@onesi/genesis 0.0.1-stage → 0.2.0

package/dist/auto.js

@@ -0,0 +1,125 @@
+import { idempotencyHeaders, ifMatchHeaders } from './idempotency.js';
+/** Auto, your organization's operating structure: orgs, mandates, spend actions, approvals, the org structure (units, positions with
+ * delegated authority, occupants, goals and scorecards), how the org operates (budgets, policies, cadences,
+ * succession and acting appointments), verifiable authority (the authority check with its signed receipt,
+ * AuthorityCredentials, token verification) and the decision ledger. Auto never runs or controls an agent.
+ * Updates, archives, appointments, vacancies, succession and acting changes take the `version` you read
+ * (sent as If-Match); a stale one is a 409. */
+export function autoModule(client) {
+    return {
+        whoami: () => client.request('auto_whoami'),
+        orgs: {
+            list: (includeArchived) => client.request('auto_listOrgs', includeArchived === undefined ? {} : { include_archived: includeArchived }),
+            get: (org) => client.request('auto_getOrg', { org }),
+            create: (body) => client.request('auto_createOrg', { body }),
+            update: (org, version, body) => client.request('auto_updateOrg', { org, body }, { headers: ifMatchHeaders('auto_updateOrg', version) }),
+            archive: (org, version) => client.request('auto_archiveOrg', { org }, { headers: ifMatchHeaders('auto_archiveOrg', version) }),
+            mandates: (org) => client.request('auto_listMandates', { org }),
+            createMandate: (org, body) => client.request('auto_createMandate', { org, body }),
+            recordDecision: (org, body) => client.request('auto_recordDecision', { org, body }),
+            ledger: (org, page = {}) => client.request('auto_getLedger', { org, ...page }),
+            verifyLedger: (org) => client.request('auto_verifyLedger', { org }),
+            approvals: (org, status) => client.request('auto_listApprovals', status ? { org, status } : { org }),
+            units: (org, includeArchived) => client.request('auto_listUnits', includeArchived === undefined ? { org } : { org, include_archived: includeArchived }),
+            createUnit: (org, body) => client.request('auto_createUnit', { org, body }),
+            positions: (org, filter = {}) => client.request('auto_listPositions', { org, ...filter }),
+            createPosition: (org, body) => client.request('auto_createPosition', { org, body }),
+            chart: (org) => client.request('auto_getOrgChart', { org }),
+            goals: (org, positionId) => client.request('auto_listGoals', positionId ? { org, position_id: positionId } : { org }),
+            createGoal: (org, body) => client.request('auto_createGoal', { org, body }),
+            scorecard: (org) => client.request('auto_getOrgScorecard', { org }),
+            budgets: (org, filter = {}) => client.request('auto_listBudgets', { org, ...filter }),
+            createBudget: (org, body) => client.request('auto_createBudget', { org, body }),
+            policies: (org, includeArchived) => client.request('auto_listPolicies', includeArchived === undefined ? { org } : { org, include_archived: includeArchived }),
+            createPolicy: (org, body) => client.request('auto_createPolicy', { org, body }),
+            cadences: (org, filter = {}) => client.request('auto_listCadences', { org, ...filter }),
+            createCadence: (org, body) => client.request('auto_createCadence', { org, body }),
+            /** Active cadences due within `withinHours` (default 24, at most 744), overdue first, with who runs each. */
+            dueCadences: (org, withinHours) => client.request('auto_listDueCadences', withinHours === undefined ? { org } : { org, within_hours: withinHours }),
+            /** Vacancies, successors and single points of spend. */
+            continuity: (org) => client.request('auto_getOrgContinuity', { org }),
+            credentials: (org, positionId) => client.request('auto_listCredentials', positionId ? { org, position_id: positionId } : { org }),
+        },
+        units: {
+            get: (unit) => client.request('auto_getUnit', { unit }),
+            update: (unit, version, body) => client.request('auto_updateUnit', { unit, body }, { headers: ifMatchHeaders('auto_updateUnit', version) }),
+            archive: (unit, version) => client.request('auto_archiveUnit', { unit }, { headers: ifMatchHeaders('auto_archiveUnit', version) }),
+        },
+        /** Positions hold delegated authority; it only flows down the reporting line. */
+        positions: {
+            get: (position) => client.request('auto_getPosition', { position }),
+            update: (position, version, body) => client.request('auto_updatePosition', { position, body }, { headers: ifMatchHeaders('auto_updatePosition', version) }),
+            archive: (position, version) => client.request('auto_archivePosition', { position }, { headers: ifMatchHeaders('auto_archivePosition', version) }),
+            /** Fill the position or swap its occupant (a person, or a Henry, Fleets or Flocks agent that Auto only references). */
+            appoint: (position, version, body) => client.request('auto_appointOccupant', { position, body }, { headers: ifMatchHeaders('auto_appointOccupant', version) }),
+            vacate: (position, version) => client.request('auto_vacatePosition', { position }, { headers: ifMatchHeaders('auto_vacatePosition', version) }),
+            terms: (position) => client.request('auto_listPositionTerms', { position }),
+            scorecard: (position) => client.request('auto_getPositionScorecard', { position }),
+            /** Replace the ordered successor list (up to 5 positions; empty clears it). */
+            setSuccession: (position, version, body) => client.request('auto_setPositionSuccession', { position, body }, { headers: ifMatchHeaders('auto_setPositionSuccession', version) }),
+            /** Someone (the occupant of `from_position_id`, or the first filled successor) acts for the position. */
+            startActing: (position, version, body) => client.request('auto_startActing', { position, body }, { headers: ifMatchHeaders('auto_startActing', version) }),
+            endActing: (position, version, reason) => client.request('auto_endActing', reason === undefined ? { position } : { position, reason }, { headers: ifMatchHeaders('auto_endActing', version) }),
+            /** A signed AuthorityCredential (JWT) for the position's holder; the `token` is returned only here. */
+            issueCredential: (position, body = {}) => client.request('auto_issuePositionCredential', { position, body }),
+        },
+        /** "May this principal, in this position, do this?" Ledgered, never metered; `auto:read` alone gets a dry run. */
+        authority: {
+            /** With an idempotency key, a repeat returns the first answer (`idempotent_replay: true`) instead of counting spend twice. */
+            check: (body, options = {}) => client.request('auto_checkAuthority', { body }, { headers: idempotencyHeaders('auto_checkAuthority', options.idempotencyKey) }),
+            getCheck: (check) => client.request('auto_getAuthorityCheck', { check }),
+            /** Spend that was allowed but did not happen stops counting against limits and budgets. Once per check. */
+            release: (check, reason) => client.request('auto_releaseAuthorityCheck', { check, body: reason === undefined ? {} : { reason } }),
+            /** Check a receipt or an AuthorityCredential: Auto's signature, expiry and revocation. */
+            verify: (token) => client.request('auto_verifyAuthorityToken', { body: { token } }),
+        },
+        goals: {
+            get: (goal) => client.request('auto_getGoal', { goal }),
+            update: (goal, version, body) => client.request('auto_updateGoal', { goal, body }, { headers: ifMatchHeaders('auto_updateGoal', version) }),
+            archive: (goal, version) => client.request('auto_archiveGoal', { goal }, { headers: ifMatchHeaders('auto_archiveGoal', version) }),
+            measure: (goal, body) => client.request('auto_recordGoalMeasurement', { goal, body }),
+        },
+        /** Spend caps for a unit (and every unit below it) or the whole org, enforced by the authority check. */
+        budgets: {
+            get: (budget) => client.request('auto_getBudget', { budget }),
+            update: (budget, version, body) => client.request('auto_updateBudget', { budget, body }, { headers: ifMatchHeaders('auto_updateBudget', version) }),
+            archive: (budget, version) => client.request('auto_archiveBudget', { budget }, { headers: ifMatchHeaders('auto_archiveBudget', version) }),
+        },
+        /** Rules that tighten every authority check (deny, or escalate to a named position). */
+        policies: {
+            get: (policy) => client.request('auto_getPolicy', { policy }),
+            update: (policy, version, body) => client.request('auto_updatePolicy', { policy, body }, { headers: ifMatchHeaders('auto_updatePolicy', version) }),
+            archive: (policy, version) => client.request('auto_archivePolicy', { policy }, { headers: ifMatchHeaders('auto_archivePolicy', version) }),
+        },
+        /** The meetings, reviews and reports the org keeps. Auto keeps the schedule and the record; it never holds the meeting. */
+        cadences: {
+            get: (cadence) => client.request('auto_getCadence', { cadence }),
+            update: (cadence, version, body) => client.request('auto_updateCadence', { cadence, body }, { headers: ifMatchHeaders('auto_updateCadence', version) }),
+            archive: (cadence, version) => client.request('auto_archiveCadence', { cadence }, { headers: ifMatchHeaders('auto_archiveCadence', version) }),
+            occurrences: (cadence, limit) => client.request('auto_listCadenceOccurrences', limit === undefined ? { cadence } : { cadence, limit }),
+            /** Record that the occurrence was held or skipped; the cadence moves to its next slot. */
+            record: (cadence, body) => client.request('auto_recordCadenceOccurrence', { cadence, body }),
+        },
+        credentials: {
+            get: (credential) => client.request('auto_getCredential', { credential }),
+            /** Public (no credential sent): the status any verifier reads from a credential's `credentialStatus` URL. */
+            status: (credential) => client.request('auto_getCredentialStatus', { credential }),
+            revoke: (credential, reason) => client.request('auto_revokeCredential', { credential, body: reason === undefined ? {} : { reason } }),
+        },
+        /** Public (no credential sent): Auto's signing keys and DID document, to verify receipts and credentials offline. */
+        keys: {
+            jwks: () => client.request('auto_getJwks'),
+            did: () => client.request('auto_getDidDocument'),
+        },
+        mandates: {
+            get: (mandate) => client.request('auto_getMandate', { mandate }),
+            update: (mandate, version, body) => client.request('auto_updateMandate', { mandate, body }, { headers: ifMatchHeaders('auto_updateMandate', version) }),
+            archive: (mandate, version) => client.request('auto_archiveMandate', { mandate }, { headers: ifMatchHeaders('auto_archiveMandate', version) }),
+            propose: (mandate, body) => client.request('auto_proposeAction', { mandate, body }),
+        },
+        approvals: {
+            get: (approval) => client.request('auto_getApproval', { approval }),
+            decide: (approval, body) => client.request('auto_decideApproval', { approval, body }),
+        },
+    };
+}

package/dist/beacons.d.ts

@@ -0,0 +1,145 @@
+import type { GenesisClient } from './client.js';
+import type { OperationInput, OperationOutput } from './types.js';
+type DashboardOptions = {
+    signal?: AbortSignal;
+};
+type PolicyConfig = OperationInput<'beacons_updateDashboardPolicy'>['body']['config'];
+/** Configuration-record families Genesis admits (beacons-api native_resources.rs). */
+export declare const BEACONS_RESOURCE_FAMILIES: readonly ["gateways", "private-gateways", "sims"];
+export type BeaconsResourceFamily = typeof BEACONS_RESOURCE_FAMILIES[number];
+type ResourceCreate = OperationInput<'beacons_createDashboardResource'>['body'];
+type ResourceUpdate = OperationInput<'beacons_updateDashboardResource'>['body'];
+/** Platforms with a Beacons agent client profile; the gateway and Beacons admit only these. */
+export declare const BEACONS_CLIENT_PLATFORMS: readonly ["linux", "macos", "windows", "ios", "android"];
+export type BeaconsClientPlatform = typeof BEACONS_CLIENT_PLATFORMS[number];
+/** Beacons uses the authenticated Genesis organization; never supply an org header. */
+export declare function beaconsModule(client: GenesisClient): {
+    fleets: {
+        /** Current human-authorized selected Sandbox scope; no caller tenant identifiers. */
+        list: (options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardFleet"][];
+        }>;
+        update: (id: string, body: {
+            name: string;
+        }, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardFleet"];
+        }>;
+        peers: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardPeer"][];
+        }>;
+        /** One peer's tunnel config: other live peers' public keys; never a private key. */
+        wireguardConfig: (id: string, peerId: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardWireguardConfig"];
+        }>;
+        /** One fleet in the current selection; 404 when it is outside it. */
+        get: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardFleet"];
+        }>;
+        /** Mesh DNS map: one A record per live peer. */
+        dns: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardDnsMap"];
+        }>;
+        /** Mesh discovery map: live peers' public keys and routes, DNS, signal and relay map. */
+        discovery: (id: string, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardDiscoveryMap"];
+        }>;
+        /** beacons-agent profile for one platform: API origin, DNS suffix and command line. */
+        clientProfile: (id: string, platform: BeaconsClientPlatform, options?: DashboardOptions) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DashboardClientProfile"];
+        }>;
+        policy: {
+            get: (id: string, options?: DashboardOptions) => Promise<{
+                data: {
+                    fleet_id: string;
+                    config: import("./index.js").components["schemas"]["Beacons.DashboardPolicyConfig"];
+                    source: "default" | "persisted";
+                    updated_at: string | null;
+                    scope: import("./index.js").components["schemas"]["Beacons.DashboardScope"];
+                };
+            }>;
+            /** Future device admissions only; this never grants IAM rights or revokes an existing peer. */
+            update: (id: string, config: PolicyConfig, options?: DashboardOptions) => Promise<{
+                data: {
+                    fleet_id: string;
+                    config: import("./index.js").components["schemas"]["Beacons.DashboardPolicyConfig"];
+                    source: "default" | "persisted";
+                    updated_at: string | null;
+                    scope: import("./index.js").components["schemas"]["Beacons.DashboardScope"];
+                };
+            }>;
+        };
+        /** Fleet configuration records (gateways, private-gateways, sims). Configuration only: nothing is provisioned or connected. */
+        resources: {
+            list: (id: string, kind: BeaconsResourceFamily, options?: DashboardOptions) => Promise<{
+                data: import("./index.js").components["schemas"]["Beacons.DashboardResource"][];
+            }>;
+            /** Not idempotent: a retry after an interrupted response creates a second record. */
+            create: (id: string, kind: BeaconsResourceFamily, body: ResourceCreate, options?: DashboardOptions) => Promise<{
+                data: import("./index.js").components["schemas"]["Beacons.DashboardResource"];
+            }>;
+            update: (id: string, kind: BeaconsResourceFamily, resourceId: string, body: ResourceUpdate, options?: DashboardOptions) => Promise<{
+                data: import("./index.js").components["schemas"]["Beacons.DashboardResource"];
+            }>;
+            delete: (id: string, kind: BeaconsResourceFamily, resourceId: string, options?: DashboardOptions) => Promise<void>;
+        };
+        /** Reuse the same request ID and body after an interrupted response. Creates metadata only. */
+        provision: (requestId: string, body?: {
+            name?: string;
+        }) => Promise<{
+            data: {
+                fleet_id: string;
+                organization_id: string;
+                workspace_id: string;
+                project_id: string;
+                environment_id: string;
+                metadata_only: true;
+            };
+        }>;
+    };
+    devices: {
+        revocations: (id: string) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DeviceRevocation"][];
+        }>;
+        acknowledge: (id: string, version: number, body: OperationInput<"beacons_acknowledgeBridgeDeviceRevocation">["body"]) => Promise<{
+            data: import("./index.js").components["schemas"]["Beacons.DeviceRevocation"];
+        }>;
+        challenge: (body: OperationInput<"beacons_issueBridgeDeviceChallenge">["body"]) => Promise<{
+            version: 1;
+            id: string;
+            nonce: string;
+            issuer: string;
+            organization: string;
+            principal: string;
+            workspace: string;
+            project: string;
+            environment: string;
+            binding_revision: string;
+            transport: string;
+            fleet_id: string;
+            proof_key: string;
+            tunnel_key: string;
+            issued_at: number;
+            expires_at: number;
+        }>;
+        enroll: (body: OperationInput<"beacons_enrollBridgeDevice">["body"]) => Promise<{
+            device_id: string;
+            fleet_id: string;
+            mesh: {
+                [key: string]: unknown;
+            };
+        }>;
+        list: () => Promise<{
+            data?: import("./index.js").components["schemas"]["Beacons.BridgeDevice"][];
+        }>;
+        update: (id: string, body: OperationInput<"beacons_updateBridgeDevice">["body"]) => Promise<{
+            id: string;
+            org_id: string;
+            name: string;
+            nicknames: string[];
+            created_at: string;
+            status: string;
+        }>;
+        revoke: (id: string) => Promise<OperationOutput<"beacons_revokeBridgeDevice"> | undefined>;
+    };
+};
+export {};

package/dist/beacons.js

@@ -0,0 +1,148 @@
+import { GenesisError } from './errors.js';
+function invalidDashboard(operationId) {
+    throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+        message: 'Provide a canonical fleet UUID and only the documented Beacons fields.' });
+}
+function fleetId(id, operationId) {
+    if (typeof id !== 'string' || id.length !== 36 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id)
+        || id === '00000000-0000-0000-0000-000000000000')
+        invalidDashboard(operationId);
+    return id;
+}
+function renameInput(body) {
+    const op = 'beacons_updateDashboardFleet';
+    if (!body || typeof body !== 'object' || Array.isArray(body)
+        || Object.keys(body).length !== 1 || !Object.hasOwn(body, 'name'))
+        invalidDashboard(op);
+    const suppliedName = body.name;
+    if (typeof suppliedName !== 'string')
+        invalidDashboard(op);
+    const name = suppliedName.trim();
+    if (!name || new TextEncoder().encode(name).length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(name))
+        invalidDashboard(op);
+    return { name };
+}
+function policyInput(config) {
+    const op = 'beacons_updateDashboardPolicy';
+    if (!config || typeof config !== 'object' || Array.isArray(config)
+        || Object.keys(config).some(key => !['device_enrollment', 'max_devices'].includes(key))
+        || !Object.hasOwn(config, 'device_enrollment'))
+        invalidDashboard(op);
+    const mode = config.device_enrollment;
+    const limit = config.max_devices;
+    if (!['allowed_with_permission', 'paused'].includes(mode)
+        || (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 10000)))
+        invalidDashboard(op);
+    // Snapshot before the asynchronous credential provider can change the caller's object.
+    return { config: { device_enrollment: mode,
+            ...(limit === undefined ? {} : { max_devices: limit }) } };
+}
+/** Configuration-record families Genesis admits (beacons-api native_resources.rs). */
+export const BEACONS_RESOURCE_FAMILIES = ['gateways', 'private-gateways', 'sims'];
+const RESOURCE_STATUS = ['active', 'inactive', 'disabled', 'pending'];
+function family(value, operationId) {
+    if (!BEACONS_RESOURCE_FAMILIES.includes(value))
+        invalidDashboard(operationId);
+    return value;
+}
+function plainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/** A shallow snapshot of the documented fields; the receiver validates every value. */
+function resourceBody(value, operationId, create) {
+    if (!plainObject(value))
+        invalidDashboard(operationId);
+    const keys = Object.keys(value);
+    if (keys.some(key => !['name', 'status', 'config'].includes(key)) || (create ? keys.length !== 3 : keys.length === 0))
+        invalidDashboard(operationId);
+    const out = {};
+    if (Object.hasOwn(value, 'name')) {
+        if (typeof value.name !== 'string')
+            invalidDashboard(operationId);
+        const name = value.name.trim();
+        if (!name || new TextEncoder().encode(name).length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(name))
+            invalidDashboard(operationId);
+        out.name = name;
+    }
+    if (Object.hasOwn(value, 'status')) {
+        if (typeof value.status !== 'string' || !RESOURCE_STATUS.includes(value.status))
+            invalidDashboard(operationId);
+        out.status = value.status;
+    }
+    if (Object.hasOwn(value, 'config')) {
+        if (!plainObject(value.config) || Object.values(value.config).some(v => v === null || v === undefined))
+            invalidDashboard(operationId);
+        out.config = JSON.parse(JSON.stringify(value.config));
+    }
+    return out;
+}
+function provisioningInput(requestId, body) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(requestId)
+        || requestId === '00000000-0000-0000-0000-000000000000'
+        || !body || typeof body !== 'object' || Array.isArray(body)
+        || Object.keys(body).some(key => key !== 'name')
+        || (body.name !== undefined && (typeof body.name !== 'string' || !body.name.trim()
+            || new TextEncoder().encode(body.name).length > 256 || /[\u0000-\u001f\u007f-\u009f]/.test(body.name)))) {
+        throw new GenesisError({ status: 0, type: 'invalid_request', operationId: 'beacons_provisionBridgeFleet', message: 'Provide a nonzero UUID request ID and an optional fleet name of up to 256 UTF-8 bytes.' });
+    }
+    return body.name === undefined ? {} : { name: body.name };
+}
+/** Platforms with a Beacons agent client profile; the gateway and Beacons admit only these. */
+export const BEACONS_CLIENT_PLATFORMS = ['linux', 'macos', 'windows', 'ios', 'android'];
+/** Beacons uses the authenticated Genesis organization; never supply an org header. */
+export function beaconsModule(client) {
+    return {
+        fleets: {
+            /** Current human-authorized selected Sandbox scope; no caller tenant identifiers. */
+            list: (options = {}) => client.request('beacons_listDashboardFleets', {}, options),
+            update: (id, body, options = {}) => client.request('beacons_updateDashboardFleet', { fleet_id: fleetId(id, 'beacons_updateDashboardFleet'), body: renameInput(body) }, options),
+            peers: (id, options = {}) => client.request('beacons_listDashboardPeers', { fleet_id: fleetId(id, 'beacons_listDashboardPeers') }, options),
+            /** One peer's tunnel config: other live peers' public keys; never a private key. */
+            wireguardConfig: (id, peerId, options = {}) => client.request('beacons_getDashboardPeerWireguardConfig', { fleet_id: fleetId(id, 'beacons_getDashboardPeerWireguardConfig'),
+                peer_id: fleetId(peerId, 'beacons_getDashboardPeerWireguardConfig') }, options),
+            /** One fleet in the current selection; 404 when it is outside it. */
+            get: (id, options = {}) => client.request('beacons_getDashboardFleet', { fleet_id: fleetId(id, 'beacons_getDashboardFleet') }, options),
+            /** Mesh DNS map: one A record per live peer. */
+            dns: (id, options = {}) => client.request('beacons_getDashboardFleetDns', { fleet_id: fleetId(id, 'beacons_getDashboardFleetDns') }, options),
+            /** Mesh discovery map: live peers' public keys and routes, DNS, signal and relay map. */
+            discovery: (id, options = {}) => client.request('beacons_getDashboardFleetDiscovery', { fleet_id: fleetId(id, 'beacons_getDashboardFleetDiscovery') }, options),
+            /** beacons-agent profile for one platform: API origin, DNS suffix and command line. */
+            clientProfile: (id, platform, options = {}) => {
+                const op = 'beacons_getDashboardClientProfile';
+                if (!BEACONS_CLIENT_PLATFORMS.includes(platform))
+                    invalidDashboard(op);
+                return client.request(op, { fleet_id: fleetId(id, op), platform }, options);
+            },
+            policy: {
+                get: (id, options = {}) => client.request('beacons_getDashboardPolicy', { fleet_id: fleetId(id, 'beacons_getDashboardPolicy') }, options),
+                /** Future device admissions only; this never grants IAM rights or revokes an existing peer. */
+                update: (id, config, options = {}) => client.request('beacons_updateDashboardPolicy', { fleet_id: fleetId(id, 'beacons_updateDashboardPolicy'), body: policyInput(config) }, options),
+            },
+            /** Fleet configuration records (gateways, private-gateways, sims). Configuration only: nothing is provisioned or connected. */
+            resources: {
+                list: (id, kind, options = {}) => client.request('beacons_listDashboardResources', { fleet_id: fleetId(id, 'beacons_listDashboardResources'),
+                    family: family(kind, 'beacons_listDashboardResources') }, options),
+                /** Not idempotent: a retry after an interrupted response creates a second record. */
+                create: (id, kind, body, options = {}) => client.request('beacons_createDashboardResource', { fleet_id: fleetId(id, 'beacons_createDashboardResource'),
+                    family: family(kind, 'beacons_createDashboardResource'), body: resourceBody(body, 'beacons_createDashboardResource', true) }, options),
+                update: (id, kind, resourceId, body, options = {}) => client.request('beacons_updateDashboardResource', { fleet_id: fleetId(id, 'beacons_updateDashboardResource'),
+                    family: family(kind, 'beacons_updateDashboardResource'), resource_id: fleetId(resourceId, 'beacons_updateDashboardResource'),
+                    body: resourceBody(body, 'beacons_updateDashboardResource', false) }, options),
+                delete: (id, kind, resourceId, options = {}) => client.request('beacons_deleteDashboardResource', { fleet_id: fleetId(id, 'beacons_deleteDashboardResource'),
+                    family: family(kind, 'beacons_deleteDashboardResource'), resource_id: fleetId(resourceId, 'beacons_deleteDashboardResource') }, options)
+                    .then(() => undefined),
+            },
+            /** Reuse the same request ID and body after an interrupted response. Creates metadata only. */
+            provision: (requestId, body = {}) => client.request('beacons_provisionBridgeFleet', { body: provisioningInput(requestId, body) }, { headers: { 'idempotency-key': requestId } }),
+        },
+        devices: {
+            revocations: (id) => client.request('beacons_listBridgeDeviceRevocations', { id }),
+            acknowledge: (id, version, body) => client.request('beacons_acknowledgeBridgeDeviceRevocation', { id, version, body }),
+            challenge: (body) => client.request('beacons_issueBridgeDeviceChallenge', { body }),
+            enroll: (body) => client.request('beacons_enrollBridgeDevice', { body }),
+            list: () => client.request('beacons_listBridgeDevices'),
+            update: (id, body) => client.request('beacons_updateBridgeDevice', { id, body }),
+            revoke: (id) => client.request('beacons_revokeBridgeDevice', { id }),
+        },
+    };
+}