + runtimeModules.
+       * @pattern SHA256_HEX
+       */
+    policySetId: string;
+    /** The org's COMPLETE runtime module set; empty moves the org back to the base. */
+    runtimeModules: RuntimeModuleContributionDto[];
+    /**
+       * The pointer the caller composed against; null when it read the base.
+       * @nullable
+       * @pattern SHA256_HEX
+       */
+    expectedCurrentPolicySetId: string | null;
+}

package/dist/models/dataClassification.d.ts

@@ -3,6 +3,9 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+/**
+ * The environment's DATA ceiling: the most restrictive `DataClassification` an invocation may carry and still run here. The PDP compares it against `join(space floor, resource tag)` and DENIES when it is exceeded. `regulated` (the top of the rank) admits everything and is the default, so the ceiling refuses nothing until it is lowered.
+ */
 export type DataClassification = typeof DataClassification[keyof typeof DataClassification];
 export declare const DataClassification: {
     readonly public: "public";

package/dist/models/executionEnvironmentKind.d.ts

@@ -4,7 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 /**
- * Closed set of built-in execution-environment classifications. Environment IDENTITY is a separate `environment:<slug>` ref — an org-custom environment carries its own slug there, and is still classified by one of these kinds.
+ * Every execution environment in which the subject holds this capability (closed enum).
  */
 export type ExecutionEnvironmentKind = typeof ExecutionEnvironmentKind[keyof typeof ExecutionEnvironmentKind];
 export declare const ExecutionEnvironmentKind: {

package/dist/models/index.d.ts

@@ -1,21 +1,12 @@
-export * from './addResourceShareDto';
 export * from './addRoleGrantDto';
 export * from './addTeamMemberDto';
+export * from './adoptOrgPolicySetDto';
 export * from './agentProvisionDecision';
 export * from './agentProvisionReason';
 export * from './agentReachTier';
 export * from './assignRoleDto';
 export * from './authorityRowOwnerSpaceKind';
-export * from './authorizationCheckRequestDto';
-export * from './authorizationCheckResponseDto';
-export * from './authorizationCheckResponseDtoDataEnvelope';
-export * from './authorizationDecisionCode';
-export * from './authorizationReasonDto';
-export * from './authorizationSuggestionDto';
-export * from './authorizationSuggestionKind';
-export * from './biomeExecutionTrustTier';
 export * from './biomePermissionProfile';
-export * from './callerKind';
 export * from './capabilityAuthorityRequestDto';
 export * from './capabilityAuthorityRequestDtoDataArrayEnvelope';
 export * from './capabilityAuthorityRequestDtoDataEnvelope';
@@ -44,9 +35,7 @@ export * from './credentialDefaultDtoDataEnvelope';
 export * from './credentialDefaultsControllerDeleteParams';
 export * from './credentialDefaultsControllerGetParams';
 export * from './credentialDefaultsControllerListParams';
-export * from './credentialPrecedenceSource';
 export * from './dataClassification';
-export * from './dataResidency';
 export * from './describeObjectsResponseDto';
 export * from './describeObjectsResponseDtoDataEnvelope';
 export * from './environmentCeilingSource';
@@ -83,14 +72,16 @@ export * from './grantVersionResponseDtoDataEnvelope';
 export * from './grantsControllerListParams';
 export * from './impactedOutputRouteConsumerDto';
 export * from './impactedOutputRouteConsumerDtoDataArrayEnvelope';
-export * from './listRegisteredResourcesDto';
-export * from './listVisibleResourcesDto';
 export * from './object';
 export * from './objectLifecycle';
 export * from './openCapabilityAuthorityRequestDto';
 export * from './openCapabilityAuthorityRequestDtoSubjectKind';
 export * from './openFgaRelationshipDto';
 export * from './openFgaRelationshipDtoPaginatedEnvelope';
+export * from './orgPolicySetDto';
+export * from './orgPolicySetDtoDataEnvelope';
+export * from './orgPolicySetDtoModel';
+export * from './orgPolicySetDtoModules';
 export * from './outputRouteAuthorityDto';
 export * from './outputRouteAuthorityDtoAllowedOutputSchema';
 export * from './outputRouteAuthorityDtoDataEnvelope';
@@ -107,30 +98,10 @@ export * from './outputRouteRevisionDto';
 export * from './outputRouteRevisionDtoAllowedOutputSchema';
 export * from './outputRouteRevisionsControllerReleaseHistoryParams';
 export * from './paginationMeta';
-export * from './policyActingAgentDto';
-export * from './policyActingAgentDtoKind';
-export * from './policyActingForDto';
-export * from './policyBiomeDto';
-export * from './policyCallerDto';
-export * from './policyCapabilityDto';
-export * from './policyCheckBatchRequestDto';
-export * from './policyCheckBatchResponseDto';
-export * from './policyCheckBatchResponseDtoDataEnvelope';
-export * from './policyCheckRequestDto';
-export * from './policyCheckRequestDtoAperture';
-export * from './policyConstraintsDto';
-export * from './policyDecisionDto';
-export * from './policyDecisionDtoDataEnvelope';
-export * from './policyDecisionKind';
-export * from './policyDelegatedAuthorityDto';
-export * from './policyEnvironmentDto';
-export * from './policyObligationDto';
-export * from './policyObligationKind';
-export * from './policyResourceDto';
-export * from './policyRouteHintDto';
-export * from './policyRouteHintDtoRequiredRunnerLabels';
-export * from './policySpaceRefDto';
-export * from './policySubjectRefDto';
+export * from './policySetTestFileDto';
+export * from './policySetTestFileResultDto';
+export * from './policySetTestResultsDto';
+export * from './policySetTestResultsDtoDataEnvelope';
 export * from './previewOutputRouteImpactDto';
 export * from './problemActionableBy';
 export * from './problemDetailsDto';
@@ -146,16 +117,10 @@ export * from './provisionAgentResultDto';
 export * from './provisionAgentResultDtoDataEnvelope';
 export * from './provisionedCapabilityDto';
 export * from './recordAgentReachTierRequestDto';
-export * from './registerResourceOwnershipDto';
 export * from './registerResourceRevisionDto';
-export * from './registeredResourceDto';
 export * from './registeredResourceRevisionDto';
 export * from './registeredResourceRevisionDtoDataEnvelope';
-export * from './registeredResourcesDto';
-export * from './registeredResourcesDtoDataEnvelope';
 export * from './relationshipsControllerListParams';
-export * from './removeResourceShareDto';
-export * from './replaceResourceOwnershipDto';
 export * from './requestOutputRouteRetirementDto';
 export * from './requestOutputRouteRevisionReleaseDto';
 export * from './requestOutputRouteRevisionReleaseDtoAllowedOutputSchema';
@@ -164,15 +129,10 @@ export * from './resolveExactOutputRouteDto';
 export * from './resolveExactResourceRevisionDto';
 export * from './resolveOutputRouteChannelDto';
 export * from './resourceManagedBy';
-export * from './resourceOwnershipDto';
-export * from './resourceOwnershipDtoDataEnvelope';
-export * from './resourceOwnershipEntryDto';
-export * from './resourceOwnershipReadDto';
-export * from './resourceOwnershipReadDtoDataEnvelope';
-export * from './resourceShareRefDto';
 export * from './resourceSubjectAccessResult';
 export * from './resourceSubjectRefDto';
-export * from './resourceVisibilityPattern';
+export * from './retiredNamespaceDto';
+export * from './retiredNamespaceDtoDataEnvelope';
 export * from './roleAssignmentDto';
 export * from './roleAssignmentDtoDataArrayEnvelope';
 export * from './roleAssignmentDtoDataEnvelope';
@@ -184,11 +144,12 @@ export * from './roleGrantDtoDataArrayEnvelope';
 export * from './roleGrantDtoDataEnvelope';
 export * from './rolesControllerListParams';
 export * from './rollbackExecutionEnvironmentDto';
-export * from './runnerKind';
-export * from './sessionParticipantRole';
+export * from './runPolicySetTestsDto';
+export * from './runPolicySetTestsDtoModel';
+export * from './runtimeModuleContributionDto';
+export * from './runtimeModuleContributionDtoManifest';
 export * from './spaceKind';
 export * from './subjectKind';
-export * from './subjectRefDto';
 export * from './teamDto';
 export * from './teamDtoDataArrayEnvelope';
 export * from './teamDtoDataEnvelope';
@@ -204,8 +165,6 @@ export * from './updateGrantDto';
 export * from './updateRoleDto';
 export * from './updateTeamDto';
 export * from './upsertCredentialDefaultDto';
-export * from './visibleResourcesDto';
-export * from './visibleResourcesDtoDataEnvelope';
 export * from './xemaObjectKind';
 export * from './xemaObjectResponseDto';
 export * from './xemaObjectResponseDtoPayload';