@geolens/sdk 1.0.0 → 1.2.3

package/dist/client/sdk.gen.js

@@ -434,6 +434,29 @@ export const generateMetadataSummaryAiMetadataSummaryPost = (options) => (option
         ...options.headers
     }
 });
+/**
+ * Get Column Ddl Feed
+ *
+ * Return the column-DDL audit history for a dataset.
+ *
+ * SEC-FU-08: Surfaces the column-DDL events written by SEC-S03 (Phase 1061)
+ * to dataset owners so they can detect editor-initiated schema changes.
+ *
+ * Access control (AGENTS.md Pre-Commit Checklist Rule 1):
+ * - Owner + granted roles: 200 with their own dataset's DDL history
+ * - Non-owner editor (no grant): 404 (check_dataset_access raises 404 for
+ * private datasets)
+ * - Admin: 200 (admin access is always allowed)
+ * - Anonymous: 401 (get_current_active_user dependency)
+ *
+ * The dataset 404-before-auth-query ordering ensures non-existent datasets
+ * return 404 without leaking audit log details.
+ */
+export const getColumnDdlFeedAuditDatasetsDatasetIdColumnDdlGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/audit/datasets/{dataset_id}/column-ddl',
+    ...options
+});
 /**
  * List My Api Keys
  *
@@ -490,6 +513,24 @@ export const changePasswordAuthChangePasswordPost = (options) => (options.client
  * Return public auth configuration (no authentication required).
  */
 export const configAuthConfigGet = (options) => (options?.client ?? client).get({ url: '/auth/config/', ...options });
+/**
+ * Create Download Token Endpoint
+ *
+ * Mint a short-lived download-scoped JWT for a single dataset.
+ *
+ * IA-P0-01 / SEC-04: the existing COG download URL path requires a
+ * ``typ='download'`` JWT on the ``?token=`` query parameter — session JWTs
+ * are rejected. This endpoint issues that token after verifying the caller
+ * has read access to the dataset.
+ *
+ * Anonymous callers are allowed for public datasets. The returned token has
+ * ``typ='download'``, ``scope='dataset:{dataset_id}'``, and a TTL of 120s.
+ */
+export const createDownloadTokenEndpointAuthDownloadTokenDatasetIdPost = (options) => (options.client ?? client).post({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/auth/download-token/{dataset_id}',
+    ...options
+});
 /**
  * Login
  *
@@ -497,7 +538,7 @@ export const configAuthConfigGet = (options) => (options?.client ?? client).get(
  */
 export const loginAuthLoginPost = (options) => (options.client ?? client).post({
     ...urlSearchParamsBodySerializer,
-    url: '/auth/login/',
+    url: '/auth/login',
     ...options,
     headers: {
         'Content-Type': 'application/x-www-form-urlencoded',
@@ -507,7 +548,12 @@ export const loginAuthLoginPost = (options) => (options.client ?? client).post({
 /**
  * Logout
  *
- * Revoke all refresh tokens for the current user.
+ * Revoke all refresh tokens and bump token_version for the current user.
+ *
+ * SEC-S15 (Phase 1062-01): revoke_all_tokens bumps User.token_version so the
+ * access JWT used for this logout call (and any other outstanding access JWTs)
+ * are rejected on the next authenticated request — closing the
+ * "logout doesn't invalidate the access JWT" gap.
  */
 export const logoutAuthLogoutPost = (options) => (options?.client ?? client).post({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -544,12 +590,24 @@ export const listPublicProvidersAuthOauthProvidersGet = (options) => (options?.c
  * Oauth Callback
  *
  * Handle IdP callback: exchange code, find/create user, issue JWT, redirect to frontend.
+ *
+ * Phase 268 H-27: the frontend redirect carries access tokens in the URL
+ * fragment. Without explicit-config resolution, an attacker controlling
+ * ``X-Forwarded-Host`` could steer the post-callback redirect to
+ * attacker.com and capture the tokens. Force explicit-config resolution
+ * by passing ``for_external_use=True``.
  */
 export const oauthCallbackAuthOauthProviderSlugCallbackGet = (options) => (options.client ?? client).get({ url: '/auth/oauth/{provider_slug}/callback', ...options });
 /**
  * Oauth Login
  *
  * Redirect user to the IdP authorization URL with PKCE parameters.
+ *
+ * Phase 268 H-27: the redirect_uri is handed to the IdP, where an
+ * attacker-controlled origin (via ``X-Forwarded-Host``) would otherwise
+ * enable auth-code theft. We force explicit-config resolution by
+ * passing ``for_external_use=True``; falling back to the request-origin
+ * is refused.
  */
 export const oauthLoginAuthOauthProviderSlugLoginGet = (options) => (options.client ?? client).get({ url: '/auth/oauth/{provider_slug}/login', ...options });
 /**
@@ -873,6 +931,26 @@ export const createEmptyDatasetEndpointDatasetsCreatePost = (options) => (option
         ...options.headers
     }
 });
+/**
+ * Get Dcat Us3 Catalog
+ *
+ * DCAT-US Schema v3.0 catalog feed. Respects dataset visibility.
+ */
+export const getDcatUs3CatalogDatasetsDcatUs30Get = (options) => (options?.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/datasets/dcat-us/3.0/',
+    ...options
+});
+/**
+ * Validate Dcat Us3 Catalog
+ *
+ * Validate the visible DCAT-US Schema v3.0 catalog feed.
+ */
+export const validateDcatUs3CatalogDatasetsDcatUs30ValidationGet = (options) => (options?.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/datasets/dcat-us/3.0/validation/',
+    ...options
+});
 /**
  * Get Dcat Catalog
  *
@@ -896,7 +974,7 @@ export const deleteDatasetRelationshipDatasetsRelationshipsRelationshipIdDelete
 /**
  * Delete Dataset Endpoint
  *
- * Delete a dataset with cascade cleanup. Admin only, requires confirm_title.
+ * Delete a dataset with cascade cleanup. Owner or admin only, requires confirm_title.
  */
 export const deleteDatasetEndpointDatasetsDatasetIdDelete = (options) => (options.client ?? client).delete({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -995,6 +1073,26 @@ export const getColumnValuesDatasetsDatasetIdColumnsColumnNameValuesGet = (optio
     url: '/datasets/{dataset_id}/columns/{column_name}/values/',
     ...options
 });
+/**
+ * Get Dcat Us3 Record
+ *
+ * DCAT-US Schema v3.0 JSON-LD for a single dataset.
+ */
+export const getDcatUs3RecordDatasetsDatasetIdDcatUs30Get = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/datasets/{dataset_id}/dcat-us/3.0/',
+    ...options
+});
+/**
+ * Validate Dcat Us3 Record
+ *
+ * Validate a single dataset as DCAT-US Schema v3.0.
+ */
+export const validateDcatUs3RecordDatasetsDatasetIdDcatUs30ValidationGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/datasets/{dataset_id}/dcat-us/3.0/validation/',
+    ...options
+});
 /**
  * Get Dcat Record
  *
@@ -1013,6 +1111,12 @@ export const getDcatRecordDatasetsDatasetIdDcatGet = (options) => (options.clien
  * Local storage: streams the COG file with Content-Type image/tiff.
  * S3 storage: returns a 302 redirect to a presigned GET URL (1-hour expiry).
  * Accepts standard auth or ?token= JWT query parameter for browser downloads.
+ *
+ * KNOWN-01 (Phase 1071): ``user`` may be None when a no-sub anonymous
+ * download token (issued by POST /auth/download-token/{id} for a public
+ * dataset) is presented on ``?token=``. The function branches on
+ * user-None to enforce public visibility and emit the audit row with
+ * user_id=NULL.
  */
 export const downloadCogDatasetsDatasetIdDownloadCogGet = (options) => (options.client ?? client).get({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -1266,11 +1370,21 @@ export const reuploadCommitDatasetsDatasetIdReuploadJobIdCommitPost = (options)
  * Reupload Preview
  *
  * Preview the schema diff between old dataset and new upload.
+ *
+ * When the uploaded file contains multiple layers, the response includes
+ * ``all_layers`` (for frontend layer-select UI) and ``previous_source_layer``
+ * (pre-selection hint from the most-recent completed IngestJob for this
+ * dataset).  Pass ``layer_name`` in the request body to target a specific
+ * layer; omit it to get the default first-layer metadata.
  */
 export const reuploadPreviewDatasetsDatasetIdReuploadJobIdPreviewPost = (options) => (options.client ?? client).post({
     security: [{ scheme: 'bearer', type: 'http' }],
     url: '/datasets/{dataset_id}/reupload/{job_id}/preview',
-    ...options
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
 });
 /**
  * Get Dataset Rows Endpoint
@@ -1390,6 +1504,35 @@ export const getVrtStatusDatasetsDatasetIdVrtStatusGet = (options) => (options.c
  * Health check endpoint for ALB, Docker, and Nginx.
  */
 export const healthHealthGet = (options) => (options?.client ?? client).get({ url: '/health', ...options });
+/**
+ * Commit Fan Out
+ *
+ * Convert a single pending IngestJob into N independent per-layer ingest tasks.
+ *
+ * For multi-layer sources (e.g. GeoPackage with 2+ layers), this endpoint
+ * fans out the original upload into one Procrastinate task per requested
+ * layer, each becoming a separate dataset. The original job is marked
+ * 'fanned_out' (a terminal state).
+ *
+ * Required: original job must be in status='pending'. Each layer_name in
+ * the request body must appear in job.user_metadata['all_layers']. Unknown
+ * layer names return HTTP 422 with the list of unrecognized names.
+ *
+ * Returns HTTP 202 with per-layer outcomes. Partial success is possible:
+ * each layer result carries status='queued' or status='failed' with a
+ * user-safe error message.
+ *
+ * Permission: same as POST /ingest/commit/{job_id} — 'upload' capability.
+ */
+export const commitFanOutIngestCommitFanOutJobIdPost = (options) => (options.client ?? client).post({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/ingest/commit-fan-out/{job_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Commit Import
  *
@@ -1422,6 +1565,20 @@ export const discoverTablesIngestDiscoverGet = (options) => (options?.client ??
     url: '/ingest/discover/',
     ...options
 });
+/**
+ * Apply Manifest Endpoint
+ *
+ * Apply a versioned manifest through the ingest service layer.
+ */
+export const applyManifestEndpointIngestManifestApplyPost = (options) => (options.client ?? client).post({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/ingest/manifest/apply',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Preview File
  *
@@ -1742,16 +1899,93 @@ export const createMapEndpointMapsPost = (options) => (options.client ?? client)
         ...options.headers
     }
 });
+/**
+ * List Map Icons Endpoint
+ *
+ * List reusable default and uploaded map icons.
+ */
+export const listMapIconsEndpointMapsIconsGet = (options) => (options?.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/icons',
+    ...options
+});
+/**
+ * Upload Map Icon Endpoint
+ *
+ * Upload a reusable SVG or PNG icon for symbol layers.
+ */
+export const uploadMapIconEndpointMapsIconsPost = (options) => (options.client ?? client).post({
+    ...formDataBodySerializer,
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/icons',
+    ...options,
+    headers: {
+        'Content-Type': null,
+        ...options.headers
+    }
+});
+/**
+ * Get Map Icon Asset Endpoint
+ *
+ * Serve an uploaded or bundled icon asset by stable icon ID.
+ *
+ * SEC-01 / M-63: SVG responses carry Content-Security-Policy
+ * ``default-src 'none'; sandbox`` so an uploaded SVG cannot fetch other
+ * origins, run scripts, or read auth cookies even if validation is bypassed
+ * in the future. Browsers (Chromium, Firefox) honor the sandbox directive on
+ * image/svg+xml responses. PNG responses use the global SecurityHeadersMiddleware
+ * default ``frame-ancestors 'self'``.
+ */
+export const getMapIconAssetEndpointMapsIconsIconIdAssetGet = (options) => (options.client ?? client).get({ url: '/maps/icons/{icon_id}/asset', ...options });
+/**
+ * Import Map Style Endpoint
+ *
+ * Import a MapLibre style JSON document into a new GeoLens map.
+ *
+ * API-01 (M-05): the request body is now a typed Pydantic model instead of
+ * a bare ``dict``. ``MapStyleImportRequest`` mirrors the MapLibre style
+ * spec top-level keys with ``extra="allow"``, so existing payloads keep
+ * working byte-identically while the OpenAPI schema gains a named class
+ * and the auto-generated SDKs stop emitting an opaque ``Mapping[str, Any]``
+ * request type.
+ */
+export const importMapStyleEndpointMapsImportPost = (options) => (options.client ?? client).post({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/import',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Get Shared Map Endpoint
  *
  * Get a shared map by token. Optionally authenticated for non-public layers.
+ *
+ * SEC-S08 (Phase 1062-05): emits ``Content-Security-Policy: frame-ancestors
+ * 'self' [<allowed_origins>...]`` on the response, derived from the active
+ * EmbedToken for this map. When no EmbedToken exists or allowed_origins is
+ * empty, defaults to ``frame-ancestors 'self'``. The SecurityHeadersMiddleware
+ * respects this route-level CSP and skips emitting X-Frame-Options: DENY.
  */
 export const getSharedMapEndpointMapsSharedTokenGet = (options) => (options.client ?? client).get({
     security: [{ scheme: 'bearer', type: 'http' }],
     url: '/maps/shared/{token}',
     ...options
 });
+/**
+ * Get Geolens Sprite Index Endpoint
+ *
+ * Serve the stable GeoLens sprite JSON index.
+ */
+export const getGeolensSpriteIndexEndpointMapsSpritesGeolensJsonGet = (options) => (options?.client ?? client).get({ url: '/maps/sprites/geolens.json', ...options });
+/**
+ * Get Geolens Sprite Png Endpoint
+ *
+ * Serve the generated GeoLens sprite sheet for stable icon IDs.
+ */
+export const getGeolensSpritePngEndpointMapsSpritesGeolensPngGet = (options) => (options?.client ?? client).get({ url: '/maps/sprites/geolens.png', ...options });
 /**
  * Delete Map Endpoint
  *
@@ -1786,6 +2020,16 @@ export const updateMapEndpointMapsMapIdPut = (options) => (options.client ?? cli
         ...options.headers
     }
 });
+/**
+ * Get Map Access Endpoint
+ *
+ * Return server-confirmed route access for the map viewer gate.
+ */
+export const getMapAccessEndpointMapsMapIdAccessGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/access/',
+    ...options
+});
 /**
  * Duplicate Map Endpoint
  *
@@ -1810,6 +2054,9 @@ export const listEmbedTokensEndpointMapsMapIdEmbedTokensGet = (options) => (opti
  * Create Embed Token Endpoint
  *
  * Create an embed token scoped to a map's current layers.
+ *
+ * Community supports the default 30-day unrestricted token. Custom lifetimes
+ * and non-empty origin restrictions require the enterprise edition.
  */
 export const createEmbedTokenEndpointMapsMapIdEmbedTokensPost = (options) => (options.client ?? client).post({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -1834,6 +2081,8 @@ export const revokeEmbedTokenEndpointMapsMapIdEmbedTokensTokenIdDelete = (option
  * Update Embed Token Endpoint
  *
  * Update embed token allowed_origins.
+ *
+ * Null clears restrictions. Non-empty origin restrictions require the enterprise edition.
  */
 export const updateEmbedTokenEndpointMapsMapIdEmbedTokensTokenIdPatch = (options) => (options.client ?? client).patch({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -1844,14 +2093,78 @@ export const updateEmbedTokenEndpointMapsMapIdEmbedTokensTokenIdPatch = (options
         ...options.headers
     }
 });
+/**
+ * Get Map History Endpoint
+ *
+ * Return recent builder edit history for a map.
+ */
+export const getMapHistoryEndpointMapsMapIdHistoryGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/history',
+    ...options
+});
+/**
+ * Patch Map Layers Endpoint
+ *
+ * Apply incremental layer additions, patches, removals, and ordering.
+ *
+ * v13.14 fixup: declared on both slash variants directly (mirrors the
+ * Phase 280 fix on POST). FastAPI's default redirect_slashes builds a
+ * relative Location header that resolves against the request's Host
+ * header, which would leak the in-container ``api:8000`` hostname
+ * through Vite's dev proxy on a 307 redirect. The canonical
+ * (OpenAPI-published) form is the no-slash sub-collection convention
+ * documented in the GeoLens API guide (https://docs.getgeolens.com/guides/api/);
+ * the trailing-slash form is a hidden alias.
+ */
+export const patchMapLayersEndpointMapsMapIdLayersPatch = (options) => (options.client ?? client).patch({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/layers',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Add Layer Endpoint
  *
  * Add a layer to a map.
+ *
+ * Phase 280: declared on both slash variants directly so neither emits a
+ * 307. FastAPI's default redirect_slashes builds a relative Location
+ * header that resolves against the request's Host header, leaking the
+ * in-container ``api:8000`` hostname through Vite's dev proxy. The
+ * canonical (OpenAPI-published) form is the no-slash sub-collection
+ * convention documented in the GeoLens API guide
+ * (https://docs.getgeolens.com/guides/api/); the trailing-slash form is a
+ * hidden alias for callers that send the slash.
  */
 export const addLayerEndpointMapsMapIdLayersPost = (options) => (options.client ?? client).post({
     security: [{ scheme: 'bearer', type: 'http' }],
-    url: '/maps/{map_id}/layers/',
+    url: '/maps/{map_id}/layers',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Bulk Delete Layers Endpoint
+ *
+ * Batch-delete multiple layers from a map in a single request.
+ *
+ * Milestone exception (v1010 Phase 1047): one additive endpoint permitted
+ * per REQUIREMENTS.md Out-of-Scope to reduce N sequential DELETEs to one
+ * batched call for bulk-delete UX (PB-03 / PERF-03).
+ *
+ * Returns 200 with deleted/failed arrays in all cases (partial failures
+ * surface inline, not as HTTP errors).  Full rollback is the caller's
+ * responsibility if all ids fail.
+ */
+export const bulkDeleteLayersEndpointMapsMapIdLayersBulkDeletePost = (options) => (options.client ?? client).post({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/layers/bulk-delete',
     ...options,
     headers: {
         'Content-Type': 'application/json',
@@ -1868,6 +2181,45 @@ export const removeLayerEndpointMapsMapIdLayersLayerIdDelete = (options) => (opt
     url: '/maps/{map_id}/layers/{layer_id}',
     ...options
 });
+/**
+ * Get Og Image
+ *
+ * Serve the OG social-card image from storage (visibility-checked).
+ *
+ * Uses ``public, max-age=86400`` for public maps — OG images change
+ * less often than thumbnails (which use 3600s). Mirrors get_thumbnail
+ * but reads ``og_image_uri`` and uses the ``maps/og-images/`` key space.
+ */
+export const getOgImageMapsMapIdOgImageGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/og-image/',
+    ...options
+});
+/**
+ * Upload Og Image
+ *
+ * Upload a base64 OG social-card image (up to 750KB) for a map.
+ *
+ * Accepts a data:image/ URI, decodes the base64 payload, validates the
+ * bytes are a real image (PIL verify), writes to storage under
+ * ``maps/og-images/{map_id}.{ext}``, and persists the storage key to
+ * ``catalog.maps.og_image_uri``.
+ *
+ * Intended for 1200x630 JPEG captures (SHARE-08). The payload cap
+ * (750KB) is larger than the thumbnail cap (100KB) to accommodate the
+ * larger canvas export — they are separate schemas (OgImageUploadRequest
+ * vs ThumbnailUploadRequest) to avoid relaxing the locked thumbnail
+ * contract. Auth and PIL-verify rules are identical to upload_thumbnail.
+ */
+export const uploadOgImageMapsMapIdOgImagePut = (options) => (options.client ?? client).put({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/og-image/',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Revoke Map Share Endpoint
  *
@@ -1892,6 +2244,8 @@ export const getMapShareTokenEndpointMapsMapIdShareGet = (options) => (options.c
  * Update Map Share Token Endpoint
  *
  * Update expiration on an existing share token. Owner or admin only.
+ *
+ * Null clears expiration.
  */
 export const updateMapShareTokenEndpointMapsMapIdSharePatch = (options) => (options.client ?? client).patch({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -1916,6 +2270,16 @@ export const shareMapEndpointMapsMapIdSharePost = (options) => (options.client ?
         ...options.headers
     }
 });
+/**
+ * Export Map Style Endpoint
+ *
+ * Export a saved map as a complete MapLibre style JSON document.
+ */
+export const exportMapStyleEndpointMapsMapIdStyleJsonGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/maps/{map_id}/style.json',
+    ...options
+});
 /**
  * Get Thumbnail
  *
@@ -1935,12 +2299,11 @@ export const getThumbnailMapsMapIdThumbnailGet = (options) => (options.client ??
  * bytes to the configured storage provider, and stores the storage key.
  */
 export const uploadThumbnailMapsMapIdThumbnailPut = (options) => (options.client ?? client).put({
-    bodySerializer: null,
     security: [{ scheme: 'bearer', type: 'http' }],
     url: '/maps/{map_id}/thumbnail/',
     ...options,
     headers: {
-        'Content-Type': 'text/plain',
+        'Content-Type': 'application/json',
         ...options.headers
     }
 });
@@ -2289,6 +2652,14 @@ export const getApiKeyStatusSettingsApiKeyStatusGet = (options) => (options?.cli
  * Basemaps with ``{api_key}`` in the URL are filtered out when no key is
  * configured.  When a key IS set the placeholder is resolved server-side.
  * The response uses ``BasemapPublicResponse`` which excludes ``api_key``.
+ *
+ * SEC-S10 (2026-05-20 audit): the resolved ``url`` field intentionally
+ * includes the substituted ``api_key`` value when configured. Client-side
+ * tile-provider keys (Mapbox, Stadia, MapTiler) are designed for browser
+ * exposure and the frontend MUST receive them to load tiles. Do NOT put a
+ * backend-only commercial-tier key in this field — rotate the key in the
+ * provider dashboard if it is misused. Rate-limited via
+ * ``_basemap_proxy_rate_limit`` to cap replay-cost from anonymous clients.
  */
 export const getBasemapsSettingsBasemapsGet = (options) => (options?.client ?? client).get({ url: '/settings/basemaps/', ...options });
 /**
@@ -2325,11 +2696,32 @@ export const detectEmbeddingDimsSettingsDetectEmbeddingDimsPost = (options) => (
  */
 export const editionInfoSettingsEditionGet = (options) => (options?.client ?? client).get({ url: '/settings/edition/', ...options });
 /**
- * Get Enabled Widgets
+ * Get Enabled Plugins
  *
- * Return enabled widget IDs. null = no restriction (all shown), [] = none, [...ids] = only those.
+ * Return enabled plugin IDs. null = no restriction (all shown), [] = none, [...ids] = only those.
  */
-export const getEnabledWidgetsSettingsEnabledWidgetsGet = (options) => (options?.client ?? client).get({ url: '/settings/enabled-widgets/', ...options });
+export const getEnabledPluginsSettingsEnabledPluginsGet = (options) => (options?.client ?? client).get({ url: '/settings/enabled-plugins/', ...options });
+/**
+ * Get Enterprise Only Tabs
+ *
+ * Return the canonical list of Settings tab keys that are enterprise-only.
+ *
+ * Phase 279 ADMIN-03 (M-03): single source of truth for enterprise-only
+ * Settings tabs. The frontend AdminSidebar uses this to conditionally render
+ * the tabs in community vs enterprise editions. The backend
+ * ``_require_enterprise_for_key`` gate uses the same set to 404 community
+ * attempts at writing enterprise-tab settings — keeping these aligned
+ * prevents silent UX drift.
+ *
+ * Note: not gated by ``require_enterprise``. Community callers must be able
+ * to read the list to render their own sidebar correctly (the response tells
+ * them which tabs to HIDE).
+ */
+export const getEnterpriseOnlyTabsSettingsEnterpriseTabsGet = (options) => (options?.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/settings/enterprise-tabs/',
+    ...options
+});
 /**
  * Get Feature Flags
  *
@@ -2448,13 +2840,21 @@ export const getCollectionStacCollectionsCollectionIdGet = (options) => (options
  *
  * List STAC Items within a collection.
  */
-export const getCollectionItemsStacCollectionsCollectionIdItemsGet = (options) => (options.client ?? client).get({ url: '/stac/collections/{collection_id}/items', ...options });
+export const getCollectionItemsStacCollectionsCollectionIdItemsGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/stac/collections/{collection_id}/items',
+    ...options
+});
 /**
  * Get Collection Item
  *
  * Get a single STAC Item within a collection.
  */
-export const getCollectionItemStacCollectionsCollectionIdItemsItemIdGet = (options) => (options.client ?? client).get({ url: '/stac/collections/{collection_id}/items/{item_id}', ...options });
+export const getCollectionItemStacCollectionsCollectionIdItemsItemIdGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/stac/collections/{collection_id}/items/{item_id}',
+    ...options
+});
 /**
  * Conformance
  *
@@ -2466,19 +2866,28 @@ export const conformanceStacConformanceGet = (options) => (options?.client ?? cl
  *
  * Get a single STAC Item by dataset ID.
  */
-export const getItemStacItemsItemIdGet = (options) => (options.client ?? client).get({ url: '/stac/items/{item_id}', ...options });
+export const getItemStacItemsItemIdGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/stac/items/{item_id}',
+    ...options
+});
 /**
  * Search Get
  *
  * STAC Item Search (GET).
  */
-export const searchGetStacSearchGet = (options) => (options?.client ?? client).get({ url: '/stac/search', ...options });
+export const searchGetStacSearchGet = (options) => (options?.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/stac/search',
+    ...options
+});
 /**
  * Search Post
  *
  * STAC Item Search (POST with JSON body).
  */
 export const searchPostStacSearchPost = (options) => (options.client ?? client).post({
+    security: [{ scheme: 'bearer', type: 'http' }],
     url: '/stac/search',
     ...options,
     headers: {
@@ -2486,6 +2895,22 @@ export const searchPostStacSearchPost = (options) => (options.client ?? client).
         ...options.headers
     }
 });
+/**
+ * Cluster Tile Endpoint
+ *
+ * Serve a server-side clustered vector tile for point datasets.
+ *
+ * URL pattern: /tiles/clusters/data.{table_name}/{z}/{x}/{y}.pbf
+ *
+ * This route deliberately reuses the normal vector tile auth model:
+ * public datasets are readable directly, non-public datasets require either
+ * valid HMAC tile params or a valid embed token scoped to the dataset.
+ */
+export const clusterTileEndpointTilesClustersTablePathZXYPbfGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/tiles/clusters/{table_path}/{z}/{x}/{y}.pbf',
+    ...options
+});
 /**
  * Raster Auth Check
  *
@@ -2513,6 +2938,23 @@ export const rasterAuthCheckTilesRasterAuthCheckGet = (options) => (options.clie
  * Used by Vite dev proxy and as a fallback for deployments without nginx.
  * Production deployments with nginx should use the nginx raster-tiles path
  * for better caching and performance.
+ *
+ * colormap_name: Optional Titiler colormap for single-band display. Validated
+ * against _ALLOWED_COLORMAPS (T-1140-01). Gray is the Titiler default for
+ * single-band — passing gray is a no-op (not forwarded). colormap_name is not
+ * forwarded for DEM layers (render_params starts with 'algorithm=').
+ *
+ * stretch: Optional stretch strategy. percentile/stddev compute a stats-based
+ * rescale from Titiler band statistics. Multi-band rasters produce one rescale=
+ * fragment per band (up to 3, RASTER-STRETCH-03).
+ *
+ * pmin/pmax: Configurable percentile clip bounds (default 2/98). Must satisfy
+ * 0 <= pmin < pmax <= 100. Forwarded as repeated p= params to /cog/statistics.
+ * The _band_stats_cache key includes pmin/pmax so different bounds never serve
+ * stale cached stats (RASTER-STRETCH-UI-01 / Phase 1153 cache-key isolation).
+ *
+ * sigma: Standard-deviation multiplier for stretch=stddev (default 2.0).
+ * Must be > 0.
  */
 export const rasterTileProxyTilesRasterProxyDatasetIdZXYFmtGet = (options) => (options.client ?? client).get({
     security: [{ scheme: 'bearer', type: 'http' }],
@@ -2569,6 +3011,19 @@ export const getTileTokensBatchTilesTokensPost = (options) => (options.client ??
  *
  * Non-public datasets require valid HMAC signature params (sig, exp, scope).
  * Public datasets can be accessed without any signature.
+ *
+ * `cols` is a runtime opt-in for additional attribute columns the client
+ * needs at all zooms (e.g. data-driven styling columns referenced by
+ * MapLibre paint expressions). Format: comma-separated column names.
+ * Each name is validated against the dataset column list before it
+ * flows into the MVT projection; invalid names are silently dropped.
+ * Does not need to be signed — `sig` already authorizes dataset
+ * access and `cols` can only project columns the caller already has
+ * REST access to.
  */
-export const tileEndpointTilesTablePathZXYPbfGet = (options) => (options.client ?? client).get({ url: '/tiles/{table_path}/{z}/{x}/{y}.pbf', ...options });
+export const tileEndpointTilesTablePathZXYPbfGet = (options) => (options.client ?? client).get({
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/tiles/{table_path}/{z}/{x}/{y}.pbf',
+    ...options
+});
 //# sourceMappingURL=sdk.gen.js.map