@xemahq/authorization-internal-api-client 0.9.3 → 0.10.0

package/README.md

@@ -59,4 +59,4 @@ from the service's OpenAPI spec.
 
 ## License
 
-Proprietary — © Xema. All rights reserved. — [xema.dev](https://xema.dev)
+LicenseRef-Xema-BSL-1.1 — © Neuralchowder Inc.. All rights reserved.

package/dist/custom-fetch.d.ts

@@ -56,6 +56,16 @@ export interface RetryNotice {
 export interface ClientCallbackOptions {
     signal?: AbortSignal;
 }
+/** What {@link ClientConfig.onUnauthorized} is told about the 401 it answers. */
+export interface UnauthorizedContext {
+    /**
+     * The token `getAuthToken` returned for the attempt the server rejected.
+     * `undefined` when no `getAuthToken` produced the Authorization header
+     * (a header from `getHeaders` or no credential at all): there is then no
+     * client-held token to drop.
+     */
+    readonly rejectedToken: string | undefined;
+}
 export interface ClientConfig {
     /**
      * Static base URL (e.g. 'http://localhost:3140') — no trailing slash.
@@ -102,8 +112,12 @@ export interface ClientConfig {
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to
      * the caller as a `ClientError` like any other 4xx.
+     *
+     * It is told WHAT was rejected (see {@link UnauthorizedContext}), so a
+     * callback that drops a cached credential can drop exactly that one and leave
+     * a newer one, minted by a concurrent request, alone.
      */
-    onUnauthorized?: () => Promise<void>;
+    onUnauthorized?: (context: UnauthorizedContext) => Promise<void>;
     /**
      * Re-attempts for a retryable status. **Defaults to 0 — no retry.**
      *

package/dist/custom-fetch.js

@@ -325,11 +325,12 @@ async function buildHeaders(config, callerHeaders, signal) {
         }
     }
     // Auth token (caller or global headers take precedence)
+    let authToken;
     if (config.getAuthToken && !headers.has('Authorization')) {
-        const token = await raceAbort(config.getAuthToken(signal ? { signal } : undefined), signal);
-        headers.set('Authorization', `Bearer ${token}`);
+        authToken = await raceAbort(config.getAuthToken(signal ? { signal } : undefined), signal);
+        headers.set('Authorization', `Bearer ${authToken}`);
     }
-    return headers;
+    return { headers, authToken };
 }
 /*
  * THE TRANSPORT RETURNS THE BODY UNCHANGED. Do not reintroduce an unwrap here.
@@ -371,8 +372,8 @@ const customFetch = async (url, options) => {
     // re-sending would replay the identical failing request with the identical
     // credential: one wasted round trip, plus a global refresh nobody asked for.
     const callerSuppliedAuth = new Headers(options.headers).has('Authorization');
-    const headers = await buildHeaders(config, options.headers, signal);
-    const requestInit = { ...options, headers };
+    const built = await buildHeaders(config, options.headers, signal);
+    const requestInit = { ...options, headers: built.headers };
     let delay = BASE_BACKOFF_MS;
     for (let attempt = 0;; attempt++) {
         const response = await fetch(fullUrl, requestInit);
@@ -380,11 +381,11 @@ const customFetch = async (url, options) => {
             config.onUnauthorized &&
             !callerSuppliedAuth &&
             attempt === 0) {
-            await raceAbort(config.onUnauthorized(), signal);
-            const refreshedHeaders = await buildHeaders(config, options.headers, signal);
+            await raceAbort(config.onUnauthorized({ rejectedToken: built.authToken }), signal);
+            const refreshed = await buildHeaders(config, options.headers, signal);
             const retryResponse = await fetch(fullUrl, {
                 ...options,
-                headers: refreshedHeaders,
+                headers: refreshed.headers,
             });
             const retryBody = await parseBody(retryResponse);
             if (retryResponse.status >= 400) {

package/dist/endpoints/agents/agents.d.ts

@@ -3,13 +3,19 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { ProvisionAgentRequestDto, ProvisionAgentResultDtoDataEnvelope, RecordAgentReachTierRequestDto } from '../../models';
+import type { ProvisionAgentRequestDto, ProvisionAgentResultDtoDataEnvelope, RecordAgentReachTierRequestDto, RecordGlobalAgentReachTierRequestDto } from '../../models';
 export declare const getAgentsControllerRecordReachTierUrl: () => string;
 /**
- * Projects `(orgId, agentSlug) -> reachTier` into this service's own store, which is what the verdict path resolves an agent ceiling from. A `null` `orgId` declares a GLOBALLY-owned agent (system-seeded or biome-contributed) and is stored slug-keyed, applying in every org; an org row always wins over it. An OMITTED `orgId` is a 400, never read as global. Idempotent (upsert on the key), so a re-save, a retry and a concurrent save from another replica all converge. Writes NO grant — that is `POST /agents/provision`, and keeping the two apart is the point: a ceiling is a restriction, a grant is an authority, and fusing them put the restriction behind the grant feature flag.
+ * Projects `(orgId, agentSlug) -> reachTier` into this service's own store, which is what the verdict path resolves an agent ceiling from. `orgId` must be the org the relayed member proved; a GLOBALLY-owned agent is declared on `PUT /agents/reach-tier/global`. Idempotent (upsert on the key), so a re-save, a retry and a concurrent save from another replica all converge. Writes NO grant — that is `POST /agents/provision`, and keeping the two apart is the point: a ceiling is a restriction, a grant is an authority, and fusing them put the restriction behind the grant feature flag.
  * @summary Record an agent's DECLARED reach-tier ceiling
  */
 export declare const agentsControllerRecordReachTier: (recordAgentReachTierRequestDto: RecordAgentReachTierRequestDto, options?: RequestInit) => Promise<void>;
+export declare const getAgentsControllerRecordGlobalReachTierUrl: () => string;
+/**
+ * The platform-tier variant of `PUT /agents/reach-tier`: a GLOBALLY-owned agent (system-seeded or biome-contributed) has no owning org, its ceiling is stored slug-keyed and applies in every org (an org row always wins over it). Org-less and admitted on the LLM registry's own workload grant. Idempotent (upsert on the slug).
+ * @summary Record a globally-owned agent's DECLARED reach-tier ceiling
+ */
+export declare const agentsControllerRecordGlobalReachTier: (recordGlobalAgentReachTierRequestDto: RecordGlobalAgentReachTierRequestDto, options?: RequestInit) => Promise<void>;
 export declare const getAgentsControllerProvisionUrl: () => string;
 /**
  * Auto-grants low/medium-risk, owner-held, non-approval-gated capabilities as full grants; writes everything else as approval-gated grants. Idempotent (each grant upserts on its natural tuple). Returns a summary for the Studio review UI.

package/dist/endpoints/agents/agents.js

@@ -1,13 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.agentsControllerProvision = exports.getAgentsControllerProvisionUrl = exports.agentsControllerRecordReachTier = exports.getAgentsControllerRecordReachTierUrl = void 0;
+exports.agentsControllerProvision = exports.getAgentsControllerProvisionUrl = exports.agentsControllerRecordGlobalReachTier = exports.getAgentsControllerRecordGlobalReachTierUrl = exports.agentsControllerRecordReachTier = exports.getAgentsControllerRecordReachTierUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
 const getAgentsControllerRecordReachTierUrl = () => {
     return `/agents/reach-tier`;
 };
 exports.getAgentsControllerRecordReachTierUrl = getAgentsControllerRecordReachTierUrl;
 /**
- * Projects `(orgId, agentSlug) -> reachTier` into this service's own store, which is what the verdict path resolves an agent ceiling from. A `null` `orgId` declares a GLOBALLY-owned agent (system-seeded or biome-contributed) and is stored slug-keyed, applying in every org; an org row always wins over it. An OMITTED `orgId` is a 400, never read as global. Idempotent (upsert on the key), so a re-save, a retry and a concurrent save from another replica all converge. Writes NO grant — that is `POST /agents/provision`, and keeping the two apart is the point: a ceiling is a restriction, a grant is an authority, and fusing them put the restriction behind the grant feature flag.
+ * Projects `(orgId, agentSlug) -> reachTier` into this service's own store, which is what the verdict path resolves an agent ceiling from. `orgId` must be the org the relayed member proved; a GLOBALLY-owned agent is declared on `PUT /agents/reach-tier/global`. Idempotent (upsert on the key), so a re-save, a retry and a concurrent save from another replica all converge. Writes NO grant — that is `POST /agents/provision`, and keeping the two apart is the point: a ceiling is a restriction, a grant is an authority, and fusing them put the restriction behind the grant feature flag.
  * @summary Record an agent's DECLARED reach-tier ceiling
  */
 const agentsControllerRecordReachTier = async (recordAgentReachTierRequestDto, options) => {
@@ -19,6 +19,23 @@ const agentsControllerRecordReachTier = async (recordAgentReachTierRequestDto, o
     });
 };
 exports.agentsControllerRecordReachTier = agentsControllerRecordReachTier;
+const getAgentsControllerRecordGlobalReachTierUrl = () => {
+    return `/agents/reach-tier/global`;
+};
+exports.getAgentsControllerRecordGlobalReachTierUrl = getAgentsControllerRecordGlobalReachTierUrl;
+/**
+ * The platform-tier variant of `PUT /agents/reach-tier`: a GLOBALLY-owned agent (system-seeded or biome-contributed) has no owning org, its ceiling is stored slug-keyed and applies in every org (an org row always wins over it). Org-less and admitted on the LLM registry's own workload grant. Idempotent (upsert on the slug).
+ * @summary Record a globally-owned agent's DECLARED reach-tier ceiling
+ */
+const agentsControllerRecordGlobalReachTier = async (recordGlobalAgentReachTierRequestDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getAgentsControllerRecordGlobalReachTierUrl)(), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(recordGlobalAgentReachTierRequestDto)
+    });
+};
+exports.agentsControllerRecordGlobalReachTier = agentsControllerRecordGlobalReachTier;
 const getAgentsControllerProvisionUrl = () => {
     return `/agents/provision`;
 };

package/dist/endpoints/authorization-biome-facts/authorization-biome-facts.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Authorization API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ReplaceBiomeFactsDto } from '../../models';
+export declare const getBiomeFactsControllerReplaceUrl: () => string;
+/**
+ * Full replace in one transaction. 400 when one service name is shipped by two biomes, or a biome appears twice; 403 for any caller but biome-host-api.
+ * @summary Replace the whole catalog's signed biome facts (biome-host only)
+ */
+export declare const biomeFactsControllerReplace: (replaceBiomeFactsDto: ReplaceBiomeFactsDto, options?: RequestInit) => Promise<void>;

package/dist/endpoints/authorization-biome-facts/authorization-biome-facts.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.biomeFactsControllerReplace = exports.getBiomeFactsControllerReplaceUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getBiomeFactsControllerReplaceUrl = () => {
+    return `/internal/biome-facts`;
+};
+exports.getBiomeFactsControllerReplaceUrl = getBiomeFactsControllerReplaceUrl;
+/**
+ * Full replace in one transaction. 400 when one service name is shipped by two biomes, or a biome appears twice; 403 for any caller but biome-host-api.
+ * @summary Replace the whole catalog's signed biome facts (biome-host only)
+ */
+const biomeFactsControllerReplace = async (replaceBiomeFactsDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getBiomeFactsControllerReplaceUrl)(), {
+        ...options,
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(replaceBiomeFactsDto)
+    });
+};
+exports.biomeFactsControllerReplace = biomeFactsControllerReplace;

package/dist/endpoints/capability-authority-requests/capability-authority-requests.d.ts

@@ -3,7 +3,7 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { CapabilityAuthorityRequestDtoDataArrayEnvelope, CapabilityAuthorityRequestDtoDataEnvelope, CapabilityAuthorityRequestsControllerGetByIdParams, CapabilityAuthorityRequestsControllerListForSubjectParams, OpenCapabilityAuthorityRequestDto } from '../../models';
+import type { CapabilityAuthorityRequestDtoDataArrayEnvelope, CapabilityAuthorityRequestDtoDataEnvelope, CapabilityAuthorityRequestsControllerListForSubjectParams, OpenCapabilityAuthorityRequestDto } from '../../models';
 export declare const getCapabilityAuthorityRequestsControllerOpenUrl: () => string;
 /**
  * The organisation policy answers immediately with one of three dispositions. `auto-allow` means the grant already exists by the time this returns and the runtime may retry its invocation. `decision-required` means a human has been asked and the runtime must poll or wait — it is NOT a denial. `refuse` is terminal and carries a machine-readable reason. A request for a capability the subject already holds is a 409 rather than a silent no-op, and a second live request for the same capability is a 409 rather than a second question in front of an administrator.
@@ -16,9 +16,9 @@ export declare const getCapabilityAuthorityRequestsControllerListForSubjectUrl:
  * @summary One subject's own authority requests
  */
 export declare const capabilityAuthorityRequestsControllerListForSubject: (params: CapabilityAuthorityRequestsControllerListForSubjectParams, options?: RequestInit) => Promise<CapabilityAuthorityRequestDtoDataArrayEnvelope>;
-export declare const getCapabilityAuthorityRequestsControllerGetByIdUrl: (id: string, params: CapabilityAuthorityRequestsControllerGetByIdParams) => string;
+export declare const getCapabilityAuthorityRequestsControllerGetByIdUrl: (id: string) => string;
 /**
  * The live status of an ask. Read from THIS plane's row; the decision's own lifecycle is decision-api's to report, and this service does not mirror it — a settled ask cannot show as pending here because the row is written by the same handler that acts on the answer.
  * @summary One authority request
  */
-export declare const capabilityAuthorityRequestsControllerGetById: (id: string, params: CapabilityAuthorityRequestsControllerGetByIdParams, options?: RequestInit) => Promise<CapabilityAuthorityRequestDtoDataEnvelope>;
+export declare const capabilityAuthorityRequestsControllerGetById: (id: string, options?: RequestInit) => Promise<CapabilityAuthorityRequestDtoDataEnvelope>;

package/dist/endpoints/capability-authority-requests/capability-authority-requests.js

@@ -53,35 +53,16 @@ const capabilityAuthorityRequestsControllerListForSubject = async (params, optio
     });
 };
 exports.capabilityAuthorityRequestsControllerListForSubject = capabilityAuthorityRequestsControllerListForSubject;
-const getCapabilityAuthorityRequestsControllerGetByIdUrl = (id, params) => {
-    const normalizedParams = new URLSearchParams();
-    Object.entries(params || {}).forEach(([key, value]) => {
-        if (value === undefined)
-            return;
-        if (value === null) {
-            normalizedParams.append(key, 'null');
-            return;
-        }
-        if (Array.isArray(value)) {
-            for (const item of value) {
-                if (item === undefined || item === null)
-                    continue;
-                normalizedParams.append(key, item.toString());
-            }
-            return;
-        }
-        normalizedParams.append(key, value.toString());
-    });
-    const stringifiedParams = normalizedParams.toString();
-    return stringifiedParams.length > 0 ? `/internal/capability-authority-requests/${id}?${stringifiedParams}` : `/internal/capability-authority-requests/${id}`;
+const getCapabilityAuthorityRequestsControllerGetByIdUrl = (id) => {
+    return `/internal/capability-authority-requests/${id}`;
 };
 exports.getCapabilityAuthorityRequestsControllerGetByIdUrl = getCapabilityAuthorityRequestsControllerGetByIdUrl;
 /**
  * The live status of an ask. Read from THIS plane's row; the decision's own lifecycle is decision-api's to report, and this service does not mirror it — a settled ask cannot show as pending here because the row is written by the same handler that acts on the answer.
  * @summary One authority request
  */
-const capabilityAuthorityRequestsControllerGetById = async (id, params, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getCapabilityAuthorityRequestsControllerGetByIdUrl)(id, params), {
+const capabilityAuthorityRequestsControllerGetById = async (id, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getCapabilityAuthorityRequestsControllerGetByIdUrl)(id), {
         ...options,
         method: 'GET'
     });

package/dist/endpoints/contribution-sync/contribution-sync.d.ts

@@ -1,2 +1,4 @@
 export declare const getContributionSyncControllerSyncUrl: () => string;
 export declare const contributionSyncControllerSync: (options?: RequestInit) => Promise<void>;
+export declare const getContributionSyncControllerSyncOrgUrl: (orgId: string) => string;
+export declare const contributionSyncControllerSyncOrg: (orgId: string, options?: RequestInit) => Promise<void>;

package/dist/endpoints/contribution-sync/contribution-sync.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.contributionSyncControllerSync = exports.getContributionSyncControllerSyncUrl = void 0;
+exports.contributionSyncControllerSyncOrg = exports.getContributionSyncControllerSyncOrgUrl = exports.contributionSyncControllerSync = exports.getContributionSyncControllerSyncUrl = void 0;
 /**
  * Generated by @xemahq/api-client-generator — do not edit manually.
  * Authorization API
@@ -18,3 +18,14 @@ const contributionSyncControllerSync = async (options) => {
     });
 };
 exports.contributionSyncControllerSync = contributionSyncControllerSync;
+const getContributionSyncControllerSyncOrgUrl = (orgId) => {
+    return `/contributions/orgs/${orgId}/sync`;
+};
+exports.getContributionSyncControllerSyncOrgUrl = getContributionSyncControllerSyncOrgUrl;
+const contributionSyncControllerSyncOrg = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getContributionSyncControllerSyncOrgUrl)(orgId), {
+        ...options,
+        method: 'PUT'
+    });
+};
+exports.contributionSyncControllerSyncOrg = contributionSyncControllerSyncOrg;

package/dist/endpoints/durable-delegations/durable-delegations.d.ts

@@ -3,17 +3,32 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { CreateDurableDelegationDto, DurableDelegationDtoDataEnvelope } from '../../models';
-export declare const getDurableDelegationsControllerCreateUrl: () => string;
+import type { BindChildCarrierDto, CreateChildDurableDelegationDto, DurableDelegationCarrierWindowDtoDataEnvelope, DurableDelegationDtoDataEnvelope, OriginateDurableDelegationDto, ReportCarrierWindowDto } from '../../models';
+export declare const getDurableDelegationsControllerOriginateUrl: () => string;
 /**
- * @summary Lend a holder durable authority, owned by a user, team or org (C1–C6)
+ * @summary Originate the durable delegation an anchor type declares, for one anchor (A0, O1-O3, S0, C1, CEIL, I1, C2-C5)
  */
-export declare const durableDelegationsControllerCreate: (createDurableDelegationDto: CreateDurableDelegationDto, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;
+export declare const durableDelegationsControllerOriginate: (originateDurableDelegationDto: OriginateDurableDelegationDto, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;
 export declare const getDurableDelegationsControllerRevokeUrl: (id: string) => string;
 /**
  * @summary Revoke a durable delegation (terminal; the PDP denies from the commit)
  */
 export declare const durableDelegationsControllerRevoke: (id: string, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;
+export declare const getDurableDelegationsHolderControllerCreateChildUrl: (parentId: string) => string;
+/**
+ * @summary Lend on, tighten-only, part of a delegation this workload holds (K1–K5)
+ */
+export declare const durableDelegationsHolderControllerCreateChild: (parentId: string, createChildDurableDelegationDto: CreateChildDurableDelegationDto, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;
+export declare const getDurableDelegationsHolderControllerBindChildCarrierUrl: (id: string) => string;
+/**
+ * @summary Bind the carrier the PARENT holder created for a child (CAS; the loser's carrier is revoked)
+ */
+export declare const durableDelegationsHolderControllerBindChildCarrier: (id: string, bindChildCarrierDto: BindChildCarrierDto, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;
+export declare const getDurableDelegationsHolderControllerReportCarrierWindowUrl: (id: string) => string;
+/**
+ * @summary The PRESENTER reports its child carrier's window; answers the recorded window and the renewal ceiling
+ */
+export declare const durableDelegationsHolderControllerReportCarrierWindow: (id: string, reportCarrierWindowDto: ReportCarrierWindowDto, options?: RequestInit) => Promise<DurableDelegationCarrierWindowDtoDataEnvelope>;
 export declare const getDurableDelegationsHolderControllerReadUrl: (id: string) => string;
 /**
  * @summary Read a durable delegation this workload holds
@@ -24,3 +39,8 @@ export declare const getDurableDelegationsHolderControllerRevokeUrl: (id: string
  * @summary Stop a durable delegation this workload holds
  */
 export declare const durableDelegationsHolderControllerRevoke: (id: string, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;
+export declare const getDurableDelegationsSupersedeControllerSupersedeUrl: (id: string) => string;
+/**
+ * @summary Supersede a durable delegation this workload holds: it ends at once, its carrier revoke is retried by authorization-api
+ */
+export declare const durableDelegationsSupersedeControllerSupersede: (id: string, options?: RequestInit) => Promise<DurableDelegationDtoDataEnvelope>;

package/dist/endpoints/durable-delegations/durable-delegations.js

@@ -1,23 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.durableDelegationsHolderControllerRevoke = exports.getDurableDelegationsHolderControllerRevokeUrl = exports.durableDelegationsHolderControllerRead = exports.getDurableDelegationsHolderControllerReadUrl = exports.durableDelegationsControllerRevoke = exports.getDurableDelegationsControllerRevokeUrl = exports.durableDelegationsControllerCreate = exports.getDurableDelegationsControllerCreateUrl = void 0;
+exports.durableDelegationsSupersedeControllerSupersede = exports.getDurableDelegationsSupersedeControllerSupersedeUrl = exports.durableDelegationsHolderControllerRevoke = exports.getDurableDelegationsHolderControllerRevokeUrl = exports.durableDelegationsHolderControllerRead = exports.getDurableDelegationsHolderControllerReadUrl = exports.durableDelegationsHolderControllerReportCarrierWindow = exports.getDurableDelegationsHolderControllerReportCarrierWindowUrl = exports.durableDelegationsHolderControllerBindChildCarrier = exports.getDurableDelegationsHolderControllerBindChildCarrierUrl = exports.durableDelegationsHolderControllerCreateChild = exports.getDurableDelegationsHolderControllerCreateChildUrl = exports.durableDelegationsControllerRevoke = exports.getDurableDelegationsControllerRevokeUrl = exports.durableDelegationsControllerOriginate = exports.getDurableDelegationsControllerOriginateUrl = void 0;
 const custom_fetch_1 = require("../../custom-fetch");
-const getDurableDelegationsControllerCreateUrl = () => {
-    return `/durable-delegations`;
+const getDurableDelegationsControllerOriginateUrl = () => {
+    return `/durable-delegations/originate`;
 };
-exports.getDurableDelegationsControllerCreateUrl = getDurableDelegationsControllerCreateUrl;
+exports.getDurableDelegationsControllerOriginateUrl = getDurableDelegationsControllerOriginateUrl;
 /**
- * @summary Lend a holder durable authority, owned by a user, team or org (C1–C6)
+ * @summary Originate the durable delegation an anchor type declares, for one anchor (A0, O1-O3, S0, C1, CEIL, I1, C2-C5)
  */
-const durableDelegationsControllerCreate = async (createDurableDelegationDto, options) => {
-    return (0, custom_fetch_1.customFetch)((0, exports.getDurableDelegationsControllerCreateUrl)(), {
+const durableDelegationsControllerOriginate = async (originateDurableDelegationDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDurableDelegationsControllerOriginateUrl)(), {
         ...options,
         method: 'POST',
         headers: { 'Content-Type': 'application/json', ...options?.headers },
-        body: JSON.stringify(createDurableDelegationDto)
+        body: JSON.stringify(originateDurableDelegationDto)
     });
 };
-exports.durableDelegationsControllerCreate = durableDelegationsControllerCreate;
+exports.durableDelegationsControllerOriginate = durableDelegationsControllerOriginate;
 const getDurableDelegationsControllerRevokeUrl = (id) => {
     return `/durable-delegations/${id}/revoke`;
 };
@@ -32,6 +32,54 @@ const durableDelegationsControllerRevoke = async (id, options) => {
     });
 };
 exports.durableDelegationsControllerRevoke = durableDelegationsControllerRevoke;
+const getDurableDelegationsHolderControllerCreateChildUrl = (parentId) => {
+    return `/internal/durable-delegations/${parentId}/children`;
+};
+exports.getDurableDelegationsHolderControllerCreateChildUrl = getDurableDelegationsHolderControllerCreateChildUrl;
+/**
+ * @summary Lend on, tighten-only, part of a delegation this workload holds (K1–K5)
+ */
+const durableDelegationsHolderControllerCreateChild = async (parentId, createChildDurableDelegationDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDurableDelegationsHolderControllerCreateChildUrl)(parentId), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(createChildDurableDelegationDto)
+    });
+};
+exports.durableDelegationsHolderControllerCreateChild = durableDelegationsHolderControllerCreateChild;
+const getDurableDelegationsHolderControllerBindChildCarrierUrl = (id) => {
+    return `/internal/durable-delegations/${id}/carrier`;
+};
+exports.getDurableDelegationsHolderControllerBindChildCarrierUrl = getDurableDelegationsHolderControllerBindChildCarrierUrl;
+/**
+ * @summary Bind the carrier the PARENT holder created for a child (CAS; the loser's carrier is revoked)
+ */
+const durableDelegationsHolderControllerBindChildCarrier = async (id, bindChildCarrierDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDurableDelegationsHolderControllerBindChildCarrierUrl)(id), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(bindChildCarrierDto)
+    });
+};
+exports.durableDelegationsHolderControllerBindChildCarrier = durableDelegationsHolderControllerBindChildCarrier;
+const getDurableDelegationsHolderControllerReportCarrierWindowUrl = (id) => {
+    return `/internal/durable-delegations/${id}/carrier/window`;
+};
+exports.getDurableDelegationsHolderControllerReportCarrierWindowUrl = getDurableDelegationsHolderControllerReportCarrierWindowUrl;
+/**
+ * @summary The PRESENTER reports its child carrier's window; answers the recorded window and the renewal ceiling
+ */
+const durableDelegationsHolderControllerReportCarrierWindow = async (id, reportCarrierWindowDto, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDurableDelegationsHolderControllerReportCarrierWindowUrl)(id), {
+        ...options,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...options?.headers },
+        body: JSON.stringify(reportCarrierWindowDto)
+    });
+};
+exports.durableDelegationsHolderControllerReportCarrierWindow = durableDelegationsHolderControllerReportCarrierWindow;
 const getDurableDelegationsHolderControllerReadUrl = (id) => {
     return `/internal/durable-delegations/${id}`;
 };
@@ -60,3 +108,17 @@ const durableDelegationsHolderControllerRevoke = async (id, options) => {
     });
 };
 exports.durableDelegationsHolderControllerRevoke = durableDelegationsHolderControllerRevoke;
+const getDurableDelegationsSupersedeControllerSupersedeUrl = (id) => {
+    return `/internal/durable-delegations/${id}/supersede`;
+};
+exports.getDurableDelegationsSupersedeControllerSupersedeUrl = getDurableDelegationsSupersedeControllerSupersedeUrl;
+/**
+ * @summary Supersede a durable delegation this workload holds: it ends at once, its carrier revoke is retried by authorization-api
+ */
+const durableDelegationsSupersedeControllerSupersede = async (id, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getDurableDelegationsSupersedeControllerSupersedeUrl)(id), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.durableDelegationsSupersedeControllerSupersede = durableDelegationsSupersedeControllerSupersede;

package/dist/endpoints/environments/environments.d.ts

@@ -3,10 +3,22 @@
  * Authorization API
  * OpenAPI spec version: 0.1.1
  */
-import type { CreateExecutionEnvironmentDto, EnvironmentsControllerFindBySlugParams, EnvironmentsControllerListParams, EnvironmentsControllerReleaseHistoryParams, EnvironmentsControllerReleaseImpactParams, EnvironmentsControllerRemoveParams, EnvironmentsControllerRollbackParams, EnvironmentsControllerUpdateParams, ExecutionEnvironmentReleaseHistoryDtoDataArrayEnvelope, ExecutionEnvironmentReleaseImpactDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataEnvelope, RollbackExecutionEnvironmentDto, UpdateExecutionEnvironmentDto } from '../../models';
+import type { CreateExecutionEnvironmentDto, EnvironmentsControllerFindBySlugParams, EnvironmentsControllerListParams, EnvironmentsControllerRemoveParams, EnvironmentsControllerUpdateParams, ExecutionEnvironmentResponseDtoDataArrayEnvelope, ExecutionEnvironmentResponseDtoDataEnvelope, UpdateExecutionEnvironmentDto } from '../../models';
+export declare const getBuiltInEnvironmentsControllerListBuiltInUrl: () => string;
+/**
+ * Built-in (non-org) environments only; no org is read or accepted.
+ * @summary List the built-in ExecutionEnvironment rows
+ */
+export declare const builtInEnvironmentsControllerListBuiltIn: (options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataArrayEnvelope>;
+export declare const getBuiltInEnvironmentsControllerFindBuiltInBySlugUrl: (slug: string) => string;
+/**
+ * Resolves a built-in only; an org-custom slug is never returned. 404 if unknown.
+ * @summary Fetch one built-in ExecutionEnvironment by slug
+ */
+export declare const builtInEnvironmentsControllerFindBuiltInBySlug: (slug: string, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerListUrl: (params?: EnvironmentsControllerListParams) => string;
 /**
- * Returns the kernel-seeded built-in environments. With `orgId` it also includes that org's custom environments; without `orgId` it returns built-ins only (back-compat).
+ * Returns the kernel-seeded built-in environments plus the admitted org's custom environments; `orgId` must be the org the caller proved. The org-less built-ins-only read is `GET /environments/built-in`.
  * @summary List ExecutionEnvironment rows
  */
 export declare const environmentsControllerList: (params?: EnvironmentsControllerListParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataArrayEnvelope>;
@@ -16,21 +28,6 @@ export declare const getEnvironmentsControllerCreateUrl: () => string;
  * @summary Create an org-custom ExecutionEnvironment
  */
 export declare const environmentsControllerCreate: (createExecutionEnvironmentDto: CreateExecutionEnvironmentDto, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
-export declare const getEnvironmentsControllerReleaseHistoryUrl: (slug: string, params?: EnvironmentsControllerReleaseHistoryParams) => string;
-/**
- * @summary List immutable generic ReleaseSet history for an Environment
- */
-export declare const environmentsControllerReleaseHistory: (slug: string, params?: EnvironmentsControllerReleaseHistoryParams, options?: RequestInit) => Promise<ExecutionEnvironmentReleaseHistoryDtoDataArrayEnvelope>;
-export declare const getEnvironmentsControllerReleaseImpactUrl: (slug: string, params?: EnvironmentsControllerReleaseImpactParams) => string;
-/**
- * @summary Preview reverse-transitive impact of the selected Environment release
- */
-export declare const environmentsControllerReleaseImpact: (slug: string, params?: EnvironmentsControllerReleaseImpactParams, options?: RequestInit) => Promise<ExecutionEnvironmentReleaseImpactDtoDataArrayEnvelope>;
-export declare const getEnvironmentsControllerRollbackUrl: (slug: string, params?: EnvironmentsControllerRollbackParams) => string;
-/**
- * @summary CAS-rollback an Environment channel to a prior ReleaseSet
- */
-export declare const environmentsControllerRollback: (slug: string, rollbackExecutionEnvironmentDto: RollbackExecutionEnvironmentDto, params?: EnvironmentsControllerRollbackParams, options?: RequestInit) => Promise<ExecutionEnvironmentResponseDtoDataEnvelope>;
 export declare const getEnvironmentsControllerFindBySlugUrl: (slug: string, params?: EnvironmentsControllerFindBySlugParams) => string;
 /**
  * Resolves a built-in by slug. With `orgId`, an org-custom slug resolves before the built-in fallback. 404 if unknown.