@faiber/faiber-profile 0.24.1 → 1.1.0

package/dist/operations.d.ts

@@ -2,1956 +2,2154 @@ import { ServiceApi, type Identifier, type RequestOptions } from "@faiber/sdk-co
 import type * as T from "./operations.types.js";
 export declare class ProfileOperations extends ServiceApi {
     /**
-     * Performs the openapi json operation for the router capability.
+     * Read raw generated OpenAPI JSON; annotations do not establish complete mounted-route coverage.
      * Calls `GET /api/openapi.json` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    routerOpenapiJsonGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RouterOpenapiJsonGetResponse, unknown, {}>>;
+    routerOpenapiJsonGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ServiceOpenApiDocument, unknown, {}, any>>;
     /**
-     * Performs the address get operation for the option capability.
+     * Read stored addresses by resolving supplied IDP user_ids to Profile UUIDs. The local mount is public.
      * Calls `POST /api/v1/address/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    optionAddressGetPost(data: T.OptionAddressGetPostInput, options?: RequestOptions<T.OptionAddressGetPostInput>): Promise<import("axios").AxiosResponse<T.OptionAddressGetPostResponse, T.OptionAddressGetPostInput, {}>>;
+    optionAddressGetPost(data: T.OptionAddressGetPostInput, options?: RequestOptions<T.OptionAddressGetPostInput>): Promise<import("axios").AxiosResponse<T.OptionAddressGetPostResponse, T.OptionAddressGetPostInput, {}, any>>;
     /**
-     * Performs the get chat context operation for the session capability.
-     * Calls `GET /api/v1/auth/chat-context` through the shared IDP-aware Faiber client.
+     * List all deployment summary configuration rows, newest first.
+     * Calls `GET /api/v1/ai-summaries/configurations` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    sessionGetChatContextGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SessionGetChatContextGetResponse, unknown, {}>>;
+    aiSummaryConfigurationsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryConfigurationRecord[]>, unknown, {}, any>>;
     /**
-     * Performs the get self operation for the session capability.
-     * Calls `GET /api/v1/auth/self` through the shared IDP-aware Faiber client.
+     * Create a role configuration after confirming the IDP role exists; duplicate role configuration returns 409. Success status is 201.
+     * Calls `POST /api/v1/ai-summaries/configurations` through the shared IDP-aware Faiber client.
+     * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    sessionGetSelfGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SessionGetSelfGetResponse, unknown, {}>>;
+    aiSummaryConfigurationCreatePost(data: T.AiSummaryConfigurationCreatePostInput, options?: RequestOptions<T.AiSummaryConfigurationCreatePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryConfigurationRecord>, import("./summaries.types.js").SummaryConfigurationWrite, {}, any>>;
     /**
-     * Performs the update self name operation for the session capability.
-     * Calls `PATCH /api/v1/auth/self` through the shared IDP-aware Faiber client.
+     * Read one deployment configuration row by UUID.
+     * Calls `GET /api/v1/ai-summaries/configurations/{id}` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummaryConfigurationGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryConfigurationRecord>, unknown, {}, any>>;
+    /**
+     * Replace a configuration draft with required expected_version; role_id is immutable, missing version returns 422, changed version returns 409.
+     * Calls `PUT /api/v1/ai-summaries/configurations/{id}` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    sessionUpdateSelfNamePatch(data: T.SessionUpdateSelfNamePatchInput, options?: RequestOptions<T.SessionUpdateSelfNamePatchInput>): Promise<import("axios").AxiosResponse<T.SessionUpdateSelfNamePatchResponse, T.SessionUpdateSelfNamePatchInput, {}>>;
+    aiSummaryConfigurationPut(id: Identifier, data: T.AiSummaryConfigurationPutInput, options?: RequestOptions<T.AiSummaryConfigurationPutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryConfigurationRecord>, import("./summaries.types.js").SummaryConfigurationUpdate, {}, any>>;
     /**
-     * Performs the complete onboarding operation for the session capability.
-     * Calls `PUT /api/v1/auth/self/onboarding` through the shared IDP-aware Faiber client.
+     * Queue an eligible subject draft preview and return job_id/run_id with status 202. Global generation must be on; preview also requires subject read permission. Preview does not publish.
+     * Calls `POST /api/v1/ai-summaries/configurations/{id}/preview` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
+     * @param data Typed JSON request body.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummaryPreviewPost(id: Identifier, data: T.AiSummaryPreviewPostInput, options?: RequestOptions<T.AiSummaryPreviewPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryPreviewResponse>, import("./summaries.types.js").SummaryPreviewWrite, {}, any>>;
+    /**
+     * Publish an immutable next revision using draft version concurrency, then enqueue eligible role members. Duplicate identical publication or changed draft returns 409.
+     * Calls `POST /api/v1/ai-summaries/configurations/{id}/publish` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummaryPublishPost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryConfigurationRecord>, unknown, {}, any>>;
+    /**
+     * Enable a published role configuration and enqueue eligible subjects, or disable it and cancel its jobs; enabling without a publication returns 409.
+     * Calls `PATCH /api/v1/ai-summaries/configurations/{id}/status` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    sessionCompleteOnboardingPut(data: T.SessionCompleteOnboardingPutInput, options?: RequestOptions<T.SessionCompleteOnboardingPutInput>): Promise<import("axios").AxiosResponse<T.SessionCompleteOnboardingPutResponse, T.SessionCompleteOnboardingPutInput, {}>>;
+    aiSummaryStatusPatch(id: Identifier, data: T.AiSummaryStatusPatchInput, options?: RequestOptions<T.AiSummaryStatusPatchInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryConfigurationRecord>, import("./summaries.types.js").SummaryStatusWrite, {}, any>>;
     /**
-     * Performs the index operation for the campaign capability.
-     * Calls `GET /api/v1/campaign` through the shared IDP-aware Faiber client.
+     * Validate draft formulas, budgets, sources, IDP role and tool-capable model without publishing; invalid drafts return 422.
+     * Calls `POST /api/v1/ai-summaries/configurations/{id}/validate` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    campaignIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CampaignIndexGetResponse, unknown, {}>>;
+    aiSummaryValidatePost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryValidation>, unknown, {}, any>>;
     /**
-     * Performs the my contributions operation for the campaign capability.
-     * Calls `GET /api/v1/campaign-profile/me/contributions` through the shared IDP-aware Faiber client.
+     * Page deployment jobs using subject/role/status; defaults 1/25 and caps 100. Preview configuration, lease token and requested_by are withheld.
+     * Calls `GET /api/v1/ai-summaries/jobs` through the shared IDP-aware Faiber client.
+     * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:manage.
      */
-    campaignMyContributionsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CampaignMyContributionsGetResponse, unknown, {}>>;
+    aiSummaryJobsGet(params?: T.AiSummaryJobsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryPage<import("./summaries.types.js").SummaryJob>>, unknown, {}, any>>;
     /**
-     * Performs the show operation for the campaign capability.
-     * Calls `GET /api/v1/campaign/{id}` through the shared IDP-aware Faiber client.
+     * Reset a failed reviewable/terminal job for this deployment and return 202. Nonretryable or missing jobs return 409.
+     * Calls `POST /api/v1/ai-summaries/jobs/{id}/retry` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:manage.
+     */
+    aiSummaryRetryPost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryRetryResponse>, unknown, {}, any>>;
+    /**
+     * Read persisted deployment/subject/role latest state with availability/freshness and nullable job_status. Required role_id; read_own restricts to current subject, read_all permits others. GET never generates.
+     * Calls `GET /api/v1/ai-summaries/latest` through the shared IDP-aware Faiber client.
+     * @param params Typed query parameters; omitted members retain backend defaults.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:read_own.
+     */
+    aiSummaryLatestGet(params: T.AiSummaryLatestGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryLatest>, unknown, {}, any>>;
+    /**
+     * Read the configured Agentic project-funded model catalog, including tool support.
+     * Calls `GET /api/v1/ai-summaries/models` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummaryModelsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryModel[]>, unknown, {}, any>>;
+    /**
+     * Queue 1–100 eligible subject-role pairs from published configurations and return 202 with job IDs; global and role generation must be enabled.
+     * Calls `POST /api/v1/ai-summaries/refresh` through the shared IDP-aware Faiber client.
+     * @param data Typed JSON request body.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:manage.
+     */
+    aiSummaryRefreshPost(data: T.AiSummaryRefreshPostInput, options?: RequestOptions<T.AiSummaryRefreshPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryRefreshResponse>, import("./summaries.types.js").SummaryRefreshWrite, {}, any>>;
+    /**
+     * Read IDP role catalog enriched with matching deployment summary configuration IDs/enabled flags.
+     * Calls `GET /api/v1/ai-summaries/roles` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    campaignShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CampaignShowGetResponse, unknown, {}>>;
+    aiSummaryRolesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryRole[]>, unknown, {}, any>>;
     /**
-     * Performs the contribute operation for the campaign capability.
-     * Calls `POST /api/v1/campaign/{id}/contributions` through the shared IDP-aware Faiber client.
+     * Read a persisted deployment run only with subject read_own/read_all authority.
+     * Calls `GET /api/v1/ai-summaries/runs/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:read_own.
+     */
+    aiSummaryRunGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryRun>, unknown, {}, any>>;
+    /**
+     * Read deployment-scoped global generation, concurrency and retention settings; reading does not invoke a model.
+     * Calls `GET /api/v1/ai-summaries/settings` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummarySettingsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummarySettings>, unknown, {}, any>>;
+    /**
+     * Set concurrency 1–16 and retention 1–3650 days; disabling generation cancels pending/retry/generating jobs for this deployment.
+     * Calls `PUT /api/v1/ai-summaries/settings` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummarySettingsPut(data: T.AiSummarySettingsPutInput, options?: RequestOptions<T.AiSummarySettingsPutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummarySettings>, import("./summaries.types.js").SummarySettings, {}, any>>;
+    /**
+     * Read source capabilities, configured availability and concrete tool input/output JSON schemas.
+     * Calls `GET /api/v1/ai-summaries/sources` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
+     */
+    aiSummarySourcesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryCapability[]>, unknown, {}, any>>;
+    /**
+     * Check an authenticated source adapter through Agentic. Connectivity alone does not establish eligible subject evidence or activate a configuration.
+     * Calls `POST /api/v1/ai-summaries/sources/{source}/check` through the shared IDP-aware Faiber client.
+     * @param source Backend path identifier `source`.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:configure.
      */
-    campaignContributePost(id: Identifier, data: T.CampaignContributePostInput, options?: RequestOptions<T.CampaignContributePostInput>): Promise<import("axios").AxiosResponse<T.CampaignContributePostResponse, T.CampaignContributePostInput, {}>>;
+    aiSummarySourceCheckPost(source: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummarySourceCheck>, unknown, {}, any>>;
     /**
-     * Performs the index operation for the city capability.
+     * Page persisted deployment summary runs using subject/role/status; defaults page=1/per_page=25 with size cap 100. read_own restricts the subject unless read_all is present.
+     * Calls `GET /api/v1/ai-summaries/summaries` through the shared IDP-aware Faiber client.
+     * @param params Typed query parameters; omitted members retain backend defaults.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: IDP-validated Bearer/cookie actor; profile:ai_summary:read_own.
+     */
+    aiSummarySummariesGet(params?: T.AiSummarySummariesGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./summaries.types.js").SummaryPage<import("./summaries.types.js").SummaryRun>>, unknown, {}, any>>;
+    /**
+     * Read Chat-scope context: remove id, user_id, properties and services from the profile; return visible properties as a separate object. Office/LMS histories are omitted.
+     * Calls `GET /api/v1/auth/chat-context` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    sessionGetChatContextGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SessionGetChatContextGetResponse, unknown, {}, any>>;
+    /**
+     * Read current gateway identity roles, permissions and Full-scope profile.
+     * Calls `GET /api/v1/auth/self` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    sessionGetSelfGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SessionGetSelfGetResponse, unknown, {}, any>>;
+    /**
+     * Set current identity fa/en name strings; first name must be nonempty, each name at most 100 characters, locale fa/en, and embedded control characters are rejected with 422.
+     * Calls `PATCH /api/v1/auth/self` through the shared IDP-aware Faiber client.
+     * @param data Typed JSON request body.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    sessionUpdateSelfNamePatch(data: T.SessionUpdateSelfNamePatchInput, options?: RequestOptions<T.SessionUpdateSelfNamePatchInput>): Promise<import("axios").AxiosResponse<T.SessionUpdateSelfNamePatchResponse, T.SessionUpdateSelfNamePatchInput, {}, any>>;
+    /**
+     * Validate age/height/weight/goal, merge onboarding app fields in PostgreSQL, and return the current session. Caller-supplied identity/role fields are rejected.
+     * Calls `PUT /api/v1/auth/self/onboarding` through the shared IDP-aware Faiber client.
+     * @param data Typed JSON request body.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    sessionCompleteOnboardingPut(data: T.SessionCompleteOnboardingPutInput, options?: RequestOptions<T.SessionCompleteOnboardingPutInput>): Promise<import("axios").AxiosResponse<T.SessionCompleteOnboardingPutResponse, T.SessionCompleteOnboardingPutInput, {}, any>>;
+    /**
+     * List the city records. List pagination defaults 1/15 and caps at 100; filters apply before pagination, and deleted records are hidden unless filter[trashed]=only/with.
      * Calls `GET /api/v1/city` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityIndexGet(params?: T.CityIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityIndexGetResponse, unknown, {}>>;
+    cityIndexGet(params?: T.CityIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the city capability.
+     * Create the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `POST /api/v1/city` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityStorePost(data: T.CityStorePostInput, options?: RequestOptions<T.CityStorePostInput>): Promise<import("axios").AxiosResponse<T.CityStorePostResponse, T.CityStorePostInput, {}>>;
+    cityStorePost(data: T.CityStorePostInput, options?: RequestOptions<T.CityStorePostInput>): Promise<import("axios").AxiosResponse<T.CityStorePostResponse, T.CityStorePostInput, {}, any>>;
     /**
-     * Performs the destroy operation for the city capability.
+     * Soft-delete the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/city/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityDestroyDeleteResponse, unknown, {}>>;
+    cityDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the city capability.
+     * Read the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/city/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityShowGetResponse, unknown, {}>>;
+    cityShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the city capability.
+     * Update supplied fields on the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PATCH /api/v1/city/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityUpdatePatch(id: Identifier, data: T.CityUpdatePatchInput, options?: RequestOptions<T.CityUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.CityUpdatePatchResponse, T.CityUpdatePatchInput, {}>>;
+    cityUpdatePatch(id: Identifier, data: T.CityUpdatePatchInput, options?: RequestOptions<T.CityUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.CityUpdatePatchResponse, T.CityUpdatePatchInput, {}, any>>;
     /**
-     * Performs the update operation for the city capability.
+     * Update supplied fields on the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PUT /api/v1/city/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityUpdatePut(id: Identifier, data: T.CityUpdatePutInput, options?: RequestOptions<T.CityUpdatePutInput>): Promise<import("axios").AxiosResponse<T.CityUpdatePutResponse, T.CityUpdatePutInput, {}>>;
+    cityUpdatePut(id: Identifier, data: T.CityUpdatePutInput, options?: RequestOptions<T.CityUpdatePutInput>): Promise<import("axios").AxiosResponse<T.CityUpdatePutResponse, T.CityUpdatePutInput, {}, any>>;
     /**
-     * Performs the force destroy operation for the city capability.
+     * Permanently delete the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/city/force/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityForceDestroyDeleteResponse, unknown, {}>>;
+    cityForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityForceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the restore operation for the city capability.
+     * Restore the city record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/city/undo/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: city:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission city:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    cityRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityRestoreGetResponse, unknown, {}>>;
+    cityRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CityRestoreGetResponse, unknown, {}, any>>;
     /**
-     * Performs the index operation for the country capability.
+     * List the country records. List pagination defaults 1/15 and caps at 100; filters apply before pagination, and deleted records are hidden unless filter[trashed]=only/with.
      * Calls `GET /api/v1/country` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryIndexGet(params?: T.CountryIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryIndexGetResponse, unknown, {}>>;
+    countryIndexGet(params?: T.CountryIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the country capability.
+     * Create the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `POST /api/v1/country` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryStorePost(data: T.CountryStorePostInput, options?: RequestOptions<T.CountryStorePostInput>): Promise<import("axios").AxiosResponse<T.CountryStorePostResponse, T.CountryStorePostInput, {}>>;
+    countryStorePost(data: T.CountryStorePostInput, options?: RequestOptions<T.CountryStorePostInput>): Promise<import("axios").AxiosResponse<T.CountryStorePostResponse, T.CountryStorePostInput, {}, any>>;
     /**
-     * Performs the destroy operation for the country capability.
+     * Soft-delete the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/country/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryDestroyDeleteResponse, unknown, {}>>;
+    countryDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the country capability.
+     * Read the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/country/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryShowGetResponse, unknown, {}>>;
+    countryShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the country capability.
+     * Update supplied fields on the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PATCH /api/v1/country/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryUpdatePatch(id: Identifier, data: T.CountryUpdatePatchInput, options?: RequestOptions<T.CountryUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.CountryUpdatePatchResponse, T.CountryUpdatePatchInput, {}>>;
+    countryUpdatePatch(id: Identifier, data: T.CountryUpdatePatchInput, options?: RequestOptions<T.CountryUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.CountryUpdatePatchResponse, T.CountryUpdatePatchInput, {}, any>>;
     /**
-     * Performs the update operation for the country capability.
+     * Update supplied fields on the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PUT /api/v1/country/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryUpdatePut(id: Identifier, data: T.CountryUpdatePutInput, options?: RequestOptions<T.CountryUpdatePutInput>): Promise<import("axios").AxiosResponse<T.CountryUpdatePutResponse, T.CountryUpdatePutInput, {}>>;
+    countryUpdatePut(id: Identifier, data: T.CountryUpdatePutInput, options?: RequestOptions<T.CountryUpdatePutInput>): Promise<import("axios").AxiosResponse<T.CountryUpdatePutResponse, T.CountryUpdatePutInput, {}, any>>;
     /**
-     * Performs the force destroy operation for the country capability.
+     * Permanently delete the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/country/force/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryForceDestroyDeleteResponse, unknown, {}>>;
+    countryForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryForceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the restore operation for the country capability.
+     * Restore the country record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/country/undo/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: country:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission country:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    countryRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryRestoreGetResponse, unknown, {}>>;
+    countryRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CountryRestoreGetResponse, unknown, {}, any>>;
     /**
-     * Performs the index operation for the custom type capability.
+     * Page undeleted custom types by name; filter[search] is a name substring, defaults 1/15 and size caps 100.
      * Calls `GET /api/v1/custom-type` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    customTypeIndexGet(params?: T.CustomTypeIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CustomTypeIndexGetResponse, unknown, {}>>;
+    customTypeIndexGet(params?: T.CustomTypeIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./wire.types.js").ProfileCustomTypePage, unknown, {}, any>>;
     /**
-     * Performs the store operation for the custom type capability.
+     * Create a custom type with at least one option matching value_type; invalid options return 422 and duplicate names 409. Options may be raw values or {value,code,labels} objects.
      * Calls `POST /api/v1/custom-type` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    customTypeStorePost(data: T.CustomTypeStorePostInput, options?: RequestOptions<T.CustomTypeStorePostInput>): Promise<import("axios").AxiosResponse<T.CustomTypeStorePostResponse, T.CustomTypeStorePostInput, {}>>;
+    customTypeStorePost(data: T.CustomTypeStorePostInput, options?: RequestOptions<T.CustomTypeStorePostInput>): Promise<import("axios").AxiosResponse<T.CustomTypeStorePostResponse, import("./types.js").CreateCustomTypeInput, {}, any>>;
     /**
-     * Performs the destroy operation for the custom type capability.
+     * Soft-delete a custom type; acknowledgement data is an empty object.
      * Calls `DELETE /api/v1/custom-type/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    customTypeDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CustomTypeDestroyDeleteResponse, unknown, {}>>;
+    customTypeDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CustomTypeDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the custom type capability.
+     * Read an undeleted custom type by UUID.
      * Calls `GET /api/v1/custom-type/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    customTypeShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CustomTypeShowGetResponse, unknown, {}>>;
+    customTypeShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CustomTypeShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the custom type capability.
+     * Update supplied custom type fields and validate the resulting option list against value_type.
      * Calls `PATCH /api/v1/custom-type/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    customTypeUpdatePatch(id: Identifier, data: T.CustomTypeUpdatePatchInput, options?: RequestOptions<T.CustomTypeUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.CustomTypeUpdatePatchResponse, T.CustomTypeUpdatePatchInput, {}>>;
+    customTypeUpdatePatch(id: Identifier, data: T.CustomTypeUpdatePatchInput, options?: RequestOptions<T.CustomTypeUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.CustomTypeUpdatePatchResponse, import("./types.js").UpdateCustomTypeInput, {}, any>>;
     /**
-     * Performs the dependency operation for the option capability.
+     * Read constant gender/status/employee_type choices.
      * Calls `GET /api/v1/dependency` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dependency:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission dependency:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    optionDependencyGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.OptionDependencyGetResponse, unknown, {}>>;
+    optionDependencyGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.OptionDependencyGetResponse, unknown, {}, any>>;
     /**
-     * Performs the index operation for the education capability.
+     * List active undeleted education {id,name} options ordered by name/id.
      * Calls `GET /api/v1/education` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    educationIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.EducationIndexGetResponse, unknown, {}>>;
+    educationIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.EducationIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the education capability.
+     * Create an education option from a trimmed name containing 1–255 characters; invalid names return 422.
      * Calls `POST /api/v1/education` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    educationStorePost(data: T.EducationStorePostInput, options?: RequestOptions<T.EducationStorePostInput>): Promise<import("axios").AxiosResponse<T.EducationStorePostResponse, T.EducationStorePostInput, {}>>;
+    educationStorePost(data: T.EducationStorePostInput, options?: RequestOptions<T.EducationStorePostInput>): Promise<import("axios").AxiosResponse<T.EducationStorePostResponse, T.EducationStorePostInput, {}, any>>;
     /**
-     * Performs the dependencies operation for the education capability.
+     * Read attendance choices, active referral source codes and level_max_length=64.
      * Calls `GET /api/v1/education/dependencies` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    educationDependenciesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.EducationDependenciesGetResponse, unknown, {}>>;
+    educationDependenciesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.EducationDependenciesGetResponse, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * As fitness admin, import validated active catalog items from an immutable published Knowledge release in one transaction.
      * Calls `POST /api/v1/fitness/admin/catalog` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: fitness:admin plus administrator role.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission fitness:admin; gateway enforces ACL metadata, local annotation itself is not a permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessImportCatalogPost(data: T.FitnessImportCatalogPostInput, options?: RequestOptions<T.FitnessImportCatalogPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessImportReceipt>, T.FitnessImportCatalogPostInput, {}>>;
+    fitnessImportCatalogPost(data: T.FitnessImportCatalogPostInput, options?: RequestOptions<T.FitnessImportCatalogPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessImportReceipt>, T.FitnessImportCatalogPostInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * As fitness admin, idempotently provision the main gym and Asset products. Validate manager/AI-coach profiles and required model/assistant choices; enabling requires a complete catalog.
      * Calls `POST /api/v1/fitness/admin/provision` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: fitness:admin plus administrator role.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission fitness:admin; gateway enforces ACL metadata, local annotation itself is not a permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessProvisionPost(data: T.FitnessProvisionPostInput, options?: RequestOptions<T.FitnessProvisionPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessGym>, import("./contracts.types.js").FitnessProvisionInput, {}>>;
+    fitnessProvisionPost(data: T.FitnessProvisionPostInput, options?: RequestOptions<T.FitnessProvisionPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessGym>, import("./contracts.types.js").FitnessProvisionInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read enabled catalog entries as an enabled member, manager or enabled main-gym coach. kind/category/name query filters apply, offset floors at zero, and at most 100 rows are returned.
      * Calls `GET /api/v1/fitness/catalog` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessListCatalogGet(params?: T.FitnessListCatalogGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessCatalogItem[]>, unknown, {}>>;
+    fitnessListCatalogGet(params?: T.FitnessListCatalogGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessCatalogItem[]>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * List enabled coaches and enabled published tariffs for the current enabled member gym, with bilingual coach_name.
      * Calls `GET /api/v1/fitness/coaches` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessCoachesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTariff[]>, unknown, {}>>;
+    fitnessCoachesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTariff[]>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read current enabled member entitled coaching context, active AI/trial plans, Full-scope profile and compact catalog. Does not accept a target user ID.
      * Calls `GET /api/v1/fitness/context` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessContextGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessContext>, unknown, {}>>;
+    fitnessContextGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessContext>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read the current enabled member intake draft, or null if no draft exists.
      * Calls `GET /api/v1/fitness/intake` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessIntakeGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessIntakeDraft | null>, unknown, {}>>;
+    fitnessIntakeGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessIntakeDraft | null>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Validate and save current member intake using expected_version; stale versions return 409 and no duplicate draft is created.
      * Calls `PUT /api/v1/fitness/intake` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessSaveIntakePut(data: T.FitnessSaveIntakePutInput, options?: RequestOptions<T.FitnessSaveIntakePutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessIntakeDraft>, import("./contracts.types.js").FitnessSaveDraftInput, {}>>;
+    fitnessSaveIntakePut(data: T.FitnessSaveIntakePutInput, options?: RequestOptions<T.FitnessSaveIntakePutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessIntakeDraft>, import("./contracts.types.js").FitnessSaveDraftInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read at most 100 unread current-user order events, newest first.
      * Calls `GET /api/v1/fitness/notifications` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessNotificationsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessEvent[]>, unknown, {}>>;
+    fitnessNotificationsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessEvent[]>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Mark a current-user order notification read; returns {read:true} even when no owned row matched.
      * Calls `POST /api/v1/fitness/notifications/{id}/read` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessReadNotificationPost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessReadReceipt>, unknown, {}>>;
+    fitnessReadNotificationPost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessReadReceipt>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * List up to 200 own/assigned/managed orders, or all orders for fitness admin; job_token and model_snapshot are withheld.
      * Calls `GET /api/v1/fitness/orders` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessOrdersGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder[]>, unknown, {}>>;
+    fitnessOrdersGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder[]>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Purchase at server-owned prices or selected human tariff. Idempotency UUID is scoped to the current member; conflicting reuse returns 422. Trial bundles consume explicit entitlement; paid orders create Payment transactions.
      * Calls `POST /api/v1/fitness/orders` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessPurchasePost(data: T.FitnessPurchasePostInput, options?: RequestOptions<T.FitnessPurchasePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder>, T.FitnessPurchasePostInput, {}>>;
+    fitnessPurchasePost(data: T.FitnessPurchasePostInput, options?: RequestOptions<T.FitnessPurchasePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder>, T.FitnessPurchasePostInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read an authorized order with current plan and pending proposals; owner, selected coach, gym manager or fitness admin may read.
      * Calls `GET /api/v1/fitness/orders/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessShowGetApiV1FitnessOrdersId(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder>, unknown, {}>>;
+    fitnessShowGetApiV1FitnessOrdersId(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Apply a versioned order transition: owner retry/retry_payment/refund, selected enabled coach accept/decline. Invalid transitions return 422; stale update returns 409.
      * Calls `POST /api/v1/fitness/orders/{id}/action` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessActionPost(id: Identifier, data: T.FitnessActionPostInput, options?: RequestOptions<T.FitnessActionPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder>, T.FitnessActionPostInput, {}>>;
+    fitnessActionPost(id: Identifier, data: T.FitnessActionPostInput, options?: RequestOptions<T.FitnessActionPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessOrder>, T.FitnessActionPostInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Assign and activate a validated human coaching plan as the selected enabled coach; base revision detects stale writes.
      * Calls `POST /api/v1/fitness/orders/{id}/plan` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessAssignPost(id: Identifier, data: T.FitnessAssignPostInput, options?: RequestOptions<T.FitnessAssignPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevisionReceipt>, import("./contracts.types.js").FitnessPlanInput, {}>>;
+    fitnessAssignPost(id: Identifier, data: T.FitnessAssignPostInput, options?: RequestOptions<T.FitnessAssignPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevisionReceipt>, import("./contracts.types.js").FitnessPlanInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read server-owned one-time plan prices in IRR and support credit quotas. Human tariffs and meal upgrades are separate workflows.
      * Calls `GET /api/v1/fitness/products` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessProductsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessProductOffer[]>, unknown, {}>>;
+    fitnessProductsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessProductOffer[]>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Validate a revision for an owned AI/trial order using base_revision_id; create a proposal without activating it.
      * Calls `POST /api/v1/fitness/proposals` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessProposePost(data: T.FitnessProposePostInput, options?: RequestOptions<T.FitnessProposePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevisionReceipt>, import("./contracts.types.js").FitnessProposalInput, {}>>;
+    fitnessProposePost(data: T.FitnessProposePostInput, options?: RequestOptions<T.FitnessProposePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevisionReceipt>, import("./contracts.types.js").FitnessProposalInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read a plan revision only after authorizing its owning order.
      * Calls `GET /api/v1/fitness/revisions/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessRevisionGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevision>, unknown, {}>>;
+    fitnessRevisionGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevision>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * As the order owner, accept a proposed revision using its base revision or reject it. Returns a revision receipt on accept and {status:rejected} on rejection.
      * Calls `POST /api/v1/fitness/revisions/{id}/review` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
     fitnessReviewPost(id: Identifier, data: T.FitnessReviewPostInput, options?: RequestOptions<T.FitnessReviewPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessRevisionReceipt | {
         status: "rejected";
-    }>, T.FitnessReviewPostInput, {}>>;
+    }>, T.FitnessReviewPostInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read current membership, active plans, manager flag, assistant ID, paid/trial chat balance and optional trial entitlement.
      * Calls `GET /api/v1/fitness/self` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessMeGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessSelf>, unknown, {}>>;
+    fitnessMeGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessSelf>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read the main gym configuration as its manager or fitness admin.
      * Calls `GET /api/v1/fitness/settings` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessSettingsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessGym>, unknown, {}>>;
+    fitnessSettingsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessGym>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Save manager model/STT/TTS selections after Chat validates them; expected_version detects stale configuration with 409.
      * Calls `PUT /api/v1/fitness/settings` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessSaveSettingsPut(data: T.FitnessSaveSettingsPutInput, options?: RequestOptions<T.FitnessSaveSettingsPutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessGym>, import("./contracts.types.js").FitnessSettingsInput, {}>>;
+    fitnessSaveSettingsPut(data: T.FitnessSaveSettingsPutInput, options?: RequestOptions<T.FitnessSaveSettingsPutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessGym>, import("./contracts.types.js").FitnessSettingsInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * As manager or the selected coach, validate and version a tariff and publish its Asset product. Expected-version conflicts return 409.
      * Calls `POST /api/v1/fitness/tariffs` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessSaveTariffPost(data: T.FitnessSaveTariffPostInput, options?: RequestOptions<T.FitnessSaveTariffPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTariff>, import("./contracts.types.js").FitnessTariffInput, {}>>;
+    fitnessSaveTariffPost(data: T.FitnessSaveTariffPostInput, options?: RequestOptions<T.FitnessSaveTariffPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTariff>, import("./contracts.types.js").FitnessTariffInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read the manager gym coach roster with profile names and tariff snapshots.
      * Calls `GET /api/v1/fitness/team` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessTeamGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessCoach[]>, unknown, {}>>;
+    fitnessTeamGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessCoach[]>, unknown, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * As manager, enroll/disable a coach within the same gym after verifying a Profile exists; the AI coach cannot be assigned here.
      * Calls `PUT /api/v1/fitness/team` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessSaveCoachPut(data: T.FitnessSaveCoachPutInput, options?: RequestOptions<T.FitnessSaveCoachPutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessCoach>, T.FitnessSaveCoachPutInput, {}>>;
+    fitnessSaveCoachPut(data: T.FitnessSaveCoachPutInput, options?: RequestOptions<T.FitnessSaveCoachPutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessCoach>, T.FitnessSaveCoachPutInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Redeem a valid gift for an eligible verified new gym member. Returns frozen trial entitlement; duplicate same-gift redemption reuses it, other prior trials are rejected.
      * Calls `POST /api/v1/fitness/trial/redeem` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessRedeemPost(data: T.FitnessRedeemPostInput, options?: RequestOptions<T.FitnessRedeemPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrial>, T.FitnessRedeemPostInput, {}>>;
+    fitnessRedeemPost(data: T.FitnessRedeemPostInput, options?: RequestOptions<T.FitnessRedeemPostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrial>, T.FitnessRedeemPostInput, {}, any>>;
     /**
-     * Use the paid coaching workflow with server-owned prices, membership and revision checks. Reuse idempotency keys for purchases; stale versions return 409, unauthorized relationships return 403.
+     * Read model/STT/TTS choices and version as an enabled member or manager; payment is not required.
      * Calls `GET /api/v1/fitness/voice-settings` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated gym membership, manager/coach relationship or owned order as required by the operation.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check; operation also enforces its current-member/order/coach/manager role as documented.
      */
-    fitnessVoiceSettingsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessVoiceSettings>, unknown, {}>>;
+    fitnessVoiceSettingsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessVoiceSettings>, unknown, {}, any>>;
     /**
-     * Performs the identity operation for the option capability.
+     * Read the current gateway identity profile using Get-scope property/service visibility.
      * Calls `GET /api/v1/identity` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    optionIdentityGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.OptionIdentityGetResponse, unknown, {}>>;
+    optionIdentityGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.OptionIdentityGetResponse, unknown, {}, any>>;
     /**
-     * Performs the integration docs show operation for the integration capability.
+     * Read HTTP integration metadata and SDK snippets; optional direct transport fields are omitted when absent.
      * Calls `GET /api/v1/integration/docs` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: admin:integration:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission admin:integration:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    integrationIntegrationDocsShowGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.IntegrationIntegrationDocsShowGetResponse, unknown, {}>>;
+    integrationIntegrationDocsShowGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.IntegrationIntegrationDocsShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the flow integration show operation for the integration capability.
+     * Read the broker queue and event payload field metadata for Profile Flow integration; this does not execute workflows.
      * Calls `GET /api/v1/integration/flow` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    integrationFlowIntegrationShowGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.IntegrationFlowIntegrationShowGetResponse, unknown, {}>>;
+    integrationFlowIntegrationShowGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.IntegrationFlowIntegrationShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the reserve operation for the fitness capability.
+     * Reserve one response credit for a trusted Chat turn. Locks quota, checks user/turn binding, consumes paid grant or trial balance, and creates a fifteen-minute reservation lease.
      * Calls `POST /api/v1/internal/fitness-chat/reserve` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: server-only product trial-gift or fitness-chat bearer credential; never browser administration.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dedicated FITNESS_CHAT_TOKEN Bearer service credential; user IDP credentials do not satisfy this guard.
      */
-    fitnessReservePost(data: T.FitnessReservePostInput, options?: RequestOptions<T.FitnessReservePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessReserveReceipt>, T.FitnessReservePostInput, {}>>;
+    fitnessReservePost(data: T.FitnessReservePostInput, options?: RequestOptions<T.FitnessReservePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessReserveReceipt>, T.FitnessReservePostInput, {}, any>>;
     /**
-     * Performs the settle operation for the fitness capability.
+     * Settle a trusted Chat turn with required success: consume a reserved response on success or refund once on failure; already-settled turns are idempotent.
      * Calls `POST /api/v1/internal/fitness-chat/settle` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: server-only product trial-gift or fitness-chat bearer credential; never browser administration.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dedicated FITNESS_CHAT_TOKEN Bearer service credential; user IDP credentials do not satisfy this guard.
      */
-    fitnessSettlePost(data: T.FitnessSettlePostInput, options?: RequestOptions<T.FitnessSettlePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessSettleReceipt>, T.FitnessSettlePostInput, {}>>;
+    fitnessSettlePost(data: T.FitnessSettlePostInput, options?: RequestOptions<T.FitnessSettlePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessSettleReceipt>, T.FitnessSettlePostInput, {}, any>>;
     /**
-     * Performs the list operation for the fitness capability.
+     * Read Asset-only trial gifts with page/per_page/search. Defaults 1/25, size caps at 100, page at 100000, and search length at 200. Token hashes are withheld.
      * Calls `GET /api/v1/internal/plans/gifts` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: server-only product trial-gift or fitness-chat bearer credential; never browser administration.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dedicated PRODUCT_TRIAL_GIFT_SERVICE_TOKEN Bearer service credential; intended for Asset adapter.
      */
-    fitnessListGet(params?: T.FitnessListGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGiftPage>, unknown, {}>>;
+    fitnessListGet(params?: T.FitnessListGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGiftPage>, unknown, {}, any>>;
     /**
-     * Performs the create operation for the fitness capability.
+     * Create an Asset-only gift idempotently by request_id and created_by. Limits require responses 1–59/plans 1–2; token is returned only on initial creation.
      * Calls `POST /api/v1/internal/plans/gifts` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: server-only product trial-gift or fitness-chat bearer credential; never browser administration.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dedicated PRODUCT_TRIAL_GIFT_SERVICE_TOKEN Bearer service credential; intended for Asset adapter.
      */
-    fitnessCreatePost(data: T.FitnessCreatePostInput, options?: RequestOptions<T.FitnessCreatePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGift>, import("./contracts.types.js").FitnessGiftCreateInput, {}>>;
+    fitnessCreatePost(data: T.FitnessCreatePostInput, options?: RequestOptions<T.FitnessCreatePostInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGift>, import("./contracts.types.js").FitnessGiftCreateInput, {}, any>>;
     /**
-     * Performs the show operation for the fitness capability.
+     * Read an Asset-only gift record without its token hash.
      * Calls `GET /api/v1/internal/plans/gifts/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: server-only product trial-gift or fitness-chat bearer credential; never browser administration.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dedicated PRODUCT_TRIAL_GIFT_SERVICE_TOKEN Bearer service credential; intended for Asset adapter.
      */
-    fitnessShowGetApiV1InternalPlansGiftsId(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGift>, unknown, {}>>;
+    fitnessShowGetApiV1InternalPlansGiftsId(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGift>, unknown, {}, any>>;
     /**
-     * Performs the update operation for the fitness capability.
+     * Edit future gift redemption settings; existing entitlement remains frozen. max_uses cannot fall below used_count; token rotation is rejected after first redemption.
      * Calls `PUT /api/v1/internal/plans/gifts/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: server-only product trial-gift or fitness-chat bearer credential; never browser administration.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: dedicated PRODUCT_TRIAL_GIFT_SERVICE_TOKEN Bearer service credential; intended for Asset adapter.
      */
-    fitnessUpdatePut(id: Identifier, data: T.FitnessUpdatePutInput, options?: RequestOptions<T.FitnessUpdatePutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGift>, import("./contracts.types.js").FitnessGiftUpdateInput, {}>>;
+    fitnessUpdatePut(id: Identifier, data: T.FitnessUpdatePutInput, options?: RequestOptions<T.FitnessUpdatePutInput>): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ApiEnvelope<import("./contracts.types.js").FitnessTrialGift>, import("./contracts.types.js").FitnessGiftUpdateInput, {}, any>>;
     /**
-     * Performs the store operation for the log action capability.
+     * Insert an action/meta audit row and return its stored ID/timestamp. meta is arbitrary JSON.
      * Calls `POST /api/v1/log-action` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: log_action:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission log_action:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    logActionStorePost(data: T.LogActionStorePostInput, options?: RequestOptions<T.LogActionStorePostInput>): Promise<import("axios").AxiosResponse<T.LogActionStorePostResponse, T.LogActionStorePostInput, {}>>;
+    logActionStorePost(data: T.LogActionStorePostInput, options?: RequestOptions<T.LogActionStorePostInput>): Promise<import("axios").AxiosResponse<T.LogActionStorePostResponse, T.LogActionStorePostInput, {}, any>>;
     /**
-     * Performs the store slug operation for the log action capability.
+     * Insert an audit row with the path slug overriding request action; metadata remains arbitrary JSON.
      * Calls `POST /api/v1/log-action/{slug}` through the shared IDP-aware Faiber client.
      * @param slug Backend path identifier `slug`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: log_action:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission log_action:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    logActionStoreSlugPost(slug: Identifier, data: T.LogActionStoreSlugPostInput, options?: RequestOptions<T.LogActionStoreSlugPostInput>): Promise<import("axios").AxiosResponse<T.LogActionStoreSlugPostResponse, T.LogActionStoreSlugPostInput, {}>>;
+    logActionStoreSlugPost(slug: Identifier, data: T.LogActionStoreSlugPostInput, options?: RequestOptions<T.LogActionStoreSlugPostInput>): Promise<import("axios").AxiosResponse<T.LogActionStoreSlugPostResponse, T.LogActionStoreSlugPostInput, {}, any>>;
     /**
-     * Performs the store direct operation for the log action capability.
+     * Insert an audit row through the public direct mount with the path slug overriding request action.
      * Calls `POST /api/v1/log-action/direct/{slug}` through the shared IDP-aware Faiber client.
      * @param slug Backend path identifier `slug`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    logActionStoreDirectPost(slug: Identifier, data: T.LogActionStoreDirectPostInput, options?: RequestOptions<T.LogActionStoreDirectPostInput>): Promise<import("axios").AxiosResponse<T.LogActionStoreDirectPostResponse, T.LogActionStoreDirectPostInput, {}>>;
+    logActionStoreDirectPost(slug: Identifier, data: T.LogActionStoreDirectPostInput, options?: RequestOptions<T.LogActionStoreDirectPostInput>): Promise<import("axios").AxiosResponse<T.LogActionStoreDirectPostResponse, T.LogActionStoreDirectPostInput, {}, any>>;
     /**
-     * Performs the index operation for the logger capability.
+     * Read all stored audit logs without pagination; local router has no authentication middleware. request/response/meta remain arbitrary JSON.
      * Calls `GET /api/v1/logger` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    loggerIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LoggerIndexGetResponse, unknown, {}>>;
+    loggerIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LoggerIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the logger capability.
+     * Read a stored audit log by UUID; missing row returns data:null.
      * Calls `GET /api/v1/logger/{log}` through the shared IDP-aware Faiber client.
      * @param log Backend path identifier `log`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    loggerShowGet(log: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LoggerShowGetResponse, unknown, {}>>;
+    loggerShowGet(log: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LoggerShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the parent children get operation for the option capability.
+     * Read children for parent user_ids, merging legacy links with active parent/child relation types and deduplicating pairs. The local mount is public.
      * Calls `POST /api/v1/parent/children/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    optionParentChildrenGetPost(data: T.OptionParentChildrenGetPostInput, options?: RequestOptions<T.OptionParentChildrenGetPostInput>): Promise<import("axios").AxiosResponse<T.OptionParentChildrenGetPostResponse, T.OptionParentChildrenGetPostInput, {}>>;
+    optionParentChildrenGetPost(data: T.OptionParentChildrenGetPostInput, options?: RequestOptions<T.OptionParentChildrenGetPostInput>): Promise<import("axios").AxiosResponse<T.OptionParentChildrenGetPostResponse, T.OptionParentChildrenGetPostInput, {}, any>>;
     /**
-     * Performs the parent get operation for the option capability.
+     * Read legacy parent-link rows for student user_ids. The local mount is public.
      * Calls `POST /api/v1/parent/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    optionParentGetPost(data: T.OptionParentGetPostInput, options?: RequestOptions<T.OptionParentGetPostInput>): Promise<import("axios").AxiosResponse<T.OptionParentGetPostResponse, T.OptionParentGetPostInput, {}>>;
+    optionParentGetPost(data: T.OptionParentGetPostInput, options?: RequestOptions<T.OptionParentGetPostInput>): Promise<import("axios").AxiosResponse<T.OptionParentGetPostResponse, T.OptionParentGetPostInput, {}, any>>;
     /**
-     * Performs the index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles.
      * Calls `GET /api/v1/profile` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: /api/v1/profile, profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileIndexGet(params?: T.ProfileIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileIndexGetResponse, unknown, {}>>;
+    profileIndexGet(params?: T.ProfileIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the avatar show operation for the profile capability.
+     * Read binary image or private media bytes. Required key must belong to the supplied owner UUID and must not contain traversal; 403 rejects unsafe keys, 404 means the object is unavailable. Returns raw bytes with service Content-Type and Cache-Control headers.
      * Calls `GET /api/v1/profile-media/{uuid}/avatar` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: public read; key restricted to requested owner UUID.
      */
-    profileAvatarShowGetApiV1ProfileMediaUuidAvatar(uuid: Identifier, params?: T.ProfileAvatarShowGetApiV1ProfileMediaUuidAvatarQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAvatarShowGetApiV1ProfileMediaUuidAvatarResponse, unknown, {}>>;
+    profileAvatarShowGetApiV1ProfileMediaUuidAvatar(uuid: Identifier, params: T.ProfileAvatarShowGetApiV1ProfileMediaUuidAvatarQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAvatarShowGetApiV1ProfileMediaUuidAvatarResponse, unknown, {}, any>>;
     /**
-     * Performs the index operation for the profile property capability.
+     * Read binary image or private media bytes. Required key must belong to the supplied owner UUID and must not contain traversal; 403 rejects unsafe keys, 404 means the object is unavailable. Returns raw bytes with service Content-Type and Cache-Control headers.
+     * Calls `GET /api/v1/profile-media/{uuid}/images` through the shared IDP-aware Faiber client.
+     * @param uuid Backend path identifier `uuid`.
+     * @param params Typed query parameters; omitted members retain backend defaults.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: public read; key restricted to requested owner UUID.
+     */
+    profileImageShowGet(uuid: Identifier, params: T.ProfileImageShowGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileImageShowGetResponse, unknown, {}, any>>;
+    /**
+     * List the property definition records. List pagination defaults 1/15 and caps at 100; filters apply before pagination, and deleted records are hidden unless filter[trashed]=only/with.
      * Calls `GET /api/v1/profile-property-definition` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyIndexGet(params?: T.ProfilePropertyIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyIndexGetResponse, unknown, {}>>;
+    profilePropertyIndexGet(params?: T.ProfilePropertyIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the profile property capability.
+     * Create the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `POST /api/v1/profile-property-definition` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyStorePost(data: T.ProfilePropertyStorePostInput, options?: RequestOptions<T.ProfilePropertyStorePostInput>): Promise<import("axios").AxiosResponse<T.ProfilePropertyStorePostResponse, T.ProfilePropertyStorePostInput, {}>>;
+    profilePropertyStorePost(data: T.ProfilePropertyStorePostInput, options?: RequestOptions<T.ProfilePropertyStorePostInput>): Promise<import("axios").AxiosResponse<T.ProfilePropertyStorePostResponse, T.ProfilePropertyStorePostInput, {}, any>>;
     /**
-     * Performs the destroy operation for the profile property capability.
+     * Soft-delete the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/profile-property-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyDestroyDeleteResponse, unknown, {}>>;
+    profilePropertyDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the profile property capability.
+     * Read the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/profile-property-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyShowGetResponse, unknown, {}>>;
+    profilePropertyShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the profile property capability.
+     * Update supplied fields on the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PATCH /api/v1/profile-property-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyUpdatePatch(id: Identifier, data: T.ProfilePropertyUpdatePatchInput, options?: RequestOptions<T.ProfilePropertyUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.ProfilePropertyUpdatePatchResponse, T.ProfilePropertyUpdatePatchInput, {}>>;
+    profilePropertyUpdatePatch(id: Identifier, data: T.ProfilePropertyUpdatePatchInput, options?: RequestOptions<T.ProfilePropertyUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.ProfilePropertyUpdatePatchResponse, T.ProfilePropertyUpdatePatchInput, {}, any>>;
     /**
-     * Performs the update operation for the profile property capability.
+     * Update supplied fields on the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PUT /api/v1/profile-property-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyUpdatePut(id: Identifier, data: T.ProfilePropertyUpdatePutInput, options?: RequestOptions<T.ProfilePropertyUpdatePutInput>): Promise<import("axios").AxiosResponse<T.ProfilePropertyUpdatePutResponse, T.ProfilePropertyUpdatePutInput, {}>>;
+    profilePropertyUpdatePut(id: Identifier, data: T.ProfilePropertyUpdatePutInput, options?: RequestOptions<T.ProfilePropertyUpdatePutInput>): Promise<import("axios").AxiosResponse<T.ProfilePropertyUpdatePutResponse, T.ProfilePropertyUpdatePutInput, {}, any>>;
     /**
-     * Performs the force destroy operation for the profile property capability.
+     * Permanently delete the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/profile-property-definition/force/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:force_delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:force_delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyForceDestroyDeleteResponse, unknown, {}>>;
+    profilePropertyForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyForceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the restore operation for the profile property capability.
+     * Restore the property definition record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/profile-property-definition/undo/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile_property_definition:restore.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile_property_definition:restore; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profilePropertyRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyRestoreGetResponse, unknown, {}>>;
+    profilePropertyRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfilePropertyRestoreGetResponse, unknown, {}, any>>;
     /**
-     * Performs the show profile referral operation for the referral capability.
+     * Read the raw Profile row by local Profile UUID; this is not the shaped public profile response.
      * Calls `GET /api/v1/profile-referral/{profile_id}` through the shared IDP-aware Faiber client.
      * @param profileId Backend path identifier `profile_id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralShowProfileReferralGet(profileId: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralShowProfileReferralGetResponse, unknown, {}>>;
+    referralShowProfileReferralGet(profileId: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralShowProfileReferralGetResponse, unknown, {}, any>>;
     /**
-     * Performs the assign operation for the referral capability.
+     * Replace referral source/referrer by local Profile UUID; null/omitted fields clear them. Reject self/cyclic referrals, chains beyond 64 levels and inactive/missing sources or referrers.
      * Calls `PUT /api/v1/profile-referral/{profile_id}` through the shared IDP-aware Faiber client.
      * @param profileId Backend path identifier `profile_id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralAssignPut(profileId: Identifier, data: T.ReferralAssignPutInput, options?: RequestOptions<T.ReferralAssignPutInput>): Promise<import("axios").AxiosResponse<T.ReferralAssignPutResponse, T.ReferralAssignPutInput, {}>>;
+    referralAssignPut(profileId: Identifier, data: T.ReferralAssignPutInput, options?: RequestOptions<T.ReferralAssignPutInput>): Promise<import("axios").AxiosResponse<T.ReferralAssignPutResponse, T.ReferralAssignPutInput, {}, any>>;
     /**
-     * Performs the list relations operation for the relation capability.
+     * List relations by optional endpoint profile_id and active flag, newest first.
      * Calls `GET /api/v1/profile-relation` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationListRelationsGet(params?: T.RelationListRelationsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationListRelationsGetResponse, unknown, {}>>;
+    relationListRelationsGet(params?: T.RelationListRelationsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationListRelationsGetResponse, unknown, {}, any>>;
     /**
-     * Performs the create relation operation for the relation capability.
+     * Create relation plus managed inverse atomically after active-type, endpoint, self-link and cardinality/status constraint checks. Returns one or two rows.
      * Calls `POST /api/v1/profile-relation` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationCreateRelationPost(data: T.RelationCreateRelationPostInput, options?: RequestOptions<T.RelationCreateRelationPostInput>): Promise<import("axios").AxiosResponse<T.RelationCreateRelationPostResponse, T.RelationCreateRelationPostInput, {}>>;
+    relationCreateRelationPost(data: T.RelationCreateRelationPostInput, options?: RequestOptions<T.RelationCreateRelationPostInput>): Promise<import("axios").AxiosResponse<T.RelationCreateRelationPostResponse, import("./wire.types.js").ProfileRelationInput, {}, any>>;
     /**
-     * Performs the delete relation operation for the relation capability.
+     * Permanently delete a relation and its inverse atomically.
      * Calls `DELETE /api/v1/profile-relation/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationDeleteRelationDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationDeleteRelationDeleteResponse, unknown, {}>>;
+    relationDeleteRelationDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationDeleteRelationDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show relation operation for the relation capability.
+     * Read a relation by UUID.
      * Calls `GET /api/v1/profile-relation/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationShowRelationGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationShowRelationGetResponse, unknown, {}>>;
+    relationShowRelationGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationShowRelationGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update relation operation for the relation capability.
+     * Update object metadata/active flag on a relation and its managed inverse atomically; returns updated rows.
      * Calls `PUT /api/v1/profile-relation/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationUpdateRelationPut(id: Identifier, data: T.RelationUpdateRelationPutInput, options?: RequestOptions<T.RelationUpdateRelationPutInput>): Promise<import("axios").AxiosResponse<T.RelationUpdateRelationPutResponse, T.RelationUpdateRelationPutInput, {}>>;
+    relationUpdateRelationPut(id: Identifier, data: T.RelationUpdateRelationPutInput, options?: RequestOptions<T.RelationUpdateRelationPutInput>): Promise<import("axios").AxiosResponse<T.RelationUpdateRelationPutResponse, import("./wire.types.js").ProfileRelationUpdateInput, {}, any>>;
     /**
-     * Performs the delete parent operation for the profile capability.
+     * Delete matching legacy student/parent IDP UUID links and return an empty acknowledgement.
      * Calls `DELETE /api/v1/profile/{student_uuid}/delete/parent/{parent_uuid}` through the shared IDP-aware Faiber client.
      * @param studentUuid Backend path identifier `student_uuid`.
      * @param parentUuid Backend path identifier `parent_uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileDeleteParentDelete(studentUuid: Identifier, parentUuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDeleteParentDeleteResponse, unknown, {}>>;
+    profileDeleteParentDelete(studentUuid: Identifier, parentUuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDeleteParentDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the destroy operation for the profile capability.
+     * Soft-delete a profile by IDP user UUID; returns an empty acknowledgement.
      * Calls `DELETE /api/v1/profile/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileDestroyDelete(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDestroyDeleteResponse, unknown, {}>>;
+    profileDestroyDelete(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the profile capability.
+     * Read a profile by IDP user UUID first, falling back to local Profile UUID; return Get-scope properties/services and Office/LMS projections.
      * Calls `GET /api/v1/profile/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileShowGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileShowGetResponse, unknown, {}>>;
+    profileShowGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the profile capability.
+     * Atomically patch profile scalars, app/meta and validated properties, then rebuild search. Resolves IDP user UUID first and local Profile UUID second. Omission preserves values; job:null clears, while other nullable scalar nulls deserialize as omission in this pinned model.
      * Calls `PATCH /api/v1/profile/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdatePatch(uuid: Identifier, data: T.ProfileUpdatePatchInput, options?: RequestOptions<T.ProfileUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePatchResponse, T.ProfileUpdatePatchInput, {}>>;
+    profileUpdatePatch(uuid: Identifier, data: T.ProfileUpdatePatchInput, options?: RequestOptions<T.ProfileUpdatePatchInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdatePatchInput, {}, any>>;
     /**
-     * Performs the show admin operation for the profile capability.
+     * Read an admin profile by IDP user UUID with admin-visible properties and trusted service data.
      * Calls `GET /api/v1/profile/{uuid}/admin` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read_admin.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_admin; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileShowAdminGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileShowAdminGetResponse, unknown, {}>>;
+    profileShowAdminGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, unknown, {}, any>>;
     /**
-     * Performs the avatar delete operation for the profile capability.
+     * Clear the owned/authorized user avatar reference and attempt object cleanup; returns an empty acknowledgement.
      * Calls `DELETE /api/v1/profile/{uuid}/avatar` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    profileAvatarDeleteDelete(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAvatarDeleteDeleteResponse, unknown, {}>>;
+    profileAvatarDeleteDelete(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAvatarDeleteDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the avatar show operation for the profile capability.
+     * Read binary image or private media bytes. Required key must belong to the supplied owner UUID and must not contain traversal; 403 rejects unsafe keys, 404 means the object is unavailable. Returns raw bytes with service Content-Type and Cache-Control headers.
      * Calls `GET /api/v1/profile/{uuid}/avatar` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: public read; key restricted to requested owner UUID.
      */
-    profileAvatarShowGetApiV1ProfileUuidAvatar(uuid: Identifier, params?: T.ProfileAvatarShowGetApiV1ProfileUuidAvatarQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAvatarShowGetApiV1ProfileUuidAvatarResponse, unknown, {}>>;
+    profileAvatarShowGetApiV1ProfileUuidAvatar(uuid: Identifier, params: T.ProfileAvatarShowGetApiV1ProfileUuidAvatarQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAvatarShowGetApiV1ProfileUuidAvatarResponse, unknown, {}, any>>;
     /**
-     * Performs the avatar store operation for the profile capability.
+     * Upload the multipart file field as JPEG, PNG or WebP (up to 5 MiB). Returns url and key; 413 rejects oversize, 415 unsupported media, 422 absent/empty file, and 503 unconfigured storage.
      * Calls `POST /api/v1/profile/{uuid}/avatar` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed multipart form.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated target user or profile:update permission.
      */
-    profileAvatarStorePost(uuid: Identifier, data: T.ProfileAvatarStorePostInput, options?: RequestOptions<T.ProfileAvatarStorePostInput>): Promise<import("axios").AxiosResponse<T.ProfileAvatarStorePostResponse, FormData, {}>>;
+    profileAvatarStorePost(uuid: Identifier, data: T.ProfileAvatarStorePostInput, options?: RequestOptions<T.ProfileAvatarStorePostInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileMediaResponse, FormData, {}, any>>;
     /**
-     * Performs the delete address operation for the profile capability.
+     * Delete an address by exact title and IDP user UUID; returns an empty acknowledgement even if the title has no row.
      * Calls `DELETE /api/v1/profile/{uuid}/delete/address/{title}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param title Backend path identifier `title`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileDeleteAddressDelete(uuid: Identifier, title: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDeleteAddressDeleteResponse, unknown, {}>>;
+    profileDeleteAddressDelete(uuid: Identifier, title: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDeleteAddressDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the update employee type operation for the profile capability.
+     * Set employee_type for an IDP user UUID and return the Get-scope profile.
      * Calls `PATCH /api/v1/profile/{uuid}/employee-type` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update_employee_type.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update_employee_type; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdateEmployeeTypePatch(uuid: Identifier, data: T.ProfileUpdateEmployeeTypePatchInput, options?: RequestOptions<T.ProfileUpdateEmployeeTypePatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdateEmployeeTypePatchResponse, T.ProfileUpdateEmployeeTypePatchInput, {}>>;
+    profileUpdateEmployeeTypePatch(uuid: Identifier, data: T.ProfileUpdateEmployeeTypePatchInput, options?: RequestOptions<T.ProfileUpdateEmployeeTypePatchInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdateEmployeeTypePatchInput, {}, any>>;
     /**
-     * Performs the update employee type operation for the profile capability.
+     * Set employee_type for an IDP user UUID and return the Get-scope profile.
      * Calls `PUT /api/v1/profile/{uuid}/employee-type` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update_employee_type.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update_employee_type; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdateEmployeeTypePut(uuid: Identifier, data: T.ProfileUpdateEmployeeTypePutInput, options?: RequestOptions<T.ProfileUpdateEmployeeTypePutInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdateEmployeeTypePutResponse, T.ProfileUpdateEmployeeTypePutInput, {}>>;
+    profileUpdateEmployeeTypePut(uuid: Identifier, data: T.ProfileUpdateEmployeeTypePutInput, options?: RequestOptions<T.ProfileUpdateEmployeeTypePutInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdateEmployeeTypePutInput, {}, any>>;
     /**
-     * Performs the update freemium operation for the profile capability.
+     * Set freemium_session_limit for an IDP user UUID and return the Get-scope profile.
      * Calls `PATCH /api/v1/profile/{uuid}/freemium-session-limit` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:freemium_session_limit.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:freemium_session_limit; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdateFreemiumPatch(uuid: Identifier, data: T.ProfileUpdateFreemiumPatchInput, options?: RequestOptions<T.ProfileUpdateFreemiumPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdateFreemiumPatchResponse, T.ProfileUpdateFreemiumPatchInput, {}>>;
+    profileUpdateFreemiumPatch(uuid: Identifier, data: T.ProfileUpdateFreemiumPatchInput, options?: RequestOptions<T.ProfileUpdateFreemiumPatchInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdateFreemiumPatchInput, {}, any>>;
     /**
-     * Performs the update freemium operation for the profile capability.
+     * Set freemium_session_limit for an IDP user UUID and return the Get-scope profile.
      * Calls `PUT /api/v1/profile/{uuid}/freemium-session-limit` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:freemium_session_limit.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:freemium_session_limit; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdateFreemiumPut(uuid: Identifier, data: T.ProfileUpdateFreemiumPutInput, options?: RequestOptions<T.ProfileUpdateFreemiumPutInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdateFreemiumPutResponse, T.ProfileUpdateFreemiumPutInput, {}>>;
+    profileUpdateFreemiumPut(uuid: Identifier, data: T.ProfileUpdateFreemiumPutInput, options?: RequestOptions<T.ProfileUpdateFreemiumPutInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdateFreemiumPutInput, {}, any>>;
     /**
-     * Performs the show full operation for the profile capability.
+     * Read by IDP user UUID or fallback Profile UUID with Full-scope properties/services and Office/LMS projections.
      * Calls `GET /api/v1/profile/{uuid}/full` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
+     */
+    profileShowFullGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, unknown, {}, any>>;
+    /**
+     * Upload the multipart file field as JPEG, PNG or WebP (up to 5 MiB). Returns url and key; 413 rejects oversize, 415 unsupported media, 422 absent/empty file, and 503 unconfigured storage.
+     * Calls `POST /api/v1/profile/{uuid}/images` through the shared IDP-aware Faiber client.
+     * @param uuid Backend path identifier `uuid`.
+     * @param data Typed multipart form.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated target user or profile:update permission.
      */
-    profileShowFullGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileShowFullGetResponse, unknown, {}>>;
+    profileImageStorePost(uuid: Identifier, data: T.ProfileImageStorePostInput, options?: RequestOptions<T.ProfileImageStorePostInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileMediaResponse, FormData, {}, any>>;
     /**
-     * Performs the media show operation for the profile capability.
+     * Read binary image or private media bytes. Required key must belong to the supplied owner UUID and must not contain traversal; 403 rejects unsafe keys, 404 means the object is unavailable. Returns raw bytes with service Content-Type and Cache-Control headers.
      * Calls `GET /api/v1/profile/{uuid}/media` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: authenticated IDP context; key restricted to requested profile UUID.
      */
-    profileMediaShowGet(uuid: Identifier, params?: T.ProfileMediaShowGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileMediaShowGetResponse, unknown, {}>>;
+    profileMediaShowGet(uuid: Identifier, params: T.ProfileMediaShowGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileMediaShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update properties operation for the profile capability.
+     * Validate active configured properties, update them atomically and rebuild search. Returns updated_keys and array-item added/removed IDs and counts; unknown/inactive keys return 422.
      * Calls `PATCH /api/v1/profile/{uuid}/properties` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdatePropertiesPatch(uuid: Identifier, data: T.ProfileUpdatePropertiesPatchInput, options?: RequestOptions<T.ProfileUpdatePropertiesPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePropertiesPatchResponse, T.ProfileUpdatePropertiesPatchInput, {}>>;
+    profileUpdatePropertiesPatch(uuid: Identifier, data: T.ProfileUpdatePropertiesPatchInput, options?: RequestOptions<T.ProfileUpdatePropertiesPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePropertiesPatchResponse, T.ProfileUpdatePropertiesPatchInput, {}, any>>;
     /**
-     * Performs the update properties operation for the profile capability.
+     * Validate active configured properties, update them atomically and rebuild search. Returns updated_keys and array-item added/removed IDs and counts; unknown/inactive keys return 422.
      * Calls `PUT /api/v1/profile/{uuid}/properties` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdatePropertiesPut(uuid: Identifier, data: T.ProfileUpdatePropertiesPutInput, options?: RequestOptions<T.ProfileUpdatePropertiesPutInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePropertiesPutResponse, T.ProfileUpdatePropertiesPutInput, {}>>;
+    profileUpdatePropertiesPut(uuid: Identifier, data: T.ProfileUpdatePropertiesPutInput, options?: RequestOptions<T.ProfileUpdatePropertiesPutInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePropertiesPutResponse, T.ProfileUpdatePropertiesPutInput, {}, any>>;
     /**
-     * Performs the update status operation for the profile capability.
+     * Set status for an IDP user UUID and return the Get-scope profile.
      * Calls `PATCH /api/v1/profile/{uuid}/status` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update_status.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update_status; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdateStatusPatch(uuid: Identifier, data: T.ProfileUpdateStatusPatchInput, options?: RequestOptions<T.ProfileUpdateStatusPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdateStatusPatchResponse, T.ProfileUpdateStatusPatchInput, {}>>;
+    profileUpdateStatusPatch(uuid: Identifier, data: T.ProfileUpdateStatusPatchInput, options?: RequestOptions<T.ProfileUpdateStatusPatchInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdateStatusPatchInput, {}, any>>;
     /**
-     * Performs the update status operation for the profile capability.
+     * Set status for an IDP user UUID and return the Get-scope profile.
      * Calls `PUT /api/v1/profile/{uuid}/status` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update_status.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update_status; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdateStatusPut(uuid: Identifier, data: T.ProfileUpdateStatusPutInput, options?: RequestOptions<T.ProfileUpdateStatusPutInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdateStatusPutResponse, T.ProfileUpdateStatusPutInput, {}>>;
+    profileUpdateStatusPut(uuid: Identifier, data: T.ProfileUpdateStatusPutInput, options?: RequestOptions<T.ProfileUpdateStatusPutInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdateStatusPutInput, {}, any>>;
     /**
-     * Performs the accountant index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to accountant.
      * Calls `GET /api/v1/profile/accountant` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_accountant; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAccountantIndexGet(params?: T.ProfileAccountantIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileAccountantIndexGetResponse, unknown, {}>>;
+    profileAccountantIndexGet(params?: T.ProfileAccountantIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the add address operation for the profile capability.
+     * Replace the address with the same title for an IDP user UUID in a transaction; blank titles return 422. Returns an empty acknowledgement.
      * Calls `PATCH /api/v1/profile/add/address/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddAddressPatch(uuid: Identifier, data: T.ProfileAddAddressPatchInput, options?: RequestOptions<T.ProfileAddAddressPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAddressPatchResponse, T.ProfileAddAddressPatchInput, {}>>;
+    profileAddAddressPatch(uuid: Identifier, data: T.ProfileAddAddressPatchInput, options?: RequestOptions<T.ProfileAddAddressPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAddressPatchResponse, T.ProfileAddAddressPatchInput, {}, any>>;
     /**
-     * Performs the add address operation for the profile capability.
+     * Replace the address with the same title for an IDP user UUID in a transaction; blank titles return 422. Returns an empty acknowledgement.
      * Calls `PUT /api/v1/profile/add/address/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddAddressPut(uuid: Identifier, data: T.ProfileAddAddressPutInput, options?: RequestOptions<T.ProfileAddAddressPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAddressPutResponse, T.ProfileAddAddressPutInput, {}>>;
+    profileAddAddressPut(uuid: Identifier, data: T.ProfileAddAddressPutInput, options?: RequestOptions<T.ProfileAddAddressPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAddressPutResponse, T.ProfileAddAddressPutInput, {}, any>>;
     /**
-     * Performs the add app operation for the profile capability.
+     * Replace schema-free app JSON for an IDP user UUID and return an empty acknowledgement.
      * Calls `PATCH /api/v1/profile/add/app/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddAppPatch(uuid: Identifier, data: T.ProfileAddAppPatchInput, options?: RequestOptions<T.ProfileAddAppPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAppPatchResponse, T.ProfileAddAppPatchInput, {}>>;
+    profileAddAppPatch(uuid: Identifier, data: T.ProfileAddAppPatchInput, options?: RequestOptions<T.ProfileAddAppPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAppPatchResponse, T.ProfileAddAppPatchInput, {}, any>>;
     /**
-     * Performs the add app operation for the profile capability.
+     * Replace schema-free app JSON for an IDP user UUID and return an empty acknowledgement.
      * Calls `PUT /api/v1/profile/add/app/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddAppPut(uuid: Identifier, data: T.ProfileAddAppPutInput, options?: RequestOptions<T.ProfileAddAppPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAppPutResponse, T.ProfileAddAppPutInput, {}>>;
+    profileAddAppPut(uuid: Identifier, data: T.ProfileAddAppPutInput, options?: RequestOptions<T.ProfileAddAppPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddAppPutResponse, T.ProfileAddAppPutInput, {}, any>>;
     /**
-     * Performs the add parent operation for the profile capability.
+     * Replace the legacy parent link for a student IDP UUID; request user_id is the parent IDP UUID. Returns an empty acknowledgement.
      * Calls `PATCH /api/v1/profile/add/parent/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddParentPatch(uuid: Identifier, data: T.ProfileAddParentPatchInput, options?: RequestOptions<T.ProfileAddParentPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddParentPatchResponse, T.ProfileAddParentPatchInput, {}>>;
+    profileAddParentPatch(uuid: Identifier, data: T.ProfileAddParentPatchInput, options?: RequestOptions<T.ProfileAddParentPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddParentPatchResponse, T.ProfileAddParentPatchInput, {}, any>>;
     /**
-     * Performs the add parent operation for the profile capability.
+     * Replace the legacy parent link for a student IDP UUID; request user_id is the parent IDP UUID. Returns an empty acknowledgement.
      * Calls `PUT /api/v1/profile/add/parent/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddParentPut(uuid: Identifier, data: T.ProfileAddParentPutInput, options?: RequestOptions<T.ProfileAddParentPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddParentPutResponse, T.ProfileAddParentPutInput, {}>>;
+    profileAddParentPut(uuid: Identifier, data: T.ProfileAddParentPutInput, options?: RequestOptions<T.ProfileAddParentPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddParentPutResponse, T.ProfileAddParentPutInput, {}, any>>;
     /**
-     * Performs the city get operation for the profile capability.
+     * Read undeleted profiles matching any requested city UUID, optionally restricted by nonempty user_ids.
      * Calls `POST /api/v1/profile/city/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileCityGetPost(data: T.ProfileCityGetPostInput, options?: RequestOptions<T.ProfileCityGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileCityGetPostResponse, T.ProfileCityGetPostInput, {}>>;
+    profileCityGetPost(data: T.ProfileCityGetPostInput, options?: RequestOptions<T.ProfileCityGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileCityGetPostResponse, T.ProfileCityGetPostInput, {}, any>>;
     /**
-     * Performs the consultant index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to consultant.
      * Calls `GET /api/v1/profile/consultant` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_consultant; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileConsultantIndexGet(params?: T.ProfileConsultantIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileConsultantIndexGetResponse, unknown, {}>>;
+    profileConsultantIndexGet(params?: T.ProfileConsultantIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the country get operation for the profile capability.
+     * Read undeleted profiles matching any requested country UUID, optionally restricted by nonempty user_ids.
      * Calls `POST /api/v1/profile/country/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileCountryGetPost(data: T.ProfileCountryGetPostInput, options?: RequestOptions<T.ProfileCountryGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileCountryGetPostResponse, T.ProfileCountryGetPostInput, {}>>;
+    profileCountryGetPost(data: T.ProfileCountryGetPostInput, options?: RequestOptions<T.ProfileCountryGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileCountryGetPostResponse, T.ProfileCountryGetPostInput, {}, any>>;
     /**
-     * Performs the force destroy operation for the profile capability.
+     * Permanently delete an undeleted profile by IDP user UUID; returns an empty acknowledgement.
      * Calls `DELETE /api/v1/profile/force/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:force_delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:force_delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileForceDestroyDelete(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileForceDestroyDeleteResponse, unknown, {}>>;
+    profileForceDestroyDelete(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileForceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the bulk get operation for the profile capability.
+     * Read undeleted profiles for IDP user UUIDs and attach legacy parent summaries. Empty batches return an empty list; the local mount has no auth middleware.
      * Calls `POST /api/v1/profile/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileBulkGetPost(data: T.ProfileBulkGetPostInput, options?: RequestOptions<T.ProfileBulkGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileBulkGetPostResponse, T.ProfileBulkGetPostInput, {}>>;
+    profileBulkGetPost(data: T.ProfileBulkGetPostInput, options?: RequestOptions<T.ProfileBulkGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileBulkGetPostResponse, T.ProfileBulkGetPostInput, {}, any>>;
     /**
-     * Performs the chat list operation for the profile capability.
+     * Read the compatibility chat-list route, which currently always returns an empty array.
      * Calls `GET /api/v1/profile/get-chat-list/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileChatListGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileChatListGetResponse, unknown, {}>>;
+    profileChatListGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileChatListGetResponse, unknown, {}, any>>;
     /**
-     * Performs the get address operation for the profile capability.
+     * Read stored addresses by IDP user UUID, resolving the separate local Profile UUID.
      * Calls `GET /api/v1/profile/get/address/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileGetAddressGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetAddressGetResponse, unknown, {}>>;
+    profileGetAddressGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetAddressGetResponse, unknown, {}, any>>;
     /**
-     * Performs the get app operation for the profile capability.
+     * Read schema-free stored app JSON for an IDP user UUID; missing data becomes an empty object.
      * Calls `GET /api/v1/profile/get/app/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileGetAppGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetAppGetResponse, unknown, {}>>;
+    profileGetAppGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetAppGetResponse, unknown, {}, any>>;
     /**
-     * Performs the get parent operation for the profile capability.
+     * Read the optional legacy parent-link row by student IDP UUID; missing link is data:null.
      * Calls `GET /api/v1/profile/get/parent/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileGetParentGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetParentGetResponse, unknown, {}>>;
+    profileGetParentGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetParentGetResponse, unknown, {}, any>>;
     /**
-     * Performs the manager index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to manager.
      * Calls `GET /api/v1/profile/manager` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_manager; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileManagerIndexGet(params?: T.ProfileManagerIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileManagerIndexGetResponse, unknown, {}>>;
+    profileManagerIndexGet(params?: T.ProfileManagerIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the get my addresses operation for the profile capability.
+     * Read addresses for the identity supplied by the authenticated gateway context.
      * Calls `GET /api/v1/profile/me/addresses` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    profileGetMyAddressesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetMyAddressesGetResponse, unknown, {}>>;
+    profileGetMyAddressesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileGetMyAddressesGetResponse, unknown, {}, any>>;
     /**
-     * Performs the save my address operation for the profile capability.
+     * Replace an address by title for the current gateway identity. Other addresses remain unchanged; blank titles return 422.
      * Calls `PATCH /api/v1/profile/me/addresses` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    profileSaveMyAddressPatch(data: T.ProfileSaveMyAddressPatchInput, options?: RequestOptions<T.ProfileSaveMyAddressPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileSaveMyAddressPatchResponse, T.ProfileSaveMyAddressPatchInput, {}>>;
+    profileSaveMyAddressPatch(data: T.ProfileSaveMyAddressPatchInput, options?: RequestOptions<T.ProfileSaveMyAddressPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileSaveMyAddressPatchResponse, T.ProfileSaveMyAddressPatchInput, {}, any>>;
     /**
-     * Performs the save my address operation for the profile capability.
+     * Replace an address by title for the current gateway identity. Other addresses remain unchanged; blank titles return 422.
      * Calls `PUT /api/v1/profile/me/addresses` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    profileSaveMyAddressPut(data: T.ProfileSaveMyAddressPutInput, options?: RequestOptions<T.ProfileSaveMyAddressPutInput>): Promise<import("axios").AxiosResponse<T.ProfileSaveMyAddressPutResponse, T.ProfileSaveMyAddressPutInput, {}>>;
+    profileSaveMyAddressPut(data: T.ProfileSaveMyAddressPutInput, options?: RequestOptions<T.ProfileSaveMyAddressPutInput>): Promise<import("axios").AxiosResponse<T.ProfileSaveMyAddressPutResponse, T.ProfileSaveMyAddressPutInput, {}, any>>;
     /**
-     * Performs the delete my address operation for the profile capability.
+     * Delete the current gateway identity address by exact title and return an empty acknowledgement.
      * Calls `DELETE /api/v1/profile/me/addresses/{title}` through the shared IDP-aware Faiber client.
      * @param title Backend path identifier `title`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    profileDeleteMyAddressDelete(title: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDeleteMyAddressDeleteResponse, unknown, {}>>;
+    profileDeleteMyAddressDelete(title: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileDeleteMyAddressDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the other index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to other.
      * Calls `GET /api/v1/profile/other` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileOtherIndexGet(params?: T.ProfileOtherIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileOtherIndexGetResponse, unknown, {}>>;
+    profileOtherIndexGet(params?: T.ProfileOtherIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the parent index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to parent.
      * Calls `GET /api/v1/profile/parent` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_parent; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileParentIndexGet(params?: T.ProfileParentIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileParentIndexGetResponse, unknown, {}>>;
+    profileParentIndexGet(params?: T.ProfileParentIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Resolve 1–200 explicit user UUIDs into active directory identities. Returns results and has_more:false; never grants collaborator eligibility.
+     * Resolve 1–200 requested active undeleted IDP user UUIDs. Results preserve names, set email/phone null, and has_more=false. Does not decide external space membership.
      * Calls `POST /api/v1/profile/people/resolve` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:lookup and authenticated directory access.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:lookup; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    workspaceResolvePeople(data: T.ProfileSearchResolvePostInput, options?: RequestOptions<T.ProfileSearchResolvePostInput>): Promise<import("axios").AxiosResponse<T.ProfileSearchResolvePostResponse, import("./types.js").ResolvePeopleInput, {}>>;
+    workspaceResolvePeople(data: T.ProfileSearchResolvePostInput, options?: RequestOptions<T.ProfileSearchResolvePostInput>): Promise<import("axios").AxiosResponse<T.ProfileSearchResolvePostResponse, import("./types.js").ResolvePeopleInput, {}, any>>;
     /**
-     * Performs the search operation for the profile search capability.
+     * Search active profiles by literal name, email, phone, national code, or exact short ID. Requires 2–160 characters and at most 8 terms; returns up to 20 minimal results and has_more, without national codes.
      * Calls `POST /api/v1/profile/people/search` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:lookup.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:lookup; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileSearchSearchPostApiV1ProfilePeopleSearch(data: T.ProfileSearchSearchPostApiV1ProfilePeopleSearchInput, options?: RequestOptions<T.ProfileSearchSearchPostApiV1ProfilePeopleSearchInput>): Promise<import("axios").AxiosResponse<T.ProfileSearchSearchPostApiV1ProfilePeopleSearchResponse, T.ProfileSearchSearchPostApiV1ProfilePeopleSearchInput, {}>>;
+    profileSearchSearchPostApiV1ProfilePeopleSearch(data: T.ProfileSearchSearchPostApiV1ProfilePeopleSearchInput, options?: RequestOptions<T.ProfileSearchSearchPostApiV1ProfilePeopleSearchInput>): Promise<import("axios").AxiosResponse<T.ProfileSearchSearchPostApiV1ProfilePeopleSearchResponse, T.ProfileSearchSearchPostApiV1ProfilePeopleSearchInput, {}, any>>;
     /**
-     * Performs the province get operation for the profile capability.
+     * Read undeleted profiles matching any requested province UUID, optionally restricted by nonempty user_ids.
      * Calls `POST /api/v1/profile/province/get` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileProvinceGetPost(data: T.ProfileProvinceGetPostInput, options?: RequestOptions<T.ProfileProvinceGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileProvinceGetPostResponse, T.ProfileProvinceGetPostInput, {}>>;
+    profileProvinceGetPost(data: T.ProfileProvinceGetPostInput, options?: RequestOptions<T.ProfileProvinceGetPostInput>): Promise<import("axios").AxiosResponse<T.ProfileProvinceGetPostResponse, T.ProfileProvinceGetPostInput, {}, any>>;
     /**
-     * Performs the search operation for the profile search capability.
+     * Search by email, names, phone, national code, exact UUID-derived short ID, or dynamic predicates; at least one filter or search term is required. Short-ID collisions return all matches with pagination. Maximum 50 filters/10 sorts, page defaults 1, per_page defaults 20 and caps at 100. include selects core/properties/services snapshots.
      * Calls `POST /api/v1/profile/search` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:search.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:search; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileSearchSearchPost(data: T.ProfileSearchSearchPostInput, options?: RequestOptions<T.ProfileSearchSearchPostInput>): Promise<import("axios").AxiosResponse<T.ProfileSearchSearchPostResponse, T.ProfileSearchSearchPostInput, {}>>;
+    profileSearchSearchPost(data: T.ProfileSearchSearchPostInput, options?: RequestOptions<T.ProfileSearchSearchPostInput>): Promise<import("axios").AxiosResponse<import("./wire.types.js").ProfileSearchResponse, T.ProfileSearchSearchPostInput, {}, any>>;
     /**
-     * Performs the student index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to student.
      * Calls `GET /api/v1/profile/student` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_student; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileStudentIndexGet(params?: T.ProfileStudentIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileStudentIndexGetResponse, unknown, {}>>;
+    profileStudentIndexGet(params?: T.ProfileStudentIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the student pes operation for the profile capability.
+     * Aggregate enrolled nonarchived enrollments across undeleted profiles: count and amount minus discount.
      * Calls `GET /api/v1/profile/students/pes` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileStudentPesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileStudentPesGetResponse, unknown, {}>>;
+    profileStudentPesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileStudentPesGetResponse, unknown, {}, any>>;
     /**
-     * Performs the student pes schema operation for the profile capability.
+     * Read the constant PES schema descriptor {count:integer,amount:number}.
      * Calls `GET /api/v1/profile/students/pes/schema` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileStudentPesSchemaGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileStudentPesSchemaGetResponse, unknown, {}>>;
+    profileStudentPesSchemaGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileStudentPesSchemaGetResponse, unknown, {}, any>>;
     /**
-     * Performs the support index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to support.
      * Calls `GET /api/v1/profile/support` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_support; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileSupportIndexGet(params?: T.ProfileSupportIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileSupportIndexGetResponse, unknown, {}>>;
+    profileSupportIndexGet(params?: T.ProfileSupportIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the support pes operation for the profile capability.
+     * Aggregate pending nonarchived enrollments across undeleted profiles: count and amount minus discount.
      * Calls `GET /api/v1/profile/supports/pes` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileSupportPesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileSupportPesGetResponse, unknown, {}>>;
+    profileSupportPesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileSupportPesGetResponse, unknown, {}, any>>;
     /**
-     * Performs the support pes schema operation for the profile capability.
+     * Read the constant PES schema descriptor {count:integer,amount:number}.
      * Calls `GET /api/v1/profile/supports/pes/schema` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    profileSupportPesSchemaGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileSupportPesSchemaGetResponse, unknown, {}>>;
+    profileSupportPesSchemaGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileSupportPesSchemaGetResponse, unknown, {}, any>>;
     /**
-     * Performs the teacher index operation for the profile capability.
+     * List undeleted profiles with role, active-enrollment, status, normalized literal identity search and dynamic filters applied before pagination. Defaults page=1/per_page=15; per_page caps at 100. filter[trashed] is accepted but does not expose deleted profiles. This mounted route fixes the role to teacher.
      * Calls `GET /api/v1/profile/teacher` through the shared IDP-aware Faiber client.
      * Supports live core/property/trusted-event filters, repeated date ranges and sorting before pagination; invalid clauses return HTTP 400.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:read_teacher; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileTeacherIndexGet(params?: T.ProfileTeacherIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileTeacherIndexGetResponse, unknown, {}>>;
+    profileTeacherIndexGet(params?: T.ProfileTeacherIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<import("./types.js").ProfileListResponse, unknown, {}, any>>;
     /**
-     * Performs the restore operation for the profile capability.
+     * Restore a profile by IDP user UUID, including a previously deleted row; returns an empty acknowledgement.
      * Calls `GET /api/v1/profile/undo/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:restore.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:restore; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileRestoreGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileRestoreGetResponse, unknown, {}>>;
+    profileRestoreGet(uuid: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProfileRestoreGetResponse, unknown, {}, any>>;
     /**
-     * Performs the add meta operation for the profile capability.
+     * Replace schema-free metadata JSON for an IDP user UUID and return an empty acknowledgement.
      * Calls `PATCH /api/v1/profile/update/{uuid}/meta` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddMetaPatch(uuid: Identifier, data: T.ProfileAddMetaPatchInput, options?: RequestOptions<T.ProfileAddMetaPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddMetaPatchResponse, T.ProfileAddMetaPatchInput, {}>>;
+    profileAddMetaPatch(uuid: Identifier, data: T.ProfileAddMetaPatchInput, options?: RequestOptions<T.ProfileAddMetaPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileAddMetaPatchResponse, T.ProfileAddMetaPatchInput, {}, any>>;
     /**
-     * Performs the add meta operation for the profile capability.
+     * Replace schema-free metadata JSON for an IDP user UUID and return an empty acknowledgement.
      * Calls `PUT /api/v1/profile/update/{uuid}/meta` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileAddMetaPut(uuid: Identifier, data: T.ProfileAddMetaPutInput, options?: RequestOptions<T.ProfileAddMetaPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddMetaPutResponse, T.ProfileAddMetaPutInput, {}>>;
+    profileAddMetaPut(uuid: Identifier, data: T.ProfileAddMetaPutInput, options?: RequestOptions<T.ProfileAddMetaPutInput>): Promise<import("axios").AxiosResponse<T.ProfileAddMetaPutResponse, T.ProfileAddMetaPutInput, {}, any>>;
     /**
-     * Performs the update operation for the education capability.
+     * Atomically update education fields by IDP user UUID. Omission preserves and null clears; invalid attendance/level/referral/education/referrer values return 422. Level is a nonempty string up to 64 characters and description up to 10000.
      * Calls `PUT /api/v1/profile/update/education-information/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    educationUpdatePut(uuid: Identifier, data: T.EducationUpdatePutInput, options?: RequestOptions<T.EducationUpdatePutInput>): Promise<import("axios").AxiosResponse<T.EducationUpdatePutResponse, import("./types.js").EducationInformationInput, {}>>;
+    educationUpdatePut(uuid: Identifier, data: T.EducationUpdatePutInput, options?: RequestOptions<T.EducationUpdatePutInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, import("./types.js").EducationInformationInput, {}, any>>;
     /**
-     * Performs the update personal operation for the profile capability.
+     * Update supplied personal fields for an IDP user UUID. Localized name objects merge fa/en string members; job:null clears the job. Other absent/null optional scalar members are preserved.
      * Calls `PATCH /api/v1/profile/update/personal-information/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdatePersonalPatch(uuid: Identifier, data: T.ProfileUpdatePersonalPatchInput, options?: RequestOptions<T.ProfileUpdatePersonalPatchInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePersonalPatchResponse, T.ProfileUpdatePersonalPatchInput, {}>>;
+    profileUpdatePersonalPatch(uuid: Identifier, data: T.ProfileUpdatePersonalPatchInput, options?: RequestOptions<T.ProfileUpdatePersonalPatchInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdatePersonalPatchInput, {}, any>>;
     /**
-     * Performs the update personal operation for the profile capability.
+     * Update supplied personal fields for an IDP user UUID. Localized name objects merge fa/en string members; job:null clears the job. Other absent/null optional scalar members are preserved.
      * Calls `PUT /api/v1/profile/update/personal-information/{uuid}` through the shared IDP-aware Faiber client.
      * @param uuid Backend path identifier `uuid`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: profile:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission profile:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    profileUpdatePersonalPut(uuid: Identifier, data: T.ProfileUpdatePersonalPutInput, options?: RequestOptions<T.ProfileUpdatePersonalPutInput>): Promise<import("axios").AxiosResponse<T.ProfileUpdatePersonalPutResponse, T.ProfileUpdatePersonalPutInput, {}>>;
+    profileUpdatePersonalPut(uuid: Identifier, data: T.ProfileUpdatePersonalPutInput, options?: RequestOptions<T.ProfileUpdatePersonalPutInput>): Promise<import("axios").AxiosResponse<import("./types.js").ProfileResponse, T.ProfileUpdatePersonalPutInput, {}, any>>;
     /**
-     * Performs the index operation for the province capability.
+     * List the province records. List pagination defaults 1/15 and caps at 100; filters apply before pagination, and deleted records are hidden unless filter[trashed]=only/with.
      * Calls `GET /api/v1/province` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceIndexGet(params?: T.ProvinceIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceIndexGetResponse, unknown, {}>>;
+    provinceIndexGet(params?: T.ProvinceIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the province capability.
+     * Create the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `POST /api/v1/province` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceStorePost(data: T.ProvinceStorePostInput, options?: RequestOptions<T.ProvinceStorePostInput>): Promise<import("axios").AxiosResponse<T.ProvinceStorePostResponse, T.ProvinceStorePostInput, {}>>;
+    provinceStorePost(data: T.ProvinceStorePostInput, options?: RequestOptions<T.ProvinceStorePostInput>): Promise<import("axios").AxiosResponse<T.ProvinceStorePostResponse, T.ProvinceStorePostInput, {}, any>>;
     /**
-     * Performs the destroy operation for the province capability.
+     * Soft-delete the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/province/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceDestroyDeleteResponse, unknown, {}>>;
+    provinceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the province capability.
+     * Read the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/province/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceShowGetResponse, unknown, {}>>;
+    provinceShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the province capability.
+     * Update supplied fields on the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PATCH /api/v1/province/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceUpdatePatch(id: Identifier, data: T.ProvinceUpdatePatchInput, options?: RequestOptions<T.ProvinceUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.ProvinceUpdatePatchResponse, T.ProvinceUpdatePatchInput, {}>>;
+    provinceUpdatePatch(id: Identifier, data: T.ProvinceUpdatePatchInput, options?: RequestOptions<T.ProvinceUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.ProvinceUpdatePatchResponse, T.ProvinceUpdatePatchInput, {}, any>>;
     /**
-     * Performs the update operation for the province capability.
+     * Update supplied fields on the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PUT /api/v1/province/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceUpdatePut(id: Identifier, data: T.ProvinceUpdatePutInput, options?: RequestOptions<T.ProvinceUpdatePutInput>): Promise<import("axios").AxiosResponse<T.ProvinceUpdatePutResponse, T.ProvinceUpdatePutInput, {}>>;
+    provinceUpdatePut(id: Identifier, data: T.ProvinceUpdatePutInput, options?: RequestOptions<T.ProvinceUpdatePutInput>): Promise<import("axios").AxiosResponse<T.ProvinceUpdatePutResponse, T.ProvinceUpdatePutInput, {}, any>>;
     /**
-     * Performs the force destroy operation for the province capability.
+     * Permanently delete the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/province/force/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceForceDestroyDeleteResponse, unknown, {}>>;
+    provinceForceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceForceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the restore operation for the province capability.
+     * Restore the province record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/province/undo/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: province:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission province:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    provinceRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceRestoreGetResponse, unknown, {}>>;
+    provinceRestoreGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ProvinceRestoreGetResponse, unknown, {}, any>>;
     /**
-     * Performs the list operation for the referral capability.
+     * List undeleted referral sources ordered by sort_order.
      * Calls `GET /api/v1/referral-source` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralListGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralListGetResponse, unknown, {}>>;
+    referralListGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralListGetResponse, unknown, {}, any>>;
     /**
-     * Performs the create operation for the referral capability.
+     * Create a referral source requiring nonblank code and object labels/metadata.
      * Calls `POST /api/v1/referral-source` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralCreatePost(data: T.ReferralCreatePostInput, options?: RequestOptions<T.ReferralCreatePostInput>): Promise<import("axios").AxiosResponse<T.ReferralCreatePostResponse, T.ReferralCreatePostInput, {}>>;
+    referralCreatePost(data: T.ReferralCreatePostInput, options?: RequestOptions<T.ReferralCreatePostInput>): Promise<import("axios").AxiosResponse<T.ReferralCreatePostResponse, import("./wire.types.js").ProfileReferralSourceInput, {}, any>>;
     /**
-     * Performs the delete operation for the referral capability.
+     * Soft-delete and deactivate a referral source.
      * Calls `DELETE /api/v1/referral-source/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralDeleteDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralDeleteDeleteResponse, unknown, {}>>;
+    referralDeleteDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralDeleteDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the referral capability.
+     * Read a referral source by UUID.
      * Calls `GET /api/v1/referral-source/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralShowGetResponse, unknown, {}>>;
+    referralShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.ReferralShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the referral capability.
+     * Replace a referral source requiring nonblank code and object labels/metadata.
      * Calls `PUT /api/v1/referral-source/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    referralUpdatePut(id: Identifier, data: T.ReferralUpdatePutInput, options?: RequestOptions<T.ReferralUpdatePutInput>): Promise<import("axios").AxiosResponse<T.ReferralUpdatePutResponse, T.ReferralUpdatePutInput, {}>>;
+    referralUpdatePut(id: Identifier, data: T.ReferralUpdatePutInput, options?: RequestOptions<T.ReferralUpdatePutInput>): Promise<import("axios").AxiosResponse<T.ReferralUpdatePutResponse, import("./wire.types.js").ProfileReferralSourceInput, {}, any>>;
     /**
-     * Performs the list types operation for the relation capability.
+     * List undeleted relation types ordered by sort_order.
      * Calls `GET /api/v1/relation-type` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationListTypesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationListTypesGetResponse, unknown, {}>>;
+    relationListTypesGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationListTypesGetResponse, unknown, {}, any>>;
     /**
-     * Performs the create type operation for the relation capability.
+     * Create a validated relation type with object labels/constraints; directional managed inverses require an active inverse type.
      * Calls `POST /api/v1/relation-type` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationCreateTypePost(data: T.RelationCreateTypePostInput, options?: RequestOptions<T.RelationCreateTypePostInput>): Promise<import("axios").AxiosResponse<T.RelationCreateTypePostResponse, T.RelationCreateTypePostInput, {}>>;
+    relationCreateTypePost(data: T.RelationCreateTypePostInput, options?: RequestOptions<T.RelationCreateTypePostInput>): Promise<import("axios").AxiosResponse<T.RelationCreateTypePostResponse, import("./wire.types.js").ProfileRelationTypeInput, {}, any>>;
     /**
-     * Performs the delete type operation for the relation capability.
+     * Soft-delete and deactivate a relation type.
      * Calls `DELETE /api/v1/relation-type/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationDeleteTypeDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationDeleteTypeDeleteResponse, unknown, {}>>;
+    relationDeleteTypeDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationDeleteTypeDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show type operation for the relation capability.
+     * Read a relation type by UUID.
      * Calls `GET /api/v1/relation-type/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationShowTypeGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationShowTypeGetResponse, unknown, {}>>;
+    relationShowTypeGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RelationShowTypeGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update type operation for the relation capability.
+     * Replace a validated relation type definition.
      * Calls `PUT /api/v1/relation-type/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    relationUpdateTypePut(id: Identifier, data: T.RelationUpdateTypePutInput, options?: RequestOptions<T.RelationUpdateTypePutInput>): Promise<import("axios").AxiosResponse<T.RelationUpdateTypePutResponse, T.RelationUpdateTypePutInput, {}>>;
+    relationUpdateTypePut(id: Identifier, data: T.RelationUpdateTypePutInput, options?: RequestOptions<T.RelationUpdateTypePutInput>): Promise<import("axios").AxiosResponse<T.RelationUpdateTypePutResponse, import("./wire.types.js").ProfileRelationTypeInput, {}, any>>;
     /**
-     * Performs the index operation for the setting capability.
+     * Read all numeric settings, newest first, under data.setting.
      * Calls `GET /api/v1/setting` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: setting:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission setting:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    settingIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SettingIndexGetResponse, unknown, {}>>;
+    settingIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SettingIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the setting capability.
+     * Create a numeric setting from key/title/value and return data.setting.
      * Calls `POST /api/v1/setting` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: setting:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission setting:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    settingStorePost(data: T.SettingStorePostInput, options?: RequestOptions<T.SettingStorePostInput>): Promise<import("axios").AxiosResponse<T.SettingStorePostResponse, T.SettingStorePostInput, {}>>;
+    settingStorePost(data: T.SettingStorePostInput, options?: RequestOptions<T.SettingStorePostInput>): Promise<import("axios").AxiosResponse<T.SettingStorePostResponse, T.SettingStorePostInput, {}, any>>;
     /**
-     * Performs the actions list operation for the lifecycle capability.
+     * List state actions, optionally by state_id, ordered by sort_order.
      * Calls `GET /api/v1/state-action` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleActionsListGet(params?: T.LifecycleActionsListGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleActionsListGetResponse, unknown, {}>>;
+    lifecycleActionsListGet(params?: T.LifecycleActionsListGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleActionsListGetResponse, unknown, {}, any>>;
     /**
-     * Performs the create action operation for the lifecycle capability.
+     * Create a validated enter/exit action of type event/webhook/message/external_flag with retry configuration.
      * Calls `POST /api/v1/state-action` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleCreateActionPost(data: T.LifecycleCreateActionPostInput, options?: RequestOptions<T.LifecycleCreateActionPostInput>): Promise<import("axios").AxiosResponse<T.LifecycleCreateActionPostResponse, T.LifecycleCreateActionPostInput, {}>>;
+    lifecycleCreateActionPost(data: T.LifecycleCreateActionPostInput, options?: RequestOptions<T.LifecycleCreateActionPostInput>): Promise<import("axios").AxiosResponse<T.LifecycleCreateActionPostResponse, import("./wire.types.js").ProfileLifecycleActionInput, {}, any>>;
     /**
-     * Performs the delete action operation for the lifecycle capability.
+     * Disable an action; this command does not physically delete its row.
      * Calls `DELETE /api/v1/state-action/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleDeleteActionDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleDeleteActionDeleteResponse, unknown, {}>>;
+    lifecycleDeleteActionDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleDeleteActionDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show action operation for the lifecycle capability.
+     * Read a state action by UUID.
      * Calls `GET /api/v1/state-action/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleShowActionGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleShowActionGetResponse, unknown, {}>>;
+    lifecycleShowActionGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleShowActionGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update action operation for the lifecycle capability.
+     * Replace a validated state action configuration.
      * Calls `PUT /api/v1/state-action/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleUpdateActionPut(id: Identifier, data: T.LifecycleUpdateActionPutInput, options?: RequestOptions<T.LifecycleUpdateActionPutInput>): Promise<import("axios").AxiosResponse<T.LifecycleUpdateActionPutResponse, T.LifecycleUpdateActionPutInput, {}>>;
+    lifecycleUpdateActionPut(id: Identifier, data: T.LifecycleUpdateActionPutInput, options?: RequestOptions<T.LifecycleUpdateActionPutInput>): Promise<import("axios").AxiosResponse<T.LifecycleUpdateActionPutResponse, import("./wire.types.js").ProfileLifecycleActionInput, {}, any>>;
     /**
-     * Performs the dry run action operation for the lifecycle capability.
+     * Validate action configuration and evaluate its condition against empty facts; returns execution eligibility without executing or enqueueing.
      * Calls `POST /api/v1/state-action/dry-run` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleDryRunActionPost(data: T.LifecycleDryRunActionPostInput, options?: RequestOptions<T.LifecycleDryRunActionPostInput>): Promise<import("axios").AxiosResponse<T.LifecycleDryRunActionPostResponse, T.LifecycleDryRunActionPostInput, {}>>;
+    lifecycleDryRunActionPost(data: T.LifecycleDryRunActionPostInput, options?: RequestOptions<T.LifecycleDryRunActionPostInput>): Promise<import("axios").AxiosResponse<T.LifecycleDryRunActionPostResponse, import("./wire.types.js").ProfileLifecycleActionInput, {}, any>>;
     /**
-     * Performs the states operation for the lifecycle capability.
+     * List undeleted state definitions, optionally by system_id, highest priority first.
      * Calls `GET /api/v1/state-definition` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleStatesGet(params?: T.LifecycleStatesGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleStatesGetResponse, unknown, {}>>;
+    lifecycleStatesGet(params?: T.LifecycleStatesGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleStatesGetResponse, unknown, {}, any>>;
     /**
-     * Performs the create state operation for the lifecycle capability.
+     * Create a validated state under an existing system; each system may have one undeleted fallback. Immediate systems trigger reevaluation.
      * Calls `POST /api/v1/state-definition` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleCreateStatePost(data: T.LifecycleCreateStatePostInput, options?: RequestOptions<T.LifecycleCreateStatePostInput>): Promise<import("axios").AxiosResponse<T.LifecycleCreateStatePostResponse, T.LifecycleCreateStatePostInput, {}>>;
+    lifecycleCreateStatePost(data: T.LifecycleCreateStatePostInput, options?: RequestOptions<T.LifecycleCreateStatePostInput>): Promise<import("axios").AxiosResponse<T.LifecycleCreateStatePostResponse, import("./wire.types.js").ProfileLifecycleStateInput, {}, any>>;
     /**
-     * Performs the delete state operation for the lifecycle capability.
+     * Soft-delete/deactivate a state definition and trigger immediate-system reevaluation.
      * Calls `DELETE /api/v1/state-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleDeleteStateDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleDeleteStateDeleteResponse, unknown, {}>>;
+    lifecycleDeleteStateDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleDeleteStateDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show state operation for the lifecycle capability.
+     * Read a state definition row by UUID.
      * Calls `GET /api/v1/state-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleShowStateGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleShowStateGetResponse, unknown, {}>>;
+    lifecycleShowStateGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleShowStateGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update state operation for the lifecycle capability.
+     * Replace a validated state configuration and increment version; immediate systems trigger reevaluation.
      * Calls `PUT /api/v1/state-definition/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleUpdateStatePut(id: Identifier, data: T.LifecycleUpdateStatePutInput, options?: RequestOptions<T.LifecycleUpdateStatePutInput>): Promise<import("axios").AxiosResponse<T.LifecycleUpdateStatePutResponse, T.LifecycleUpdateStatePutInput, {}>>;
+    lifecycleUpdateStatePut(id: Identifier, data: T.LifecycleUpdateStatePutInput, options?: RequestOptions<T.LifecycleUpdateStatePutInput>): Promise<import("axios").AxiosResponse<T.LifecycleUpdateStatePutResponse, import("./wire.types.js").ProfileLifecycleStateInput, {}, any>>;
     /**
-     * Performs the action attempts operation for the lifecycle capability.
+     * List action attempts optionally by outbox_id, newest first.
      * Calls `GET /api/v1/state-evaluation/action-attempts` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleActionAttemptsGet(params?: T.LifecycleActionAttemptsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleActionAttemptsGetResponse, unknown, {}>>;
+    lifecycleActionAttemptsGet(params?: T.LifecycleActionAttemptsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleActionAttemptsGetResponse, unknown, {}, any>>;
     /**
-     * Performs the evaluate operation for the lifecycle capability.
+     * Persist a changed eligible selected state under a profile/system lock, record its transition, and enqueue enter/exit actions; unchanged/ineligible results do not create transitions.
      * Calls `POST /api/v1/state-evaluation/evaluate` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleEvaluatePost(data: T.LifecycleEvaluatePostInput, options?: RequestOptions<T.LifecycleEvaluatePostInput>): Promise<import("axios").AxiosResponse<T.LifecycleEvaluatePostResponse, T.LifecycleEvaluatePostInput, {}>>;
+    lifecycleEvaluatePost(data: T.LifecycleEvaluatePostInput, options?: RequestOptions<T.LifecycleEvaluatePostInput>): Promise<import("axios").AxiosResponse<T.LifecycleEvaluatePostResponse, import("./wire.types.js").ProfileLifecycleEvaluationInput, {}, any>>;
     /**
-     * Performs the outbox operation for the lifecycle capability.
+     * List outbox rows optionally filtered by status.
      * Calls `GET /api/v1/state-evaluation/outbox` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleOutboxGet(params?: T.LifecycleOutboxGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleOutboxGetResponse, unknown, {}>>;
+    lifecycleOutboxGet(params?: T.LifecycleOutboxGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleOutboxGetResponse, unknown, {}, any>>;
     /**
-     * Performs the retry operation for the lifecycle capability.
+     * Reset only a failed outbox row to pending; missing rows return 404 and other states 409.
      * Calls `POST /api/v1/state-evaluation/outbox/{id}/retry` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleRetryPost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleRetryPostResponse, unknown, {}>>;
+    lifecycleRetryPost(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleRetryPostResponse, unknown, {}, any>>;
     /**
-     * Performs the process outbox operation for the lifecycle capability.
+     * Process up to 100 ready actions and return the count completed; may publish broker events or call configured webhooks.
      * Calls `POST /api/v1/state-evaluation/outbox/process` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleProcessOutboxPost(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleProcessOutboxPostResponse, unknown, {}>>;
+    lifecycleProcessOutboxPost(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleProcessOutboxPostResponse, unknown, {}, any>>;
     /**
-     * Performs the preview operation for the lifecycle capability.
+     * Evaluate system eligibility and choose the highest-priority matching active state or fallback without persisting transitions.
      * Calls `POST /api/v1/state-evaluation/preview` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecyclePreviewPost(data: T.LifecyclePreviewPostInput, options?: RequestOptions<T.LifecyclePreviewPostInput>): Promise<import("axios").AxiosResponse<T.LifecyclePreviewPostResponse, T.LifecyclePreviewPostInput, {}>>;
+    lifecyclePreviewPost(data: T.LifecyclePreviewPostInput, options?: RequestOptions<T.LifecyclePreviewPostInput>): Promise<import("axios").AxiosResponse<T.LifecyclePreviewPostResponse, import("./wire.types.js").ProfileLifecycleEvaluationInput, {}, any>>;
     /**
-     * Performs the transitions operation for the lifecycle capability.
+     * List transitions optionally filtered by Profile UUID and system UUID, newest first.
      * Calls `GET /api/v1/state-evaluation/transitions` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleTransitionsGet(params?: T.LifecycleTransitionsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleTransitionsGetResponse, unknown, {}>>;
+    lifecycleTransitionsGet(params?: T.LifecycleTransitionsGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleTransitionsGetResponse, unknown, {}, any>>;
     /**
-     * Performs the validate rule operation for the lifecycle capability.
+     * Validate and evaluate the lifecycle AST against supplied JSON facts; returns valid/matched, invalid rules return 422.
      * Calls `POST /api/v1/state-evaluation/validate-rule` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleValidateRulePost(data: T.LifecycleValidateRulePostInput, options?: RequestOptions<T.LifecycleValidateRulePostInput>): Promise<import("axios").AxiosResponse<T.LifecycleValidateRulePostResponse, T.LifecycleValidateRulePostInput, {}>>;
+    lifecycleValidateRulePost(data: T.LifecycleValidateRulePostInput, options?: RequestOptions<T.LifecycleValidateRulePostInput>): Promise<import("axios").AxiosResponse<T.LifecycleValidateRulePostResponse, import("./wire.types.js").ProfileLifecycleRuleInput, {}, any>>;
     /**
-     * Performs the systems operation for the lifecycle capability.
+     * List undeleted lifecycle systems ordered by code.
      * Calls `GET /api/v1/state-system` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleSystemsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleSystemsGetResponse, unknown, {}>>;
+    lifecycleSystemsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleSystemsGetResponse, unknown, {}, any>>;
     /**
-     * Performs the create system operation for the lifecycle capability.
+     * Create a lifecycle system with object labels/description, validated rule and optional valid cron schedule.
      * Calls `POST /api/v1/state-system` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleCreateSystemPost(data: T.LifecycleCreateSystemPostInput, options?: RequestOptions<T.LifecycleCreateSystemPostInput>): Promise<import("axios").AxiosResponse<T.LifecycleCreateSystemPostResponse, T.LifecycleCreateSystemPostInput, {}>>;
+    lifecycleCreateSystemPost(data: T.LifecycleCreateSystemPostInput, options?: RequestOptions<T.LifecycleCreateSystemPostInput>): Promise<import("axios").AxiosResponse<T.LifecycleCreateSystemPostResponse, import("./wire.types.js").ProfileLifecycleSystemInput, {}, any>>;
     /**
-     * Performs the delete system operation for the lifecycle capability.
+     * Soft-delete and deactivate a lifecycle system; acknowledge with an empty object.
      * Calls `DELETE /api/v1/state-system/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleDeleteSystemDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleDeleteSystemDeleteResponse, unknown, {}>>;
+    lifecycleDeleteSystemDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleDeleteSystemDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show system operation for the lifecycle capability.
+     * Read a lifecycle system row by local UUID, including a soft-deleted row if present.
      * Calls `GET /api/v1/state-system/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleShowSystemGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleShowSystemGetResponse, unknown, {}>>;
+    lifecycleShowSystemGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.LifecycleShowSystemGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update system operation for the lifecycle capability.
+     * Replace lifecycle system configuration, increment version and trigger reevaluation for immediate publication mode.
      * Calls `PUT /api/v1/state-system/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    lifecycleUpdateSystemPut(id: Identifier, data: T.LifecycleUpdateSystemPutInput, options?: RequestOptions<T.LifecycleUpdateSystemPutInput>): Promise<import("axios").AxiosResponse<T.LifecycleUpdateSystemPutResponse, T.LifecycleUpdateSystemPutInput, {}>>;
+    lifecycleUpdateSystemPut(id: Identifier, data: T.LifecycleUpdateSystemPutInput, options?: RequestOptions<T.LifecycleUpdateSystemPutInput>): Promise<import("axios").AxiosResponse<T.LifecycleUpdateSystemPutResponse, import("./wire.types.js").ProfileLifecycleSystemInput, {}, any>>;
     /**
-     * Performs the index operation for the survey capability.
+     * Read all survey rows without pagination. meta is arbitrary stored JSON.
      * Calls `GET /api/v1/survey` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: survey:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission survey:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    surveyIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SurveyIndexGetResponse, unknown, {}>>;
+    surveyIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.SurveyIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the survey capability.
+     * Create a survey row. Request key type is serialized as survey_type on the returned row; enrollment_id/type/meta may be omitted or null.
      * Calls `POST /api/v1/survey` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: survey:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission survey:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    surveyStorePost(data: T.SurveyStorePostInput, options?: RequestOptions<T.SurveyStorePostInput>): Promise<import("axios").AxiosResponse<T.SurveyStorePostResponse, T.SurveyStorePostInput, {}>>;
+    surveyStorePost(data: T.SurveyStorePostInput, options?: RequestOptions<T.SurveyStorePostInput>): Promise<import("axios").AxiosResponse<T.SurveyStorePostResponse, T.SurveyStorePostInput, {}, any>>;
     /**
-     * Performs the index operation for the trusted service capability.
+     * List the trusted service records. List pagination defaults 1/15 and caps at 100; filters apply before pagination, and deleted records are hidden unless filter[trashed]=only/with.
      * Calls `GET /api/v1/trusted-service` through the shared IDP-aware Faiber client.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceIndexGet(params?: T.TrustedServiceIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceIndexGetResponse, unknown, {}>>;
+    trustedServiceIndexGet(params?: T.TrustedServiceIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the store operation for the trusted service capability.
+     * Create the trusted service record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `POST /api/v1/trusted-service` through the shared IDP-aware Faiber client.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceStorePost(data: T.TrustedServiceStorePostInput, options?: RequestOptions<T.TrustedServiceStorePostInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceStorePostResponse, T.TrustedServiceStorePostInput, {}>>;
+    trustedServiceStorePost(data: T.TrustedServiceStorePostInput, options?: RequestOptions<T.TrustedServiceStorePostInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceStorePostResponse, T.TrustedServiceStorePostInput, {}, any>>;
     /**
-     * Performs the destroy operation for the trusted service capability.
+     * Soft-delete the trusted service record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `DELETE /api/v1/trusted-service/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceDestroyDeleteResponse, unknown, {}>>;
+    trustedServiceDestroyDelete(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the show operation for the trusted service capability.
+     * Read the trusted service record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `GET /api/v1/trusted-service/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceShowGetResponse, unknown, {}>>;
+    trustedServiceShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the update operation for the trusted service capability.
+     * Update supplied fields on the trusted service record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PATCH /api/v1/trusted-service/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceUpdatePatch(id: Identifier, data: T.TrustedServiceUpdatePatchInput, options?: RequestOptions<T.TrustedServiceUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceUpdatePatchResponse, T.TrustedServiceUpdatePatchInput, {}>>;
+    trustedServiceUpdatePatch(id: Identifier, data: T.TrustedServiceUpdatePatchInput, options?: RequestOptions<T.TrustedServiceUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceUpdatePatchResponse, T.TrustedServiceUpdatePatchInput, {}, any>>;
     /**
-     * Performs the update operation for the trusted service capability.
+     * Update supplied fields on the trusted service record. Local IDs are UUIDs; responses retain the named backend envelope.
      * Calls `PUT /api/v1/trusted-service/{id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceUpdatePut(id: Identifier, data: T.TrustedServiceUpdatePutInput, options?: RequestOptions<T.TrustedServiceUpdatePutInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceUpdatePutResponse, T.TrustedServiceUpdatePutInput, {}>>;
+    trustedServiceUpdatePut(id: Identifier, data: T.TrustedServiceUpdatePutInput, options?: RequestOptions<T.TrustedServiceUpdatePutInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceUpdatePutResponse, T.TrustedServiceUpdatePutInput, {}, any>>;
     /**
-     * Performs the event index operation for the trusted service capability.
+     * Manage trusted-service event visibility and arbitrary payload_schema within the path service UUID. Event reads/updates/deletes verify event ownership and deleted status.
      * Calls `GET /api/v1/trusted-service/{id}/event` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param params Typed query parameters; omitted members retain backend defaults.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceEventIndexGet(id: Identifier, params?: T.TrustedServiceEventIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceEventIndexGetResponse, unknown, {}>>;
+    trustedServiceEventIndexGet(id: Identifier, params?: T.TrustedServiceEventIndexGetQuery, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceEventIndexGetResponse, unknown, {}, any>>;
     /**
-     * Performs the event store operation for the trusted service capability.
+     * Manage trusted-service event visibility and arbitrary payload_schema within the path service UUID. Event reads/updates/deletes verify event ownership and deleted status.
      * Calls `POST /api/v1/trusted-service/{id}/event` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:create.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:create; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceEventStorePost(id: Identifier, data: T.TrustedServiceEventStorePostInput, options?: RequestOptions<T.TrustedServiceEventStorePostInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceEventStorePostResponse, T.TrustedServiceEventStorePostInput, {}>>;
+    trustedServiceEventStorePost(id: Identifier, data: T.TrustedServiceEventStorePostInput, options?: RequestOptions<T.TrustedServiceEventStorePostInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceEventStorePostResponse, T.TrustedServiceEventStorePostInput, {}, any>>;
     /**
-     * Performs the event destroy operation for the trusted service capability.
+     * Manage trusted-service event visibility and arbitrary payload_schema within the path service UUID. Event reads/updates/deletes verify event ownership and deleted status.
      * Calls `DELETE /api/v1/trusted-service/{id}/event/{event_id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param eventId Backend path identifier `event_id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:delete.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:delete; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceEventDestroyDelete(id: Identifier, eventId: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceEventDestroyDeleteResponse, unknown, {}>>;
+    trustedServiceEventDestroyDelete(id: Identifier, eventId: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceEventDestroyDeleteResponse, unknown, {}, any>>;
     /**
-     * Performs the event show operation for the trusted service capability.
+     * Manage trusted-service event visibility and arbitrary payload_schema within the path service UUID. Event reads/updates/deletes verify event ownership and deleted status.
      * Calls `GET /api/v1/trusted-service/{id}/event/{event_id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param eventId Backend path identifier `event_id`.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:read.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:read; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceEventShowGet(id: Identifier, eventId: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceEventShowGetResponse, unknown, {}>>;
+    trustedServiceEventShowGet(id: Identifier, eventId: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.TrustedServiceEventShowGetResponse, unknown, {}, any>>;
     /**
-     * Performs the event update operation for the trusted service capability.
+     * Manage trusted-service event visibility and arbitrary payload_schema within the path service UUID. Event reads/updates/deletes verify event ownership and deleted status.
      * Calls `PATCH /api/v1/trusted-service/{id}/event/{event_id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param eventId Backend path identifier `event_id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
      */
-    trustedServiceEventUpdatePatch(id: Identifier, eventId: Identifier, data: T.TrustedServiceEventUpdatePatchInput, options?: RequestOptions<T.TrustedServiceEventUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceEventUpdatePatchResponse, T.TrustedServiceEventUpdatePatchInput, {}>>;
+    trustedServiceEventUpdatePatch(id: Identifier, eventId: Identifier, data: T.TrustedServiceEventUpdatePatchInput, options?: RequestOptions<T.TrustedServiceEventUpdatePatchInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceEventUpdatePatchResponse, T.TrustedServiceEventUpdatePatchInput, {}, any>>;
     /**
-     * Performs the event update operation for the trusted service capability.
+     * Manage trusted-service event visibility and arbitrary payload_schema within the path service UUID. Event reads/updates/deletes verify event ownership and deleted status.
      * Calls `PUT /api/v1/trusted-service/{id}/event/{event_id}` through the shared IDP-aware Faiber client.
      * @param id Backend path identifier `id`.
      * @param eventId Backend path identifier `event_id`.
      * @param data Typed JSON request body.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: trusted_service:update.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: declared IDP permission trusted_service:update; gateway enforces ACL metadata, local annotation itself is not a permission check.
+     */
+    trustedServiceEventUpdatePut(id: Identifier, eventId: Identifier, data: T.TrustedServiceEventUpdatePutInput, options?: RequestOptions<T.TrustedServiceEventUpdatePutInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceEventUpdatePutResponse, T.TrustedServiceEventUpdatePutInput, {}, any>>;
+    /**
+     * Read active campaigns in their current date window, ordered by sort_order and creation time. visibility metadata is returned as data and is not a row predicate.
+     * Calls `GET /campaign` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    campaignIndexGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CampaignIndexGetResponse, unknown, {}, any>>;
+    /**
+     * Read current user contribution history with purpose snapshots; confirmed_at is not serialized.
+     * Calls `GET /campaign-profile/me/contributions` through the shared IDP-aware Faiber client.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    campaignMyContributionsGet(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CampaignMyContributionsGetResponse, unknown, {}, any>>;
+    /**
+     * Read one campaign projection by UUID; the detail query does not restrict status or date window.
+     * Calls `GET /campaign/{id}` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
+     */
+    campaignShowGet(id: Identifier, options?: RequestOptions): Promise<import("axios").AxiosResponse<T.CampaignShowGetResponse, unknown, {}, any>>;
+    /**
+     * Record a positive money/sha contribution for an available campaign using current user and idempotency_key. Disabled methods return 409, invalid amount/method 422; duplicate user/key reuses the existing receipt.
+     * Calls `POST /campaign/{id}/contributions` through the shared IDP-aware Faiber client.
+     * @param id Backend path identifier `id`.
+     * @param data Typed JSON request body.
+     * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: gateway AuthContext; no additional named handler permission check.
      */
-    trustedServiceEventUpdatePut(id: Identifier, eventId: Identifier, data: T.TrustedServiceEventUpdatePutInput, options?: RequestOptions<T.TrustedServiceEventUpdatePutInput>): Promise<import("axios").AxiosResponse<T.TrustedServiceEventUpdatePutResponse, T.TrustedServiceEventUpdatePutInput, {}>>;
+    campaignContributePost(id: Identifier, data: T.CampaignContributePostInput, options?: RequestOptions<T.CampaignContributePostInput>): Promise<import("axios").AxiosResponse<T.CampaignContributePostResponse, T.CampaignContributePostInput, {}, any>>;
     /**
-     * Performs the health operation for the router capability.
+     * Read process health and the package version; no dependency readiness check is performed.
      * Calls `GET /health` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    routerHealthGetHealth(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RouterHealthGetHealthResponse, unknown, {}>>;
+    routerHealthGetHealth(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ServiceHealthResponse, unknown, {}, any>>;
     /**
-     * Performs the health operation for the router capability.
+     * Read process health and the package version; no dependency readiness check is performed.
      * Calls `GET /up` through the shared IDP-aware Faiber client.
      * @param options Axios headers, timeout, cancellation signal, credentials, adapter, and other request options.
-     * @returns The complete Axios response, including the typed service envelope, status, and headers.
-     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: session-derived or public bootstrap route.
+     * @returns The complete Axios response, including the typed handler payload, status, and headers.
+     * @throws AxiosError for authentication, permission, validation, not-found, conflict, or transport failures; required permission: no local authentication or permission check; deployment gateway policy is separate.
      */
-    routerHealthGetUp(options?: RequestOptions): Promise<import("axios").AxiosResponse<T.RouterHealthGetUpResponse, unknown, {}>>;
+    routerHealthGetUp(options?: RequestOptions): Promise<import("axios").AxiosResponse<import("@faiber/sdk-core").ServiceHealthResponse, unknown, {}, any>>;
 }
 //# sourceMappingURL=operations.d.ts.map