@xemahq/authorization-internal-api-client 0.5.3 → 0.8.0

package/dist/models/index.js

@@ -15,24 +15,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 // Auto-generated by tooling/codegen/regenerate-models-barrel.js — do not edit manually.
-__exportStar(require("./addResourceShareDto"), exports);
 __exportStar(require("./addRoleGrantDto"), exports);
 __exportStar(require("./addTeamMemberDto"), exports);
+__exportStar(require("./adoptOrgPolicySetDto"), exports);
 __exportStar(require("./agentProvisionDecision"), exports);
 __exportStar(require("./agentProvisionReason"), exports);
 __exportStar(require("./agentReachTier"), exports);
 __exportStar(require("./assignRoleDto"), exports);
 __exportStar(require("./authorityRowOwnerSpaceKind"), exports);
-__exportStar(require("./authorizationCheckRequestDto"), exports);
-__exportStar(require("./authorizationCheckResponseDto"), exports);
-__exportStar(require("./authorizationCheckResponseDtoDataEnvelope"), exports);
-__exportStar(require("./authorizationDecisionCode"), exports);
-__exportStar(require("./authorizationReasonDto"), exports);
-__exportStar(require("./authorizationSuggestionDto"), exports);
-__exportStar(require("./authorizationSuggestionKind"), exports);
-__exportStar(require("./biomeExecutionTrustTier"), exports);
 __exportStar(require("./biomePermissionProfile"), exports);
-__exportStar(require("./callerKind"), exports);
 __exportStar(require("./capabilityAuthorityRequestDto"), exports);
 __exportStar(require("./capabilityAuthorityRequestDtoDataArrayEnvelope"), exports);
 __exportStar(require("./capabilityAuthorityRequestDtoDataEnvelope"), exports);
@@ -61,9 +52,7 @@ __exportStar(require("./credentialDefaultDtoDataEnvelope"), exports);
 __exportStar(require("./credentialDefaultsControllerDeleteParams"), exports);
 __exportStar(require("./credentialDefaultsControllerGetParams"), exports);
 __exportStar(require("./credentialDefaultsControllerListParams"), exports);
-__exportStar(require("./credentialPrecedenceSource"), exports);
 __exportStar(require("./dataClassification"), exports);
-__exportStar(require("./dataResidency"), exports);
 __exportStar(require("./describeObjectsResponseDto"), exports);
 __exportStar(require("./describeObjectsResponseDtoDataEnvelope"), exports);
 __exportStar(require("./environmentCeilingSource"), exports);
@@ -100,14 +89,16 @@ __exportStar(require("./grantVersionResponseDtoDataEnvelope"), exports);
 __exportStar(require("./grantsControllerListParams"), exports);
 __exportStar(require("./impactedOutputRouteConsumerDto"), exports);
 __exportStar(require("./impactedOutputRouteConsumerDtoDataArrayEnvelope"), exports);
-__exportStar(require("./listRegisteredResourcesDto"), exports);
-__exportStar(require("./listVisibleResourcesDto"), exports);
 __exportStar(require("./object"), exports);
 __exportStar(require("./objectLifecycle"), exports);
 __exportStar(require("./openCapabilityAuthorityRequestDto"), exports);
 __exportStar(require("./openCapabilityAuthorityRequestDtoSubjectKind"), exports);
 __exportStar(require("./openFgaRelationshipDto"), exports);
 __exportStar(require("./openFgaRelationshipDtoPaginatedEnvelope"), exports);
+__exportStar(require("./orgPolicySetDto"), exports);
+__exportStar(require("./orgPolicySetDtoDataEnvelope"), exports);
+__exportStar(require("./orgPolicySetDtoModel"), exports);
+__exportStar(require("./orgPolicySetDtoModules"), exports);
 __exportStar(require("./outputRouteAuthorityDto"), exports);
 __exportStar(require("./outputRouteAuthorityDtoAllowedOutputSchema"), exports);
 __exportStar(require("./outputRouteAuthorityDtoDataEnvelope"), exports);
@@ -124,30 +115,10 @@ __exportStar(require("./outputRouteRevisionDto"), exports);
 __exportStar(require("./outputRouteRevisionDtoAllowedOutputSchema"), exports);
 __exportStar(require("./outputRouteRevisionsControllerReleaseHistoryParams"), exports);
 __exportStar(require("./paginationMeta"), exports);
-__exportStar(require("./policyActingAgentDto"), exports);
-__exportStar(require("./policyActingAgentDtoKind"), exports);
-__exportStar(require("./policyActingForDto"), exports);
-__exportStar(require("./policyBiomeDto"), exports);
-__exportStar(require("./policyCallerDto"), exports);
-__exportStar(require("./policyCapabilityDto"), exports);
-__exportStar(require("./policyCheckBatchRequestDto"), exports);
-__exportStar(require("./policyCheckBatchResponseDto"), exports);
-__exportStar(require("./policyCheckBatchResponseDtoDataEnvelope"), exports);
-__exportStar(require("./policyCheckRequestDto"), exports);
-__exportStar(require("./policyCheckRequestDtoAperture"), exports);
-__exportStar(require("./policyConstraintsDto"), exports);
-__exportStar(require("./policyDecisionDto"), exports);
-__exportStar(require("./policyDecisionDtoDataEnvelope"), exports);
-__exportStar(require("./policyDecisionKind"), exports);
-__exportStar(require("./policyDelegatedAuthorityDto"), exports);
-__exportStar(require("./policyEnvironmentDto"), exports);
-__exportStar(require("./policyObligationDto"), exports);
-__exportStar(require("./policyObligationKind"), exports);
-__exportStar(require("./policyResourceDto"), exports);
-__exportStar(require("./policyRouteHintDto"), exports);
-__exportStar(require("./policyRouteHintDtoRequiredRunnerLabels"), exports);
-__exportStar(require("./policySpaceRefDto"), exports);
-__exportStar(require("./policySubjectRefDto"), exports);
+__exportStar(require("./policySetTestFileDto"), exports);
+__exportStar(require("./policySetTestFileResultDto"), exports);
+__exportStar(require("./policySetTestResultsDto"), exports);
+__exportStar(require("./policySetTestResultsDtoDataEnvelope"), exports);
 __exportStar(require("./previewOutputRouteImpactDto"), exports);
 __exportStar(require("./problemActionableBy"), exports);
 __exportStar(require("./problemDetailsDto"), exports);
@@ -163,16 +134,10 @@ __exportStar(require("./provisionAgentResultDto"), exports);
 __exportStar(require("./provisionAgentResultDtoDataEnvelope"), exports);
 __exportStar(require("./provisionedCapabilityDto"), exports);
 __exportStar(require("./recordAgentReachTierRequestDto"), exports);
-__exportStar(require("./registerResourceOwnershipDto"), exports);
 __exportStar(require("./registerResourceRevisionDto"), exports);
-__exportStar(require("./registeredResourceDto"), exports);
 __exportStar(require("./registeredResourceRevisionDto"), exports);
 __exportStar(require("./registeredResourceRevisionDtoDataEnvelope"), exports);
-__exportStar(require("./registeredResourcesDto"), exports);
-__exportStar(require("./registeredResourcesDtoDataEnvelope"), exports);
 __exportStar(require("./relationshipsControllerListParams"), exports);
-__exportStar(require("./removeResourceShareDto"), exports);
-__exportStar(require("./replaceResourceOwnershipDto"), exports);
 __exportStar(require("./requestOutputRouteRetirementDto"), exports);
 __exportStar(require("./requestOutputRouteRevisionReleaseDto"), exports);
 __exportStar(require("./requestOutputRouteRevisionReleaseDtoAllowedOutputSchema"), exports);
@@ -181,15 +146,10 @@ __exportStar(require("./resolveExactOutputRouteDto"), exports);
 __exportStar(require("./resolveExactResourceRevisionDto"), exports);
 __exportStar(require("./resolveOutputRouteChannelDto"), exports);
 __exportStar(require("./resourceManagedBy"), exports);
-__exportStar(require("./resourceOwnershipDto"), exports);
-__exportStar(require("./resourceOwnershipDtoDataEnvelope"), exports);
-__exportStar(require("./resourceOwnershipEntryDto"), exports);
-__exportStar(require("./resourceOwnershipReadDto"), exports);
-__exportStar(require("./resourceOwnershipReadDtoDataEnvelope"), exports);
-__exportStar(require("./resourceShareRefDto"), exports);
 __exportStar(require("./resourceSubjectAccessResult"), exports);
 __exportStar(require("./resourceSubjectRefDto"), exports);
-__exportStar(require("./resourceVisibilityPattern"), exports);
+__exportStar(require("./retiredNamespaceDto"), exports);
+__exportStar(require("./retiredNamespaceDtoDataEnvelope"), exports);
 __exportStar(require("./roleAssignmentDto"), exports);
 __exportStar(require("./roleAssignmentDtoDataArrayEnvelope"), exports);
 __exportStar(require("./roleAssignmentDtoDataEnvelope"), exports);
@@ -201,11 +161,12 @@ __exportStar(require("./roleGrantDtoDataArrayEnvelope"), exports);
 __exportStar(require("./roleGrantDtoDataEnvelope"), exports);
 __exportStar(require("./rolesControllerListParams"), exports);
 __exportStar(require("./rollbackExecutionEnvironmentDto"), exports);
-__exportStar(require("./runnerKind"), exports);
-__exportStar(require("./sessionParticipantRole"), exports);
+__exportStar(require("./runPolicySetTestsDto"), exports);
+__exportStar(require("./runPolicySetTestsDtoModel"), exports);
+__exportStar(require("./runtimeModuleContributionDto"), exports);
+__exportStar(require("./runtimeModuleContributionDtoManifest"), exports);
 __exportStar(require("./spaceKind"), exports);
 __exportStar(require("./subjectKind"), exports);
-__exportStar(require("./subjectRefDto"), exports);
 __exportStar(require("./teamDto"), exports);
 __exportStar(require("./teamDtoDataArrayEnvelope"), exports);
 __exportStar(require("./teamDtoDataEnvelope"), exports);
@@ -221,8 +182,6 @@ __exportStar(require("./updateGrantDto"), exports);
 __exportStar(require("./updateRoleDto"), exports);
 __exportStar(require("./updateTeamDto"), exports);
 __exportStar(require("./upsertCredentialDefaultDto"), exports);
-__exportStar(require("./visibleResourcesDto"), exports);
-__exportStar(require("./visibleResourcesDtoDataEnvelope"), exports);
 __exportStar(require("./xemaObjectKind"), exports);
 __exportStar(require("./xemaObjectResponseDto"), exports);
 __exportStar(require("./xemaObjectResponseDtoPayload"), exports);

package/dist/models/orgPolicySetDto.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { OrgPolicySetDtoModel } from './orgPolicySetDtoModel.js';
+import type { OrgPolicySetDtoModules } from './orgPolicySetDtoModules.js';
+export interface OrgPolicySetDto {
+    /**
+       * The policy set content address, or null for the base.
+       * @nullable
+       */
+    policySetId: string | null;
+    /** The OpenFGA JSON model. */
+    model?: OrgPolicySetDtoModel;
+    /** namespace → { moduleVersion, contentHash }. */
+    modules?: OrgPolicySetDtoModules;
+}

package/dist/models/orgPolicySetDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { OrgPolicySetDto } from './orgPolicySetDto.js';
+export interface OrgPolicySetDtoDataEnvelope {
+    data: OrgPolicySetDto;
+}

package/dist/models/{policyRouteHintDtoRequiredRunnerLabels.d.ts → orgPolicySetDtoModel.d.ts}

@@ -3,6 +3,9 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-export type PolicyRouteHintDtoRequiredRunnerLabels = {
-    [key: string]: string;
+/**
+ * The OpenFGA JSON model.
+ */
+export type OrgPolicySetDtoModel = {
+    [key: string]: unknown;
 };

package/dist/models/orgPolicySetDtoModules.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * namespace → { moduleVersion, contentHash }.
+ */
+export type OrgPolicySetDtoModules = {
+    [key: string]: unknown;
+};

package/dist/models/policySetTestFileDto.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface PolicySetTestFileDto {
+    /**
+       * The module the file belongs to (`xema_core`, a biome id).
+       * @minLength 1
+       */
+    owner: string;
+    /**
+       * The file name, e.g. `pai-core.fga.yaml`.
+       * @minLength 1
+       */
+    name: string;
+    /**
+       * The standard OpenFGA test file (`fga model test`) as YAML.
+       * @minLength 1
+       */
+    contents: string;
+}

package/dist/models/policySetTestFileResultDto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface PolicySetTestFileResultDto {
+    owner: string;
+    name: string;
+    passed: boolean;
+    output: string;
+}

package/dist/models/policySetTestResultsDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicySetTestFileResultDto } from './policySetTestFileResultDto.js';
+export interface PolicySetTestResultsDto {
+    results: PolicySetTestFileResultDto[];
+}

package/dist/models/policySetTestResultsDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicySetTestResultsDto } from './policySetTestResultsDto.js';
+export interface PolicySetTestResultsDtoDataEnvelope {
+    data: PolicySetTestResultsDto;
+}

package/dist/models/retiredNamespaceDto.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+export interface RetiredNamespaceDto {
+    /** Tuples deleted by the teardown. */
+    tuplesDeleted: number;
+}

package/dist/models/retiredNamespaceDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RetiredNamespaceDto } from './retiredNamespaceDto.js';
+export interface RetiredNamespaceDtoDataEnvelope {
+    data: RetiredNamespaceDto;
+}

package/dist/models/runPolicySetTestsDto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { PolicySetTestFileDto } from './policySetTestFileDto.js';
+import type { RunPolicySetTestsDtoModel } from './runPolicySetTestsDtoModel.js';
+export interface RunPolicySetTestsDto {
+    /** The composed OpenFGA JSON model. */
+    model: RunPolicySetTestsDtoModel;
+    testFiles: PolicySetTestFileDto[];
+}

package/dist/models/runPolicySetTestsDtoModel.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * The composed OpenFGA JSON model.
+ */
+export type RunPolicySetTestsDtoModel = {
+    [key: string]: unknown;
+};

package/dist/models/runtimeModuleContributionDto.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { RuntimeModuleContributionDtoManifest } from './runtimeModuleContributionDtoManifest.js';
+export interface RuntimeModuleContributionDto {
+    /**
+       * The signed biome id (the derived namespace).
+       * @minLength 1
+       */
+    biomeId: string;
+    /**
+       * The signed biome version the module was read from.
+       * @minLength 1
+       */
+    biomeVersion: string;
+    /** The stamped authorization-module contribution manifest (envelope, files, tests, signedBiome). */
+    manifest: RuntimeModuleContributionDtoManifest;
+}

package/dist/models/runtimeModuleContributionDtoManifest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * The stamped authorization-module contribution manifest (envelope, files, tests, signedBiome).
+ */
+export type RuntimeModuleContributionDtoManifest = {
+    [key: string]: unknown;
+};

package/dist/models/runtimeModuleContributionDtoManifest.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/spaceKind.d.ts

@@ -3,6 +3,9 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
+/**
+ * The ref's tier — what an admin sees this as (a project, an app, the org).
+ */
 export type SpaceKind = typeof SpaceKind[keyof typeof SpaceKind];
 export declare const SpaceKind: {
     readonly system: "system";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/authorization-internal-api-client",
-  "version": "0.5.3",
+  "version": "0.8.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [

package/dist/endpoints/resources/resources.d.ts

@@ -1,59 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { AddResourceShareDto, ListRegisteredResourcesDto, ListVisibleResourcesDto, RegisterResourceOwnershipDto, RegisteredResourcesDtoDataEnvelope, RemoveResourceShareDto, ReplaceResourceOwnershipDto, ResourceOwnershipDtoDataEnvelope, ResourceOwnershipReadDtoDataEnvelope, VisibleResourcesDtoDataEnvelope } from '../../models';
-export declare const getResourcesControllerRegisterUrl: () => string;
-/**
- * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
- * @summary Register ownership/visibility of a resource instance
- */
-export declare const resourcesControllerRegister: (registerResourceOwnershipDto: RegisterResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDtoDataEnvelope>;
-export declare const getResourcesControllerListVisibleUrl: () => string;
-/**
- * Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
- *
- * Supplying `minLevel` narrows the question from "may this subject SEE it" to "does this subject hold at least this LEVEL on it": the answer becomes owner ∪ shared at or above that rung, and org-shared instances drop out because org-shared is a visibility pattern rather than a rung. That is the question a BFF asks to decide who may MANAGE an instance, and answering it here is what keeps the caller from having to expand identity groups itself — OpenFGA expands `team#member` and `role#assignee` usersets transitively.
- * @summary List the instances of a resource type a subject may see
- */
-export declare const resourcesControllerListVisible: (listVisibleResourcesDto: ListVisibleResourcesDto, options?: RequestInit) => Promise<VisibleResourcesDtoDataEnvelope>;
-export declare const getResourcesControllerListRegisteredUrl: () => string;
-/**
- * Every registered instance of `resourceType` in the caller org, with the subjects that OWN it. Org scope is forced from the caller context.
- *
- * This is NOT `resource.listVisible` with a privileged subject, and the difference is the reason it exists. `listVisible` answers "what may THIS SUBJECT see"; a service needing "what has this org registered" used to ask it about a subject it had made the owner of everything — which works only for as long as that fixed owner exists, and turns any later ownership change into a silent, total loss of the enumeration. A convergence pass built on the substitute does not just stop registering: it reads every live instance as registered-but-not-live and DEREGISTERS it.
- *
- * A POST rather than a GET because `resource.getOwnership` is mounted at `GET /resources/:type/:id`, which would shadow any `GET /resources/registered/...` shape; the body carries the one input.
- * @summary List the instances of a resource type this ORG has registered
- */
-export declare const resourcesControllerListRegistered: (listRegisteredResourcesDto: ListRegisteredResourcesDto, options?: RequestInit) => Promise<RegisteredResourcesDtoDataEnvelope>;
-export declare const getResourcesControllerGetOwnershipUrl: (type: string, id: string) => string;
-/**
- * Returns the instance visibility and the combined set of registered subjects (owners + shares; the SQL authority does not split them). 404 when the instance was never registered.
- * @summary Read a resource instance’s current visibility + subjects
- */
-export declare const resourcesControllerGetOwnership: (type: string, id: string, options?: RequestInit) => Promise<ResourceOwnershipReadDtoDataEnvelope>;
-export declare const getResourcesControllerReplaceOwnershipUrl: (type: string, id: string) => string;
-/**
- * The whole post-state: after this call the instance’s registered subjects are EXACTLY `owners` ∪ `explicitShares`, and a subject named by neither loses its authority row AND its `shared_with` tuple. This is the ONLY surface that can express a revocation as part of a set write — `resource.register` upserts what it is handed and never touches a subject outside that list, so re-registering with a subject removed reports 200 and leaves both its row and its tuple live. Removals delete the tuple BEFORE the row (a crash between them leaves the subject WITHOUT access); additions write the row before the tuple. Serialised per instance by an advisory lock, so two concurrent replaces cannot interleave into a mixed set. Idempotent. Refuses (409 `RESOURCE_SUBJECT_IS_OWNER`) when a currently-registered OWNER is absent from the new `owners` list — dropping or demoting an owner is `resource.deregister`. Org scope is forced from the caller context. A body naming a `grantor` has every share judged against the level that subject actually holds (read from the tuple store, never from the body); omitting it means the calling service asserts owner authority.
- * @summary REPLACE a resource instance’s ownership set
- */
-export declare const resourcesControllerReplaceOwnership: (type: string, id: string, replaceResourceOwnershipDto: ReplaceResourceOwnershipDto, options?: RequestInit) => Promise<ResourceOwnershipDtoDataEnvelope>;
-export declare const getResourcesControllerDeregisterUrl: (type: string, id: string) => string;
-/**
- * Idempotent — a no-op when the instance was never registered.
- * @summary Deregister a resource instance (drop ownership rows + tuples)
- */
-export declare const resourcesControllerDeregister: (type: string, id: string, options?: RequestInit) => Promise<void>;
-export declare const getResourcesControllerAddShareUrl: (type: string, id: string) => string;
-/**
- * @summary Add an explicit share to a registered resource instance
- */
-export declare const resourcesControllerAddShare: (type: string, id: string, addResourceShareDto: AddResourceShareDto, options?: RequestInit) => Promise<void>;
-export declare const getResourcesControllerRemoveShareUrl: (type: string, id: string) => string;
-/**
- * The inverse of `resource.addShare`, and the ONLY way to unshare without the deregister-then-register window (during which the instance is UNREGISTERED and the PDP resolves it as a verb-only ALLOW for everyone). Drops the `shared_with` tuple FIRST and the authority row second, so a crash between them leaves the subject WITHOUT access, never with it. Idempotent: removing a share that does not exist is a no-op success. Refuses a subject that holds an `owned_by` tuple (409 `RESOURCE_SUBJECT_IS_OWNER`) — owner removal is `resource.deregister`. Does NOT change the instance visibility, even when this removes the last share: `explicit-share` with zero shares means "shared with nobody".
- * @summary Remove an explicit share from a registered resource instance
- */
-export declare const resourcesControllerRemoveShare: (type: string, id: string, removeResourceShareDto: RemoveResourceShareDto, options?: RequestInit) => Promise<void>;

package/dist/endpoints/resources/resources.js

@@ -1,141 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resourcesControllerRemoveShare = exports.getResourcesControllerRemoveShareUrl = exports.resourcesControllerAddShare = exports.getResourcesControllerAddShareUrl = exports.resourcesControllerDeregister = exports.getResourcesControllerDeregisterUrl = exports.resourcesControllerReplaceOwnership = exports.getResourcesControllerReplaceOwnershipUrl = exports.resourcesControllerGetOwnership = exports.getResourcesControllerGetOwnershipUrl = exports.resourcesControllerListRegistered = exports.getResourcesControllerListRegisteredUrl = exports.resourcesControllerListVisible = exports.getResourcesControllerListVisibleUrl = exports.resourcesControllerRegister = exports.getResourcesControllerRegisterUrl = void 0;
-const custom_fetch_1 = require("../../custom-fetch");
-const getResourcesControllerRegisterUrl = () => {
-    return `/resources`;
-};
-exports.getResourcesControllerRegisterUrl = getResourcesControllerRegisterUrl;
-/**
- * Writes the ownership rows + OpenFGA tuples so the PDP ANDs the verb verdict with instance ownership. Idempotent (upsert + ignore-duplicate tuples). Org scope is forced from the caller context.
- * @summary Register ownership/visibility of a resource instance
- */
-const resourcesControllerRegister = async (registerResourceOwnershipDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerRegisterUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(registerResourceOwnershipDto)
-    });
-};
-exports.resourcesControllerRegister = resourcesControllerRegister;
-const getResourcesControllerListVisibleUrl = () => {
-    return `/resources/visible`;
-};
-exports.getResourcesControllerListVisibleUrl = getResourcesControllerListVisibleUrl;
-/**
- * Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
- *
- * Supplying `minLevel` narrows the question from "may this subject SEE it" to "does this subject hold at least this LEVEL on it": the answer becomes owner ∪ shared at or above that rung, and org-shared instances drop out because org-shared is a visibility pattern rather than a rung. That is the question a BFF asks to decide who may MANAGE an instance, and answering it here is what keeps the caller from having to expand identity groups itself — OpenFGA expands `team#member` and `role#assignee` usersets transitively.
- * @summary List the instances of a resource type a subject may see
- */
-const resourcesControllerListVisible = async (listVisibleResourcesDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerListVisibleUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(listVisibleResourcesDto)
-    });
-};
-exports.resourcesControllerListVisible = resourcesControllerListVisible;
-const getResourcesControllerListRegisteredUrl = () => {
-    return `/resources/registered`;
-};
-exports.getResourcesControllerListRegisteredUrl = getResourcesControllerListRegisteredUrl;
-/**
- * Every registered instance of `resourceType` in the caller org, with the subjects that OWN it. Org scope is forced from the caller context.
- *
- * This is NOT `resource.listVisible` with a privileged subject, and the difference is the reason it exists. `listVisible` answers "what may THIS SUBJECT see"; a service needing "what has this org registered" used to ask it about a subject it had made the owner of everything — which works only for as long as that fixed owner exists, and turns any later ownership change into a silent, total loss of the enumeration. A convergence pass built on the substitute does not just stop registering: it reads every live instance as registered-but-not-live and DEREGISTERS it.
- *
- * A POST rather than a GET because `resource.getOwnership` is mounted at `GET /resources/:type/:id`, which would shadow any `GET /resources/registered/...` shape; the body carries the one input.
- * @summary List the instances of a resource type this ORG has registered
- */
-const resourcesControllerListRegistered = async (listRegisteredResourcesDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerListRegisteredUrl)(), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(listRegisteredResourcesDto)
-    });
-};
-exports.resourcesControllerListRegistered = resourcesControllerListRegistered;
-const getResourcesControllerGetOwnershipUrl = (type, id) => {
-    return `/resources/${type}/${id}`;
-};
-exports.getResourcesControllerGetOwnershipUrl = getResourcesControllerGetOwnershipUrl;
-/**
- * Returns the instance visibility and the combined set of registered subjects (owners + shares; the SQL authority does not split them). 404 when the instance was never registered.
- * @summary Read a resource instance’s current visibility + subjects
- */
-const resourcesControllerGetOwnership = async (type, id, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerGetOwnershipUrl)(type, id), {
-        ...options,
-        method: 'GET'
-    });
-};
-exports.resourcesControllerGetOwnership = resourcesControllerGetOwnership;
-const getResourcesControllerReplaceOwnershipUrl = (type, id) => {
-    return `/resources/${type}/${id}`;
-};
-exports.getResourcesControllerReplaceOwnershipUrl = getResourcesControllerReplaceOwnershipUrl;
-/**
- * The whole post-state: after this call the instance’s registered subjects are EXACTLY `owners` ∪ `explicitShares`, and a subject named by neither loses its authority row AND its `shared_with` tuple. This is the ONLY surface that can express a revocation as part of a set write — `resource.register` upserts what it is handed and never touches a subject outside that list, so re-registering with a subject removed reports 200 and leaves both its row and its tuple live. Removals delete the tuple BEFORE the row (a crash between them leaves the subject WITHOUT access); additions write the row before the tuple. Serialised per instance by an advisory lock, so two concurrent replaces cannot interleave into a mixed set. Idempotent. Refuses (409 `RESOURCE_SUBJECT_IS_OWNER`) when a currently-registered OWNER is absent from the new `owners` list — dropping or demoting an owner is `resource.deregister`. Org scope is forced from the caller context. A body naming a `grantor` has every share judged against the level that subject actually holds (read from the tuple store, never from the body); omitting it means the calling service asserts owner authority.
- * @summary REPLACE a resource instance’s ownership set
- */
-const resourcesControllerReplaceOwnership = async (type, id, replaceResourceOwnershipDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerReplaceOwnershipUrl)(type, id), {
-        ...options,
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(replaceResourceOwnershipDto)
-    });
-};
-exports.resourcesControllerReplaceOwnership = resourcesControllerReplaceOwnership;
-const getResourcesControllerDeregisterUrl = (type, id) => {
-    return `/resources/${type}/${id}`;
-};
-exports.getResourcesControllerDeregisterUrl = getResourcesControllerDeregisterUrl;
-/**
- * Idempotent — a no-op when the instance was never registered.
- * @summary Deregister a resource instance (drop ownership rows + tuples)
- */
-const resourcesControllerDeregister = async (type, id, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerDeregisterUrl)(type, id), {
-        ...options,
-        method: 'DELETE'
-    });
-};
-exports.resourcesControllerDeregister = resourcesControllerDeregister;
-const getResourcesControllerAddShareUrl = (type, id) => {
-    return `/resources/${type}/${id}/relationships`;
-};
-exports.getResourcesControllerAddShareUrl = getResourcesControllerAddShareUrl;
-/**
- * @summary Add an explicit share to a registered resource instance
- */
-const resourcesControllerAddShare = async (type, id, addResourceShareDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerAddShareUrl)(type, id), {
-        ...options,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(addResourceShareDto)
-    });
-};
-exports.resourcesControllerAddShare = resourcesControllerAddShare;
-const getResourcesControllerRemoveShareUrl = (type, id) => {
-    return `/resources/${type}/${id}/relationships`;
-};
-exports.getResourcesControllerRemoveShareUrl = getResourcesControllerRemoveShareUrl;
-/**
- * The inverse of `resource.addShare`, and the ONLY way to unshare without the deregister-then-register window (during which the instance is UNREGISTERED and the PDP resolves it as a verb-only ALLOW for everyone). Drops the `shared_with` tuple FIRST and the authority row second, so a crash between them leaves the subject WITHOUT access, never with it. Idempotent: removing a share that does not exist is a no-op success. Refuses a subject that holds an `owned_by` tuple (409 `RESOURCE_SUBJECT_IS_OWNER`) — owner removal is `resource.deregister`. Does NOT change the instance visibility, even when this removes the last share: `explicit-share` with zero shares means "shared with nobody".
- * @summary Remove an explicit share from a registered resource instance
- */
-const resourcesControllerRemoveShare = async (type, id, removeResourceShareDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getResourcesControllerRemoveShareUrl)(type, id), {
-        ...options,
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(removeResourceShareDto)
-    });
-};
-exports.resourcesControllerRemoveShare = resourcesControllerRemoveShare;

package/dist/models/addResourceShareDto.d.ts

@@ -1,12 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { ResourceShareRefDto } from './resourceShareRefDto.js';
-import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
-export interface AddResourceShareDto {
-    share: ResourceShareRefDto;
-    /** The subject GRANTING this share, when it is not the instance owner. Used to apply the two delegation rules: a grantor may never confer more than they hold, and re-sharing is itself a level. Omitted means the caller asserts owner authority, which this service verifies against the tuple store — it is never taken on the caller's word. */
-    grantor?: ResourceSubjectRefDto;
-}

package/dist/models/authorizationCheckRequestDto.d.ts

@@ -1,39 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Authorization API
- * OpenAPI spec version: 0.1.1
- */
-import type { SubjectRefDto } from './subjectRefDto.js';
-export interface AuthorizationCheckRequestDto {
-    /**
-       * Organization identifier. Scopes the grant lookup to the tenant.
-       * @minLength 1
-       */
-    orgId: string;
-    /**
-       * Canonical CapabilityRef `<domain>:<resource>.<verb>@<major>` from `@xemahq/kernel-contracts/capability`.
-       * @minLength 1
-       */
-    capability: string;
-    subject: SubjectRefDto;
-    /**
-       * ExecutionEnvironmentRef in `environment:<slug>` format (e.g. `"environment:project"`). The service parses the prefix and checks the slug against the ExecutionEnvironmentKind enum.
-       * @minLength 1
-       */
-    environment: string;
-    /**
-       * Canonical `xema://<Space>/resource/<type>/<id>[@version]` address naming the instance the capability targets. Optional — omit it for a verb-only check; do not send a placeholder. The legacy `resource:<type>:<id>` form is still accepted, but it cannot express the org scope the canonical form carries. Any other shape is refused at the edge with `400 RESOURCE_REF_MALFORMED`.
-       * @minLength 1
-       */
-    resource?: string;
-    /**
-       * Audience policy slug; Phase 3 ignores this dimension.
-       * @minLength 1
-       */
-    audience?: string;
-    /**
-       * Caller-supplied correlation id surfaced in audit logs.
-       * @minLength 1
-       */
-    correlationId?: string;
-}