@xemahq/space-registry-api-client 0.2.12 → 0.2.18

package/dist/custom-fetch.js

@@ -223,14 +223,66 @@ const customFetch = async (url, options) => {
     }
 };
 exports.customFetch = customFetch;
-async function parseBody(response) {
-    const contentType = response.headers.get('content-type');
-    if (contentType?.includes('application/json')) {
-        return response.json();
+/**
+ * Does this media type carry JSON?
+ *
+ * ── THE OUTAGE THIS FIXES ────────────────────────────────────────────────
+ *
+ * This used to be `contentType?.includes('application/json')`, and EVERY error
+ * this fleet returns failed that test. The platform's `GlobalExceptionFilter`
+ * emits RFC 9457 problem documents and sets the media type explicitly —
+ * `.type(PROBLEM_DETAILS_CONTENT_TYPE)` before `.json()`, so it cannot be
+ * overridden — and that constant is `application/problem+json`, which does NOT
+ * contain the substring `application/json`: after `application/` comes
+ * `problem+json`.
+ *
+ * So every non-2xx body fell through to `response.text()` and reached the
+ * caller as an UNPARSED STRING. `ClientError.body` is typed `unknown`, so
+ * nothing complained; every consumer that reads a machine-readable code off an
+ * error — `error.body.code`, `error.body.details.code` — silently read
+ * `undefined` instead, for every error, in every service.
+ *
+ * Measured in production on 2026-09-15: skill-registry-api's
+ * `resolveOrNull()` absorbs `RELEASE_CHANNEL_NOT_FOUND` into `null` by exactly
+ * that read. With the code unreadable the absorb never fired, a routine "no
+ * pointer on this channel" 404 became a 500 on `GET /skills` and
+ * `GET /describe-objects`, and agent-session-api's `apply_control_bundle` step
+ * aborted EVERY session launch in the organisation — 7,871 failed resolutions
+ * an hour. A fix written for that exact page months earlier was present in the
+ * running image and could not help, because the classifier it repaired was
+ * being handed a string.
+ *
+ * ── WHY THE STRUCTURED SUFFIX, NOT A SECOND SUBSTRING ────────────────────
+ *
+ * Adding `|| includes('application/problem+json')` would fix this one media
+ * type and leave the next one — `application/vnd.api+json`, and anything else
+ * a service legitimately emits. RFC 6839 defines `+json` as the structured
+ * syntax suffix meaning "this is JSON"; that is the actual rule, so it is the
+ * rule implemented. Parameters are stripped first, because
+ * `application/problem+json; charset=utf-8` is the same media type.
+ */
+function isJsonMediaType(contentType) {
+    if (contentType === null) {
+        return false;
     }
+    const essence = contentType.split(';')[0]?.trim().toLowerCase() ?? '';
+    return essence === 'application/json' || essence.endsWith('+json');
+}
+async function parseBody(response) {
+    // 204 FIRST, and deliberately — this ORDER is carried from `develop`, which
+    // fixed the same defect independently and got this half right where `main`
+    // did not. A 204 carries no body, so `response.json()` on one throws
+    // SyntaxError; and a 204 whose headers STILL declare a JSON content type is
+    // ordinary, because the framework sets the header before the handler returns
+    // nothing. With the JSON branch first, a documented `undefined` becomes a
+    // thrown parse error. Pinned by a case in `transport-problem-json.test.cjs`.
     if (response.status === 204) {
         return undefined;
     }
+    const contentType = response.headers.get('content-type');
+    if (isJsonMediaType(contentType)) {
+        return response.json();
+    }
     return response.text();
 }
 function parseRetryAfter(value) {

package/dist/endpoints/spaces/spaces.d.ts

@@ -65,8 +65,8 @@ export declare const getSpacesControllerAncestorsUrl: (params: SpacesControllerA
 export declare const spacesControllerAncestors: (params: SpacesControllerAncestorsParams, options?: RequestInit) => Promise<SpaceAncestorsDtoDataEnvelope>;
 export declare const getSpacesControllerClassificationUrl: (params: SpacesControllerClassificationParams) => string;
 /**
- * Same tenant rule as /spaces/resolve. A data-classification label is exactly the kind of metadata a cross-tenant read must not expose, so a ref naming another organization is refused with 403.
- * @summary Resolve effective (most-specific-wins) classification over the ancestry.
+ * The monotone JOIN over every declaration on the ref and its ancestors — NOT most-specific-wins, which is the whole safety property: a project declaring `public` cannot escape an org that declared `secret`. The response carries the ANSWER as well as the value — `configured`, `source`, the full `inheritancePath` (silent rungs included) and `clampedByRefUri`, the ancestor that overrode a nearer declaration. Same tenant rule as /spaces/resolve. A data-classification label is exactly the kind of metadata a cross-tenant read must not expose, so a ref naming another organization is refused with 403.
+ * @summary Resolve the effective classification over the ancestry, with its source.
  */
 export declare const spacesControllerClassification: (params: SpacesControllerClassificationParams, options?: RequestInit) => Promise<SpaceClassificationDtoDataEnvelope>;
 export declare const getSpacesControllerGetByIdUrl: (id: string) => string;

package/dist/endpoints/spaces/spaces.js

@@ -240,8 +240,8 @@ const getSpacesControllerClassificationUrl = (params) => {
 };
 exports.getSpacesControllerClassificationUrl = getSpacesControllerClassificationUrl;
 /**
- * Same tenant rule as /spaces/resolve. A data-classification label is exactly the kind of metadata a cross-tenant read must not expose, so a ref naming another organization is refused with 403.
- * @summary Resolve effective (most-specific-wins) classification over the ancestry.
+ * The monotone JOIN over every declaration on the ref and its ancestors — NOT most-specific-wins, which is the whole safety property: a project declaring `public` cannot escape an org that declared `secret`. The response carries the ANSWER as well as the value — `configured`, `source`, the full `inheritancePath` (silent rungs included) and `clampedByRefUri`, the ancestor that overrode a nearer declaration. Same tenant rule as /spaces/resolve. A data-classification label is exactly the kind of metadata a cross-tenant read must not expose, so a ref naming another organization is refused with 403.
+ * @summary Resolve the effective classification over the ancestry, with its source.
  */
 const spacesControllerClassification = async (params, options) => {
     return (0, custom_fetch_1.customFetch)((0, exports.getSpacesControllerClassificationUrl)(params), {

package/dist/models/createSpaceDto.d.ts

@@ -6,7 +6,10 @@
 import type { CreateSpaceDtoLabels } from './createSpaceDtoLabels.js';
 import type { DataClassification } from './dataClassification.js';
 export interface CreateSpaceDto {
-    /** Canonical xema:// Space URI to create. */
+    /**
+       * Canonical xema:// Space URI to create.
+       * @pattern /^xema:\/\//
+       */
     ref: string;
     /** Human-readable label for this Space. */
     displayName: string;

package/dist/models/growthGateDto.d.ts

@@ -9,6 +9,9 @@ export interface GrowthGateDto {
     enabled?: boolean;
     /** Minimum organization role. Absent means every member satisfies it. */
     minimumOrgRole?: GrowthGateDtoMinimumOrgRole;
-    /** Restrict to members of these identity groups. Absent or empty means no group restriction was stated — it never means "nobody". */
+    /**
+       * Restrict to members of these identity groups. Absent or empty means no group restriction was stated — it never means "nobody".
+       * @items.maxLength 256
+       */
     restrictedToGroupIds?: string[];
 }

package/dist/models/index.d.ts

@@ -1,10 +1,6 @@
 export * from './createSpaceDto';
 export * from './createSpaceDtoLabels';
 export * from './dataClassification';
-export * from './errorDetailsDto';
-export * from './errorDetailsDtoDetails';
-export * from './errorPayloadDto';
-export * from './errorResponseDto';
 export * from './growthGateDto';
 export * from './growthGateDtoMinimumOrgRole';
 export * from './memberShellModeOverrideDto';
@@ -18,6 +14,10 @@ export * from './orgGovernanceSettingsDto';
 export * from './orgGovernanceSettingsDtoDataEnvelope';
 export * from './orgGrowthSettingsDto';
 export * from './orgGrowthSettingsDtoDataEnvelope';
+export * from './parameterSourceKind';
+export * from './parameterStepOutcome';
+export * from './problemDetailsDto';
+export * from './problemFieldIssueDto';
 export * from './resolvedResourceRoleBindingResponseDto';
 export * from './resolvedResourceRoleBindingResponseDtoDataEnvelope';
 export * from './resourceRoleBindingListResponseDto';
@@ -39,6 +39,7 @@ export * from './spaceAncestorsDto';
 export * from './spaceAncestorsDtoDataEnvelope';
 export * from './spaceClassificationDto';
 export * from './spaceClassificationDtoDataEnvelope';
+export * from './spaceClassificationStepDto';
 export * from './spaceDto';
 export * from './spaceDtoDataArrayEnvelope';
 export * from './spaceDtoDataEnvelope';

package/dist/models/index.js

@@ -18,10 +18,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./createSpaceDto"), exports);
 __exportStar(require("./createSpaceDtoLabels"), exports);
 __exportStar(require("./dataClassification"), exports);
-__exportStar(require("./errorDetailsDto"), exports);
-__exportStar(require("./errorDetailsDtoDetails"), exports);
-__exportStar(require("./errorPayloadDto"), exports);
-__exportStar(require("./errorResponseDto"), exports);
 __exportStar(require("./growthGateDto"), exports);
 __exportStar(require("./growthGateDtoMinimumOrgRole"), exports);
 __exportStar(require("./memberShellModeOverrideDto"), exports);
@@ -35,6 +31,10 @@ __exportStar(require("./orgGovernanceSettingsDto"), exports);
 __exportStar(require("./orgGovernanceSettingsDtoDataEnvelope"), exports);
 __exportStar(require("./orgGrowthSettingsDto"), exports);
 __exportStar(require("./orgGrowthSettingsDtoDataEnvelope"), exports);
+__exportStar(require("./parameterSourceKind"), exports);
+__exportStar(require("./parameterStepOutcome"), exports);
+__exportStar(require("./problemDetailsDto"), exports);
+__exportStar(require("./problemFieldIssueDto"), exports);
 __exportStar(require("./resolvedResourceRoleBindingResponseDto"), exports);
 __exportStar(require("./resolvedResourceRoleBindingResponseDtoDataEnvelope"), exports);
 __exportStar(require("./resourceRoleBindingListResponseDto"), exports);
@@ -56,6 +56,7 @@ __exportStar(require("./spaceAncestorsDto"), exports);
 __exportStar(require("./spaceAncestorsDtoDataEnvelope"), exports);
 __exportStar(require("./spaceClassificationDto"), exports);
 __exportStar(require("./spaceClassificationDtoDataEnvelope"), exports);
+__exportStar(require("./spaceClassificationStepDto"), exports);
 __exportStar(require("./spaceDto"), exports);
 __exportStar(require("./spaceDtoDataArrayEnvelope"), exports);
 __exportStar(require("./spaceDtoDataEnvelope"), exports);

package/dist/models/memberShellModeOverrideDto.d.ts

@@ -5,6 +5,7 @@
  */
 import type { MemberShellModeOverrideDtoMode } from './memberShellModeOverrideDtoMode.js';
 export interface MemberShellModeOverrideDto {
+    /** @maxLength 256 */
     groupId: string;
     mode: MemberShellModeOverrideDtoMode;
 }

package/dist/models/orgGovernanceSettingsDto.d.ts

@@ -3,9 +3,12 @@
  * Space Registry API
  * OpenAPI spec version: 0.1.0
  */
+import type { ParameterSourceKind } from './parameterSourceKind.js';
 export interface OrgGovernanceSettingsDto {
     /** False when this organization has never written a governance setting — the resting state, not an error. */
     configured: boolean;
+    /** Where an effective value came from: `platform-default` (nobody stated it anywhere), `stated` (the scope being read stated it) or `inherited` (a less specific scope in the same chain stated it). */
+    source: ParameterSourceKind;
     /** When true, LOWERING a Space classification opens a Decision addressed to the data-governance group instead of performing the write. Raising a classification is never affected. */
     downgradeSeparationOfDuties: boolean;
     /**

package/dist/models/orgGovernanceSettingsDto.js

@@ -1,7 +1,2 @@
 "use strict";
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Space Registry API
- * OpenAPI spec version: 0.1.0
- */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/parameterSourceKind.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+/**
+ * Where an effective value came from: `platform-default` (nobody stated it anywhere), `stated` (the scope being read stated it) or `inherited` (a less specific scope in the same chain stated it).
+ */
+export type ParameterSourceKind = typeof ParameterSourceKind[keyof typeof ParameterSourceKind];
+export declare const ParameterSourceKind: {
+    readonly 'platform-default': "platform-default";
+    readonly stated: "stated";
+    readonly inherited: "inherited";
+};

package/dist/models/parameterSourceKind.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParameterSourceKind = void 0;
+exports.ParameterSourceKind = {
+    'platform-default': 'platform-default',
+    stated: 'stated',
+    inherited: 'inherited',
+};

package/dist/models/parameterStepOutcome.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+/**
+ * What this rung did: `silent` (declared nothing), `decided` (its value IS the effective one — exactly one rung ever is), `shadowed` (it declared something and something else decided).
+ */
+export type ParameterStepOutcome = typeof ParameterStepOutcome[keyof typeof ParameterStepOutcome];
+export declare const ParameterStepOutcome: {
+    readonly silent: "silent";
+    readonly decided: "decided";
+    readonly shadowed: "shadowed";
+};

package/dist/models/parameterStepOutcome.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ParameterStepOutcome = void 0;
+exports.ParameterStepOutcome = {
+    silent: 'silent',
+    decided: 'decided',
+    shadowed: 'shadowed',
+};

package/dist/models/problemDetailsDto.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+import type { ProblemFieldIssueDto } from './problemFieldIssueDto.js';
+/**
+ * RFC 9457 problem document. The declared members are the reserved core; extension members are TOP-LEVEL and OPEN, owned by the refusing plane.
+ */
+export interface ProblemDetailsDto {
+    /** Absolute URI identifying the refusal TYPE. Derived one-to-one from `code`, so a caller may branch on either and can never be told two different things. Never `about:blank`. */
+    type: string;
+    /** Short, human-readable, and STABLE for a given `type`. Never per-occurrence — that is `detail`. */
+    title: string;
+    /** The HTTP status code, repeated in the body so a logged document is self-contained. */
+    status: number;
+    /** SCREAMING_SNAKE_CASE. The machine-branchable refusal, and the value a policy rule, a retry predicate and a UI branch all name. */
+    code: string;
+    /** Human-readable and specific to THIS occurrence. */
+    detail?: string;
+    /** URI reference identifying the occurrence — a request path, a run, a row. */
+    instance?: string;
+    /** W3C trace-context trace-id, present when the caller sent a `traceparent`. Omitted rather than invented when it did not. */
+    traceId?: string;
+    /** Field-level issues, when the refusal is about the request body. */
+    errors?: ProblemFieldIssueDto[];
+    [key: string]: unknown;
+}

package/dist/models/problemFieldIssueDto.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+export interface ProblemFieldIssueDto {
+    /** RFC 6901 JSON Pointer into the request body. Root is "/". */
+    pointer: string;
+    detail: string;
+}

package/dist/models/resourceRolesControllerResolveParams.d.ts

@@ -4,6 +4,13 @@
  * OpenAPI spec version: 0.1.0
  */
 export type ResourceRolesControllerResolveParams = {
+    /**
+     * The owner space to resolve AT, as `<fence>::<SpaceRef>`. Resolution walks the ladder from here; the most specific statement wins.
+     */
     ownerSpaceRef: string;
+    /**
+     * The role, as `<resourceKind>.<role>`. Roles are an OPEN vocabulary, so this is validated for GRAMMAR only — an unknown but well-formed role resolves to `configured: false`, which is an answer rather than an error.
+     * @pattern ^[a-z][a-z0-9-]{0,62}\.[a-z][a-z0-9-]{0,62}$
+     */
     roleKey: string;
 };

package/dist/models/spaceClassificationDto.d.ts

@@ -4,6 +4,8 @@
  * OpenAPI spec version: 0.1.0
  */
 import type { DataClassification } from './dataClassification.js';
+import type { ParameterSourceKind } from './parameterSourceKind.js';
+import type { SpaceClassificationStepDto } from './spaceClassificationStepDto.js';
 export interface SpaceClassificationDto {
     /** The Space URI that was resolved. */
     refUri: string;
@@ -14,4 +16,15 @@ export interface SpaceClassificationDto {
        * @nullable
        */
     resolvedFromRefUri?: string | null;
+    /** Did ANYBODY in the chain declare a classification? A different fact from what the value is: `false` means "nobody has armed this", which a UI must not present as "this is public". */
+    configured: boolean;
+    /** `platform-default` (nobody declared anything), `stated` (this ref declared the winning value), `inherited` (an ancestor did). */
+    source: ParameterSourceKind;
+    /** Every rung considered, CLOSEST-FIRST with the ref itself at index 0, silent rungs included. */
+    inheritancePath: SpaceClassificationStepDto[];
+    /**
+       * The ANCESTOR whose floor overrode a declaration this ref itself made — Law 9's "which override decided this". Null when nothing was taken away, including when this ref declared nothing.
+       * @nullable
+       */
+    clampedByRefUri?: string | null;
 }

package/dist/models/spaceClassificationStepDto.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generated by @xemahq/api-client-generator — do not edit manually.
+ * Space Registry API
+ * OpenAPI spec version: 0.1.0
+ */
+import type { DataClassification } from './dataClassification.js';
+import type { ParameterStepOutcome } from './parameterStepOutcome.js';
+export interface SpaceClassificationStepDto {
+    /** The Space URI of this rung. */
+    refUri: string;
+    /** The rung's tier (`SpaceKind` value). Carried so a UI can say "your org's floor" without re-parsing the URI. */
+    tier: string;
+    /** What THIS rung declares. Null when it declares nothing — the join's identity, and indistinguishable from having no row at all. */
+    declared?: DataClassification | null;
+    /** What this rung did: `silent` (declared nothing), `decided` (its value IS the effective one — exactly one rung ever is), `shadowed` (it declared something and something else decided). */
+    outcome: ParameterStepOutcome;
+}

package/dist/models/updateOrgGovernanceSettingsDto.d.ts

@@ -6,7 +6,10 @@
 export interface UpdateOrgGovernanceSettingsDto {
     /** Arm (true) or disarm (false) separation of duties on classification downgrades. Arming REQUIRES dataGovernanceGroupId. */
     downgradeSeparationOfDuties: boolean;
-    /** Identity group the approval is addressed to. decision-api expands it against the identity directory at open time; an empty or unknown group fails the downgrade fast rather than producing an ask nobody can answer. */
+    /**
+       * Identity group the approval is addressed to. decision-api expands it against the identity directory at open time; an empty or unknown group fails the downgrade fast rather than producing an ask nobody can answer.
+       * @maxLength 256
+       */
     dataGovernanceGroupId?: string;
     /**
        * Approvals required. Defaults to 2.

package/dist/models/updateOrgGrowthSettingsDto.d.ts

@@ -15,6 +15,8 @@ export interface UpdateOrgGrowthSettingsDto {
        * @maximum 10
        */
     internalPublishReviewQuorum?: number;
+    /** @items.maxLength 128 */
     allowedCapabilityDomains?: string[];
+    /** @items.maxLength 128 */
     allowedConnectorProviders?: string[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/space-registry-api-client",
-  "version": "0.2.12",
+  "version": "0.2.18",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -19,7 +19,7 @@
     "service": "space-registry-api",
     "biome": "space-registry",
     "target": "server",
-    "generator": "@xemahq/api-client-generator@0.15.2",
+    "generator": "@xemahq/api-client-generator@0.21.0",
     "source": "openapi.public.json"
   },
   "license": "LicenseRef-Xema-BSL-1.1",
@@ -32,6 +32,30 @@
     "directory": "packages/clients/space-registry-api"
   },
   "description": "Generated public API client for the Xema space-registry-api service.",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./models": {
+      "types": "./dist/models/index.d.ts",
+      "default": "./dist/models/index.js"
+    },
+    "./models/*": {
+      "types": "./dist/models/*.d.ts",
+      "default": "./dist/models/*.js"
+    },
+    "./endpoints/*": {
+      "types": "./dist/endpoints/*.d.ts",
+      "default": "./dist/endpoints/*.js"
+    },
+    "./custom-fetch": {
+      "types": "./dist/custom-fetch.d.ts",
+      "default": "./dist/custom-fetch.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
   "scripts": {
     "build": "tsc -p tsconfig.json"
   }

package/dist/models/errorDetailsDto.d.ts

@@ -1,10 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Space Registry API
- * OpenAPI spec version: 0.1.0
- */
-import type { ErrorDetailsDtoDetails } from './errorDetailsDtoDetails.js';
-export interface ErrorDetailsDto {
-    /** @nullable */
-    details: ErrorDetailsDtoDetails;
-}

package/dist/models/errorDetailsDtoDetails.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Space Registry API
- * OpenAPI spec version: 0.1.0
- */
-/**
- * @nullable
- */
-export type ErrorDetailsDtoDetails = {
-    [key: string]: unknown;
-} | null;

package/dist/models/errorPayloadDto.d.ts

@@ -1,11 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Space Registry API
- * OpenAPI spec version: 0.1.0
- */
-import type { ErrorDetailsDto } from './errorDetailsDto.js';
-export interface ErrorPayloadDto {
-    code: string;
-    message: string;
-    details: ErrorDetailsDto | null;
-}

package/dist/models/errorResponseDto.d.ts

@@ -1,9 +0,0 @@
-/**
- * Generated by @xemahq/api-client-generator — do not edit manually.
- * Space Registry API
- * OpenAPI spec version: 0.1.0
- */
-import type { ErrorPayloadDto } from './errorPayloadDto.js';
-export interface ErrorResponseDto {
-    error: ErrorPayloadDto;
-}

package/dist/models/errorResponseDto.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });