@xemahq/biome-host-internal-api-client 0.3.7 → 0.3.12

package/dist/custom-fetch.d.ts

@@ -47,6 +47,28 @@ export interface ClientConfig {
     getAuthToken?: () => Promise<string>;
     /** Optional callback returning headers to inject on every request. Per-call headers take precedence. */
     getHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Optional resolver for the CORRELATION ID of the request being made — the
+     * handle that ties one causal chain together across every service hop.
+     *
+     * WHY IT IS A CALLBACK AND NOT A VALUE. `ClientConfig` is process-global
+     * (`configureClient` is called once at wiring time), and a correlation id is
+     * per-request. This is invoked INSIDE the request, so a server can point it
+     * at whatever carries its ambient request context and get the CURRENT id
+     * rather than the one that happened to be live at boot.
+     *
+     * WHY THE TRANSPORT DOES NOT MINT ONE. Returning `undefined` sends no header,
+     * and the receiving service's `RequestContextMiddleware` mints its own — a
+     * new trace, which is honest. A transport that minted per call would produce
+     * a FRESH id on every hop while looking like propagation, which is strictly
+     * worse than none: every row would carry a correlation id and no two rows
+     * that belong together would share one. That is the exact defect this exists
+     * to fix, so the transport must not reproduce it one layer down.
+     *
+     * A caller-supplied `X-Correlation-Id` header always wins, and so does one
+     * from `getHeaders`.
+     */
+    getCorrelationId?: () => string | undefined | Promise<string | undefined>;
     /**
      * Optional callback invoked on a 401 before ONE re-attempt. Supplying it is
      * what opts this client into that re-attempt; without it a 401 comes back to

package/dist/custom-fetch.js

@@ -89,6 +89,16 @@ function getClientConfig() {
  */
 /** The only statuses that state the request was NOT processed. See above. */
 const RETRYABLE_STATUSES = [429, 503];
+/**
+ * The platform's correlation header, spelled once.
+ *
+ * Value-identical to what `RequestContextMiddleware` reads in
+ * `@xemahq/platform-common`. It is a literal here rather than an import
+ * because this file has ZERO imports on purpose: it ships byte-identical into
+ * browser-target clients as well as server-target ones, and a dependency on a
+ * NestJS-peer package would follow it into every one of them.
+ */
+const CORRELATION_ID_HEADER = 'X-Correlation-Id';
 /** Backoff floor, doubling per attempt up to {@link MAX_BACKOFF_MS}. */
 const BASE_BACKOFF_MS = 1000;
 /** Ceiling on a single backoff, however many attempts have elapsed. */
@@ -104,6 +114,23 @@ async function buildHeaders(config, callerHeaders) {
             }
         }
     }
+    // Correlation id (caller and global headers still take precedence).
+    //
+    // Without this, every server-to-server hop through a generated client started
+    // a NEW trace: the id is read-or-minted per hop by the receiving service's
+    // RequestContextMiddleware, and nothing carried it outbound — so an audit
+    // journal could record a whole causal chain and offer no way to join it back
+    // together.
+    //
+    // Absent resolver, or a resolver that answers `undefined`: NO header. The
+    // receiver mints and a new trace begins, which is the truthful outcome when
+    // there is nothing to continue.
+    if (config.getCorrelationId && !headers.has(CORRELATION_ID_HEADER)) {
+        const correlationId = await Promise.resolve(config.getCorrelationId());
+        if (correlationId) {
+            headers.set(CORRELATION_ID_HEADER, correlationId);
+        }
+    }
     // Auth token (caller or global headers take precedence)
     if (config.getAuthToken && !headers.has('Authorization')) {
         const token = await config.getAuthToken();

package/dist/endpoints/bundle-bytes/bundle-bytes.d.ts

@@ -0,0 +1,5 @@
+export declare const getBundleBytesControllerDownloadUrl: (grantId: string) => string;
+/**
+ * @summary Stream the granted biome bundle's tarball (raw gzip) to a dispatched adapter host.
+ */
+export declare const bundleBytesControllerDownload: (grantId: string, options?: RequestInit) => Promise<void>;

package/dist/endpoints/bundle-bytes/bundle-bytes.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bundleBytesControllerDownload = exports.getBundleBytesControllerDownloadUrl = void 0;
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+const custom_fetch_1 = require("../../custom-fetch");
+const getBundleBytesControllerDownloadUrl = (grantId) => {
+    return `/internal/bundle-bytes/${grantId}`;
+};
+exports.getBundleBytesControllerDownloadUrl = getBundleBytesControllerDownloadUrl;
+/**
+ * @summary Stream the granted biome bundle's tarball (raw gzip) to a dispatched adapter host.
+ */
+const bundleBytesControllerDownload = async (grantId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getBundleBytesControllerDownloadUrl)(grantId), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.bundleBytesControllerDownload = bundleBytesControllerDownload;

package/dist/endpoints/execution-targets-internal/execution-targets-internal.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ExecutionTargetInternalControllerResolveParams, ExecutionTargetResponseDtoDataEnvelope } from '../../models';
+export declare const getExecutionTargetInternalControllerResolveUrl: (params: ExecutionTargetInternalControllerResolveParams) => string;
+/**
+ * @summary Resolve the one execution target an org should place work on — by slug, or the org default
+ */
+export declare const executionTargetInternalControllerResolve: (params: ExecutionTargetInternalControllerResolveParams, options?: RequestInit) => Promise<ExecutionTargetResponseDtoDataEnvelope>;

package/dist/endpoints/execution-targets-internal/execution-targets-internal.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executionTargetInternalControllerResolve = exports.getExecutionTargetInternalControllerResolveUrl = void 0;
+const custom_fetch_1 = require("../../custom-fetch");
+const getExecutionTargetInternalControllerResolveUrl = (params) => {
+    const normalizedParams = new URLSearchParams();
+    Object.entries(params || {}).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (value === null) {
+            normalizedParams.append(key, 'null');
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item === undefined || item === null)
+                    continue;
+                normalizedParams.append(key, item.toString());
+            }
+            return;
+        }
+        normalizedParams.append(key, value.toString());
+    });
+    const stringifiedParams = normalizedParams.toString();
+    return stringifiedParams.length > 0 ? `/internal/execution-targets/resolve?${stringifiedParams}` : `/internal/execution-targets/resolve`;
+};
+exports.getExecutionTargetInternalControllerResolveUrl = getExecutionTargetInternalControllerResolveUrl;
+/**
+ * @summary Resolve the one execution target an org should place work on — by slug, or the org default
+ */
+const executionTargetInternalControllerResolve = async (params, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getExecutionTargetInternalControllerResolveUrl)(params), {
+        ...options,
+        method: 'GET'
+    });
+};
+exports.executionTargetInternalControllerResolve = executionTargetInternalControllerResolve;

package/dist/endpoints/org-erasure/org-erasure.d.ts

@@ -0,0 +1,5 @@
+export declare const getOrgErasureControllerEraseUrl: (orgId: string) => string;
+/**
+ * @summary Erase every row belonging to an org across this service's org-scoped models
+ */
+export declare const orgErasureControllerErase: (orgId: string, options?: RequestInit) => Promise<void>;

package/dist/endpoints/org-erasure/org-erasure.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgErasureControllerErase = exports.getOrgErasureControllerEraseUrl = void 0;
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+const custom_fetch_1 = require("../../custom-fetch");
+const getOrgErasureControllerEraseUrl = (orgId) => {
+    return `/internal/org-erasure/${orgId}`;
+};
+exports.getOrgErasureControllerEraseUrl = getOrgErasureControllerEraseUrl;
+/**
+ * @summary Erase every row belonging to an org across this service's org-scoped models
+ */
+const orgErasureControllerErase = async (orgId, options) => {
+    return (0, custom_fetch_1.customFetch)((0, exports.getOrgErasureControllerEraseUrl)(orgId), {
+        ...options,
+        method: 'POST'
+    });
+};
+exports.orgErasureControllerErase = orgErasureControllerErase;

package/dist/index.d.ts

@@ -1,4 +1,7 @@
 export { configureClient, getClientConfig, ClientError, customFetch, type ClientConfig, type RetryNotice } from './custom-fetch';
 export * from './models';
+export * from './endpoints/bundle-bytes/bundle-bytes';
 export * from './endpoints/describe-objects/describe-objects';
+export * from './endpoints/execution-targets-internal/execution-targets-internal';
+export * from './endpoints/org-erasure/org-erasure';
 export * from './endpoints/runtime-authority-internal/runtime-authority-internal';

package/dist/index.js

@@ -22,5 +22,8 @@ Object.defineProperty(exports, "getClientConfig", { enumerable: true, get: funct
 Object.defineProperty(exports, "ClientError", { enumerable: true, get: function () { return custom_fetch_1.ClientError; } });
 Object.defineProperty(exports, "customFetch", { enumerable: true, get: function () { return custom_fetch_1.customFetch; } });
 __exportStar(require("./models"), exports);
+__exportStar(require("./endpoints/bundle-bytes/bundle-bytes"), exports);
 __exportStar(require("./endpoints/describe-objects/describe-objects"), exports);
+__exportStar(require("./endpoints/execution-targets-internal/execution-targets-internal"), exports);
+__exportStar(require("./endpoints/org-erasure/org-erasure"), exports);
 __exportStar(require("./endpoints/runtime-authority-internal/runtime-authority-internal"), exports);

package/dist/models/credentialDeliveryKind.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+export type CredentialDeliveryKind = typeof CredentialDeliveryKind[keyof typeof CredentialDeliveryKind];
+export declare const CredentialDeliveryKind: {
+    readonly platform_custody: "platform_custody";
+    readonly one_time_exchange: "one_time_exchange";
+    readonly token_only: "token_only";
+};

package/dist/models/credentialDeliveryKind.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialDeliveryKind = void 0;
+exports.CredentialDeliveryKind = {
+    platform_custody: 'platform_custody',
+    one_time_exchange: 'one_time_exchange',
+    token_only: 'token_only',
+};

package/dist/models/dataClassification.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Classification CEILING this target accepts, or null for un-configured. Joined monotonically — it may only ever RAISE restriction.
+ */
+export type DataClassification = typeof DataClassification[keyof typeof DataClassification];
+export declare const DataClassification: {
+    readonly public: "public";
+    readonly internal: "internal";
+    readonly confidential: "confidential";
+    readonly secret: "secret";
+    readonly regulated: "regulated";
+};

package/dist/models/dataClassification.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataClassification = void 0;
+exports.DataClassification = {
+    public: 'public',
+    internal: 'internal',
+    confidential: 'confidential',
+    secret: 'secret',
+    regulated: 'regulated',
+};

package/dist/models/dispatchAuthorizationResponseDto.d.ts

@@ -19,7 +19,7 @@ export interface DispatchAuthorizationResponseDto {
     /** @minimum 1 */
     bindingRevision: number;
     installationId: string;
-    runtimeId: string;
+    executionTargetId: string;
     enrollmentId: string;
     runnerId: string;
     /** @minimum 1 */

package/dist/models/executionTargetInternalControllerResolveParams.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+export type ExecutionTargetInternalControllerResolveParams = {
+    /**
+     * The tenant whose Space ladder to resolve against.
+     */
+    orgId: string;
+    /**
+     * The target to resolve. Omitted resolves the org's default. A named slug NEVER falls back: a target that exists but is not active is a typed refusal, because quietly running work somewhere else is what the placement plane exists to prevent.
+     */
+    slug?: string;
+};

package/dist/models/executionTargetInternalControllerResolveParams.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/executionTargetResponseDto.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { CredentialDeliveryKind } from './credentialDeliveryKind.js';
+import type { DataClassification } from './dataClassification.js';
+import type { ExecutionTargetResponseDtoLabels } from './executionTargetResponseDtoLabels.js';
+import type { ExecutionTargetStatus } from './executionTargetStatus.js';
+import type { RunnerDataLocality } from './runnerDataLocality.js';
+import type { RunnerTrustTier } from './runnerTrustTier.js';
+import type { RuntimeOperatorKind } from './runtimeOperatorKind.js';
+import type { SpaceKind } from './spaceKind.js';
+export interface ExecutionTargetResponseDto {
+    id: string;
+    slug: string;
+    displayName: string;
+    /** Canonical `xema://…` SpaceRef URI of the owner. THE address — the tier and the tenant fence below are projections of it. */
+    ownerSpaceUri: string;
+    /** The owner TIER, projected from `ownerSpaceUri`. Only `system` and `org` are admissible for a placement target. */
+    ownerSpaceKind: SpaceKind;
+    /** Isolation level this target PROVIDES (RuntimeIsolationLevel wire value). */
+    isolation: string;
+    /** Data locality this target PROVIDES (RunnerDataLocality wire value). */
+    locality: string;
+    /** Minimum runner trust tier admitted (RunnerTrustTier wire value). */
+    minTrustTier: string;
+    operatorKind: RuntimeOperatorKind;
+    /**
+       * The tenant fence. `null` for the org-less System-owned platform target.
+       * @nullable
+       */
+    ownerOrgId: string | null;
+    credentialDelivery: CredentialDeliveryKind;
+    maxTrustTier: RunnerTrustTier;
+    allowedLocalities: RunnerDataLocality[];
+    /** OPEN operator label map declaring what this pool provides. `ExecutionTargetLabel` names the three keys the platform itself reads (region, residency, accelerator); anything else is an operator vocabulary. */
+    labels: ExecutionTargetResponseDtoLabels;
+    /** Classification CEILING this target accepts, or null for un-configured. Joined monotonically — it may only ever RAISE restriction. */
+    maxDataClassification: DataClassification | null;
+    status: ExecutionTargetStatus;
+    /** @minimum 1 */
+    revision: number;
+    /** The fallback target WITHIN its owner space. At most one. */
+    isDefault: boolean;
+    createdBy: string;
+    createdAt: string;
+    updatedAt: string;
+}

package/dist/models/executionTargetResponseDto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/executionTargetResponseDtoDataEnvelope.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+import type { ExecutionTargetResponseDto } from './executionTargetResponseDto.js';
+export interface ExecutionTargetResponseDtoDataEnvelope {
+    data: ExecutionTargetResponseDto;
+}

package/dist/models/executionTargetResponseDtoDataEnvelope.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/executionTargetResponseDtoLabels.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * OPEN operator label map declaring what this pool provides. `ExecutionTargetLabel` names the three keys the platform itself reads (region, residency, accelerator); anything else is an operator vocabulary.
+ */
+export type ExecutionTargetResponseDtoLabels = {
+    [key: string]: string;
+};

package/dist/models/executionTargetResponseDtoLabels.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/executionTargetStatus.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+export type ExecutionTargetStatus = typeof ExecutionTargetStatus[keyof typeof ExecutionTargetStatus];
+export declare const ExecutionTargetStatus: {
+    readonly provisioning: "provisioning";
+    readonly active: "active";
+    readonly draining: "draining";
+    readonly revoked: "revoked";
+    readonly failed: "failed";
+};

package/dist/models/executionTargetStatus.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionTargetStatus = void 0;
+exports.ExecutionTargetStatus = {
+    provisioning: 'provisioning',
+    active: 'active',
+    draining: 'draining',
+    revoked: 'revoked',
+    failed: 'failed',
+};

package/dist/models/index.d.ts

@@ -6,6 +6,8 @@ export * from './biomeTrustTier';
 export * from './claimDispatchAuthorizationDto';
 export * from './claimRunnerCredentialMaterializationDto';
 export * from './completeDispatchAuthorizationDto';
+export * from './credentialDeliveryKind';
+export * from './dataClassification';
 export * from './describeObjectsResponseDto';
 export * from './describeObjectsResponseDtoDataEnvelope';
 export * from './dispatchAuthorizationResponseDto';
@@ -25,6 +27,11 @@ export * from './errorDetailsDto';
 export * from './errorDetailsDtoDetails';
 export * from './errorPayloadDto';
 export * from './errorResponseDto';
+export * from './executionTargetInternalControllerResolveParams';
+export * from './executionTargetResponseDto';
+export * from './executionTargetResponseDtoDataEnvelope';
+export * from './executionTargetResponseDtoLabels';
+export * from './executionTargetStatus';
 export * from './inFlightRevocationPolicy';
 export * from './objectLifecycle';
 export * from './recordRunnerAttestationDto';
@@ -40,6 +47,7 @@ export * from './runnerEnrollmentDesiredState';
 export * from './runnerEnrollmentObservedState';
 export * from './runnerEnrollmentResponseDto';
 export * from './runnerEnrollmentResponseDtoDataEnvelope';
+export * from './runnerKind';
 export * from './runnerTrustTier';
 export * from './runtimeBindingCandidateResponseDto';
 export * from './runtimeBindingCandidateResponseDtoDataArrayEnvelope';

package/dist/models/index.js

@@ -23,6 +23,8 @@ __exportStar(require("./biomeTrustTier"), exports);
 __exportStar(require("./claimDispatchAuthorizationDto"), exports);
 __exportStar(require("./claimRunnerCredentialMaterializationDto"), exports);
 __exportStar(require("./completeDispatchAuthorizationDto"), exports);
+__exportStar(require("./credentialDeliveryKind"), exports);
+__exportStar(require("./dataClassification"), exports);
 __exportStar(require("./describeObjectsResponseDto"), exports);
 __exportStar(require("./describeObjectsResponseDtoDataEnvelope"), exports);
 __exportStar(require("./dispatchAuthorizationResponseDto"), exports);
@@ -42,6 +44,11 @@ __exportStar(require("./errorDetailsDto"), exports);
 __exportStar(require("./errorDetailsDtoDetails"), exports);
 __exportStar(require("./errorPayloadDto"), exports);
 __exportStar(require("./errorResponseDto"), exports);
+__exportStar(require("./executionTargetInternalControllerResolveParams"), exports);
+__exportStar(require("./executionTargetResponseDto"), exports);
+__exportStar(require("./executionTargetResponseDtoDataEnvelope"), exports);
+__exportStar(require("./executionTargetResponseDtoLabels"), exports);
+__exportStar(require("./executionTargetStatus"), exports);
 __exportStar(require("./inFlightRevocationPolicy"), exports);
 __exportStar(require("./objectLifecycle"), exports);
 __exportStar(require("./recordRunnerAttestationDto"), exports);
@@ -57,6 +64,7 @@ __exportStar(require("./runnerEnrollmentDesiredState"), exports);
 __exportStar(require("./runnerEnrollmentObservedState"), exports);
 __exportStar(require("./runnerEnrollmentResponseDto"), exports);
 __exportStar(require("./runnerEnrollmentResponseDtoDataEnvelope"), exports);
+__exportStar(require("./runnerKind"), exports);
 __exportStar(require("./runnerTrustTier"), exports);
 __exportStar(require("./runtimeBindingCandidateResponseDto"), exports);
 __exportStar(require("./runtimeBindingCandidateResponseDtoDataArrayEnvelope"), exports);

package/dist/models/recordRunnerAttestationDto.d.ts

@@ -4,6 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 import type { RunnerDataLocality } from './runnerDataLocality.js';
+import type { RunnerKind } from './runnerKind.js';
 import type { RunnerTrustTier } from './runnerTrustTier.js';
 export interface RecordRunnerAttestationDto {
     principalId: string;
@@ -11,5 +12,6 @@ export interface RecordRunnerAttestationDto {
     credentialRevision: number;
     trustTier: RunnerTrustTier;
     locality: RunnerDataLocality;
+    kind: RunnerKind;
     environmentIds: string[];
 }

package/dist/models/runnerEnrollmentResponseDto.d.ts

@@ -7,13 +7,14 @@ import type { InFlightRevocationPolicy } from './inFlightRevocationPolicy.js';
 import type { RunnerDataLocality } from './runnerDataLocality.js';
 import type { RunnerEnrollmentDesiredState } from './runnerEnrollmentDesiredState.js';
 import type { RunnerEnrollmentObservedState } from './runnerEnrollmentObservedState.js';
+import type { RunnerKind } from './runnerKind.js';
 import type { RunnerTrustTier } from './runnerTrustTier.js';
 import type { RuntimeOperatorKind } from './runtimeOperatorKind.js';
 export interface RunnerEnrollmentResponseDto {
     id: string;
     /** @minimum 1 */
     revision: number;
-    runtimeId: string;
+    executionTargetId: string;
     runnerId: string;
     /** @nullable */
     principalId: string | null;
@@ -26,6 +27,8 @@ export interface RunnerEnrollmentResponseDto {
     allowedEnvironmentIds: string[];
     maxTrustTier: RunnerTrustTier;
     allowedLocalities: RunnerDataLocality[];
+    /** Runner kinds this enrollment permits. Capped at attestation; a runner asserting a kind outside this set is REFUSED, never signed. */
+    allowedKinds: RunnerKind[];
     attestationRevision: number;
     inFlightPolicy: InFlightRevocationPolicy;
     operatorKind: RuntimeOperatorKind;

package/dist/models/runnerKind.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+/**
+ * Runner kinds this enrollment permits. Capped at attestation; a runner asserting a kind outside this set is REFUSED, never signed.
+ */
+export type RunnerKind = typeof RunnerKind[keyof typeof RunnerKind];
+export declare const RunnerKind: {
+    readonly local: "local";
+    readonly cloud: "cloud";
+    readonly 'customer-edge': "customer-edge";
+    readonly gpu: "gpu";
+    readonly sandbox: "sandbox";
+    readonly ci: "ci";
+    readonly 'mcp-external': "mcp-external";
+};

package/dist/models/runnerKind.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Biome Host API
+ * OpenAPI spec version: 0.1.1
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerKind = void 0;
+exports.RunnerKind = {
+    local: 'local',
+    cloud: 'cloud',
+    'customer-edge': 'customer-edge',
+    gpu: 'gpu',
+    sandbox: 'sandbox',
+    ci: 'ci',
+    'mcp-external': 'mcp-external',
+};

package/dist/models/runtimeBindingCandidateResponseDto.d.ts

@@ -22,8 +22,8 @@ export interface RuntimeBindingCandidateResponseDto {
     bindingPrincipalId: string;
     /** @minimum 1 */
     bindingCredentialRevision: number;
-    runtimeId: string;
-    runtimeSlug: string;
+    executionTargetId: string;
+    executionTargetSlug: string;
     runtimeOperatorKind: RuntimeOperatorKind;
     /** @nullable */
     runtimeOwnerOrgId: RuntimeBindingCandidateResponseDtoRuntimeOwnerOrgId;

package/dist/models/spaceKind.d.ts

@@ -4,7 +4,7 @@
  * OpenAPI spec version: 0.1.1
  */
 /**
- * Ownership tier (system | biome | org | project | user)
+ * The owner TIER, projected from `ownerSpaceUri`. Only `system` and `org` are admissible for a placement target.
  */
 export type SpaceKind = typeof SpaceKind[keyof typeof SpaceKind];
 export declare const SpaceKind: {

package/dist/models/xemaObjectKind.d.ts

@@ -27,10 +27,10 @@ export declare const XemaObjectKind: {
     readonly 'mount-source': "mount-source";
     readonly 'artifact-type': "artifact-type";
     readonly artifact: "artifact";
+    readonly 'output-route': "output-route";
+    readonly resource: "resource";
     readonly 'knowledge-space': "knowledge-space";
     readonly 'knowledge-page': "knowledge-page";
-    readonly 'document-template': "document-template";
-    readonly 'document-theme': "document-theme";
     readonly 'chart-runtime': "chart-runtime";
     readonly 'presentation-runtime': "presentation-runtime";
     readonly 'widget-kind': "widget-kind";

package/dist/models/xemaObjectKind.js

@@ -26,10 +26,10 @@ exports.XemaObjectKind = {
     'mount-source': 'mount-source',
     'artifact-type': 'artifact-type',
     artifact: 'artifact',
+    'output-route': 'output-route',
+    resource: 'resource',
     'knowledge-space': 'knowledge-space',
     'knowledge-page': 'knowledge-page',
-    'document-template': 'document-template',
-    'document-theme': 'document-theme',
     'chart-runtime': 'chart-runtime',
     'presentation-runtime': 'presentation-runtime',
     'widget-kind': 'widget-kind',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-host-internal-api-client",
-  "version": "0.3.7",
+  "version": "0.3.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-base.git",
@@ -25,7 +25,7 @@
     "service": "biome-host-api",
     "biome": "biome-host",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.12.1",
+    "generator": "@xemahq/api-client-generator@0.15.0",
     "source": "openapi.internal.json"
   },
   "scripts": {