aegis-platform-sdk 0.1.0 → 1.3.0

package/dist/index.d.ts

@@ -1,7 +1,9 @@
-type QueryParams = Record<string, string | number | boolean | undefined | null>;
+type QueryParams = Record<string, string | number | boolean | ReadonlyArray<string | number> | undefined | null>;
 interface RequestOptions {
     params?: QueryParams;
     json?: unknown;
+    /** Multipart body (e.g. logo upload) — mutually exclusive with `json`. */
+    form?: FormData;
     signal?: AbortSignal;
 }
 /** The verb-agnostic transport contract every resource is built on. */
@@ -9,6 +11,30 @@ interface Transport {
     request<T = unknown>(method: string, path: string, opts?: RequestOptions): Promise<T>;
 }
 
+/**
+ * Minimal SSE (text/event-stream) support — zero dependencies.
+ *
+ * AEGIS exposes server-sent-event endpoints for long-running work
+ * (operator task progress, AIP chat streaming). `AegisClient.stream()`
+ * yields parsed events as an async iterator:
+ *
+ * ```ts
+ * for await (const ev of client.stream("/operator/tasks/t1/events")) {
+ *   if (ev.event === "progress") console.log(JSON.parse(ev.data));
+ * }
+ * ```
+ */
+interface SseEvent {
+    /** Event name — defaults to "message" per the SSE spec. */
+    event: string;
+    /** Raw data payload (multi-line `data:` fields joined with `\n`). */
+    data: string;
+    id?: string;
+    retry?: number;
+}
+/** Parse a `text/event-stream` byte stream into events (spec-compliant subset). */
+declare function parseSseStream(stream: ReadableStream<Uint8Array>): AsyncGenerator<SseEvent, void, undefined>;
+
 /**
  * Core wire types — mirrors `aegis/types.py` in the Python SDK.
  *
@@ -97,12 +123,18 @@ interface LoginOptions {
     /** Attach the issued JWT to the client for subsequent calls (default true). */
     attach?: boolean;
 }
-/** `client.auth.*` — login, whoami, dev-mode. */
+/** `client.auth.*` — login, refresh, whoami, dev-mode. */
 declare class AuthResource {
     private readonly t;
-    private readonly setToken;
-    constructor(t: Transport, setToken: (token: string | null) => void);
+    private readonly attach;
+    constructor(t: Transport, attach: (pair: TokenPair) => void);
     login(username: string, password: string, opts?: LoginOptions): Promise<TokenPair>;
+    /** Rotate a refresh token explicitly (`POST /auth/refresh`). The client
+     *  already does this transparently on 401 — call this only for manual
+     *  flows. Attaches the new pair unless `attach: false`. */
+    refresh(refreshToken: string, opts?: {
+        attach?: boolean;
+    }): Promise<TokenPair>;
     me(): Promise<WhoAmI>;
     /** Activate a vendor dev-mode session; requires the `vendor` role. */
     enableDevMode(password: string): Promise<DevMode>;
@@ -123,21 +155,21 @@ declare class RolesResource {
 declare class GroupsResource {
     private readonly t;
     constructor(t: Transport);
-    list(opts?: {
+    list<T = Json>(opts?: {
         limit?: number;
         offset?: number;
-    }): Promise<Json[]>;
-    get(groupId: string): Promise<Json>;
-    create(name: string, description?: string): Promise<Json>;
-    update(groupId: string, patch: {
+    }): Promise<T[]>;
+    get<T = Json>(groupId: string): Promise<T>;
+    create<T = Json>(name: string, description?: string): Promise<T>;
+    update<T = Json>(groupId: string, patch: {
         name?: string;
         description?: string;
-    }): Promise<Json>;
+    }): Promise<T>;
     delete(groupId: string): Promise<void>;
-    listMembers(groupId: string): Promise<Json[]>;
-    addMember(groupId: string, userId: string): Promise<Json>;
+    listMembers<T = Json>(groupId: string): Promise<T[]>;
+    addMember<T = Json>(groupId: string, userId: string): Promise<T>;
     removeMember(groupId: string, userId: string): Promise<void>;
-    listForUser(userId: string): Promise<Json[]>;
+    listForUser<T = Json>(userId: string): Promise<T[]>;
 }
 declare class PermissionsResource {
     private readonly t;
@@ -147,7 +179,7 @@ declare class PermissionsResource {
 declare class NavResource {
     private readonly t;
     constructor(t: Transport);
-    tree(asRoleId?: string): Promise<Json>;
+    tree<T = Json>(asRoleId?: string): Promise<T>;
 }
 /** `client.iam.*` — users, roles, groups, permissions, nav tree. */
 declare class IamResource {
@@ -189,12 +221,12 @@ interface OperatorTaskCreate {
 declare class OperatorTasksResource {
     private readonly t;
     constructor(t: Transport);
-    list(opts?: OperatorTaskListOptions): Promise<Json[]>;
-    get(taskId: string): Promise<Json>;
-    create(input: OperatorTaskCreate): Promise<Json>;
-    cancel(taskId: string): Promise<Json>;
-    retry(taskId: string): Promise<Json>;
-    reprioritize(taskId: string, priority: string): Promise<Json>;
+    list<T = Json>(opts?: OperatorTaskListOptions): Promise<T[]>;
+    get<T = Json>(taskId: string): Promise<T>;
+    create<T = Json>(input: OperatorTaskCreate): Promise<T>;
+    cancel<T = Json>(taskId: string): Promise<T>;
+    retry<T = Json>(taskId: string): Promise<T>;
+    reprioritize<T = Json>(taskId: string, priority: string): Promise<T>;
 }
 /** `client.operator.*` — operator task queue (NL kanban). */
 declare class OperatorResource {
@@ -205,44 +237,44 @@ declare class OperatorResource {
 declare class ObjectsResource {
     private readonly t;
     constructor(t: Transport);
-    get(objectId: string): Promise<Json>;
-    list(kind: string, opts?: {
+    get<T = Json>(objectId: string): Promise<T>;
+    list<T = Json>(kind: string, opts?: {
         limit?: number;
         offset?: number;
         q?: string;
-    }): Promise<Json[]>;
-    create(kind: string, properties: Json, name?: string): Promise<Json>;
-    createMany(kind: string, items: Json[], markings?: string[]): Promise<Json>;
-    delete(objectId: string): Promise<Json>;
-    bulkDelete(opts: {
+    }): Promise<T[]>;
+    create<T = Json>(kind: string, properties: Json, name?: string): Promise<T>;
+    createMany<T = Json>(kind: string, items: Json[], markings?: string[]): Promise<T>;
+    delete<T = Json>(objectId: string): Promise<T>;
+    bulkDelete<T = Json>(opts: {
         object_ids?: string[];
         kind?: string;
         dry_run?: boolean;
         confirm?: boolean;
         expected_count?: number;
-    }): Promise<Json>;
-    links(objectId: string): Promise<Json[]>;
-    history(objectId: string): Promise<Json[]>;
-    queryTimeseries(objectId: string, propertyName: string, opts?: {
+    }): Promise<T>;
+    links<T = Json>(objectId: string): Promise<T[]>;
+    history<T = Json>(objectId: string): Promise<T[]>;
+    queryTimeseries<T = Json>(objectId: string, propertyName: string, opts?: {
         from_time?: string;
         to_time?: string;
         max_points?: number;
-    }): Promise<Json>;
-    appendTimeseries(objectId: string, propertyName: string, points: Json[]): Promise<Json>;
+    }): Promise<T>;
+    appendTimeseries<T = Json>(objectId: string, propertyName: string, points: Json[]): Promise<T>;
 }
 declare class GraphResource {
     private readonly t;
     constructor(t: Transport);
-    expand(seedId: string, opts?: {
+    expand<T = Json>(seedId: string, opts?: {
         depth?: number;
         limit?: number;
-    }): Promise<Json>;
+    }): Promise<T>;
 }
 declare class ExplorerResource {
     private readonly t;
     constructor(t: Transport);
-    histogram(property: string, filters?: Json): Promise<Json[]>;
-    timeline(filters?: Json, bin?: string): Promise<Json[]>;
+    histogram<T = Json>(property: string, filters?: Json): Promise<T[]>;
+    timeline<T = Json>(filters?: Json, bin?: string): Promise<T[]>;
 }
 interface ObjectTypeWrite {
     title_property: string;
@@ -254,22 +286,22 @@ interface ObjectTypeWrite {
 declare class ObjectTypesResource {
     private readonly t;
     constructor(t: Transport);
-    get(kind: string): Promise<Json>;
-    create(kind: string, input: ObjectTypeWrite): Promise<Json>;
-    update(kind: string, input: ObjectTypeWrite): Promise<Json>;
-    delete(kind: string): Promise<Json>;
+    get<T = Json>(kind: string): Promise<T>;
+    create<T = Json>(kind: string, input: ObjectTypeWrite): Promise<T>;
+    update<T = Json>(kind: string, input: ObjectTypeWrite): Promise<T>;
+    delete<T = Json>(kind: string): Promise<T>;
 }
 declare class LinkTypesResource {
     private readonly t;
     constructor(t: Transport);
-    declare(input: {
+    declare<T = Json>(input: {
         source_kind: string;
         target_kind: string;
         relation: string;
         cardinality: string;
         inverse_label?: string;
-    }): Promise<Json>;
-    delete(edgeId: string): Promise<Json>;
+    }): Promise<T>;
+    delete<T = Json>(edgeId: string): Promise<T>;
 }
 /** `client.ontology.*` — objects, graph, explorer, object/link types, OSDK manifest. */
 declare class OntologyResource {
@@ -282,46 +314,46 @@ declare class OntologyResource {
     constructor(t: Transport);
     /** Shortcut — same as `objectTypes.get(kind)`. */
     objectType(kind: string): Promise<Json>;
-    osdkManifest(): Promise<Json[]>;
-    osdkFunctions(): Promise<Json[]>;
-    osdkGenerate(lang?: string): Promise<Json>;
+    osdkManifest<T = Json>(): Promise<T[]>;
+    osdkFunctions<T = Json>(): Promise<T[]>;
+    osdkGenerate<T = Json>(lang?: string): Promise<T>;
 }
 
 declare class FlowsResource {
     private readonly t;
     constructor(t: Transport);
-    list(): Promise<Json[]>;
-    get(flowId: string): Promise<Json>;
-    runs(flowId: string): Promise<Json[]>;
-    patch(flowId: string, payload: Json): Promise<Json>;
-    run(flowId: string, dryRun?: boolean): Promise<Json>;
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(flowId: string): Promise<T>;
+    runs<T = Json>(flowId: string): Promise<T[]>;
+    patch<T = Json>(flowId: string, payload: Json): Promise<T>;
+    run<T = Json>(flowId: string, dryRun?: boolean): Promise<T>;
 }
 declare class AgentsResource {
     private readonly t;
     constructor(t: Transport);
-    list(): Promise<Json[]>;
-    get(agentId: string): Promise<Json>;
-    patch(agentId: string, config: Json): Promise<Json>;
-    manualRun(agentId: string): Promise<Json>;
-    runs(agentId: string): Promise<Json[]>;
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(agentId: string): Promise<T>;
+    patch<T = Json>(agentId: string, config: Json): Promise<T>;
+    manualRun<T = Json>(agentId: string): Promise<T>;
+    runs<T = Json>(agentId: string): Promise<T[]>;
 }
 declare class ModelsResource {
     private readonly t;
     constructor(t: Transport);
-    catalog(provider?: string): Promise<Json[]>;
-    defaults(): Promise<Json[]>;
-    setDefault(input: {
+    catalog<T = Json>(provider?: string): Promise<T[]>;
+    defaults<T = Json>(): Promise<T[]>;
+    setDefault<T = Json>(input: {
         provider: string;
         model: string;
         purpose?: string;
         provider_id?: string;
-    }): Promise<Json>;
+    }): Promise<T>;
 }
 declare class BudgetResource {
     private readonly t;
     constructor(t: Transport);
-    get(): Promise<Json>;
-    set(tokensPerMonth: number): Promise<Json>;
+    get<T = Json>(): Promise<T>;
+    set<T = Json>(tokensPerMonth: number): Promise<T>;
 }
 /** `client.aip.*` — flows, agents, model catalog/defaults, LLM budget. */
 declare class AipResource {
@@ -358,43 +390,43 @@ interface PullRequestCreate {
 declare class FunctionsResource {
     private readonly t;
     constructor(t: Transport);
-    list(): Promise<Json[]>;
-    get(slug: string): Promise<Json>;
-    create(input: FunctionCreate): Promise<Json>;
-    invoke(slug: string, inputs?: Json, opts?: {
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(slug: string): Promise<T>;
+    create<T = Json>(input: FunctionCreate): Promise<T>;
+    invoke<T = Json>(slug: string, inputs?: Json, opts?: {
         branch?: string;
         draft?: boolean;
-    }): Promise<Json>;
-    tests(slug: string): Promise<Json[]>;
-    addTest(slug: string, name: string, inputs?: Json, expectedContains?: string): Promise<Json>;
-    runTest(slug: string, testId: string): Promise<Json>;
-    runTests(slug: string): Promise<Json>;
-    publish(slug: string, branch?: string): Promise<Json>;
-    versions(slug: string): Promise<Json[]>;
-    pullRequests(slug: string, status?: string): Promise<Json[]>;
-    openPullRequest(slug: string, input: PullRequestCreate): Promise<Json>;
-    updatePullRequest(slug: string, prId: string, patch: Json): Promise<Json>;
-    runPrCi(slug: string, prId: string): Promise<Json>;
-    reviewPullRequest(slug: string, prId: string, decision: string, comment?: string): Promise<Json>;
-    mergePullRequest(slug: string, prId: string): Promise<Json>;
+    }): Promise<T>;
+    tests<T = Json>(slug: string): Promise<T[]>;
+    addTest<T = Json>(slug: string, name: string, inputs?: Json, expectedContains?: string): Promise<T>;
+    runTest<T = Json>(slug: string, testId: string): Promise<T>;
+    runTests<T = Json>(slug: string): Promise<T>;
+    publish<T = Json>(slug: string, branch?: string): Promise<T>;
+    versions<T = Json>(slug: string): Promise<T[]>;
+    pullRequests<T = Json>(slug: string, status?: string): Promise<T[]>;
+    openPullRequest<T = Json>(slug: string, input: PullRequestCreate): Promise<T>;
+    updatePullRequest<T = Json>(slug: string, prId: string, patch: Json): Promise<T>;
+    runPrCi<T = Json>(slug: string, prId: string): Promise<T>;
+    reviewPullRequest<T = Json>(slug: string, prId: string, decision: string, comment?: string): Promise<T>;
+    mergePullRequest<T = Json>(slug: string, prId: string): Promise<T>;
 }
 /** `client.codeRepositories.*` — repos/branches around Code Functions. */
 declare class CodeRepositoriesResource {
     private readonly t;
     constructor(t: Transport);
-    list(): Promise<Json[]>;
-    create(input: {
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: {
         slug: string;
         display_name: string;
         description?: string;
         default_branch?: string;
-    }): Promise<Json>;
-    branches(repoId: string): Promise<Json[]>;
-    createBranch(repoId: string, name: string, description?: string): Promise<Json>;
-    functions(repoId: string): Promise<Json[]>;
-    assignFunction(repoId: string, slug: string): Promise<Json>;
-    runCi(repoId: string): Promise<Json>;
-    mergeBranch(repoId: string, sourceBranch: string, into?: string): Promise<Json>;
+    }): Promise<T>;
+    branches<T = Json>(repoId: string): Promise<T[]>;
+    createBranch<T = Json>(repoId: string, name: string, description?: string): Promise<T>;
+    functions<T = Json>(repoId: string): Promise<T[]>;
+    assignFunction<T = Json>(repoId: string, slug: string): Promise<T>;
+    runCi<T = Json>(repoId: string): Promise<T>;
+    mergeBranch<T = Json>(repoId: string, sourceBranch: string, into?: string): Promise<T>;
 }
 
 type TransactionKind = "SNAPSHOT" | "APPEND" | "UPDATE" | "DELETE";
@@ -402,34 +434,2001 @@ type TransactionKind = "SNAPSHOT" | "APPEND" | "UPDATE" | "DELETE";
 declare class DatasetsResource {
     private readonly t;
     constructor(t: Transport);
-    list(): Promise<Json[]>;
-    get(name: string): Promise<Json>;
-    sample(name: string, limit?: number): Promise<Json>;
-    listBranches(name: string): Promise<Json[]>;
-    createBranch(name: string, branchName: string, opts?: {
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(name: string): Promise<T>;
+    sample<T = Json>(name: string, limit?: number): Promise<T>;
+    listBranches<T = Json>(name: string): Promise<T[]>;
+    createBranch<T = Json>(name: string, branchName: string, opts?: {
         from_branch?: string;
         from_asset_id?: string;
         description?: string;
         project_id?: string;
-    }): Promise<Json>;
-    deactivateBranch(name: string, branchName: string): Promise<Json>;
-    listTransactions(name: string, branch?: string): Promise<Json[]>;
-    beginTransaction(name: string, kind: TransactionKind, branch?: string): Promise<Json>;
-    commitTransaction(name: string, txId: string, inputPayload: Json): Promise<Json>;
-    abortTransaction(name: string, txId: string, reason?: string): Promise<Json>;
-    mergeFastForward(name: string, source: string, into: string): Promise<Json>;
+    }): Promise<T>;
+    deactivateBranch<T = Json>(name: string, branchName: string): Promise<T>;
+    listTransactions<T = Json>(name: string, branch?: string): Promise<T[]>;
+    beginTransaction<T = Json>(name: string, kind: TransactionKind, branch?: string): Promise<T>;
+    commitTransaction<T = Json>(name: string, txId: string, inputPayload: Json): Promise<T>;
+    abortTransaction<T = Json>(name: string, txId: string, reason?: string): Promise<T>;
+    mergeFastForward<T = Json>(name: string, source: string, into: string): Promise<T>;
     /** 409 responses carry the conflict body in `AegisAPIError.payload`. */
-    mergeThreeWay(name: string, source: string, into: string, resolutions?: Json): Promise<Json>;
-    getClassification(name: string): Promise<Json>;
-    setClassification(name: string, patch: {
+    mergeThreeWay<T = Json>(name: string, source: string, into: string, resolutions?: Json): Promise<T>;
+    getClassification<T = Json>(name: string): Promise<T>;
+    setClassification<T = Json>(name: string, patch: {
         data_classification?: string;
         file_classification?: string;
-    }): Promise<Json>;
-    listMarkings(name: string): Promise<Json[]>;
-    applyMarking(name: string, markingId: string): Promise<Json>;
+    }): Promise<T>;
+    listMarkings<T = Json>(name: string): Promise<T[]>;
+    applyMarking<T = Json>(name: string, markingId: string): Promise<T>;
     removeMarking(name: string, markingId: string): Promise<void>;
 }
 
+/** `client.geo.*` — geospatial read layer over the ontology (/api/v1/geo). */
+declare class GeoResource {
+    private readonly t;
+    constructor(t: Transport);
+    nodes<T = Json>(opts?: {
+        node_type?: string;
+        since_minutes?: number;
+        limit?: number;
+        bbox?: string;
+    }): Promise<T>;
+    nodeTypes<T = Json>(): Promise<T>;
+    sources<T = Json>(): Promise<T>;
+    edges<T = Json>(nodeIds: string[], relationTypes?: string[]): Promise<T>;
+    /** Catalog of keyless reference layers (IBGE limits, CNES health, …). */
+    referenceLayers<T = Json>(): Promise<T>;
+    /** GeoJSON of one reference layer (resilient keyless proxy). */
+    referenceLayer<T = Json>(layerId: string, opts?: {
+        uf?: string;
+        municipio?: string;
+    }): Promise<T>;
+    zones<T = Json>(): Promise<T>;
+    importZones<T = Json>(features: Json[], opts?: {
+        default_zone_type?: string;
+        extruded_height?: number;
+        source_name?: string;
+    }): Promise<T>;
+    deleteZone(zoneId: string): Promise<void>;
+    /** Builder layers of the tenant, grouped by "map" (the project). */
+    layers<T = Json>(): Promise<T>;
+    /** Creates a layer (empty inline dataset + published board). The
+     *  `node_type` derives from the name and is IMMUTABLE. */
+    createLayer<T = Json>(input: {
+        nome: string;
+        mapa?: string;
+        descricao?: string;
+    }): Promise<T>;
+    layerFeatures<T = Json>(boardId: string): Promise<T>;
+    /** Saves the drawing as a versioned SNAPSHOT. `geometry` is GeoJSON
+     *  `[lng,lat]`; `geo_style` travels PER FEATURE (colour/alpha/extrusion). */
+    saveLayerFeatures<T = Json>(boardId: string, rows: Json[]): Promise<T>;
+    /** Runs the board and RECONCILES — a feature deleted in the builder leaves
+     *  the map (the engine is upsert-only). */
+    publishLayer<T = Json>(boardId: string): Promise<T>;
+    /** Renames / regroups. Never changes the `node_type`; `mapa: ""` ungroups. */
+    patchLayer<T = Json>(boardId: string, changes: {
+        nome?: string;
+        mapa?: string;
+        descricao?: string;
+    }): Promise<T>;
+    /** Deletes the whole layer: materialized nodes + dataset + board. */
+    deleteLayer<T = Json>(boardId: string): Promise<T>;
+}
+/** `client.mapTemplates.*` — reusable map specs (v22).
+ *  (The Python SDK's stdout `Map` builder is sandbox-IDE-only and is not ported.) */
+declare class MapTemplatesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list(): Promise<Json[]>;
+    get<T = Json>(templateId: string): Promise<T>;
+    create<T = Json>(name: string, spec: Json, description?: string): Promise<T>;
+    instantiate<T = Json>(templateId: string, variables?: Json): Promise<T>;
+    /** Returns the raw SVG markup (non-JSON body). */
+    exportSvg(templateId: string): Promise<string>;
+}
+/** `client.media.*` — media sets + item metadata (bytes live in MinIO via `uri`). */
+declare class MediaResource {
+    private readonly t;
+    constructor(t: Transport);
+    listSets<T = Json>(): Promise<T[]>;
+    createSet<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        /** image | video | audio | document | mixed */
+        media_type: string;
+        bucket?: string;
+        markings?: string[];
+        project_id?: string;
+    }): Promise<T>;
+    deleteSet<T = Json>(setId: string): Promise<T>;
+    listItems<T = Json>(setId: string): Promise<T[]>;
+    /** Metadata only — no file bytes are uploaded (pass a pre-supplied `uri`). */
+    addItem<T = Json>(setId: string, input: {
+        filename: string;
+        content_type?: string;
+        size_bytes?: number;
+        uri?: string;
+        meta?: Json;
+    }): Promise<T>;
+}
+/** `client.docs.*` — platform documentation tree. */
+declare class DocsResource {
+    private readonly t;
+    constructor(t: Transport);
+    tree<T = Json>(): Promise<T>;
+    read<T = Json>(path: string): Promise<T>;
+}
+/** `client.pages.*` — registered pages (v23 page registry). */
+declare class PagesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        status?: string;
+        scope?: string;
+        perm?: string;
+    }): Promise<T[]>;
+    get<T = Json>(slug: string): Promise<T>;
+    getConfig<T = Json>(slug: string): Promise<T>;
+    create<T = Json>(input: {
+        slug: string;
+        title: string;
+        route: string;
+        status?: string;
+        workspace_bindings?: Json[];
+        marking_requirements?: string[];
+        iam_perm_required?: string;
+        config?: Json;
+    }): Promise<T>;
+    update<T = Json>(slug: string, patch: Json): Promise<T>;
+    /** Soft delete — page moves to status=archived. */
+    delete<T = Json>(slug: string): Promise<T>;
+    duplicate<T = Json>(slug: string): Promise<T>;
+    putConfig<T = Json>(slug: string, config: Json): Promise<T>;
+    publish<T = Json>(slug: string): Promise<T>;
+}
+/** `client.dossier.*` — async dossier generation (start → poll `get`). */
+declare class DossierResource {
+    private readonly t;
+    constructor(t: Transport);
+    startGeneric<T = Json>(nodeId: string, purpose?: string): Promise<T>;
+    /** Requires `anchor_node_id` or `node_ids`. */
+    startComposite<T = Json>(input: {
+        anchor_node_id?: string;
+        node_ids?: string[];
+        purpose?: string;
+        correlate?: boolean;
+        scene?: boolean;
+        max_depth?: number;
+        budget_nodes?: number;
+    }): Promise<T>;
+    /** Poll until `status === "done"`; `result` is then populated. */
+    get<T = Json>(taskId: string): Promise<T>;
+}
+/** `client.timeseries.*` — chart definitions + render (v23). */
+declare class TimeSeriesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        node_type: string;
+        /** e.g. `{ bucket: "day" | "hour" }` */
+        config?: Json;
+        markings?: string[];
+    }): Promise<T>;
+    delete<T = Json>(chartId: string): Promise<T>;
+    render<T = Json>(chartId: string): Promise<T>;
+}
+
+/**
+ * Body do `POST /public/v1/guest/{token}/fix` — uma leitura de GPS do visitante.
+ * O backend avalia cerca/rota/destino (evaluate_fix) e devolve
+ * inside_fence/arrived/deviated. Sem throttle e sem geofence-gate nesta rota.
+ */
+interface GuestFix {
+    lat: number;
+    lng: number;
+    accuracy?: number;
+    /** ISO-8601; o backend usa "agora" se ausente. */
+    ts?: string;
+    /** Veredito de desvio do PRÓPRIO cliente (ex.: livetracker checando contra a
+     *  rota desenhada por ruas). O backend RELAIA à portaria (paridade legado);
+     *  ausente ⇒ o backend calcula pelo desvio da reta do token. */
+    off_route?: boolean;
+}
+/** Body do `POST /{token}/document/object-sets/query`. */
+interface GuestObjectSetQuery {
+    object_type: string;
+    filter?: Json;
+    order_by?: Json;
+    /** 1..10000, default 200 no backend. */
+    limit?: number;
+}
+/**
+ * O transporte + a base URL. `mediaUrl()` precisa da base para montar um
+ * `<img src>`; o AegisClient satisfaz isto (implementa Transport e expõe
+ * `readonly baseUrl`).
+ */
+interface PublicGuestTransport extends Transport {
+    readonly baseUrl: string;
+}
+/**
+ * `client.publicGuest.*` — o lado CONSUMIDOR do guest token público
+ * (`/public/v1/guest/{token}/*`). Sem cookie e sem Authorization: o token
+ * viaja no path; construa um client anônimo (`new AegisClient({ baseUrl })`).
+ *
+ * Erros mapeados pelo transporte: 404 (token inválido/expirado/revogado —
+ * "never leaks why"), 403 (geofence-gate/ação não permitida — invoke),
+ * 429 (throttle — invoke). Visita finalizada (chegou ao destino) → 410, que
+ * cai em `AegisAPIError` com `statusCode === 410`.
+ */
+declare class PublicGuestResource {
+    private readonly t;
+    constructor(t: PublicGuestTransport);
+    private base;
+    /** Menu/resumo do token: label, subject, status, geo, ações permitidas. */
+    menu<T = Json>(token: string): Promise<T>;
+    /** Reporta uma posição GPS; o backend avalia cerca/rota/destino. */
+    fix<T = Json>(token: string, body: GuestFix): Promise<T>;
+    /** Invoca uma ação permitida do token (ex.: abrir portão). */
+    invoke<T = Json>(token: string, actionId: string, input?: Json): Promise<T>;
+    /**
+     * Onda 2 — última posição do VISITANTE amarrado a um token de MORADOR
+     * (`geo.live_ref`). Sem push: a SPA do morador faz polling desta rota. O
+     * morador só vê ESSA visita (least-privilege). Retorna `{available, lat,
+     * lng, ts, inside_fence, arrived, deviated, distance_to_target_m,
+     * visit_status}`; `available:false` enquanto o visitante não mandou fix.
+     */
+    position<T = Json>(token: string): Promise<T>;
+    /** Documento vinculado ao token (se `geo.document_id`). */
+    document<T = Json>(token: string): Promise<T>;
+    /** Consulta um object-set embutido no documento do token. */
+    queryObjectSet<T = Json>(token: string, body: GuestObjectSetQuery): Promise<T>;
+    /** Um nó da ontologia referenciado pelo documento (mascarado por ABAC). */
+    documentNode<T = Json>(token: string, nodeId: string): Promise<T>;
+    /** Descritor da Page vinculada ao token (`geo.page_slug`). */
+    page<T = Json>(token: string, slug: string): Promise<T>;
+    /** Avalia as variáveis da Page (com overrides só de variáveis estáticas). */
+    evaluatePage<T = Json>(token: string, slug: string, overrides?: Json): Promise<T>;
+    /**
+     * URL absoluta de um objeto de mídia do documento (bytes servidos com
+     * `Cache-Control: private`). Retorna string p/ `<img src>`/`<a href>` —
+     * NÃO faz request (o transporte é JSON-cêntrico). A `key` deve começar
+     * com `notepad/{doc_id}/` (validado no backend).
+     */
+    mediaUrl(token: string, key: string): string;
+}
+
+declare class AlertFeedsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(name: string, filters: Json, cadenceSeconds?: number): Promise<T>;
+    delete(feedId: string): Promise<void>;
+    alerts<T = Json>(): Promise<T[]>;
+    acknowledge(alertId: string): Promise<void>;
+}
+declare class AlertWatchesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(objectId: string): Promise<T>;
+    delete(watchId: string): Promise<void>;
+    alerts<T = Json>(): Promise<T[]>;
+    acknowledge(alertId: string): Promise<void>;
+}
+declare class AlertGeofencesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    /** `coordinates` is shape-dependent: polygon `[[lon,lat],…]`, circle
+     *  `{center, radius_meters}`, corridor/route `{waypoints, width_meters}`. */
+    create<T = Json>(input: {
+        name: string;
+        shape: string;
+        coordinates: unknown;
+        severity?: string;
+        baseline_silent?: boolean;
+    }): Promise<T>;
+    update<T = Json>(geofenceId: string, patch: Json): Promise<T>;
+    delete(geofenceId: string): Promise<void>;
+    alerts<T = Json>(): Promise<T[]>;
+    acknowledge(alertId: string): Promise<void>;
+}
+declare class AlertSharesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    acknowledge(alertId: string): Promise<void>;
+}
+declare class AlertRoutesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: {
+        name: string;
+        channel: string;
+        match?: Json;
+        channel_config_ref?: string;
+        escalation?: Json;
+        active?: boolean;
+    }): Promise<T>;
+    update<T = Json>(routeId: string, patch: Json): Promise<T>;
+    delete(routeId: string): Promise<void>;
+    silence<T = Json>(routeId: string, minutes: number): Promise<T>;
+    unsilence(routeId: string): Promise<Json>;
+    silenceState<T = Json>(routeId: string): Promise<T>;
+    kinds(): Promise<string[]>;
+}
+declare class AlertInboxResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        kinds?: string[];
+        severities?: string[];
+        status?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+    countPending(): Promise<number>;
+    acknowledge<T = Json>(alertId: string): Promise<T>;
+}
+/** `client.alerts.*` — feeds, watches, geofences, shares, routes, inbox. */
+declare class AlertsResource {
+    private readonly t;
+    readonly feeds: AlertFeedsResource;
+    readonly watches: AlertWatchesResource;
+    readonly geofences: AlertGeofencesResource;
+    readonly shares: AlertSharesResource;
+    readonly routes: AlertRoutesResource;
+    readonly inbox: AlertInboxResource;
+    constructor(t: Transport);
+    escalate(alertId: string): Promise<void>;
+    channels<T = Json>(): Promise<T[]>;
+    /**
+     * `PUT /alerts/channels/{ref}` — point a delivery channel at its
+     * destination.
+     *
+     * Exists so this is a GESTURE: before it, sending alerts to the team's
+     * Discord (or any webhook) meant editing the tenant's JSONB in the
+     * database. Audited as `alert_channel.configured`.
+     *
+     * `ref` is the channel name (`"discord"`) or a named ref
+     * (`"discord-plantao"`, then pass `channel: "discord"`). Fields are open
+     * because the vocabulary belongs to the CHANNEL, not the core.
+     *
+     * The response returns the config MASKED — a webhook URL is the
+     * credential, and reads never hand it back whole.
+     * Perm: `alerts.routes.manage`.
+     */
+    setChannel<T = Json>(ref: string, config: AlertChannelConfigInput): Promise<T>;
+    /** `DELETE /alerts/channels/{ref}` — audited as `alert_channel.removed`. */
+    deleteChannel(ref: string): Promise<void>;
+}
+/** What `setChannel` accepts. Open-ended on purpose: the vocabulary is the
+ *  channel's, not the core's. */
+interface AlertChannelConfigInput {
+    /** Which channel a named ref belongs to (omit when ref === channel). */
+    channel?: string;
+    /** Webhook address. This IS the credential — reads return it masked. */
+    url?: string;
+    to?: string;
+    token?: string;
+    username?: string;
+    allowlist?: string[];
+    timeout?: number;
+}
+/** `client.alarms.*` — threshold alarm rules on node properties (v26). */
+declare class AlarmsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    /** `node_id` XOR `node_type`; operator ∈ gt|gte|lt|lte|eq|ne. */
+    create<T = Json>(input: {
+        name: string;
+        property_name: string;
+        operator: string;
+        threshold: number;
+        node_id?: string;
+        node_type?: string;
+        action_type_name?: string;
+        action_payload?: Json;
+        cooldown_seconds?: number;
+        active?: boolean;
+    }): Promise<T>;
+    update<T = Json>(ruleId: string, patch: Json): Promise<T>;
+    delete(ruleId: string): Promise<void>;
+    events<T = Json>(opts?: {
+        rule_id?: string;
+        limit?: number;
+    }): Promise<T[]>;
+}
+/** `client.events.*` — detections pipeline status + dead-letter queue. */
+declare class EventsResource {
+    private readonly t;
+    constructor(t: Transport);
+    pipelineStatus<T = Json>(): Promise<T>;
+    dlqList<T = Json>(limit?: number): Promise<T>;
+    /** Exactly one of `ids` / `all` is required. */
+    dlqRetry<T = Json>(opts: {
+        ids?: string[];
+        all?: boolean;
+    }): Promise<T>;
+    /** Exactly one of `ids` / `all` is required. */
+    dlqPurge<T = Json>(opts: {
+        ids?: string[];
+        all?: boolean;
+    }): Promise<T>;
+}
+/**
+ * Pairing state for a skill that declares the `pairing` capability (e.g. a
+ * WhatsApp station). `qr_data_url` is a ready-to-render `data:image/png;base64`.
+ */
+interface PairingInfo {
+    state: "connected" | "awaiting_scan" | "disconnected" | "error";
+    qr_data_url: string | null;
+    code: string | null;
+    expires_at: string | null;
+    detail: string;
+    /** Additive (pool station): WHICH number is pairing — single-instance skills never set it. */
+    pairing_number?: string | null;
+}
+/**
+ * Result of an inventory gesture on a skill that declares the `inventory`
+ * capability. `detail` carries the driver's own sentence ("já existe número
+ * com este identificador") — it is the operator's diagnosis, so surface it
+ * instead of a generic failure.
+ */
+interface InventoryResult {
+    ok: boolean;
+    detail: string;
+    item?: Record<string, unknown> | null;
+}
+/** A row of the connector skill catalog (`GET /governance/agents/skills`). */
+interface SkillCatalogRow {
+    skill_key: string;
+    label: string;
+    description: string;
+    category: string;
+    source: string;
+    platforms: string[];
+    requires_secrets: string[];
+    param_schema: Json[];
+    /** Additive — declared capabilities of the skill, e.g. `["pairing"]`. */
+    capabilities?: string[];
+}
+/** `client.connectors.*` — HTTP connector agents under governance. */
+declare class ConnectorsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    patch<T = Json>(agentId: string, patch: Json): Promise<T>;
+    /** status ∈ inactive|active|running|degraded|failed */
+    setStatus(agentId: string, status: string): Promise<Json>;
+    bindings<T = Json>(agentId: string): Promise<T[]>;
+    /** Two calls: creates the worker agent, then binds the `connector.http` skill. */
+    register(input: {
+        slug: string;
+        display_name: string;
+        base_url: string;
+        node_type: string;
+        id_field: string;
+        path?: string;
+        name_field?: string;
+        records_path?: string;
+        auth?: Json;
+        pagination?: Json;
+        cron_preset?: string;
+    }): Promise<Json>;
+    test<T = Json>(agentId: string): Promise<T>;
+    run<T = Json>(agentId: string): Promise<T>;
+    /**
+     * Start/renew QR pairing for a skill with the `pairing` capability (WhatsApp
+     * station). Pass `{ refresh: true }` to force a fresh code.
+     */
+    pairingStart<T = PairingInfo>(agentId: string, skillKey: string, opts?: {
+        refresh?: boolean;
+        target?: string;
+    }): Promise<T>;
+    /** Read-only poll of the pairing state (no side effects). `target` aims a pool number. */
+    pairingPoll<T = PairingInfo>(agentId: string, skillKey: string, opts?: {
+        target?: string;
+    }): Promise<T>;
+    /**
+     * Add / correct / remove a sub-unit administered by a connector that
+     * declares the `inventory` capability — e.g. one number of a WhatsApp
+     * number-station.
+     *
+     * Reading is NOT here: the inventory already reaches callers through the
+     * snapshot the tick publishes on the device mirror (`GET /api/v1/edge/nodes`
+     * → `nodes[].pool`). A second read path would drift between ticks.
+     */
+    applyInventory<T = InventoryResult>(agentId: string, skillKey: string, op: "add" | "update" | "remove", item: Record<string, unknown>): Promise<T>;
+    schedulerTick<T = Json>(): Promise<T>;
+    /** source ∈ native|clawhub. Rows carry an additive `capabilities` field. */
+    skillCatalog<T = SkillCatalogRow>(source?: string): Promise<T[]>;
+    installOpenclaw<T = Json>(slug: string): Promise<T>;
+    refreshOpenclaw<T = Json>(): Promise<T>;
+}
+/** `client.pipelines.*` — data pipelines (v22 CRUD + v23 preview/dry-run). */
+declare class PipelinesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    transformPreview<T = Json>(sampleRows: Json[], steps: Json[]): Promise<T>;
+    dryRun<T = Json>(boardId: string): Promise<T>;
+    syncPreview<T = Json>(format: string, opts?: {
+        sample?: string;
+        source_url?: string;
+        options?: Json;
+        headers?: Json;
+    }): Promise<T>;
+    create<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        description?: string;
+        /** `{ source, steps[], output?: { target_node_type, id_field } }` */
+        spec?: Json;
+    }): Promise<T>;
+    update<T = Json>(pipelineId: string, patch: Json): Promise<T>;
+    setSchedule(pipelineId: string, preset: string): Promise<Json>;
+    build<T = Json>(pipelineId: string, opts?: {
+        incremental?: boolean;
+        branch?: string;
+    }): Promise<T>;
+    runs<T = Json>(pipelineId: string, limit?: number): Promise<T[]>;
+}
+declare class ChatChannelsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(channelId: string): Promise<T>;
+    create<T = Json>(input: {
+        name: string;
+        visibility?: string;
+        min_classification?: string;
+        project_id?: string;
+        description?: string;
+    }): Promise<T>;
+    patch<T = Json>(channelId: string, payload: Json): Promise<T>;
+    delete(channelId: string): Promise<void>;
+}
+declare class ChatMessagesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(channelId: string, opts?: {
+        limit?: number;
+        before?: string;
+    }): Promise<T[]>;
+    send<T = Json>(channelId: string, body: string, opts?: {
+        classification?: string;
+        embeds?: Json[];
+    }): Promise<T>;
+}
+/** `client.chat.*` — operator chat channels + messages. */
+declare class ChatResource {
+    readonly channels: ChatChannelsResource;
+    readonly messages: ChatMessagesResource;
+    constructor(t: Transport);
+}
+/** `client.notepad.*` — markdown docs (v23). */
+declare class NotepadResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(docId: string): Promise<T>;
+    create<T = Json>(input: {
+        slug: string;
+        title: string;
+        body_md?: string;
+        markings?: string[];
+        pinned?: boolean;
+        project_id?: string;
+    }): Promise<T>;
+    /** Mirrors Python: all keys are sent (null = unchanged server-side). */
+    update<T = Json>(docId: string, patch: {
+        title?: string;
+        body_md?: string;
+        markings?: string[];
+        pinned?: boolean;
+    }): Promise<T>;
+    delete<T = Json>(docId: string): Promise<T>;
+}
+
+/** `client.lineage.*` — workflow lineage graph + event log. */
+declare class LineageResource {
+    private readonly t;
+    constructor(t: Transport);
+    graph<T = Json>(opts?: {
+        marking?: string;
+        since?: string;
+        kind?: string;
+        limit_events?: number;
+    }): Promise<T>;
+    events<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+        event_type?: string;
+        status?: string;
+    }): Promise<T[]>;
+}
+/** `client.accessAudit.*` — governance access-audit trail. */
+declare class AccessAuditResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        resource_type?: string;
+        resource_id?: string;
+        user_id?: string;
+        since?: string;
+        until?: string;
+        limit?: number;
+    }): Promise<T[]>;
+}
+declare class MarkingCategoriesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+    create<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        mode?: string;
+        description?: string;
+    }): Promise<T>;
+}
+/** `client.markings.*` — marking catalog + per-user eligibility. */
+declare class MarkingsResource {
+    private readonly t;
+    readonly categories: MarkingCategoriesResource;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+        category_id?: string;
+    }): Promise<T[]>;
+    get<T = Json>(markingId: string): Promise<T>;
+    create<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        description?: string;
+        category_id?: string;
+    }): Promise<T>;
+    update<T = Json>(markingId: string, patch: {
+        display_name?: string;
+        description?: string;
+        category_id?: string;
+        active?: boolean;
+    }): Promise<T>;
+    listEligibility<T = Json>(markingId: string): Promise<T[]>;
+    grantEligibility<T = Json>(markingId: string, userId: string, canApply?: boolean): Promise<T>;
+    revokeEligibility(markingId: string, userId: string): Promise<void>;
+}
+/** `client.resourceMarkings.*` — markings applied to arbitrary resources. */
+declare class ResourceMarkingsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(resourceKind: string, resourceId: string): Promise<T[]>;
+    apply<T = Json>(resourceKind: string, resourceId: string, markingId: string): Promise<T>;
+    remove(resourceKind: string, resourceId: string, markingId: string): Promise<void>;
+}
+/** `client.propertyMarkings.*` — markings on individual node properties. */
+declare class PropertyMarkingsResource {
+    private readonly t;
+    constructor(t: Transport);
+    listForNode<T = Json>(nodeId: string): Promise<T>;
+    listOne<T = Json>(nodeId: string, propertyKey: string): Promise<T[]>;
+    apply<T = Json>(nodeId: string, propertyKey: string, markingId: string): Promise<T>;
+    remove(nodeId: string, propertyKey: string, markingId: string): Promise<void>;
+}
+/** `client.rowPolicies.*` — row-level security policy templates (v26). */
+declare class RowPoliciesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: {
+        object_type: string;
+        role: string;
+        predicate_template: string;
+        description?: string;
+        active?: boolean;
+    }): Promise<T>;
+    delete(policyId: string): Promise<void>;
+}
+interface ErasureSelector {
+    node_ids?: string[];
+    property?: string;
+    value?: string;
+    node_type?: string;
+}
+/** `client.erasure.*` — right-to-be-forgotten (preview first, then forget). */
+declare class ErasureResource {
+    private readonly t;
+    constructor(t: Transport);
+    /** Dry-run: shows the match radius without mutating anything. */
+    preview<T = Json>(selector: ErasureSelector): Promise<T>;
+    /** Requires `confirm: true`; pass `expected_count` to guard the radius (422 on mismatch). */
+    forget<T = Json>(selector: ErasureSelector, opts?: {
+        mode?: string;
+        reason?: string;
+        confirm?: boolean;
+        expected_count?: number;
+    }): Promise<T>;
+}
+/** `client.retention.*` — retention windows per target + manual prune. */
+declare class RetentionResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    set<T = Json>(target: string, retentionDays: number, active?: boolean): Promise<T>;
+    delete(target: string): Promise<void>;
+    run<T = Json>(target: string): Promise<T>;
+}
+interface GuestTokenIssue {
+    allowed_action_ids: string[];
+    label?: string;
+    subject?: string;
+    ttl_hours?: number;
+    max_uses?: number;
+    min_interval_seconds?: number;
+    /** `{ fence, target, arrival_radius_m }` */
+    geo?: Json;
+    /**
+     * Free-form denormalized contact (e.g. `{ phone, document, notes }`),
+     * surfaced by real-time gate screens without extra reads. Multi-domain: the
+     * site decides what goes here.
+     */
+    contact?: Json;
+    /** `{ channel, to, text? }` */
+    share?: Json;
+    link_base?: string;
+}
+/** `client.guestTokens.*` — public /m/{token} guest links. */
+declare class GuestTokensResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    /** Plaintext token appears once in the response — treat as a secret. */
+    issue<T = Json>(input: GuestTokenIssue): Promise<T>;
+    revoke<T = Json>(tokenId: string): Promise<T>;
+}
+
+declare class WorkshopBriefingsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(briefingId: string): Promise<T>;
+    create<T = Json>(name: string): Promise<T>;
+    patch<T = Json>(briefingId: string, payload: Json): Promise<T>;
+    broadcast<T = Json>(briefingId: string): Promise<T>;
+}
+declare class WorkshopDossiersResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(dossierId: string): Promise<T>;
+    create<T = Json>(title: string): Promise<T>;
+    patch<T = Json>(dossierId: string, body: Json): Promise<T>;
+    delete(dossierId: string): Promise<void>;
+    addEmbed<T = Json>(dossierId: string, kind: string, sourceRef: string, nodeId: string): Promise<T>;
+    embeds<T = Json>(dossierId: string): Promise<T[]>;
+}
+declare class WorkshopCovsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(objectType?: string): Promise<T[]>;
+    get<T = Json>(covId: string): Promise<T>;
+    /** Full-object upsert. */
+    save<T = Json>(cov: Json): Promise<T>;
+    delete(covId: string): Promise<void>;
+    setTeamDefault(covId: string): Promise<void>;
+}
+/** `client.workshop.*` — briefings, dossiers, custom object views, widget catalog. */
+declare class WorkshopResource {
+    private readonly t;
+    readonly briefings: WorkshopBriefingsResource;
+    readonly dossiers: WorkshopDossiersResource;
+    readonly covs: WorkshopCovsResource;
+    constructor(t: Transport);
+    widgetCatalog<T = Json>(proposableOnly?: boolean): Promise<T[]>;
+}
+declare class ComputeProvidersResource {
+    private readonly t;
+    constructor(t: Transport);
+    catalog<T = Json>(): Promise<T>;
+    list<T = Json>(): Promise<T[]>;
+    /** `api_key` is write-only — never returned by the API. */
+    create<T = Json>(input: {
+        display_name: string;
+        vendor: string;
+        api_key?: string;
+        base_url?: string;
+        country?: string;
+        jurisdictions?: string[];
+        capabilities?: string[];
+        cert_metadata?: Json;
+        pricing_hint?: Json;
+        provider_kind?: string;
+        enabled?: boolean;
+    }): Promise<T>;
+    update<T = Json>(providerId: string, patch: Json): Promise<T>;
+    delete<T = Json>(providerId: string): Promise<T>;
+    test<T = Json>(providerId: string): Promise<T>;
+}
+declare class ComputeReleasesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(name?: string): Promise<T>;
+    publish<T = Json>(input: {
+        name: string;
+        image: string;
+        eval_score?: number;
+        metrics_sha256?: string;
+        eval_notes?: string;
+        notes?: string;
+        spec?: Json;
+    }): Promise<T>;
+    /** 409 if `eval_score` is below the gate. */
+    promote<T = Json>(name: string, version: string, minEvalScore?: number): Promise<T>;
+    deploy<T = Json>(providerId: string, name: string, channel?: string, extra?: Json): Promise<T>;
+}
+/** Scoped control-plane for one provider — `client.compute.control(providerId)`. */
+declare class ComputeControlResource {
+    private readonly t;
+    private readonly base;
+    constructor(t: Transport, providerId: string);
+    listTemplates<T = Json>(): Promise<T>;
+    saveTemplate<T = Json>(name: string, imageName: string, extra?: Json): Promise<T>;
+    deleteTemplate<T = Json>(templateId: string): Promise<T>;
+    listEndpoints<T = Json>(): Promise<T>;
+    createEndpoint<T = Json>(templateId: string, name: string, extra?: Json): Promise<T>;
+    updateEndpoint<T = Json>(endpointId: string, patch: Json): Promise<T>;
+    deleteEndpoint<T = Json>(endpointId: string): Promise<T>;
+    endpointHealth<T = Json>(endpointId: string): Promise<T>;
+    /** `sync: true` long-polls server-side up to `timeout_s` — pass a matching
+     *  `signal` (or raise the client `timeoutMs`) for long jobs. */
+    submitJob<T = Json>(endpointId: string, input: Json, opts?: {
+        sync?: boolean;
+        webhook?: string;
+        timeout_s?: number;
+    }): Promise<T>;
+    jobStatus<T = Json>(endpointId: string, jobId: string): Promise<T>;
+    cancelJob<T = Json>(endpointId: string, jobId: string): Promise<T>;
+    listPods<T = Json>(): Promise<T>;
+    createPod<T = Json>(name: string, imageName: string, extra?: Json): Promise<T>;
+    stopPod<T = Json>(podId: string): Promise<T>;
+    terminatePod<T = Json>(podId: string): Promise<T>;
+}
+/** `client.compute.*` — vision compute, providers, releases, per-provider control plane. */
+declare class ComputeResource {
+    private readonly t;
+    readonly providers: ComputeProvidersResource;
+    readonly releases: ComputeReleasesResource;
+    constructor(t: Transport);
+    selectModel<T = Json>(objective: string, opts?: {
+        intention?: string;
+        jurisdiction?: string;
+    }): Promise<T>;
+    generateSpec<T = Json>(objective: string, opts?: {
+        base_image?: string;
+        contract?: Json;
+        pip?: string[];
+        env?: Json;
+    }): Promise<T>;
+    visionCount<T = Json>(imageUrl: string, instruction: string, opts?: {
+        provider?: string;
+        jurisdiction?: string;
+        /** `{ nw: {lat,lng}, se: {lat,lng} }` */
+        geo_bounds?: Json;
+        /** detect | segment */
+        capability?: string;
+        /** geoshape | point */
+        output_as?: string;
+    }): Promise<T>;
+    /** Factory (no HTTP) — control plane scoped to one provider. */
+    control(providerId: string): ComputeControlResource;
+}
+/** `client.inference.*` — audited LLM inference (server-side InferenceLog). */
+declare class InferenceResource {
+    private readonly t;
+    constructor(t: Transport);
+    complete<T = Json>(prompt: string, opts?: {
+        provider?: string;
+        model?: string;
+        system_prompt?: string;
+        temperature?: number;
+        max_tokens?: number;
+    }): Promise<T>;
+    chat<T = Json>(messages: Json[], opts?: {
+        rag_sources?: string[];
+        rag_limit?: number;
+        provider?: string;
+        model?: string;
+        temperature?: number;
+        max_tokens?: number;
+    }): Promise<T>;
+    models<T = Json>(): Promise<T[]>;
+    collections<T = Json>(): Promise<T[]>;
+    chatWithRag(query: string, opts?: {
+        sources?: string[];
+        limit?: number;
+        provider?: string;
+        model?: string;
+        temperature?: number;
+        max_tokens?: number;
+        system?: string;
+    }): Promise<Json>;
+    auditTrail<T = Json>(opts?: {
+        limit?: number;
+        provider?: string;
+    }): Promise<T[]>;
+}
+/** `client.codegen.*` — LLM code generation (server AST-validates; invalid → 400). */
+declare class CodegenResource {
+    private readonly t;
+    constructor(t: Transport);
+    /** kind ∈ transform|script */
+    generate<T = Json>(objective: string, kind?: string, context?: Json): Promise<T>;
+}
+/** `client.correlation.*` — chain correlation (quick 1-hop sync + multi-hop async). */
+declare class CorrelationResource {
+    private readonly t;
+    constructor(t: Transport);
+    quickLinks<T = Json>(value: string, kind?: string): Promise<T>;
+    startChain<T = Json>(value: string, opts?: {
+        kind?: string;
+        max_depth?: number;
+        budget_nodes?: number;
+        deep_osint_depth?: number;
+    }): Promise<T>;
+    /** Poll until `status === "done"`. */
+    getChain<T = Json>(taskId: string): Promise<T>;
+    /** Opt-in: materializes the chain graph into the ontology. */
+    saveChain<T = Json>(taskId: string, nodeIds?: string[]): Promise<T>;
+}
+/** `client.situational.*` — spatio-temporal correlation over positioned nodes. */
+declare class SituationalResource {
+    private readonly t;
+    constructor(t: Transport);
+    nearby<T = Json>(nodeId: string, opts?: {
+        radius_m?: number;
+        window_s?: number;
+        kinds?: string[];
+        limit?: number;
+    }): Promise<T>;
+    correlations<T = Json>(nodeId: string): Promise<T>;
+    correlate<T = Json>(anchorNodeId: string, opts?: {
+        radius_m?: number;
+        window_s?: number;
+        kinds?: string[];
+        limit?: number;
+    }): Promise<T>;
+    /** Reversible — removes the correlation edge. */
+    cut(edgeId: string): Promise<void>;
+}
+/** Merge target selector: `{object_id}` | `{node_type, canonical}` | `{create: node_type}`. */
+type MergeTarget = Json;
+/** `client.merge.*` — evidence-preserving merge into canonical objects (perm `ontology.merge`). */
+declare class MergeResource {
+    private readonly t;
+    constructor(t: Transport);
+    suggestTarget<T = Json>(nodeType: string, canonical: string): Promise<T>;
+    /** Pass `result_payload` (raw) OR `properties` (ready). */
+    preview<T = Json>(target: MergeTarget, opts?: {
+        result_payload?: Json;
+        properties?: Json;
+    }): Promise<T>;
+    /** `field_resolutions`: `{field: "keep"|"replace"|"append"}`;
+     *  `link`: `{target_object_id, relation_type, metadata?}`. */
+    apply<T = Json>(target: MergeTarget, opts?: {
+        result_payload?: Json;
+        properties?: Json;
+        field_resolutions?: Json;
+        link?: Json;
+    }): Promise<T>;
+}
+
+declare class AtlasLayersResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(name: string, kind: string, extra?: Json): Promise<T>;
+    delete(layerId: string): Promise<void>;
+    /** KML content travels inside the JSON body (not multipart) — same as Python. */
+    importKml<T = Json>(layerId: string, kmlText: string): Promise<T>;
+}
+declare class AtlasEvaluationResource {
+    private readonly t;
+    constructor(t: Transport);
+    status<T = Json>(): Promise<T>;
+    runOnce<T = Json>(): Promise<T>;
+}
+/** `client.atlas.*` — atlas layers + rule evaluator. */
+declare class AtlasResource {
+    readonly layers: AtlasLayersResource;
+    readonly evaluation: AtlasEvaluationResource;
+    constructor(t: Transport);
+}
+/** `client.briefing.*` — per-slug home briefing. */
+declare class BriefingResource {
+    private readonly t;
+    constructor(t: Transport);
+    get<T = Json>(slug: string): Promise<T>;
+    refresh<T = Json>(slug: string): Promise<T>;
+    crisisPlan<T = Json>(slug: string): Promise<T>;
+}
+declare class CctvBookmarksResource {
+    private readonly t;
+    constructor(t: Transport);
+    create<T = Json>(streamId: string, input: {
+        t_ms: number;
+        label: string;
+        t_end_ms?: number;
+        severity?: string;
+    }): Promise<T>;
+    list<T = Json>(streamId: string, opts?: {
+        from_ms?: number;
+        to_ms?: number;
+    }): Promise<T[]>;
+    delete(bookmarkId: string): Promise<void>;
+}
+declare class CctvGcpsResource {
+    private readonly t;
+    constructor(t: Transport);
+    put<T = Json>(streamId: string, gcps: Json[]): Promise<T>;
+    get<T = Json>(streamId: string): Promise<T>;
+    delete(streamId: string): Promise<void>;
+}
+declare class CctvHotlistResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(activeOnly?: boolean): Promise<T[]>;
+    add<T = Json>(plate: string, opts?: {
+        reason?: string;
+        severity?: string;
+    }): Promise<T>;
+    remove(watchedId: string): Promise<void>;
+}
+/** `client.cctv.*` — CCTV streams, detections, recordings, exports, LPR hotlist. */
+declare class CctvResource {
+    private readonly t;
+    readonly bookmarks: CctvBookmarksResource;
+    readonly gcps: CctvGcpsResource;
+    readonly hotlist: CctvHotlistResource;
+    constructor(t: Transport);
+    streamsPage<T = Json>(opts?: {
+        offset?: number;
+        limit?: number;
+        q?: string;
+        status?: string;
+        city?: string;
+        detection_enabled?: boolean;
+    }): Promise<T>;
+    detections<T = Json>(streamId: string, opts?: {
+        limit?: number;
+        from_ms?: number;
+        to_ms?: number;
+    }): Promise<T[]>;
+    detectorClasses<T = Json>(): Promise<T>;
+    presets<T = Json>(): Promise<T[]>;
+    bridgeBackfill<T = Json>(): Promise<T>;
+    /** 202 — returns a provider job to poll. */
+    detectNow<T = Json>(streamId: string, opts?: {
+        frames?: number;
+        frame_stride?: number;
+        push?: boolean;
+    }): Promise<T>;
+    /** 202 — export job; poll with `exportStatus`. */
+    exportClip<T = Json>(streamId: string, opts?: {
+        duration_s?: number;
+        from_ms?: number;
+        to_ms?: number;
+    }): Promise<T>;
+    exportStatus<T = Json>(jobId: string): Promise<T>;
+    recordings<T = Json>(streamId: string, opts?: {
+        from_ms?: number;
+        to_ms?: number;
+    }): Promise<T>;
+    recordingStatus<T = Json>(streamId: string): Promise<T>;
+    /** action ∈ start|stop */
+    recordingControl<T = Json>(streamId: string, action: "start" | "stop", cadence?: number): Promise<T>;
+    /** Returns the raw HLS VOD playlist text (m3u8), not JSON. */
+    recordingsPlaylist(streamId: string, opts?: {
+        from_ms?: number;
+        to_ms?: number;
+    }): Promise<string>;
+}
+/**
+ * A number of a pool station's inventory (`GET /api/v1/edge/nodes` →
+ * `nodes[].pool.numbers[]`). Published by the `connector.whatsapp_pool` tick.
+ */
+interface EdgePoolNumber {
+    id: string;
+    msisdn?: string;
+    role?: string;
+    owner?: string;
+    state?: string;
+    sendable?: boolean;
+    needs_gesture?: boolean;
+    banned_until?: string | null;
+    sent?: number;
+    /** Present only when a device is declared for this number (opt-in). */
+    automation?: EdgePoolAutomation | null;
+}
+/**
+ * Android relink automation for one number. The phone is an edge: when a
+ * session dies, a runner types the 8-character pairing code on the declared
+ * device. Absent when no device is declared — the number stays on the manual
+ * gesture and the row is unchanged.
+ */
+interface EdgePoolAutomation {
+    /** `"idle"` | `"pending"` | `"attempting"` | `"confirming"` | `"needs_human"` */
+    state?: string;
+    attempts?: number;
+    max_attempts?: number;
+    /** Why the automation gave up. Truncated to 160 chars by the backend. */
+    last_error?: string;
+    last_attempt_at?: string;
+    last_success_at?: string;
+    device?: {
+        serial?: string;
+        /** 0 = not reported. */
+        battery?: number;
+        screen_on?: boolean;
+        wa_foreground?: boolean;
+        at?: string;
+    };
+}
+/** Pool snapshot of a number-station device (additive `pool` on {@link EdgeNode}). */
+interface EdgePoolSummary {
+    station?: string | null;
+    state?: string | null;
+    health?: {
+        total?: number;
+        sendable?: number;
+        standby?: number;
+        needs_gesture?: number;
+        temp_banned?: number;
+        connected?: boolean;
+    };
+    numbers?: EdgePoolNumber[];
+}
+/**
+ * An edge device row from `GET /api/v1/edge/nodes`. `kind` is additive —
+ * `"camera_gateway"` | `"whatsapp_station"` | `"whatsapp_pool"` |
+ * `"autosync_bridge"` (absent = legacy camera gateway). `pool` is additive —
+ * present only on number-station devices whose connector published inventory.
+ */
+interface EdgeNode {
+    edge_id: string;
+    name: string;
+    kind?: string;
+    status: string;
+    version: string;
+    last_seen_at: string | null;
+    update_available: boolean;
+    cameras_ok: number | null;
+    pool?: EdgePoolSummary | null;
+    /**
+     * Connector behind a station-like device. `capabilities` are the ones the
+     * skill DECLARES (`"pairing"`, `"inventory"`, …) — gate each gesture by
+     * them, never by a hardcoded skill key.
+     */
+    pairing?: {
+        agent_id: string;
+        slug: string;
+        skill_key: string;
+        capabilities?: string[];
+    } | null;
+}
+/** `client.edge.*` — edge node pairing + fleet version pinning. */
+declare class EdgeResource {
+    private readonly t;
+    constructor(t: Transport);
+    /**
+     * Issue a single-use pairing code (short TTL). The plaintext `code` appears
+     * ONLY in this response (hash at rest).
+     *
+     * `grants` GRANTS gestures to whichever device redeems the code (allowlist;
+     * today `["retry"]`, so a desk app can ask the station to reconnect a
+     * number). Empty — the default — is **read only**: least privilege, and
+     * granting has to be a choice. The grant travels from the code to the node
+     * and dies with it on `revoke`.
+     *
+     * Even when granted, the device never receives the gesture's ADDRESS
+     * (`agent_id`/`skill_key`): it sends the verb and the server routes it.
+     * Perm: `connectors.manage`.
+     */
+    createPairingCode<T = Json>(opts?: {
+        label?: string;
+        ttl_seconds?: number;
+        grants?: string[];
+    }): Promise<T>;
+    /** Nodes carry an additive `kind` field — see {@link EdgeNode}. */
+    listNodes<T = Json>(): Promise<T>;
+    listDiscovered<T = Json>(): Promise<T[]>;
+    revoke<T = Json>(edgeId: string): Promise<T>;
+    setExpectedVersion<T = Json>(version: string): Promise<T>;
+    getExpectedVersion<T = Json>(): Promise<T>;
+}
+declare class VideoStreamsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: {
+        name: string;
+        source_url: string;
+        source_kind: string;
+        classification?: string;
+        camera_pose?: Json;
+    }): Promise<T>;
+    delete(streamId: string): Promise<void>;
+}
+/** `client.video.*` — video streams, detections, tags, soak heatmap, exports. */
+declare class VideoResource {
+    private readonly t;
+    readonly streams: VideoStreamsResource;
+    constructor(t: Transport);
+    listDetections<T = Json>(streamId: string, opts?: {
+        from?: string;
+        to?: string;
+    }): Promise<T[]>;
+    submitDetection<T = Json>(detection: Json): Promise<T>;
+    listTags<T = Json>(streamId: string): Promise<T[]>;
+    submitTag<T = Json>(tag: Json): Promise<T>;
+    soakHeatmap<T = Json>(streamId: string, from: string, to: string, precision?: number): Promise<T[]>;
+    createExport<T = Json>(streamId: string, frameRange: Json, redactions?: Json[]): Promise<T>;
+    getExport<T = Json>(exportId: string): Promise<T>;
+}
+/** `client.comunicados.*` — tenant-wide announcements (v23). */
+declare class ComunicadosResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        kind?: string;
+        status_temporal?: string;
+        include_deleted?: boolean;
+    }): Promise<T[]>;
+    listActive<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: {
+        kind: string;
+        title: string;
+        body?: string;
+        icon?: string;
+        closable?: boolean;
+        duration_s?: number;
+        audience_roles?: string[];
+        audience_iam_perms?: string[];
+        audience_groups?: string[];
+        schedule_start?: string;
+        schedule_end?: string;
+        schedule_days_of_week?: number[];
+        cta_label?: string;
+        cta_href?: string;
+    }): Promise<T>;
+    /** Sparse patch — only provided keys are sent. */
+    patch<T = Json>(comunicadoId: string, patch: Json): Promise<T>;
+    /** Soft delete. */
+    delete(comunicadoId: string): Promise<void>;
+    /** Idempotent per-user dismissal. */
+    dismissMe(comunicadoId: string): Promise<void>;
+}
+declare class CampaignBriefingResource {
+    private readonly t;
+    constructor(t: Transport);
+    refresh<T = Json>(opts?: {
+        candidato_nome?: string;
+        candidato_slug?: string;
+        perfil_payload?: Json;
+        clipping_items?: Json[];
+        default_modo_inicial?: string;
+    }): Promise<T>;
+    get<T = Json>(candidatoSlug: string, includeHeadline?: boolean): Promise<T>;
+    /** 409 when the briefing is in crisis mode. */
+    regenerateHeadline<T = Json>(candidatoSlug: string): Promise<T>;
+    /** duration_hours ∈ 1..168 (default 24). */
+    overrideModo<T = Json>(candidatoSlug: string, novoModo: string, durationHours?: number): Promise<T>;
+}
+/** `client.campaign.*` — campaign home-briefing engine. */
+declare class CampaignResource {
+    readonly briefing: CampaignBriefingResource;
+    constructor(t: Transport);
+}
+
+/** `client.forms.*` — governed form submissions (v23). */
+declare class FormsResource {
+    private readonly t;
+    constructor(t: Transport);
+    submit<T = Json>(formKey: string, payload: Json, opts?: {
+        fields?: Json[];
+        visibility_policy?: string;
+        required_perm?: string;
+        action_id?: string;
+        target_node_type?: string;
+        note?: string;
+    }): Promise<T>;
+    listSubmissions<T = Json>(opts?: {
+        form_key?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+}
+declare class AppShellSection {
+    private readonly t;
+    private readonly path;
+    constructor(t: Transport, path: string);
+    get<T = Json>(): Promise<T>;
+    put<T = Json>(value: Json): Promise<T>;
+}
+/** `client.appShell.*` — chrome configuration (banner/footer/user-menu/sidenav/homepage). */
+declare class AppShellResource {
+    private readonly t;
+    readonly banner: AppShellSection;
+    readonly footer: AppShellSection;
+    readonly userMenu: AppShellSection;
+    readonly sidenav: AppShellSection;
+    readonly homepage: AppShellSection;
+    constructor(t: Transport);
+    getMe<T = Json>(): Promise<T>;
+    putMe<T = Json>(config: Json): Promise<T>;
+    getTenant<T = Json>(): Promise<T>;
+    putTenant<T = Json>(config: Json): Promise<T>;
+}
+declare class ProjectConstraintsResource {
+    private readonly t;
+    constructor(t: Transport);
+    get<T = Json>(projectId: string): Promise<T>;
+    put<T = Json>(projectId: string, opts?: {
+        mode?: string;
+        markings?: string[];
+        classification_ceiling?: string;
+    }): Promise<T>;
+    clear(projectId: string): Promise<void>;
+    /** Report-only — deletes nothing. */
+    revalidate<T = Json>(projectId: string): Promise<T>;
+}
+/** `client.projects.*` — project placement + governance constraints. */
+declare class ProjectsResource {
+    private readonly t;
+    readonly constraints: ProjectConstraintsResource;
+    constructor(t: Transport);
+    /** `spaceId: null` removes the project from its Space. */
+    move<T = Json>(projectId: string, spaceId: string | null): Promise<T>;
+}
+/** `client.organizations.*` — org listing + cross-org guests. */
+declare class OrganizationsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+    get<T = Json>(organizationId: string): Promise<T>;
+    listGuests<T = Json>(organizationId: string, includeRevoked?: boolean): Promise<T[]>;
+    inviteGuest<T = Json>(organizationId: string, userId: string, expiresAt?: string): Promise<T>;
+    revokeGuest(organizationId: string, userId: string): Promise<void>;
+}
+/** `client.spaces.*` — spaces (project grouping) + org membership. */
+declare class SpacesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+    get<T = Json>(spaceId: string): Promise<T>;
+    create<T = Json>(slug: string, displayName: string, description?: string): Promise<T>;
+    update<T = Json>(spaceId: string, patch: {
+        display_name?: string;
+        description?: string;
+        active?: boolean;
+    }): Promise<T>;
+    addOrganization<T = Json>(spaceId: string, tenantId: string): Promise<T>;
+    removeOrganization(spaceId: string, tenantId: string): Promise<void>;
+}
+/** Valid project roles (mirror of `aegis.taxonomy.VALID_ROLES`). */
+declare const VALID_PROJECT_ROLES: readonly ["owner", "editor", "reviewer", "viewer", "discoverer"];
+/** `client.solutions.*` — AIP solution designer (blueprints, diagrams, materialize, teardown, marketplace). */
+declare class SolutionsResource {
+    private readonly t;
+    constructor(t: Transport);
+    design<T = Json>(problem: string, opts?: {
+        domain?: string;
+        wizard?: Json;
+    }): Promise<T>;
+    /** Accept-flags travel nested under `accept`; blueprint/diagram_id/app_id/linked_sources stay top-level. */
+    materialize<T = Json>(blueprint: Json, accept?: {
+        ontology_types?: boolean;
+        logic_functions?: boolean;
+        action_types?: boolean;
+        workspace_layout?: boolean;
+        project?: boolean;
+        project_id?: string;
+        agents?: boolean;
+        flows?: boolean;
+    }, opts?: {
+        diagram_id?: string;
+        app_id?: string;
+        linked_sources?: Json[];
+    }): Promise<T>;
+    /** depth ∈ lean|full */
+    designGraph<T = Json>(problem: string, opts?: {
+        wizard?: Json;
+        depth?: string;
+    }): Promise<T>;
+    mergeGraph<T = Json>(currentGraph: Json, baseBlueprint: Json, incomingBlueprint: Json): Promise<T>;
+    listPatterns<T = Json>(): Promise<T[]>;
+    listDiagrams<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+    get<T = Json>(diagramId: string): Promise<T>;
+    create<T = Json>(input: {
+        slug: string;
+        title: string;
+        nodes: Json[];
+        edges: Json[];
+        wizard?: Json;
+        description?: string;
+        project_id?: string;
+    }): Promise<T>;
+    /** Save == publish. */
+    save<T = Json>(diagramId: string, input: {
+        nodes: Json[];
+        edges: Json[];
+        wizard?: Json;
+        message?: string;
+    }): Promise<T>;
+    delete(diagramId: string): Promise<void>;
+    versions<T = Json>(diagramId: string): Promise<T[]>;
+    walkthrough<T = Json>(diagramId: string): Promise<T>;
+    implementations<T = Json>(graph: Json, nodeId: string, opts?: {
+        problem?: string;
+        wizard?: Json;
+    }): Promise<T[]>;
+    expandNode<T = Json>(graph: Json, nodeId: string, planId: string, wizard?: Json): Promise<T>;
+    ontologyModel<T = Json>(prompt: string): Promise<T>;
+    fromLineage<T = Json>(events?: Json[]): Promise<T>;
+    teardownPlan<T = Json>(appId: string): Promise<T>;
+    teardown<T = Json>(appId: string): Promise<T>;
+    marketplaceListings<T = Json>(opts?: {
+        status?: string;
+        q?: string;
+        tag?: string;
+        category?: string;
+    }): Promise<T[]>;
+    marketplaceDetail<T = Json>(listingId: string): Promise<T>;
+    marketplacePublish<T = Json>(diagramId: string, opts?: {
+        title?: string;
+        description?: string;
+        category?: string;
+        tags?: string[];
+    }): Promise<T>;
+    /** Re-materializes the listing in the caller's tenant. */
+    marketplaceInstall<T = Json>(listingId: string): Promise<T>;
+    marketplacePatch<T = Json>(listingId: string, fields: Json): Promise<T>;
+}
+
+declare class WorkspaceVersionsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(workspaceId: string): Promise<T[]>;
+    get<T = Json>(workspaceId: string, versionNumber: number): Promise<T>;
+    republish<T = Json>(workspaceId: string, versionNumber: number, message?: string): Promise<T>;
+}
+/** `client.workspaces.*` — Workshop workspaces: publish, navigation, promotions, kiosk. */
+declare class WorkspacesResource {
+    private readonly t;
+    readonly versions: WorkspaceVersionsResource;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        limit?: number;
+        offset?: number;
+        include_inactive?: boolean;
+    }): Promise<T[]>;
+    get<T = Json>(workspaceId: string): Promise<T>;
+    create<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        description?: string;
+        project_id?: string;
+        config?: Json;
+    }): Promise<T>;
+    /** Save == immediate publish — bumps version + snapshot. */
+    publish<T = Json>(workspaceId: string, config: Json, message?: string): Promise<T>;
+    /** Soft delete (`active=false`). */
+    delete(workspaceId: string): Promise<void>;
+    getNavigation<T = Json>(workspaceId: string): Promise<T>;
+    setNavigation<T = Json>(workspaceId: string, opts?: {
+        navigate_out_allowed?: boolean;
+        allowed_applications?: string[];
+        message?: string;
+    }): Promise<T>;
+    listPromotions<T = Json>(workspaceId: string): Promise<T[]>;
+    /** Idempotent. */
+    promote<T = Json>(workspaceId: string, organizationId: string, ordering?: number): Promise<T>;
+    unpromote(workspaceId: string, organizationId: string): Promise<void>;
+    listPromotedForOrganization<T = Json>(organizationId: string): Promise<T[]>;
+    getKiosk<T = Json>(workspaceId: string): Promise<T>;
+    setKiosk<T = Json>(workspaceId: string, opts?: {
+        hide_chrome?: boolean;
+        allow_exit?: boolean;
+        auto_fullscreen?: boolean;
+        message?: string;
+    }): Promise<T>;
+    startKioskSession<T = Json>(workspaceId: string, clientInfo?: Json): Promise<T>;
+    endKioskSession<T = Json>(workspaceId: string, sessionId: string): Promise<T>;
+    listKioskSessions<T = Json>(workspaceId: string, opts?: {
+        active_only?: boolean;
+        limit?: number;
+        offset?: number;
+    }): Promise<T[]>;
+}
+/** `client.workspaceUpdates.*` — workspace release-notes tours. */
+declare class WorkspaceUpdatesResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(workspaceId: string, includeArchived?: boolean): Promise<T[]>;
+    /** Active updates not yet seen by the caller. */
+    listUnseen<T = Json>(workspaceId: string): Promise<T[]>;
+    get<T = Json>(workspaceId: string, updateId: string): Promise<T>;
+    create<T = Json>(workspaceId: string, input: {
+        title: string;
+        pages: Json[];
+        summary?: string;
+    }): Promise<T>;
+    patch<T = Json>(workspaceId: string, updateId: string, patch: {
+        title?: string;
+        summary?: string;
+        pages?: Json[];
+    }): Promise<T>;
+    archive<T = Json>(workspaceId: string, updateId: string): Promise<T>;
+    /** Hard delete — cascades pages + views. */
+    delete(workspaceId: string, updateId: string): Promise<void>;
+    markSeen(workspaceId: string, updateId: string, dismissed?: boolean): Promise<void>;
+}
+
+/**
+ * Versioned platform surfaces (`/platform/v22..v26`) — mirrors the Python
+ * `platform_v22..platform_v26` modules, unified over the single client
+ * transport (Python uses four different transports; TS uses one).
+ *
+ * Surfaces already mirrored on first-class resources are NOT duplicated
+ * here (pipelines v22, notepad/media/timeseries/pages/guest-tokens/
+ * lineage-graph/llm-budget v23, aip models v25, functions/code-repos/
+ * row-policies/alarms v26).
+ */
+
+declare class V22ActionLogResource {
+    private readonly t;
+    constructor(t: Transport);
+    record<T = Json>(input: {
+        subject_type: string;
+        subject_id: string;
+        action: string;
+        summary?: string;
+        before?: Json;
+        after?: Json;
+        markings?: string[];
+    }): Promise<T>;
+    list<T = Json>(opts?: {
+        subject_type?: string;
+        subject_id?: string;
+    }): Promise<T[]>;
+}
+declare class V22NotepadResource {
+    private readonly t;
+    constructor(t: Transport);
+    create<T = Json>(title: string, opts?: {
+        body?: string;
+        is_template?: boolean;
+        markings?: string[];
+    }): Promise<T>;
+    freeze<T = Json>(docId: string): Promise<T>;
+    instantiate<T = Json>(templateId: string, title: string, variables?: Json): Promise<T>;
+}
+declare class V22QuiverResource {
+    private readonly t;
+    constructor(t: Transport);
+    create<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        cells?: Json[];
+        input_vars?: Json;
+        output_vars?: Json;
+    }): Promise<T>;
+    render<T = Json>(dashId: string, opts?: {
+        variables?: Json;
+        range?: Json;
+    }): Promise<T>;
+}
+/** `client.platformV22.*` — action log, notepad templates, quiver dashboards, usage metering. */
+declare class PlatformV22Resource {
+    private readonly t;
+    readonly actionLog: V22ActionLogResource;
+    readonly notepad: V22NotepadResource;
+    readonly quiver: V22QuiverResource;
+    constructor(t: Transport);
+    /** Returns the transformed value (unwraps the response's `value` field). */
+    applyVariableTransform(kind: string, inputs: Json): Promise<unknown>;
+    recordUsage<T = Json>(input: {
+        object_type: string;
+        op: string;
+        app_type: string;
+        user_count_delta?: number;
+        event_count_delta?: number;
+    }): Promise<T>;
+    queryUsage<T = Json>(opts?: {
+        object_type?: string;
+        op?: string;
+        app_type?: string;
+        days?: number;
+    }): Promise<T[]>;
+}
+declare class V23LogicResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(fid: string): Promise<T>;
+    create<T = Json>(input: Json): Promise<T>;
+    update<T = Json>(fid: string, patch: Json): Promise<T>;
+    delete(fid: string): Promise<void>;
+    invoke<T = Json>(fid: string, inputs?: Json): Promise<T>;
+    addTest<T = Json>(fid: string, input: Json): Promise<T>;
+    runTest<T = Json>(fid: string, testId: string): Promise<T>;
+}
+declare class V23ActionsResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    get<T = Json>(aid: string): Promise<T>;
+    create<T = Json>(input: Json): Promise<T>;
+    update<T = Json>(aid: string, patch: Json): Promise<T>;
+    delete(aid: string): Promise<void>;
+    execute<T = Json>(aid: string, inputs?: Json, note?: string): Promise<T>;
+    plan<T = Json>(steps: Json[]): Promise<T>;
+    executions<T = Json>(aid: string): Promise<T[]>;
+}
+declare class V23AssistResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(opts?: {
+        scope?: string;
+        resource_id?: string;
+    }): Promise<T[]>;
+    create<T = Json>(input: Json): Promise<T>;
+    delete(cid: string): Promise<void>;
+    suggest<T = Json>(input: Json): Promise<T>;
+}
+declare class V23PipelineResource {
+    private readonly t;
+    constructor(t: Transport);
+    list<T = Json>(): Promise<T[]>;
+    create<T = Json>(input: Json): Promise<T>;
+    update<T = Json>(pid: string, patch: Json): Promise<T>;
+    delete(pid: string): Promise<void>;
+    run<T = Json>(pid: string, opts?: Json): Promise<T>;
+    runs<T = Json>(pid: string, limit?: number): Promise<T[]>;
+}
+declare class V23StylesBrandResource {
+    private readonly t;
+    constructor(t: Transport);
+    get<T = Json>(): Promise<T>;
+    update<T = Json>(patch: Json): Promise<T>;
+    /** Unauthenticated-safe read. */
+    getPublic<T = Json>(tenant?: string): Promise<T>;
+}
+declare class V23StylesResource {
+    private readonly t;
+    readonly brand: V23StylesBrandResource;
+    constructor(t: Transport);
+    get<T = Json>(): Promise<T>;
+    update<T = Json>(tokens: Json, message?: string): Promise<T>;
+    getRegionColors<T = Json>(): Promise<T>;
+    updateRegionColors<T = Json>(patch: Json): Promise<T>;
+    /** Multipart upload (the only non-JSON write in the v2x surfaces). */
+    uploadLogo<T = Json>(file: Blob, filename?: string): Promise<T>;
+}
+/** `client.platformV23.*` — logic, action-types, assist, pipeline, quiver,
+ *  connectors, automate, health, contour, vertex, repos, object-sets, carbon, styles. */
+declare class PlatformV23Resource {
+    private readonly t;
+    readonly logic: V23LogicResource;
+    readonly actions: V23ActionsResource;
+    readonly assist: V23AssistResource;
+    readonly pipeline: V23PipelineResource;
+    readonly styles: V23StylesResource;
+    readonly quiver: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        update(id: string, patch: Json): Promise<Json>;
+        run(id: string): Promise<Json>;
+    };
+    readonly connectors: {
+        list(): Promise<Json[]>;
+        register(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        heartbeat(id: string, status?: string, error?: string): Promise<Json>;
+    };
+    readonly automate: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        fire(id: string): Promise<Json>;
+        runs(id: string): Promise<Json[]>;
+    };
+    readonly health: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        run(id: string): Promise<Json>;
+    };
+    readonly contour: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        evaluate(id: string, limit?: number): Promise<Json>;
+    };
+    readonly vertex: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+    };
+    readonly repos: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        commit(id: string, input: Json): Promise<Json>;
+        commits(id: string, branch?: string): Promise<Json[]>;
+        show(id: string, commitId: string): Promise<Json>;
+    };
+    readonly objectSets: {
+        list(): Promise<Json[]>;
+        create(input: Json): Promise<Json>;
+        delete(id: string): Promise<void>;
+        materialize(id: string, limit?: number): Promise<Json>;
+    };
+    constructor(t: Transport);
+    carbonValidate<T = Json>(config: Json): Promise<T>;
+    catalog<T = Json>(): Promise<T>;
+}
+/** `client.marketplace.*` — product storefront + install wizard (v23). */
+declare class MarketplaceResource {
+    private readonly t;
+    constructor(t: Transport);
+    storefront<T = Json>(opts?: {
+        category?: string;
+        sort?: string;
+        search?: string;
+        tags?: string[];
+    }): Promise<T[]>;
+    products<T = Json>(publishedOnly?: boolean): Promise<T[]>;
+    create<T = Json>(input: Json): Promise<T>;
+    publish<T = Json>(pid: string): Promise<T>;
+    details<T = Json>(pid: string): Promise<T>;
+    ontologyImpact<T = Json>(pid: string): Promise<T>;
+    installPrecheck<T = Json>(pid: string): Promise<T>;
+    /** 422 with `{ok:false, gaps}` in the error payload when modules are missing. */
+    install<T = Json>(pid: string, opts?: {
+        confirm_text?: string;
+        config?: Json;
+        notes?: string;
+    }): Promise<T>;
+    installed<T = Json>(): Promise<T[]>;
+    uninstall<T = Json>(installId: string): Promise<T>;
+    /** Admin, idempotent. */
+    seed<T = Json>(): Promise<T>;
+}
+/** `client.platformV24.*` — flat surface (logic functions, assist sessions,
+ *  views, rules, checkpoints, expectations, change requests, scenarios,
+ *  aggregations, object-set traversal, automations, metrics). */
+declare class PlatformV24Resource {
+    private readonly t;
+    constructor(t: Transport);
+    createLogicFunction<T = Json>(input: Json): Promise<T>;
+    listLogicFunctions<T = Json>(): Promise<T[]>;
+    invokeLogicFunction<T = Json>(fnId: string, inputs: Json): Promise<T>;
+    openAssistSession<T = Json>(surface: string, context?: Json): Promise<T>;
+    assistTurn<T = Json>(sessionId: string, content: string): Promise<T>;
+    createView<T = Json>(input: Json): Promise<T>;
+    materializeView<T = Json>(viewId: string): Promise<T>;
+    listTemplates<T = Json>(): Promise<T[]>;
+    installTemplate<T = Json>(templateId: string, config?: Json): Promise<T>;
+    createRule<T = Json>(input: Json): Promise<T>;
+    evaluateRules<T = Json>(trigger: string, subject: Json): Promise<T>;
+    recordCheckpoint<T = Json>(pipeline: string, step: string, opts?: {
+        status?: string;
+        state?: Json;
+    }): Promise<T>;
+    resumePipeline<T = Json>(pipeline: string): Promise<T>;
+    createExpectation<T = Json>(input: Json): Promise<T>;
+    runExpectation<T = Json>(expId: string): Promise<T>;
+    submitChangeRequest<T = Json>(input: Json): Promise<T>;
+    reviewChangeRequest<T = Json>(crId: string, status: string, note?: string): Promise<T>;
+    createScenario<T = Json>(input: Json): Promise<T>;
+    simulateScenario<T = Json>(scenarioId: string): Promise<T>;
+    createNotebook<T = Json>(input: Json): Promise<T>;
+    createAgent<T = Json>(input: Json): Promise<T>;
+    createEvalDashboard<T = Json>(input: Json): Promise<T>;
+    renderEvalDashboard<T = Json>(dashId: string): Promise<T>;
+    addVerticalTab<T = Json>(input: Json): Promise<T>;
+    createAggregation<T = Json>(input: Json): Promise<T>;
+    runAggregation<T = Json>(aggId: string): Promise<T>;
+    /** Multi-hop object-set traversal (gate `workshop.apps.read`). */
+    searchAround<T = Json>(input: Json): Promise<T>;
+    /** On-the-fly aggregation: count/sum/avg/min/max/distinct_count/cardinality. */
+    aggregateObjectSet<T = Json>(input: Json): Promise<T>;
+    createOsdkToken<T = Json>(name: string, scopes?: string[]): Promise<T>;
+    verifyOsdkToken<T = Json>(token: string): Promise<T>;
+    createAutomation<T = Json>(input: Json): Promise<T>;
+    runAutomation<T = Json>(autoId: string): Promise<T>;
+    computeOntologyMetrics<T = Json>(): Promise<T>;
+    forkThread<T = Json>(parentSessionId: string, branchName: string, forkAtMessage?: number): Promise<T>;
+}
+/** `client.platformV25.*` — machinery processes, branch protection, kiosk
+ *  tokens, analyst threads, dataset rollback/snapshots/limits, freshness,
+ *  code scan, evals generation. */
+declare class PlatformV25Resource {
+    private readonly t;
+    constructor(t: Transport);
+    listProcesses<T = Json>(): Promise<T[]>;
+    createProcess<T = Json>(input: {
+        slug: string;
+        display_name: string;
+        graph: Json;
+        description?: string;
+        markings?: string[];
+        project_id?: string;
+    }): Promise<T>;
+    startProcessInstance<T = Json>(processId: string, opts?: {
+        subject_ref?: string;
+        context?: Json;
+        initial_state?: string;
+    }): Promise<T>;
+    transitionProcessInstance<T = Json>(instanceId: string, to: string, reason?: string): Promise<T>;
+    setBranchProtection<T = Json>(dataset: string, branch: string, opts?: {
+        require_approvals?: number;
+        required_clearances?: string[];
+        required_reviewers?: string[];
+        block_direct_commit?: boolean;
+    }): Promise<T>;
+    evaluateBranchProtection<T = Json>(dataset: string, branch: string, opts?: {
+        approvals?: number;
+        committer?: string;
+    }): Promise<T>;
+    mintKioskSession<T = Json>(appId: string, opts?: {
+        display_name?: string;
+        allowed_markings?: string[];
+        ttl_hours?: number;
+    }): Promise<T>;
+    verifyKioskToken<T = Json>(token: string): Promise<T>;
+    newAnalystThread<T = Json>(title?: string): Promise<T>;
+    postAnalystMessage<T = Json>(threadId: string, input: {
+        role: string;
+        content: string;
+        citations?: Json[];
+        depends_on?: string[];
+        kind?: string;
+    }): Promise<T>;
+    rollbackDataset<T = Json>(dataset: string, toAssetId: string, opts?: {
+        branch?: string;
+        reason?: string;
+    }): Promise<T>;
+    queueSnapshot<T = Json>(dataset: string, branch?: string): Promise<T>;
+    peekSnapshotQueue<T = Json>(dataset: string, branch?: string): Promise<T>;
+    setTransactionLimits<T = Json>(dataset: string, opts?: {
+        branch?: string;
+        max_rows?: number;
+        max_bytes?: number;
+        max_open?: number;
+    }): Promise<T>;
+    /** Repeated `dataset` query params. */
+    checkFreshness<T = Json>(datasets: string[]): Promise<T>;
+    raiseCodeScanFinding<T = Json>(input: {
+        repo_ref: string;
+        path: string;
+        rule_id: string;
+        severity: string;
+        message: string;
+        line?: number;
+        commit_sha?: string;
+    }): Promise<T>;
+    codeScanSummary<T = Json>(repoRef: string): Promise<T>;
+    generateEvals<T = Json>(subjectFunction: string, opts?: {
+        description?: string;
+        count?: number;
+    }): Promise<T>;
+    analyzeEvals<T = Json>(evalRunId: string, failures: Json[]): Promise<T>;
+}
+/** `client.platformV26.*` — promotions, object/core views, capacity,
+ *  listeners, sensitive-data scanner, monitoring, health checks, media
+ *  versions, insight, peers, run history. */
+declare class PlatformV26Resource {
+    private readonly t;
+    constructor(t: Transport);
+    listPromotions<T = Json>(): Promise<T[]>;
+    promoteObjectType<T = Json>(objectType: string, opts?: {
+        status?: string;
+        justification?: string;
+    }): Promise<T>;
+    listObjectViews<T = Json>(objectType?: string): Promise<T[]>;
+    createObjectView<T = Json>(objectType: string, branch: string, opts?: {
+        parent_branch?: string;
+        view_spec?: Json;
+    }): Promise<T>;
+    publishObjectView<T = Json>(branchId: string): Promise<T>;
+    generateCoreView<T = Json>(objectType: string, topN?: number): Promise<T>;
+    getCoreView<T = Json>(objectType: string): Promise<T>;
+    reserveCapacity<T = Json>(provider: string, model: string, opts?: {
+        reserved_tpm?: number;
+        reserved_rpm?: number;
+        reason?: string;
+    }): Promise<T>;
+    consumeCapacity<T = Json>(provider: string, model: string, opts?: {
+        tokens?: number;
+        requests?: number;
+    }): Promise<T>;
+    /** Webhook listener — the secret is returned once. */
+    createListener<T = Json>(slug: string, opts?: {
+        integration?: string;
+        target_ontology_type?: string;
+        markings?: string[];
+    }): Promise<T>;
+    listenerEvents<T = Json>(listenerId: string): Promise<T[]>;
+    /** mode ∈ report_only|hash|redact */
+    scanSensitive<T = Json>(payload: Json, opts?: {
+        mode?: string;
+        scope?: string;
+        scope_ref?: string;
+    }): Promise<T>;
+    scanHistory<T = Json>(limit?: number): Promise<T[]>;
+    createMonitoringView<T = Json>(slug: string, displayName: string, opts?: {
+        project_scope?: string;
+        resource_kinds?: string[];
+    }): Promise<T>;
+    monitoringRollup<T = Json>(slug: string): Promise<T>;
+    createHealthCheck<T = Json>(datasetName: string, name: string, checkType: string, spec?: Json): Promise<T>;
+    runHealthCheck<T = Json>(checkId: string, branch?: string): Promise<T>;
+    healthRuns<T = Json>(checkId: string, limit?: number): Promise<T[]>;
+    /** Hash-referenced version metadata — no binary body. */
+    uploadMediaVersion<T = Json>(mediaSet: string, path: string, input: {
+        content_hash: string;
+        mime_type?: string;
+        size_bytes?: number;
+        metadata?: Json;
+    }): Promise<T>;
+    mediaHistory<T = Json>(mediaSet: string, path: string): Promise<T[]>;
+    createInsight<T = Json>(slug: string, input: {
+        display_name: string;
+        base_object_type: string;
+        path: Json[];
+        markings?: string[];
+        project_id?: string;
+    }): Promise<T>;
+    executeInsight<T = Json>(analysisId: string): Promise<T>;
+    createPeer<T = Json>(slug: string, displayName: string, remoteUrl: string, authToken?: string): Promise<T>;
+    syncPeer<T = Json>(peerId: string, input: {
+        resource_kind: string;
+        remote_path: string;
+        local_ref?: string;
+    }): Promise<T>;
+    listPeerMirrors<T = Json>(peerId: string): Promise<T[]>;
+    runHistory<T = Json>(opts?: {
+        status?: string;
+        since?: string;
+        until?: string;
+        user?: string;
+        action?: string;
+        min_duration_ms?: number;
+        failed_only?: boolean;
+        limit?: number;
+    }): Promise<T[]>;
+}
+
 interface AegisClientOptions {
     /** Root URL of the AEGIS deployment, e.g. `https://aegis.example.com`.
      *  Falls back to `process.env.AEGIS_API_URL`, then `http://localhost:8002`. */
@@ -441,12 +2440,38 @@ interface AegisClientOptions {
     timeoutMs?: number;
     /** Custom fetch implementation (tests, proxies, polyfills). */
     fetch?: typeof globalThis.fetch;
+    /** Extra fetch init merged into every request — e.g. cookie-proxy setups
+     *  use `{ credentials: "include", cache: "no-store" }` with a relative
+     *  `baseUrl` like `/api` (the browser cookie carries the auth). */
+    fetchInit?: Omit<RequestInit, "method" | "body" | "signal">;
+    /** Refresh token to seed automatic JWT refresh (normally captured from
+     *  `auth.login`). On a 401 the client rotates it via `POST /auth/refresh`
+     *  and retries the request once. */
+    refreshToken?: string;
+    /** Retry/backoff for transient failures (network errors, timeouts, 429/
+     *  502/503/504). GET/HEAD only unless `retryPost`. Exponential backoff
+     *  with full jitter. Pass `{ retries: 0 }` to disable. */
+    retry?: RetryOptions;
+}
+interface RetryOptions {
+    /** Extra attempts after the first (default 2). */
+    retries?: number;
+    /** First backoff delay in ms (default 250; doubles per attempt). */
+    baseDelayMs?: number;
+    /** Backoff ceiling in ms (default 4000). */
+    maxDelayMs?: number;
+    /** Also retry non-idempotent verbs (default false). */
+    retryPost?: boolean;
 }
 declare class AegisClient implements Transport {
     readonly baseUrl: string;
     private _token;
     private readonly timeoutMs;
-    private readonly _fetch;
+    private readonly _fetchOverride?;
+    private readonly _fetchInit;
+    private _refreshToken;
+    private readonly _retry;
+    private _refreshInFlight;
     readonly auth: AuthResource;
     readonly iam: IamResource;
     readonly osdk: OsdkResource;
@@ -456,12 +2481,88 @@ declare class AegisClient implements Transport {
     readonly functions: FunctionsResource;
     readonly codeRepositories: CodeRepositoriesResource;
     readonly datasets: DatasetsResource;
+    readonly geo: GeoResource;
+    readonly mapTemplates: MapTemplatesResource;
+    readonly media: MediaResource;
+    readonly docs: DocsResource;
+    readonly pages: PagesResource;
+    readonly dossier: DossierResource;
+    readonly timeseries: TimeSeriesResource;
+    /** Public guest-token consumer surface (`/public/v1/guest/{token}/*`). */
+    readonly publicGuest: PublicGuestResource;
+    readonly alerts: AlertsResource;
+    readonly alarms: AlarmsResource;
+    readonly events: EventsResource;
+    readonly connectors: ConnectorsResource;
+    readonly pipelines: PipelinesResource;
+    readonly chat: ChatResource;
+    readonly notepad: NotepadResource;
+    readonly lineage: LineageResource;
+    readonly accessAudit: AccessAuditResource;
+    readonly markings: MarkingsResource;
+    readonly resourceMarkings: ResourceMarkingsResource;
+    readonly propertyMarkings: PropertyMarkingsResource;
+    readonly rowPolicies: RowPoliciesResource;
+    readonly erasure: ErasureResource;
+    readonly retention: RetentionResource;
+    readonly guestTokens: GuestTokensResource;
+    readonly atlas: AtlasResource;
+    readonly briefing: BriefingResource;
+    readonly campaign: CampaignResource;
+    readonly cctv: CctvResource;
+    readonly comunicados: ComunicadosResource;
+    readonly edge: EdgeResource;
+    readonly video: VideoResource;
+    readonly appShell: AppShellResource;
+    readonly forms: FormsResource;
+    /** Alias of `iam.groups` (mirrors Python's standalone `client.groups`). */
+    readonly groups: GroupsResource;
+    readonly organizations: OrganizationsResource;
+    readonly projects: ProjectsResource;
+    readonly solutions: SolutionsResource;
+    readonly spaces: SpacesResource;
+    readonly workspaces: WorkspacesResource;
+    readonly workspaceUpdates: WorkspaceUpdatesResource;
+    readonly marketplace: MarketplaceResource;
+    readonly platformV22: PlatformV22Resource;
+    readonly platformV23: PlatformV23Resource;
+    readonly platformV24: PlatformV24Resource;
+    readonly platformV25: PlatformV25Resource;
+    readonly platformV26: PlatformV26Resource;
+    readonly workshop: WorkshopResource;
+    readonly compute: ComputeResource;
+    readonly inference: InferenceResource;
+    readonly codegen: CodegenResource;
+    readonly correlation: CorrelationResource;
+    readonly situational: SituationalResource;
+    readonly merge: MergeResource;
     constructor(options?: AegisClientOptions);
     /** Replace the active bearer token (or clear with `null`). */
     setToken(token: string | null): void;
+    /** Replace the refresh token used for automatic 401 recovery. */
+    setRefreshToken(token: string | null): void;
     get token(): string | null;
-    /** Generic escape hatch — call any AEGIS endpoint not yet wrapped. */
+    private get _fetch();
+    /** Generic escape hatch — call any AEGIS endpoint not yet wrapped.
+     *  Transient failures are retried with backoff (see `RetryOptions`);
+     *  a 401 triggers one transparent `POST /auth/refresh` + retry when a
+     *  refresh token is held. */
     request<T = unknown>(method: string, path: string, opts?: RequestOptions): Promise<T>;
+    /** Rotate the refresh token (single-flight) and attach the new pair. */
+    private _refreshOnce;
+    private _requestWithRetry;
+    private _doRequest;
+    /**
+     * Open a server-sent-events endpoint and iterate its events. Long-lived:
+     * no default timeout is applied — pass `signal` to cancel.
+     *
+     * ```ts
+     * for await (const ev of client.stream("/operator/tasks/t1/events")) { … }
+     * ```
+     */
+    stream(path: string, opts?: RequestOptions & {
+        method?: string;
+    }): AsyncGenerator<SseEvent, void, undefined>;
 }
 
 /**
@@ -494,4 +2595,79 @@ declare class PermissionDeniedError extends AegisAPIError {
 declare class NotFoundError extends AegisAPIError {
 }
 
-export { AegisAPIError, AegisClient, type AegisClientOptions, AuthError, type DevMode, type FunctionCreate, type Json, type LoginOptions, NotFoundError, type ObjectTypeWrite, type OperatorTaskCreate, type OperatorTaskListOptions, type OsdkToken, type OsdkTokenWithSecret, type Permission, PermissionDeniedError, type PullRequestCreate, type QueryParams, type RequestOptions, type Role, type Tenant, type TokenPair, type TransactionKind, type Transport, type User, type WhoAmI };
+/**
+ * Pure client-side CBAC helpers — mirrors `aegis/classification.py`.
+ * No HTTP: these validate the classification invariant before writes.
+ */
+type ClassificationLevel = "PUBLICO" | "INTERNO" | "RESTRITO" | "SECRETO";
+declare const VALID_LEVELS: readonly ClassificationLevel[];
+declare const CLASSIFICATION_RANK: Readonly<Record<ClassificationLevel, number>>;
+declare const CLASSIFICATION_LABEL: Readonly<Record<ClassificationLevel, string>>;
+declare class ClassificationInvariantViolation extends Error {
+    constructor(message: string);
+}
+/** Highest classification level among the given ones. */
+declare function maxLevel(levels: Iterable<string>): ClassificationLevel;
+/**
+ * The file classification must dominate the data classification, and the
+ * data classification must dominate every upstream input. Throws
+ * `ClassificationInvariantViolation` on breach.
+ */
+declare function validateInvariant(fileCls: string, dataCls: string, upstreamData?: Iterable<string>): void;
+
+/**
+ * IAM permission catalog — mirrors `aegis/iam/permissions.py` verbatim.
+ * Pure client-side (no HTTP): lets SDK consumers reference permission keys
+ * statically instead of hardcoding strings.
+ */
+declare const NAV_PERMISSIONS: readonly ["nav.section.discover", "nav.item.discover.home", "nav.section.operations", "nav.item.operations.tasks", "nav.section.core_loop", "nav.item.core_loop.alerts", "nav.item.core_loop.proposals", "nav.item.core_loop.actions", "nav.section.ontology", "nav.item.ontology.manager", "nav.item.ontology.explorer", "nav.item.ontology.types", "nav.item.ontology.actions", "nav.item.ontology.interfaces", "nav.item.ontology.links", "nav.item.ontology.views", "nav.item.ontology.aggregations", "nav.item.ontology.object_sets", "nav.section.data", "nav.item.data.datasets", "nav.item.data.pipelines", "nav.item.data.connectors", "nav.item.data.media", "nav.item.data.schedules", "nav.item.data.notepad", "nav.item.data.lineage", "nav.item.data.health", "nav.section.aip", "nav.item.aip.threads", "nav.item.aip.agents", "nav.item.aip.tools", "nav.item.aip.logic", "nav.item.aip.models", "nav.item.aip.capacity", "nav.item.aip.scenarios", "nav.item.aip.evals", "nav.item.aip.memory", "nav.item.aip.mcp_adapters", "nav.section.workshop", "nav.item.workshop.apps", "nav.section.governance", "nav.item.governance.projects", "nav.item.governance.audit", "nav.item.governance.lgpd", "nav.item.governance.trace", "nav.item.governance.rules", "nav.item.governance.change_requests", "nav.item.governance.automations", "nav.item.governance.tokens", "nav.item.governance.peers", "nav.item.governance.code_scan", "nav.item.governance.kiosk", "nav.item.governance.access", "nav.item.governance.osdk", "nav.section.resources", "nav.item.resources.docs", "nav.item.resources.template_gallery", "nav.item.resources.aegis_sdk", "nav.section.other", "nav.item.other.intel_map", "nav.item.other.cognitive", "nav.item.other.map_view", "nav.section.campanha", "nav.item.campaign.hub", "nav.item.campaign.chat", "nav.item.campaign.visibility", "nav.item.campaign.agents", "nav.item.campaign.scenarios", "nav.item.campaign.brief", "nav.section.painel-de-controle", "nav.item.painel.home", "nav.item.painel.aprovacoes", "nav.item.painel.comunicacoes", "nav.item.painel.atividade"];
+declare const CAPABILITY_PERMISSIONS: readonly ["ontology.types.read", "ontology.types.write", "ontology.actions.read", "ontology.actions.write", "ontology.actions.execute", "ontology.actions.execute_external", "ontology.objects.read", "ontology.objects.write", "ontology.objects.bulk_delete", "ontology.links.read", "ontology.links.write", "solution.diagram.read", "solution.diagram.write", "solution.diagram.publish", "solution.diagram.delete", "solution.diagram.history.read", "solution.materialize.delete", "solution.refactor", "data.datasets.read", "data.datasets.write", "data.pipelines.read", "data.pipelines.write", "data.lineage.read", "data.connectors.read", "data.connectors.write", "aip.threads.read", "aip.threads.write", "aip.agents.read", "aip.agents.write", "aip.models.read", "aip.models.write", "aip.evals.read", "aip.evals.run", "aip.memory.read", "aip.memory.write", "workshop.apps.read", "workshop.apps.write", "workshop.apps.purge", "operator.tasks.read", "operator.tasks.write", "governance.audit.read", "governance.rules.read", "governance.rules.write", "governance.change_requests.read", "governance.change_requests.write", "governance.change_requests.approve", "governance.tokens.read", "governance.tokens.write", "governance.lgpd.read", "governance.lgpd.write", "governance.peers.read", "governance.peers.write", "governance.kiosk.read", "governance.kiosk.write", "admin.acessos", "admin.classificacao", "admin.auditoria", "admin.federacao", "admin.unidades", "admin.templates", "admin.automacoes", "admin.tokens", "campaign.chat.read", "campaign.chat.write", "campaign.brief.read", "campaign.brief.generate", "campaign.brief.sign", "campaign.scenario.read", "campaign.scenario.run", "campaign.scenario.write", "campaign.visibility.read", "campaign.visibility.pin", "campaign.visibility.escalate", "campaign.agents.read", "campaign.agents.write", "campaign.agents.run", "campaign.flows.read", "campaign.flows.write", "campaign.flows.run", "campaign.briefing.read", "campaign.briefing.refresh", "campaign.briefing.headline", "campaign.briefing.crisis_override", "vault.cookies.manage", "iam.users.read", "iam.users.write", "iam.roles.read", "iam.roles.write", "iam.permissions.read", "iam.permissions.write", "iam.nav.read", "iam.nav.write", "iam.audit.read", "iam.groups.read", "iam.groups.write", "iam.groups.manage_members", "docs.tree.read", "docs.content.read", "aip.flows.read", "aip.flows.write", "aip.flows.execute", "aip.agents.execute", "briefing.read", "briefing.refresh", "ontology.objects.view", "ontology.graph.read", "ontology.graph.export", "ontology.explorer.aggregate", "workshop.briefings.read", "workshop.briefings.write", "workshop.briefings.broadcast", "workshop.dossiers.read", "workshop.dossiers.write", "workshop.dossiers.share", "workshop.covs.read", "workshop.covs.write", "workshop.covs.share", "chat.channels.read", "chat.channels.write", "chat.channels.manage", "chat.messages.send", "chat.messages.read", "alerts.feeds.read", "alerts.feeds.subscribe", "alerts.watches.read", "alerts.watches.subscribe", "alerts.geofences.read", "alerts.geofences.manage", "alerts.shares.read", "alerts.read", "alerts.escalate", "alerts.routes.view", "alerts.routes.manage", "atlas.layers.read", "atlas.layers.manage", "atlas.geofences.draw", "atlas.evaluation.read", "atlas.evaluation.manage", "video.exports.create", "connectors.manage", "events.pipeline.view", "events.pipeline.manage", "situational.correlate.view", "situational.correlate.manage", "security.painel.view", "security.buscar.view", "security.geo.view", "security.geo.cerca.create", "security.cameras.view", "security.cameras.tag", "security.cameras.export", "security.cameras.manage", "security.cameras.bookmark", "security.cameras.hotlist", "security.cameras.cloud_inference", "security.explorador.view", "security.rede.view", "security.rede.edit", "security.ficha.view", "security.ficha.edit", "security.alertas.view", "security.alertas.resolve", "security.relatorios.view", "security.relatorios.edit", "security.relatorios.close", "security.briefings.view", "security.briefings.edit", "security.briefings.broadcast", "security.workshop.view", "security.workshop.edit", "security.workshop.publish_global", "security.fluxos.view", "security.fluxos.edit", "security.fluxos.run", "security.agentes.view", "security.agentes.edit", "security.agentes.run", "security.ontologia.view", "security.ontologia.edit", "security.workshop.kiosk", "security.configuracoes.view", "security.browser.manage", "painel.home.view", "painel.aprovacoes.view", "painel.aprovacoes.act", "painel.comunicacoes.view", "painel.comunicacoes.edit", "painel.atividade.view", "painel.atividade.export", "painel.favoritos.edit", "organization.read", "organization.write", "organization.invite_guest", "space.read", "space.write", "space.add_organization", "project.read", "project.write", "project.move", "project.link", "markings.read", "markings.write", "markings.apply", "markings.remove", "markings.expand_access", "markings.manage_eligibility", "classification.read", "classification.set", "classification.upgrade", "project.constraints.read", "project.constraints.configure", "project.constraints.revalidate", "workspace.read", "workspace.write", "workspace.delete", "workspace.publish", "workspace.history.read", "workspace.republish", "workspace.update.read", "workspace.update.write", "workspace.update.archive", "workspace.update.delete", "workspace.update.view", "workspace.navigation.read", "workspace.navigation.configure", "workspace.promote.read", "workspace.promote.set", "workspace.promote.unset", "workspace.kiosk.read", "workspace.kiosk.configure", "workspace.kiosk.session.start", "workspace.kiosk.session.end", "app_shell.manage", "comunicado.read", "comunicado.write", "comunicado.delete", "forms.submit", "forms.submissions.read", "vendor.dev_mode", "public.token.read", "public.token.issue", "public.token.revoke", "messaging.send", "automation.alarms.read", "automation.alarms.write", "data.media.read", "data.media.write", "function.read", "function.write", "function.invoke", "function.review", "sandbox.install", "sandbox.terminal", "llm.budget.read", "llm.budget.write", "governance.retention.read", "governance.retention.write", "rowpolicy.read", "rowpolicy.write", "compute.providers.read", "compute.providers.write", "compute.pipelines.deploy", "vision.count.execute", "ontology.objects.bulk_write"];
+type NavPermissionKey = (typeof NAV_PERMISSIONS)[number];
+type CapabilityPermissionKey = (typeof CAPABILITY_PERMISSIONS)[number];
+type PermissionKey = NavPermissionKey | CapabilityPermissionKey;
+declare const ALL_PERMISSIONS: readonly PermissionKey[];
+interface IamPermissionDef {
+    key: PermissionKey;
+    kind: "nav" | "capability";
+    /** Key minus its last segment. */
+    resource: string;
+    /** Last segment of the key. */
+    action: string;
+}
+declare function listPermissions(kind?: "nav" | "capability"): IamPermissionDef[];
+declare function isSystemPermission(key: string): boolean;
+
+interface OsdkApplication {
+    slug: string;
+    display_name: string;
+    description: string;
+    permissions: readonly string[];
+}
+declare const APPLICATIONS: readonly OsdkApplication[];
+declare function listApplications(): readonly OsdkApplication[];
+declare function applicationBySlug(slug: string): OsdkApplication | undefined;
+declare function applicationHas(app: OsdkApplication, key: string): boolean;
+/** Throws if the application references a permission key unknown to the catalog. */
+declare function validateApplication(app: OsdkApplication): void;
+
+/**
+ * Adapter between `AegisClient` and the `OSDKClient` contract expected by
+ * code generated from the live ontology (`aegis-osdk generate` /
+ * `GET /ontology/osdk/generate?lang=typescript`):
+ *
+ * ```ts
+ * import { AegisClient, asOsdkClient } from "aegis-platform-sdk";
+ * import { CameraApi } from "./aegis_osdk"; // generated
+ *
+ * const osdk = asOsdkClient(new AegisClient({ ... }));
+ * ```
+ */
+
+/** The client contract emitted at the top of every generated OSDK module. */
+interface OSDKClient {
+    get(path: string, params?: Record<string, unknown>): Promise<any>;
+    post(path: string, body?: unknown): Promise<any>;
+}
+declare function asOsdkClient(client: AegisClient): OSDKClient;
+
+export { ALL_PERMISSIONS, APPLICATIONS, AccessAuditResource, AegisAPIError, AegisClient, type AegisClientOptions, AipResource, AlarmsResource, type AlertChannelConfigInput, AlertsResource, AppShellResource, AtlasResource, AuthError, AuthResource, BriefingResource, CAPABILITY_PERMISSIONS, CLASSIFICATION_LABEL, CLASSIFICATION_RANK, CampaignResource, type CapabilityPermissionKey, CctvResource, ChatResource, ClassificationInvariantViolation, type ClassificationLevel, CodeRepositoriesResource, CodegenResource, ComputeControlResource, ComputeResource, ComunicadosResource, ConnectorsResource, CorrelationResource, DatasetsResource, type DevMode, DocsResource, DossierResource, type EdgeNode, type EdgePoolAutomation, type EdgePoolNumber, type EdgePoolSummary, EdgeResource, ErasureResource, type ErasureSelector, EventsResource, FormsResource, type FunctionCreate, FunctionsResource, GeoResource, GroupsResource, type GuestFix, type GuestObjectSetQuery, type GuestTokenIssue, GuestTokensResource, type IamPermissionDef, IamResource, InferenceResource, type InventoryResult, type Json, LineageResource, type LoginOptions, MapTemplatesResource, MarketplaceResource, MarkingsResource, MediaResource, MergeResource, type MergeTarget, NAV_PERMISSIONS, type NavPermissionKey, NotFoundError, NotepadResource, type OSDKClient, type ObjectTypeWrite, OntologyResource, OperatorResource, type OperatorTaskCreate, type OperatorTaskListOptions, OrganizationsResource, type OsdkApplication, OsdkResource, type OsdkToken, type OsdkTokenWithSecret, PagesResource, type PairingInfo, type Permission, PermissionDeniedError, type PermissionKey, PipelinesResource, PlatformV22Resource, PlatformV23Resource, PlatformV24Resource, PlatformV25Resource, PlatformV26Resource, ProjectsResource, PropertyMarkingsResource, PublicGuestResource, type PublicGuestTransport, type PullRequestCreate, type QueryParams, type RequestOptions, ResourceMarkingsResource, RetentionResource, type RetryOptions, type Role, RowPoliciesResource, SituationalResource, type SkillCatalogRow, SolutionsResource, SpacesResource, type SseEvent, type Tenant, TimeSeriesResource, type TokenPair, type TransactionKind, type Transport, type User, VALID_LEVELS, VALID_PROJECT_ROLES, VideoResource, type WhoAmI, WorkshopResource, WorkspaceUpdatesResource, WorkspacesResource, applicationBySlug, applicationHas, asOsdkClient, isSystemPermission, listApplications, listPermissions, maxLevel, parseSseStream, validateApplication, validateInvariant };