This reads the committed swagger/swagger_governance.json (no network call) and uses openapi-generator-cli to produce the typed client under generated/. The generated sources are committed to the repository.

Creating a typed client

import { createApiClient, PolicyApi } from "@uipath/aops-policy-sdk";

const api = await createApiClient(PolicyApi);
const policies = await api.policyGetAllPoliciesByQueryOptions({
    productName: "StudioX",
});

createApiClient pulls login/org context from @uipath/auth and builds a Configuration scoped to {baseUrl}/{orgId}/roboticsops_.

Resolving whether a tenant is governed (`/resolver`)

import { resolvePolicyAsync } from "@uipath/aops-policy-sdk/resolver";

const resolution = await resolvePolicyAsync({
    subject: {
        organizationId,
        tenantId,
        product: "Development",
        licenseType: "Development",
    },
    baseUrl: "https://cloud.uipath.com",
    accessToken,
    clientVersion: pkg.version,
});

switch (resolution.outcome) {
    case "governed":   // resolution.document is the policy, byte for byte
    case "ungoverned": // a 204 — nobody publishes a policy for this subject
    case "unknown":    // resolution.reason says why the question went unanswered
}

Separate from the root barrel on purpose: the root pulls in createApiClient, which needs @uipath/auth and is node-only. The /resolver subpath has no runtime dependencies and no node: imports, so it works in the browser bundle too.

Three things it deliberately does not do. It never returns ungoverned for anything but a 204 — a 404, a 5xx or an expired token are all unknown, which is not the same claim. It never retries; a Retry-After is parsed into audit.retryAfterSeconds and the decision is the caller's. And it never touches the document: no reparse, no reserialize, because callers checksum that string.

product and licenseType have no defaults. A default here is how two callers came to ask the same tenant different questions and get different answers; the command layer owns that choice.