dominus-sdk-nodejs 1.24.0 → 1.24.2

package/docs/usage-reference.md

@@ -0,0 +1,550 @@
+# SDK Usage Reference
+
+Generated from `src/namespaces/**/*.ts` method signatures and JSDoc comments.
+
+Total namespaced commands: **367**.
+
+Columns: `Command` is the method path on the singleton, `Params` is the expected parameter signature, `Returns` is the declared TypeScript return type, `Route` is the backend endpoint (or local behavior), and `What it does` is the method summary.
+
+## dominus.secrets
+
+Source: `src/namespaces/secrets.ts` (SecretsNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.secrets.get` | `key: string` | `Promise<string \| undefined>` | `POST /api/warden/secrets` | Get a secret value. |
+| `dominus.secrets.upsert` | `key: string, value: string, comment?: string` | `Promise<UpsertResult>` | `POST /api/warden/secrets` | Create or update a secret. |
+| `dominus.secrets.list` | `prefix?: string` | `Promise<Array<Record<string, unknown>>>` | `POST /api/warden/secrets` | List secrets, optionally filtered by prefix. |
+| `dominus.secrets.delete` | `key: string` | `Promise<Record<string, unknown>>` | `POST /api/warden/secrets` | Delete a secret. |
+
+## dominus.db
+
+Source: `src/namespaces/db.ts` (DbNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.db.schemas` | `options?: { open?: boolean }` | `Promise<string[]>` | `POST /api/database/schemas` | List accessible schemas. |
+| `dominus.db.tables` | `schema?: string, options?: { open?: boolean }` | `Promise<TableInfo[]>` | `POST /api/database/tables` | List tables in a schema. |
+| `dominus.db.columns` | `table: string, schema?: string, options?: { open?: boolean }` | `Promise<ColumnInfo[]>` | `POST /api/database/columns` | List columns in a table. |
+| `dominus.db.query` | `table: string, options?: QueryOptions` | `Promise<QueryResult>` | `POST /api/database/select` | Query table data with filtering, sorting, and pagination. |
+| `dominus.db.insert` | `table: string, data: Record<string, unknown>, options?: { schema?: string; open?: boolean; reason?: string; actor?: string }` | `Promise<Record<string, unknown>>` | `POST /api/database/insert` | Insert a row into a table. |
+| `dominus.db.update` | `table: string, data: Record<string, unknown>, filters: Record<string, unknown>, options?: { schema?: string; open?: boolean; reason?: string; actor?: string }` | `Promise<{ affected_rows: number }>` | `POST /api/database/update` | Update rows matching filters. |
+| `dominus.db.delete` | `table: string, filters: Record<string, unknown>, options?: { schema?: string; open?: boolean; reason?: string; actor?: string }` | `Promise<{ affected_rows: number }>` | `POST /api/database/delete` | Delete rows matching filters. |
+| `dominus.db.raw` | `sql: string, params?: unknown[], options?: { schema?: string; open?: boolean; reason?: string; actor?: string; use_shared?: boolean }` | `Promise<QueryResult>` | `POST /api/database/raw` | Execute raw SQL queries. |
+| `dominus.db.bulkInsert` | `table: string, rows: Array<Record<string, unknown>>, options?: { schema?: string; reason?: string; actor?: string }` | `Promise<{ inserted_count: number; rows?: Array<Record<string, unknown>> }>` | `POST /api/database/raw` | Insert multiple rows at once using a transaction. |
+| `dominus.db.syncSchema` | `none` | `Promise<{ success: boolean; schemas_synced: string[]; tables_created: string[]; indexes_created: string[]; errors: string[]; seeding?: { success: boolean; seeded_entities: string[]; }; }>` | `POST /api/provision/sync` | Sync protected schemas to factory default. |
+
+## dominus.secure
+
+Source: `src/namespaces/secure.ts` (SecureNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.secure.tables` | `schema?: string` | `Promise<TableInfo[]>` | `GET /api/scribe/data/${schema}/tables` | List tables in a schema. |
+| `dominus.secure.columns` | `table: string, schema?: string` | `Promise<ColumnInfo[]>` | `GET /api/scribe/data/${schema}/${table}/columns` | List columns in a table. |
+| `dominus.secure.query` | `table: string, context: SecureAccessContext, options?: SecureQueryOptions` | `Promise<QueryResult>` | `POST /api/scribe/data/${schema}/${table}/query` | Query secure table data with audit logging. |
+| `dominus.secure.insert` | `table: string, data: Record<string, unknown>, context: SecureAccessContext, schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/scribe/data/${schema}/${table}/insert` | Insert a row into a secure table with audit logging. |
+| `dominus.secure.update` | `table: string, data: Record<string, unknown>, filters: Record<string, unknown>, context: SecureAccessContext, schema?: string` | `Promise<{ affected_rows: number }>` | `POST /api/scribe/data/${schema}/${table}/update` | Update rows in a secure table with audit logging. |
+| `dominus.secure.delete` | `table: string, filters: Record<string, unknown>, context: SecureAccessContext, schema?: string` | `Promise<{ affected_rows: number }>` | `POST /api/scribe/data/${schema}/${table}/delete` | Delete rows from a secure table with audit logging. |
+| `dominus.secure.bulkInsert` | `table: string, rows: Array<Record<string, unknown>>, context: SecureAccessContext, schema?: string` | `Promise<{ inserted_count: number; rows?: Array<Record<string, unknown>> }>` | `POST /api/scribe/data/${schema}/${table}/bulk-insert` | Insert multiple rows into a secure table with audit logging. |
+
+## dominus.redis
+
+Source: `src/namespaces/redis.ts` (RedisNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.redis.set` | `key: string, value: unknown, ttl?: number, category?: string` | `Promise<SetResult>` | `POST /api/whisperer/set` | Set a value with TTL. |
+| `dominus.redis.get` | `key: string, options?: { category?: string; nudge?: boolean; ttl?: number }` | `Promise<GetResult>` | `POST /api/whisperer/get` | Get a value, optionally refreshing TTL. |
+| `dominus.redis.delete` | `key: string, category?: string` | `Promise<{ deleted: boolean }>` | `POST /api/whisperer/delete` | Delete a key. |
+| `dominus.redis.list` | `options?: { prefix?: string; category?: string; limit?: number; cursor?: string; }` | `Promise<ListResult>` | `POST /api/whisperer/list` | List keys by prefix with pagination. |
+| `dominus.redis.mget` | `keys: Array<{ logical_path: string; category?: string }>` | `Promise<{ results: Array<GetResult> }>` | `POST /api/whisperer/mget` | Get multiple keys at once. |
+| `dominus.redis.setnx` | `key: string, value: unknown, ttl?: number, category?: string` | `Promise<SetnxResult>` | `POST /api/whisperer/setnx` | Set if not exists (for distributed locks). |
+| `dominus.redis.incr` | `key: string, delta?: number, ttl?: number, category?: string` | `Promise<IncrResult>` | `POST /api/whisperer/incr` | Increment counter (creates if not exists). |
+| `dominus.redis.hset` | `key: string, field: string, value: unknown, ttl?: number, category?: string` | `Promise<HsetResult>` | `POST /api/whisperer/hset` | Set a hash field. |
+| `dominus.redis.hget` | `key: string, field: string, category?: string` | `Promise<GetResult>` | `POST /api/whisperer/hget` | Get a hash field. |
+| `dominus.redis.hgetall` | `key: string, category?: string` | `Promise<HgetallResult>` | `POST /api/whisperer/hgetall` | Get all fields from a hash. |
+| `dominus.redis.hdel` | `key: string, field: string, category?: string` | `Promise<{ deleted: boolean }>` | `POST /api/whisperer/hdel` | Delete a hash field. |
+| `dominus.redis.type` | `key: string, category?: string` | `Promise<TypeResult>` | `POST /api/whisperer/type` | Get the Redis data type of a key. |
+| `dominus.redis.smembers` | `key: string, category?: string` | `Promise<SmembersResult>` | `POST /api/whisperer/smembers` | Get all members of a Redis set. |
+| `dominus.redis.lrange` | `key: string, options?: { start?: number; stop?: number; category?: string }` | `Promise<LrangeResult>` | `POST /api/whisperer/lrange` | Get a range of items from a Redis list. |
+
+## dominus.files
+
+Source: `src/namespaces/files.ts` (FilesNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.files.upload` | `data: Buffer, filename: string, options?: { contentType?: string; category?: string; path?: string; tags?: Record<string, string>; compliance?: boolean; actor?: string; retentionDays?: number; }` | `Promise<UploadResult>` | `POST /api/archivist/upload` | Upload a file to object storage. |
+| `dominus.files.download` | `options: FileInfo & { expiresSeconds?: number }` | `Promise<DownloadResult>` | `POST /api/archivist/download` | Get a presigned download URL for a file. |
+| `dominus.files.fetch` | `options: FileInfo` | `Promise<FetchResult>` | `POST /api/archivist/fetch` | Fetch file content directly. |
+| `dominus.files.list` | `options?: { category?: string; prefix?: string; limit?: number; cursor?: string; }` | `Promise<ListResult>` | `POST /api/archivist/list` | List files with optional filtering. |
+| `dominus.files.delete` | `options: FileInfo` | `Promise<{ deleted: boolean }>` | `POST /api/archivist/delete` | Delete a file. |
+| `dominus.files.move` | `fileId: string, options: { newCategory?: string; newPath?: string }` | `Promise<Record<string, unknown>>` | `POST /api/archivist/move` | Move or rename a file. |
+| `dominus.files.updateMeta` | `fileId: string, options: { tags?: Record<string, string>; description?: string }` | `Promise<Record<string, unknown>>` | `POST /api/archivist/update` | Update file metadata. |
+| `dominus.files.browse` | `options: { category: string; path?: string; includeSubfolders?: boolean; limit?: number; cursor?: string; }` | `Promise<BrowseResult>` | `POST /api/archivist/browse` | Browse storage with hierarchical navigation. |
+| `dominus.files.getStorageStats` | `none` | `Promise<StorageStats>` | `POST /api/archivist/stats` | Get storage statistics. |
+| `dominus.files.listCategories` | `none` | `Promise<CategoriesResponse>` | `POST /api/archivist/categories` | List all categories (root folders) in storage. |
+| `dominus.files.listViews` | `options?: { userScopes?: string[]; activeTenant?: string; }` | `Promise<ViewsResult>` | `POST /api/archivist/views` | List storage views filtered by user access. |
+| `dominus.files.listCategoriesInView` | `view: string` | `Promise<CategoriesResponse>` | `POST /api/archivist/view-categories` | List categories within a specific view (scope). |
+| `dominus.files.createFolder` | `options: { category: string; path: string; }` | `Promise<CreateFolderResult>` | `POST /api/archivist/folder` | Create a virtual folder. |
+| `dominus.files.deleteFolder` | `options: { category: string; path: string; force?: boolean; }` | `Promise<DeleteFolderResult>` | `DELETE /api/archivist/folder` | Delete a virtual folder and all its contents. |
+| `dominus.files.factoryReset` | `options?: { force?: boolean; reinitializeStructure?: boolean; }` | `Promise<FactoryResetResult>` | `POST /api/admin/factory-reset-storage` | Factory reset - delete ALL objects in the project/environment. |
+
+## dominus.auth
+
+Source: `src/namespaces/auth.ts` (AuthNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.auth.createUser` | `params: { username: string; email: string; password?: string; passwordHash?: string; status?: string; emailVerified?: boolean; isSystem?: boolean; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/users` | Execute create user. |
+| `dominus.auth.getUser` | `userId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/users/${userId}` | Execute get user. |
+| `dominus.auth.listUsers` | `params?: { status?: string; limit?: number; offset?: number; orderBy?: string; orderDesc?: boolean; includeSystem?: boolean; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/users${queryParams}` | Execute list users. |
+| `dominus.auth.updateUser` | `userId: string, data: { username?: string; email?: string; status?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/users/${userId}` | Execute update user. |
+| `dominus.auth.deleteUser` | `userId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/users/${userId}` | Execute delete user. |
+| `dominus.auth.updatePassword` | `userId: string, password: string` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/users/${userId}/password` | Execute update password. |
+| `dominus.auth.verifyPassword` | `userId: string, password: string` | `Promise<Record<string, unknown>>` | `POST /api/guardian/users/${userId}/verify-password` | Execute verify password. |
+| `dominus.auth.getUserProfile` | `userId: string` | `Promise<Record<string, unknown> \| null>` | `GET /api/guardian/user-profiles?user_id=${userId}&limit=1` | Execute get user profile. |
+| `dominus.auth.createUserProfile` | `data: { user_id: string; first_name?: string; last_name?: string; display_name?: string; avatar_url?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/user-profiles` | Execute create user profile. |
+| `dominus.auth.updateUserProfile` | `profileId: string, data: { first_name?: string; last_name?: string; display_name?: string; avatar_url?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/user-profiles/${profileId}` | Execute update user profile. |
+| `dominus.auth.getUserRoles` | `userId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/users/${userId}/roles` | Execute get user roles. |
+| `dominus.auth.addUserRoles` | `userId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/users/${userId}/roles` | Execute add user roles. |
+| `dominus.auth.removeUserRoles` | `userId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/users/${userId}/roles` | Execute remove user roles. |
+| `dominus.auth.getUserScopes` | `userId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/users/${userId}/scopes` | Execute get user scopes. |
+| `dominus.auth.addUserScopes` | `userId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/users/${userId}/scopes` | Execute add user scopes. |
+| `dominus.auth.removeUserScopes` | `userId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/users/${userId}/scopes` | Execute remove user scopes. |
+| `dominus.auth.getUserTenants` | `userId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/users/${userId}/tenants` | Execute get user tenants. |
+| `dominus.auth.addUserTenants` | `userId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/users/${userId}/tenants` | Execute add user tenants. |
+| `dominus.auth.removeUserTenants` | `userId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/users/${userId}/tenants` | Execute remove user tenants. |
+| `dominus.auth.getUserSubtypes` | `userId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/users/${userId}/subtypes` | Execute get user subtypes. |
+| `dominus.auth.addUserSubtypes` | `userId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/users/${userId}/subtypes` | Execute add user subtypes. |
+| `dominus.auth.removeUserSubtypes` | `userId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/users/${userId}/subtypes` | Execute remove user subtypes. |
+| `dominus.auth.createRole` | `params: { name: string; description?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/roles` | Execute create role. |
+| `dominus.auth.getRole` | `roleId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/roles/${roleId}` | Execute get role. |
+| `dominus.auth.listRoles` | `params?: { limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/roles?limit=${limit}&offset=${offset}` | Execute list roles. |
+| `dominus.auth.updateRole` | `roleId: string, data: { name?: string; description?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/roles/${roleId}` | Execute update role. |
+| `dominus.auth.deleteRole` | `roleId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/roles/${roleId}` | Execute delete role. |
+| `dominus.auth.getRoleScopes` | `roleId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/roles/${roleId}/scopes` | Execute get role scopes. |
+| `dominus.auth.addRoleScopes` | `roleId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/roles/${roleId}/scopes` | Execute add role scopes. |
+| `dominus.auth.removeRoleScopes` | `roleId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/roles/${roleId}/scopes` | Execute remove role scopes. |
+| `dominus.auth.getRoleTenants` | `roleId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/roles/${roleId}/tenants` | Execute get role tenants. |
+| `dominus.auth.addRoleTenants` | `roleId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/roles/${roleId}/tenants` | Execute add role tenants. |
+| `dominus.auth.removeRoleTenants` | `roleId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/roles/${roleId}/tenants` | Execute remove role tenants. |
+| `dominus.auth.getRoleCategories` | `roleId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/roles/${roleId}/categories` | Execute get role categories. |
+| `dominus.auth.addRoleCategories` | `roleId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/roles/${roleId}/categories` | Execute add role categories. |
+| `dominus.auth.removeRoleCategories` | `roleId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/roles/${roleId}/categories` | Execute remove role categories. |
+| `dominus.auth.getRoleSubtypes` | `roleId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/roles/${roleId}/subtypes` | Execute get role subtypes. |
+| `dominus.auth.addRoleSubtypes` | `roleId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/roles/${roleId}/subtypes` | Execute add role subtypes. |
+| `dominus.auth.removeRoleSubtypes` | `roleId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/roles/${roleId}/subtypes` | Execute remove role subtypes. |
+| `dominus.auth.createScope` | `params: { slug: string; displayName: string; description?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/scopes` | Execute create scope. |
+| `dominus.auth.getScope` | `scopeId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/scopes/${scopeId}` | Execute get scope. |
+| `dominus.auth.listScopes` | `params?: { limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/scopes?limit=${limit}&offset=${offset}` | Execute list scopes. |
+| `dominus.auth.updateScope` | `scopeId: string, data: { slug?: string; displayName?: string; description?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/scopes/${scopeId}` | Execute update scope. |
+| `dominus.auth.deleteScope` | `scopeId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/scopes/${scopeId}` | Execute delete scope. |
+| `dominus.auth.getScopeTenants` | `scopeId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/scopes/${scopeId}/tenants` | Execute get scope tenants. |
+| `dominus.auth.addScopeTenants` | `scopeId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/scopes/${scopeId}/tenants` | Execute add scope tenants. |
+| `dominus.auth.removeScopeTenants` | `scopeId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/scopes/${scopeId}/tenants` | Execute remove scope tenants. |
+| `dominus.auth.getScopeCategories` | `scopeId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/scopes/${scopeId}/categories` | Execute get scope categories. |
+| `dominus.auth.addScopeCategories` | `scopeId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/scopes/${scopeId}/categories` | Execute add scope categories. |
+| `dominus.auth.removeScopeCategories` | `scopeId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/scopes/${scopeId}/categories` | Execute remove scope categories. |
+| `dominus.auth.createClient` | `params: { label: string; description?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients` | Execute create client. |
+| `dominus.auth.getClient` | `clientId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/clients/${clientId}` | Execute get client. |
+| `dominus.auth.listClients` | `params?: { limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/clients?limit=${limit}&offset=${offset}` | Execute list clients. |
+| `dominus.auth.updateClient` | `clientId: string, data: { label?: string; description?: string; status?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/clients/${clientId}` | Execute update client. |
+| `dominus.auth.deleteClient` | `clientId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/clients/${clientId}` | Execute delete client. |
+| `dominus.auth.regeneratePsk` | `clientId: string` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients/${clientId}/regenerate-psk` | Execute regenerate psk. |
+| `dominus.auth.verifyPsk` | `clientId: string, psk: string` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients/${clientId}/verify-psk` | Execute verify psk. |
+| `dominus.auth.getClientTenants` | `clientId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/clients/${clientId}/tenants` | Execute get client tenants. |
+| `dominus.auth.addClientTenants` | `clientId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients/${clientId}/tenants` | Execute add client tenants. |
+| `dominus.auth.removeClientTenants` | `clientId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/clients/${clientId}/tenants` | Execute remove client tenants. |
+| `dominus.auth.getClientRoles` | `clientId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/clients/${clientId}/roles` | Execute get client roles. |
+| `dominus.auth.addClientRoles` | `clientId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients/${clientId}/roles` | Execute add client roles. |
+| `dominus.auth.removeClientRoles` | `clientId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/clients/${clientId}/roles` | Execute remove client roles. |
+| `dominus.auth.getClientScopes` | `clientId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/clients/${clientId}/scopes` | Execute get client scopes. |
+| `dominus.auth.addClientScopes` | `clientId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients/${clientId}/scopes` | Execute add client scopes. |
+| `dominus.auth.removeClientScopes` | `clientId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/clients/${clientId}/scopes` | Execute remove client scopes. |
+| `dominus.auth.getClientSubtypes` | `clientId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/clients/${clientId}/subtypes` | Execute get client subtypes. |
+| `dominus.auth.addClientSubtypes` | `clientId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/clients/${clientId}/subtypes` | Execute add client subtypes. |
+| `dominus.auth.removeClientSubtypes` | `clientId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/clients/${clientId}/subtypes` | Execute remove client subtypes. |
+| `dominus.auth.createTenant` | `params: { name: string; slug: string; categoryId?: string; shortname?: string; description?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/tenants` | Execute create tenant. |
+| `dominus.auth.getTenant` | `tenantId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/tenants/${tenantId}` | Execute get tenant. |
+| `dominus.auth.listTenants` | `params?: { status?: string; categoryId?: string; includeSystem?: boolean; limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/tenants${queryParams}` | Execute list tenants. |
+| `dominus.auth.updateTenant` | `tenantId: string, data: { name?: string; shortname?: string; description?: string; status?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/tenants/${tenantId}` | Execute update tenant. |
+| `dominus.auth.deleteTenant` | `tenantId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/tenants/${tenantId}` | Execute delete tenant. |
+| `dominus.auth.createTenantCategory` | `params: { name: string; slug: string; description?: string; color?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/tenant-categories` | Execute create tenant category. |
+| `dominus.auth.getTenantCategory` | `categoryId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/tenant-categories/${categoryId}` | Execute get tenant category. |
+| `dominus.auth.listTenantCategories` | `params?: { includeSystem?: boolean; limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/tenant-categories${queryParams}` | Execute list tenant categories. |
+| `dominus.auth.updateTenantCategory` | `categoryId: string, data: { name?: string; description?: string; color?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/tenant-categories/${categoryId}` | Execute update tenant category. |
+| `dominus.auth.deleteTenantCategory` | `categoryId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/tenant-categories/${categoryId}` | Execute delete tenant category. |
+| `dominus.auth.createSubtype` | `params: { name: string; slug: string; description?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/subtypes` | Execute create subtype. |
+| `dominus.auth.getSubtype` | `subtypeId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/subtypes/${subtypeId}` | Execute get subtype. |
+| `dominus.auth.listSubtypes` | `params?: { limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/subtypes?limit=${limit}&offset=${offset}` | Execute list subtypes. |
+| `dominus.auth.updateSubtype` | `subtypeId: string, data: { name?: string; description?: string; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/subtypes/${subtypeId}` | Execute update subtype. |
+| `dominus.auth.deleteSubtype` | `subtypeId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/subtypes/${subtypeId}` | Execute delete subtype. |
+| `dominus.auth.getSubtypeTenants` | `subtypeId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/subtypes/${subtypeId}/tenants` | Execute get subtype tenants. |
+| `dominus.auth.addSubtypeTenants` | `subtypeId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/subtypes/${subtypeId}/tenants` | Execute add subtype tenants. |
+| `dominus.auth.removeSubtypeTenants` | `subtypeId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/subtypes/${subtypeId}/tenants` | Execute remove subtype tenants. |
+| `dominus.auth.getSubtypeCategories` | `subtypeId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/subtypes/${subtypeId}/categories` | Execute get subtype categories. |
+| `dominus.auth.addSubtypeCategories` | `subtypeId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/subtypes/${subtypeId}/categories` | Execute add subtype categories. |
+| `dominus.auth.removeSubtypeCategories` | `subtypeId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/subtypes/${subtypeId}/categories` | Execute remove subtype categories. |
+| `dominus.auth.getSubtypeScopes` | `subtypeId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/subtypes/${subtypeId}/scopes` | Execute get subtype scopes. |
+| `dominus.auth.addSubtypeScopes` | `subtypeId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/subtypes/${subtypeId}/scopes` | Execute add subtype scopes. |
+| `dominus.auth.removeSubtypeScopes` | `subtypeId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/subtypes/${subtypeId}/scopes` | Execute remove subtype scopes. |
+| `dominus.auth.createPage` | `params: { path: string; name: string; description?: string; isActive?: boolean; showInNav?: boolean; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/pages` | Execute create page. |
+| `dominus.auth.getPage` | `pageId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/pages/${pageId}` | Execute get page. |
+| `dominus.auth.listPages` | `params?: { isActive?: boolean; limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/pages${queryParams}` | Execute list pages. |
+| `dominus.auth.updatePage` | `pageId: string, data: { path?: string; name?: string; description?: string; isActive?: boolean; showInNav?: boolean; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/pages/${pageId}` | Execute update page. |
+| `dominus.auth.deletePage` | `pageId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/pages/${pageId}` | Execute delete page. |
+| `dominus.auth.getPageTenants` | `pageId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/pages/${pageId}/tenants` | Execute get page tenants. |
+| `dominus.auth.addPageTenants` | `pageId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/pages/${pageId}/tenants` | Execute add page tenants. |
+| `dominus.auth.removePageTenants` | `pageId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/pages/${pageId}/tenants` | Execute remove page tenants. |
+| `dominus.auth.setPageTenants` | `pageId: string, tenantIds: string[]` | `Promise<Array<Record<string, unknown>>>` | `PUT /api/guardian/pages/${pageId}/tenants` | Execute set page tenants. |
+| `dominus.auth.getPageScopes` | `pageId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/pages/${pageId}/scopes` | Execute get page scopes. |
+| `dominus.auth.addPageScopes` | `pageId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/pages/${pageId}/scopes` | Execute add page scopes. |
+| `dominus.auth.removePageScopes` | `pageId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/pages/${pageId}/scopes` | Execute remove page scopes. |
+| `dominus.auth.setPageScopes` | `pageId: string, scopeIds: string[]` | `Promise<Array<Record<string, unknown>>>` | `PUT /api/guardian/pages/${pageId}/scopes` | Execute set page scopes. |
+| `dominus.auth.getPageCategories` | `pageId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/pages/${pageId}/categories` | Execute get page categories. |
+| `dominus.auth.addPageCategories` | `pageId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/pages/${pageId}/categories` | Execute add page categories. |
+| `dominus.auth.removePageCategories` | `pageId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/pages/${pageId}/categories` | Execute remove page categories. |
+| `dominus.auth.setPageCategories` | `pageId: string, categoryIds: string[]` | `Promise<Array<Record<string, unknown>>>` | `PUT /api/guardian/pages/${pageId}/categories` | Execute set page categories. |
+| `dominus.auth.getPageExcludedScopes` | `pageId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/pages/${pageId}/excluded-scopes` | Execute get page excluded scopes. |
+| `dominus.auth.addPageExcludedScopes` | `pageId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/pages/${pageId}/excluded-scopes` | Execute add page excluded scopes. |
+| `dominus.auth.removePageExcludedScopes` | `pageId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/pages/${pageId}/excluded-scopes` | Execute remove page excluded scopes. |
+| `dominus.auth.setPageExcludedScopes` | `pageId: string, scopeIds: string[]` | `Promise<Array<Record<string, unknown>>>` | `PUT /api/guardian/pages/${pageId}/excluded-scopes` | Execute set page excluded scopes. |
+| `dominus.auth.getPageExcludedRoles` | `pageId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/pages/${pageId}/excluded-roles` | Execute get page excluded roles. |
+| `dominus.auth.addPageExcludedRoles` | `pageId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/pages/${pageId}/excluded-roles` | Execute add page excluded roles. |
+| `dominus.auth.removePageExcludedRoles` | `pageId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/pages/${pageId}/excluded-roles` | Execute remove page excluded roles. |
+| `dominus.auth.setPageExcludedRoles` | `pageId: string, roleIds: string[]` | `Promise<Array<Record<string, unknown>>>` | `PUT /api/guardian/pages/${pageId}/excluded-roles` | Execute set page excluded roles. |
+| `dominus.auth.getBatchJunctions` | `entity: string, junctions: string[]` | `Promise<Record<string, unknown>>` | `GET /api/guardian/${entity}/batch-junctions?junctions=${encodeURIComponent(junctionsParam)}` | Batch-fetch all junction data for an entity type. |
+| `dominus.auth.createNavItem` | `params: { title: string; icon?: string; description?: string; pageId?: string; parentId?: string; itemType?: 'link' \| 'header' \| 'group_label'; isActive?: boolean; sortOrder?: number; isExpandedDefault?: boolean; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/nav-items` | Execute create nav item. |
+| `dominus.auth.getNavItem` | `navId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/nav-items/${navId}` | Execute get nav item. |
+| `dominus.auth.listNavItems` | `params?: { tenantId?: string; parentId?: string; isActive?: boolean; limit?: number; offset?: number; orderBy?: string; orderDesc?: boolean; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/nav-items?${queryParams.toString()}` | Execute list nav items. |
+| `dominus.auth.updateNavItem` | `navId: string, data: { title?: string; icon?: string \| null; description?: string \| null; pageId?: string \| null; parentId?: string \| null; itemType?: 'link' \| 'header' \| 'group_label'; isActive?: boolean; sortOrder?: number; isExpandedDefault?: boolean; }` | `Promise<Record<string, unknown>>` | `PUT /api/guardian/nav-items/${navId}` | Execute update nav item. |
+| `dominus.auth.deleteNavItem` | `navId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/nav-items/${navId}` | Execute delete nav item. |
+| `dominus.auth.getNavScopes` | `navId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/nav-items/${navId}/scopes` | Execute get nav scopes. |
+| `dominus.auth.addNavScopes` | `navId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/nav-items/${navId}/scopes` | Execute add nav scopes. |
+| `dominus.auth.removeNavScopes` | `navId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/nav-items/${navId}/scopes` | Execute remove nav scopes. |
+| `dominus.auth.getNavRoles` | `navId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/nav-items/${navId}/roles` | Execute get nav roles. |
+| `dominus.auth.addNavRoles` | `navId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/nav-items/${navId}/roles` | Execute add nav roles. |
+| `dominus.auth.removeNavRoles` | `navId: string, roleIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/nav-items/${navId}/roles` | Execute remove nav roles. |
+| `dominus.auth.getNavSubtypes` | `navId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/nav-items/${navId}/subtypes` | Execute get nav subtypes. |
+| `dominus.auth.addNavSubtypes` | `navId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/nav-items/${navId}/subtypes` | Execute add nav subtypes. |
+| `dominus.auth.removeNavSubtypes` | `navId: string, subtypeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/nav-items/${navId}/subtypes` | Execute remove nav subtypes. |
+| `dominus.auth.getNavTenants` | `navId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/nav-items/${navId}/tenants` | Execute get nav tenants. |
+| `dominus.auth.addNavTenants` | `navId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/nav-items/${navId}/tenants` | Execute add nav tenants. |
+| `dominus.auth.removeNavTenants` | `navId: string, tenantIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/nav-items/${navId}/tenants` | Execute remove nav tenants. |
+| `dominus.auth.getNavCategories` | `navId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/nav-items/${navId}/categories` | Execute get nav categories. |
+| `dominus.auth.addNavCategories` | `navId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/nav-items/${navId}/categories` | Execute add nav categories. |
+| `dominus.auth.removeNavCategories` | `navId: string, categoryIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/nav-items/${navId}/categories` | Execute remove nav categories. |
+| `dominus.auth.createSecureTable` | `params: { tableName: string; schemaName?: string; }` | `Promise<Record<string, unknown>>` | `POST /api/guardian/secure-tables` | Execute create secure table. |
+| `dominus.auth.getSecureTable` | `secureTableId: string` | `Promise<Record<string, unknown>>` | `GET /api/guardian/secure-tables/${secureTableId}` | Execute get secure table. |
+| `dominus.auth.listSecureTables` | `params?: { limit?: number; offset?: number; }` | `Promise<Record<string, unknown>>` | `GET /api/guardian/secure-tables?limit=${limit}&offset=${offset}` | Execute list secure tables. |
+| `dominus.auth.deleteSecureTable` | `secureTableId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/secure-tables/${secureTableId}` | Execute delete secure table. |
+| `dominus.auth.getSecureTableScopes` | `secureTableId: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/guardian/secure-tables/${secureTableId}/scopes` | Execute get secure table scopes. |
+| `dominus.auth.addSecureTableScopes` | `secureTableId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `POST /api/guardian/secure-tables/${secureTableId}/scopes` | Execute add secure table scopes. |
+| `dominus.auth.removeSecureTableScopes` | `secureTableId: string, scopeIds: string[]` | `Promise<Record<string, unknown>>` | `DELETE /api/guardian/secure-tables/${secureTableId}/scopes` | Execute remove secure table scopes. |
+| `dominus.auth.getJwks` | `none` | `Promise<Record<string, unknown>>` | `GET /api/warden/jwks (direct fetch; public endpoint)` | Get JWKS (JSON Web Key Set) for token verification. |
+| `dominus.auth.validateJwt` | `token: string` | `Promise<Record<string, unknown>>` | `local verification (invokes getJwks cache when needed)` | Execute validate jwt. |
+
+## dominus.ddl
+
+Source: `src/namespaces/ddl.ts` (DdlNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ddl.createTable` | `tableName: string, columns: ColumnDefinition[], schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/create-table` | Create a table in a schema. |
+| `dominus.ddl.dropTable` | `tableName: string, schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/drop-table` | Drop a table from a schema. |
+| `dominus.ddl.addColumn` | `tableName: string, column: ColumnDefinition, schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/add-column` | Add a column to a table. |
+| `dominus.ddl.dropColumn` | `tableName: string, columnName: string, schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/drop-column` | Drop a column from a table. |
+| `dominus.ddl.alterColumn` | `tableName: string, columnName: string, changes: { newType?: string; newDefault?: string; nullable?: boolean; }, schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/alter-column` | Alter a column in a table. |
+| `dominus.ddl.createIndex` | `tableName: string, indexName: string, columns: string[], options?: { unique?: boolean; schema?: string }` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/create-index` | Create an index on a table. |
+| `dominus.ddl.dropIndex` | `indexName: string, schema?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/schema/drop-index` | Drop an index. |
+| `dominus.ddl.categoryCreateTable` | `categorySlug: string, tableName: string, columns: ColumnDefinition[]` | `Promise<Record<string, unknown>>` | `POST /api/smith/category/create-table` | Create a table across all schemas in a category. |
+| `dominus.ddl.categoryAddColumn` | `categorySlug: string, tableName: string, column: ColumnDefinition` | `Promise<Record<string, unknown>>` | `POST /api/smith/category/add-column` | Add a column across all schemas in a category. |
+| `dominus.ddl.listMigrations` | `schema: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/smith/migrations/list/${schema}` | List migrations for a schema. |
+| `dominus.ddl.listCategoryMigrations` | `categorySlug: string` | `Promise<Array<Record<string, unknown>>>` | `GET /api/smith/migrations/category/${categorySlug}/list` | List migrations for a category. |
+| `dominus.ddl.applyMigration` | `schema: string, migrationId: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/migrations/apply` | Apply a specific migration to a schema. |
+| `dominus.ddl.rollbackMigration` | `schema: string, migrationId: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/migrations/rollback` | Rollback a migration from a schema. |
+| `dominus.ddl.provisionTenantSchema` | `tenantSlug: string, categorySlug?: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/provision/tenant-schema` | Provision a new tenant schema. |
+| `dominus.ddl.provisionTenantFromCategory` | `tenantSlug: string, categorySlug: string` | `Promise<Record<string, unknown>>` | `POST /api/smith/provision/tenant-from-category` | Provision a tenant from a category template. |
+| `dominus.ddl.getCategoryStructure` | `categorySlug: string` | `Promise<SchemaStructure>` | `GET /api/database/builder/category/${categorySlug}/structure` | Get schema structure for a category (for Schema Builder UI). |
+| `dominus.ddl.getCategoryMigrationHistory` | `categorySlug: string` | `Promise<MigrationHistoryResponse>` | `GET /api/database/builder/category/${categorySlug}/migrations` | Get migration history for a category. |
+| `dominus.ddl.previewMigration` | `categorySlug: string, operation: string, params: Record<string, unknown>, migrationName: string` | `Promise<MigrationPreview>` | `POST /api/database/builder/category/${categorySlug}/preview-migration` | Preview a migration before applying. |
+| `dominus.ddl.applyBuilderMigration` | `categorySlug: string, operation: string, params: Record<string, unknown>, migrationName: string` | `Promise<MigrationResult>` | `POST /api/database/builder/category/${categorySlug}/apply-migration` | Apply a migration from Schema Builder. |
+| `dominus.ddl.getMigrationFile` | `categorySlug: string, versionId: string` | `Promise<MigrationFileResponse>` | `GET /api/database/builder/category/${categorySlug}/migrations/${versionId}` | Get a specific migration file content from B2 storage. |
+| `dominus.ddl.getTenantSyncStatus` | `categorySlug: string` | `Promise<SyncStatusResponse>` | `GET /api/database/builder/category/${categorySlug}/sync-status` | Get sync status for all tenants in a category. |
+| `dominus.ddl.syncTenantsToLatest` | `categorySlug: string` | `Promise<SyncTenantsResult>` | `POST /api/database/builder/category/${categorySlug}/sync-tenants` | Sync all tenants in a category to the latest migration version. |
+| `dominus.ddl.resetCategorySchema` | `categorySlug: string` | `Promise<ResetCategoryResult>` | `DELETE /api/database/builder/category/${categorySlug}/reset` | Factory reset a category's schema. |
+| `dominus.ddl.resetTenantSchema` | `categorySlug: string, tenantSlug: string` | `Promise<ResetTenantResult>` | `DELETE /api/database/builder/category/${categorySlug}/tenants/${tenantSlug}/reset` | Reset a single tenant's schema to blank. |
+| `dominus.ddl.deleteMigration` | `categorySlug: string, versionId: string` | `Promise<DeleteMigrationResult>` | `DELETE /api/database/builder/category/${categorySlug}/migrations/${versionId}` | Delete a single migration file from B2 storage. |
+
+## dominus.logs
+
+Source: `src/namespaces/logs.ts` (LogsNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.logs.debug` | `message: string, context?: LogContext, category?: string` | `Promise<boolean>` | `POST /api/logs/ingest (delegates to _log)` | Log debug message. |
+| `dominus.logs.info` | `message: string, context?: LogContext, category?: string` | `Promise<boolean>` | `POST /api/logs/ingest (delegates to _log)` | Log info message. |
+| `dominus.logs.notice` | `message: string, context?: LogContext, category?: string` | `Promise<boolean>` | `POST /api/logs/ingest (delegates to _log)` | Log notice message. |
+| `dominus.logs.warn` | `message: string, context?: LogContext, category?: string` | `Promise<boolean>` | `POST /api/logs/ingest (delegates to _log)` | Log warning message. |
+| `dominus.logs.error` | `message: string, context?: LogContext, options?: { category?: string; exception?: Error }` | `Promise<boolean>` | `POST /api/logs/ingest (delegates to _log)` | Log error message. |
+| `dominus.logs.critical` | `message: string, context?: LogContext, options?: { category?: string; exception?: Error }` | `Promise<boolean>` | `POST /api/logs/ingest (delegates to _log)` | Log critical message. |
+| `dominus.logs.tail` | `options?: { minutes?: number; limit?: number; }` | `Promise<LogEvent[]>` | `GET /api/logs/tail${qs}` | Tail recent logs from the Logs Worker. |
+| `dominus.logs.query` | `options?: { minutes?: number; limit?: number; }` | `Promise<LogEvent[]>` | `GET /api/logs/tail (alias of logs.tail)` | Query logs — alias for tail(). |
+| `dominus.logs.batch` | `events: Array<{ level: string; message: string; context?: LogContext; category?: string; }>` | `Promise<BatchResult>` | `POST /api/logs/ingest` | Send multiple log events in one request. |
+
+## dominus.portal
+
+Source: `src/namespaces/portal.ts` (PortalNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.portal.login` | `username: string, password: string, tenantId?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/auth/login` | Login user with password. |
+| `dominus.portal.loginClient` | `psk: string, tenantId?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/auth/login-client` | Login service client with PSK. |
+| `dominus.portal.logout` | `userToken?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/auth/logout` | End session and clear cookie. |
+| `dominus.portal.refresh` | `userToken?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/auth/refresh` | Refresh JWT token using existing session. |
+| `dominus.portal.me` | `userToken?: string` | `Promise<Record<string, unknown>>` | `GET /api/portal/auth/me` | Get current user/client info. |
+| `dominus.portal.switchTenant` | `tenantId: string, userToken?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/auth/switch-tenant` | Switch active tenant context. |
+| `dominus.portal.changePassword` | `currentPassword: string, newPassword: string, userToken?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/security/change-password` | Change current user's password. |
+| `dominus.portal.requestPasswordReset` | `email: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/security/request-reset` | Request password reset email. |
+| `dominus.portal.confirmPasswordReset` | `token: string, newPassword: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/security/confirm-reset` | Confirm password reset with token. |
+| `dominus.portal.listSessions` | `userToken?: string` | `Promise<Session[]>` | `GET /api/portal/security/sessions` | List all active sessions for current user. |
+| `dominus.portal.revokeSession` | `sessionId: string, userToken?: string` | `Promise<Record<string, unknown>>` | `DELETE /api/portal/security/sessions/${sessionId}` | Revoke a specific session. |
+| `dominus.portal.revokeAllSessions` | `userToken?: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/security/sessions/revoke-all` | Revoke all sessions except current. |
+| `dominus.portal.getProfile` | `userToken?: string` | `Promise<Record<string, unknown>>` | `GET /api/portal/profile` | Get current user's profile. |
+| `dominus.portal.updateProfile` | `params: { displayName?: string; avatarUrl?: string; bio?: string; phone?: string; extra?: Record<string, unknown>; }, userToken?: string` | `Promise<Record<string, unknown>>` | `PUT /api/portal/profile` | Update user profile. |
+| `dominus.portal.getPreferences` | `userToken?: string` | `Promise<Record<string, unknown>>` | `GET /api/portal/profile/preferences` | Get current user's preferences. |
+| `dominus.portal.updatePreferences` | `params: { theme?: string; language?: string; timezone?: string; sidebarCollapsed?: boolean; notificationsEnabled?: boolean; emailNotifications?: boolean; extra?: Record<string, unknown>; }, userToken?: string` | `Promise<Record<string, unknown>>` | `PUT /api/portal/profile/preferences` | Update user preferences. |
+| `dominus.portal.getNavigation` | `userToken?: string, options?: { forceRefresh?: boolean }` | `Promise<NavigationResponse>` | `GET /api/portal/nav` | Get navigation tree for current user's tenant. |
+| `dominus.portal.checkPageAccess` | `pagePath: string, userToken?: string` | `Promise<{ allowed: boolean; reason?: string }>` | `POST /api/portal/nav/check-access` | Check if current user can access a page. |
+| `dominus.portal.register` | `username: string, email: string, password: string, tenantId: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/register` | Self-register new user. |
+| `dominus.portal.verifyEmail` | `token: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/register/verify` | Verify email with token. |
+| `dominus.portal.resendVerification` | `email: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/register/resend-verification` | Resend verification email. |
+| `dominus.portal.acceptInvitation` | `token: string, password: string` | `Promise<Record<string, unknown>>` | `POST /api/portal/register/accept-invitation` | Accept admin invitation and set password. |
+
+## dominus.courier
+
+Source: `src/namespaces/courier.ts` (CourierNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.courier.send` | `templateAlias: string, to: string, fromEmail: string, model: Record<string, unknown>, options?: { tag?: string; replyTo?: string }` | `Promise<SendResult>` | `POST /api/courier/send` | Send email using Postmark template. |
+| `dominus.courier.sendWelcome` | `to: string, fromEmail: string, params: { name: string; productName: string; actionUrl?: string; [key: string]: unknown; }` | `Promise<SendResult>` | `POST /api/courier/send (delegates to send)` | Send welcome email. |
+| `dominus.courier.sendPasswordReset` | `to: string, fromEmail: string, params: { name: string; resetUrl: string; productName: string; [key: string]: unknown; }` | `Promise<SendResult>` | `POST /api/courier/send (delegates to send)` | Send password reset email. |
+| `dominus.courier.sendEmailVerification` | `to: string, fromEmail: string, params: { name: string; verifyUrl: string; productName: string; [key: string]: unknown; }` | `Promise<SendResult>` | `POST /api/courier/send (delegates to send)` | Send email verification email. |
+| `dominus.courier.sendInvitation` | `to: string, fromEmail: string, params: { name: string; inviteUrl: string; inviterName: string; productName: string; [key: string]: unknown; }` | `Promise<SendResult>` | `POST /api/courier/send (delegates to send)` | Send user invitation email. |
+
+## dominus.open
+
+Source: `src/namespaces/open.ts` (OpenNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.open.dsn` | `none` | `Promise<string>` | `GET /api/scribe/open/dsn` | Get the PostgreSQL connection DSN. |
+| `dominus.open.execute` | `sql: string, params?: Record<string, unknown>` | `Promise<Record<string, unknown>>` | `POST /api/scribe/open/execute` | Execute raw SQL query. |
+
+## dominus.health
+
+Source: `src/namespaces/health.ts` (HealthNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.health.check` | `none` | `Promise<HealthStatus>` | `GET /api/health (direct fetch)` | Perform comprehensive health check of orchestrator and dependencies. |
+| `dominus.health.ping` | `none` | `Promise<{ status: string }>` | `GET /api/health/ping` | Simple ping check (fastest response). |
+| `dominus.health.warmup` | `none` | `Promise<Record<string, unknown>>` | `GET /api/health/warmup` | Warmup request (triggers cold start if needed). |
+
+## dominus.stt
+
+Source: `src/namespaces/oracle/index.ts` (OracleNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.stt.createSession` | `userToken: string, options?: OracleSessionOptions` | `OracleSession` | `WebSocket /api/oracle/stream (created by OracleSession)` | Create a streaming transcription session. |
+
+## dominus.admin
+
+Source: `src/namespaces/admin.ts` (AdminNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.admin.reseedAdminCategory` | `none` | `Promise<ReseedResult>` | `POST /api/admin/reseed-admin-category` | Reseed the Admin category baseline data. |
+| `dominus.admin.resetAdminCategory` | `none` | `Promise<ResetResult>` | `DELETE /api/admin/reset-admin-category` | Factory reset the Admin category schema and reseed baseline data. |
+| `dominus.admin.exportTokens` | `none` | `Promise<ExportTokensResult>` | `GET /api/admin/tokens/export` | Export hashed tokens from the platform database. |
+| `dominus.admin.seedKV` | `none` | `Promise<SeedKVResult>` | `POST /api/admin/kv/seed` | Seed KV store with tokens and project metadata from the database. |
+
+## dominus.ai
+
+Source: `src/namespaces/ai.ts` (AiNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ai.runAgent` | `options: AgentRunOptions` | `Promise<AgentResult>` | `POST /api/agent/run` | Execute agent with blocking wait |
+| `dominus.ai.streamAgent` | `options: AgentRunOptions & { onChunk?: (chunk: StreamChunk) => void }` | `AsyncGenerator<StreamChunk>` | `POST /api/agent/stream` | Execute agent with SSE streaming |
+| `dominus.ai.runAgentAsync` | `options: AgentRunAsyncOptions` | `Promise<{ resultKey: string }>` | `POST /api/agent/run-async` | Fire-and-forget async execution |
+| `dominus.ai.history` | `conversationId: string, limit?: number` | `Promise<Message[]>` | `GET /api/agent/history/${conversationId}?limit=${limit}` | Get conversation history |
+| `dominus.ai.complete` | `options: CompleteOptions` | `Promise<CompleteResult>` | `POST /api/llm/complete` | Blocking LLM completion |
+| `dominus.ai.completeStream` | `options: CompleteOptions & { onChunk?: (chunk: StreamChunk) => void }` | `AsyncGenerator<StreamChunk>` | `POST /api/llm/stream` | Streaming LLM completion |
+| `dominus.ai.stt` | `audio: Buffer, options?: SttOptions` | `Promise<SttResult>` | `POST /api/agent/stt` | Speech-to-text conversion |
+| `dominus.ai.tts` | `text: string, options?: TtsOptions` | `Promise<Buffer>` | `POST /api/agent/tts` | Text-to-speech conversion |
+| `dominus.ai.setup` | `options: SetupOptions` | `Promise<SetupResult>` | `POST /api/session/setup` | Pre-flight session setup |
+
+## dominus.ai.rag
+
+Source: `src/namespaces/ai.ts` (RagSubNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ai.rag.list` | `none` | `Promise<CorpusInfo[]>` | `GET /api/rag` | List all corpora |
+| `dominus.ai.rag.ensure` | `slug: string, options?: { description?: string; embeddingModel?: string }` | `Promise<Record<string, unknown>>` | `POST /api/rag/${slug}/ensure` | Ensure corpus exists (create if not) |
+| `dominus.ai.rag.stats` | `slug: string` | `Promise<Record<string, unknown>>` | `GET /api/rag/${slug}/stats` | Get corpus statistics |
+| `dominus.ai.rag.drop` | `slug: string` | `Promise<Record<string, unknown>>` | `DELETE /api/rag/${slug}` | Drop/delete a corpus |
+| `dominus.ai.rag.entries` | `slug: string, options?: { category?: string; limit?: number; offset?: number }` | `Promise<Record<string, unknown>>` | `POST /api/rag/${slug}/entries` | List entries in a corpus |
+| `dominus.ai.rag.upsert` | `slug: string, identifier: string, options: RagUpsertOptions` | `Promise<Record<string, unknown>>` | `PUT /api/rag/${slug}/${identifier}` | Upsert a single entry |
+| `dominus.ai.rag.get` | `slug: string, identifier: string` | `Promise<RagEntry>` | `GET /api/rag/${slug}/${identifier}` | Get a specific entry |
+| `dominus.ai.rag.delete` | `slug: string, identifier: string` | `Promise<Record<string, unknown>>` | `DELETE /api/rag/${slug}/${identifier}` | Delete an entry |
+| `dominus.ai.rag.bulkUpsert` | `slug: string, entries: Array<RagUpsertOptions & { identifier: string }>` | `Promise<{ processed: number; failed: number; errors?: string[] }>` | `POST /api/rag/${slug}/bulk` | Bulk upsert entries |
+| `dominus.ai.rag.search` | `slug: string, query: string, options?: RagSearchOptions` | `Promise<RagEntry[]>` | `POST /api/rag/${slug}/search` | Semantic search |
+| `dominus.ai.rag.searchRerank` | `slug: string, query: string, options?: { limit?: number; rerankModel?: string }` | `Promise<RagEntry[]>` | `POST /api/rag/${slug}/search/rerank` | Semantic search with reranking |
+| `dominus.ai.rag.ingest` | `slug: string, content: Buffer, filename: string, options?: { contentType?: string; chunkSize?: number; chunkOverlap?: number; }` | `Promise<Record<string, unknown>>` | `POST /api/rag/${slug}/ingest` | Ingest a document (PDF, DOCX, etc.) |
+| `dominus.ai.rag.deleteDocument` | `slug: string, documentId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/rag/${slug}/document/${documentId}` | Delete a document and all its chunks |
+
+## dominus.ai.artifacts
+
+Source: `src/namespaces/ai.ts` (ArtifactsSubNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ai.artifacts.get` | `artifactId: string, conversationId: string` | `Promise<Artifact>` | `GET /api/agent/artifacts/${artifactId}?conversation_id=${conversationId}` | Get artifact by ID |
+| `dominus.ai.artifacts.create` | `options: CreateArtifactOptions` | `Promise<Artifact>` | `POST /api/agent/artifacts` | Create a new artifact |
+| `dominus.ai.artifacts.list` | `conversationId: string` | `Promise<Artifact[]>` | `GET /api/agent/artifacts?conversation_id=${conversationId}` | List artifacts for a conversation |
+| `dominus.ai.artifacts.delete` | `artifactId: string, conversationId: string` | `Promise<Record<string, unknown>>` | `DELETE /api/agent/artifacts/${artifactId}?conversation_id=${conversationId}` | Delete an artifact |
+
+## dominus.ai.results
+
+Source: `src/namespaces/ai.ts` (ResultsSubNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ai.results.get` | `resultKey: string` | `Promise<AsyncResult>` | `GET /api/results/${resultKey}` | Get async result by key |
+| `dominus.ai.results.poll` | `resultKey: string, options?: PollOptions` | `Promise<AsyncResult>` | `GET /api/results/${resultKey} (polling loop via results.get)` | Poll for result until completion or timeout |
+
+## dominus.ai.tools
+
+Source: `src/namespaces/ai.ts` (ToolsSubNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ai.tools.list` | `options?: ToolListOptions` | `Promise<ToolDefinition[]>` | `GET /api/agent/tools[?category=...&enabled_only=...]` | List all tools in the registry. |
+| `dominus.ai.tools.get` | `toolName: string` | `Promise<ToolDefinition>` | `GET /api/agent/tools/${toolName}` | Get a specific tool by name. |
+| `dominus.ai.tools.create` | `options: ToolCreateOptions` | `Promise<ToolDefinition>` | `POST /api/agent/tools` | Register a new tool in the registry. |
+| `dominus.ai.tools.update` | `toolName: string, updates: Partial<ToolCreateOptions>` | `Promise<ToolDefinition>` | `PUT /api/agent/tools/${toolName}` | Update an existing tool. |
+| `dominus.ai.tools.delete` | `toolName: string` | `Promise<{ deleted: boolean }>` | `DELETE /api/agent/tools/${toolName}` | Delete a tool from the registry. |
+| `dominus.ai.tools.enable` | `toolName: string` | `Promise<{ enabled: boolean; toolName: string }>` | `POST /api/agent/tools/${toolName}/enable` | Enable a tool (explicit opt-in for default-deny). |
+| `dominus.ai.tools.disable` | `toolName: string` | `Promise<{ disabled: boolean; toolName: string }>` | `POST /api/agent/tools/${toolName}/disable` | Disable a tool. |
+| `dominus.ai.tools.bulkEnable` | `toolNames: string[]` | `Promise<{ enabled: string[]; failed: string[] }>` | `POST /api/agent/tools/bulk/enable` | Bulk enable multiple tools. |
+| `dominus.ai.tools.bulkDisable` | `toolNames: string[]` | `Promise<{ disabled: string[]; failed: string[] }>` | `POST /api/agent/tools/bulk/disable` | Bulk disable multiple tools. |
+| `dominus.ai.tools.test` | `toolName: string, inputs: Record<string, unknown>` | `Promise<{ success: boolean; output?: unknown; error?: string; }>` | `POST /api/agent/tools/${toolName}/test` | Test an HTTP tool execution. |
+
+## dominus.ai.workflow
+
+Source: `src/namespaces/ai.ts` (WorkflowSubNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.ai.workflow.execute` | `options: WorkflowExecuteOptions` | `Promise<WorkflowResult>` | `POST /api/orchestration/execute` | Execute a multi-agent workflow. |
+| `dominus.ai.workflow.streamExecute` | `options: Omit<WorkflowExecuteOptions, 'mode'>` | `AsyncGenerator<Record<string, unknown>, void, unknown>` | `POST /api/orchestration/execute` | Execute a workflow with SSE streaming. |
+| `dominus.ai.workflow.validate` | `workflowDefinition: WorkflowDefinition \| Record<string, unknown>` | `Promise<WorkflowValidationResult>` | `POST /api/orchestration/validate` | Validate a workflow definition without executing. |
+| `dominus.ai.workflow.messages` | `executionId: string, options?: { count?: number }` | `Promise<Message[]>` | `GET /api/orchestration/messages/${executionId}?count=${count}` | Get agent messages from an execution. |
+| `dominus.ai.workflow.events` | `executionId: string, fromId?: string` | `Promise<Record<string, unknown>[]>` | `GET /api/orchestration/events/${executionId}[?from_id=...]` | Replay events from an execution (for reconnection). |
+| `dominus.ai.workflow.status` | `executionId: string` | `Promise<WorkflowExecutionStatus>` | `GET /api/orchestration/status/${executionId}` | Get async execution status (for polling). |
+| `dominus.ai.workflow.output` | `executionId: string` | `Promise<WorkflowExecutionOutput>` | `GET /api/orchestration/output/${executionId}` | Get final execution output (for async mode). |
+| `dominus.ai.workflow.cancel` | `executionId: string` | `Promise<WorkflowCancelResult>` | `POST /api/orchestration/cancel/${executionId}` | Cancel a running workflow execution. |
+| `dominus.ai.workflow.createRun` | `options: CreateRunOptions` | `Promise<WorkflowRun>` | `POST /api/orchestration/runs` | Phase 1: Create a workflow run and get the run_id. |
+| `dominus.ai.workflow.startRun` | `runId: string, options?: StartRunOptions` | `Promise<WorkflowResult>` | `POST /api/orchestration/runs/${runId}/start` | Phase 2: Start a workflow run after artifacts are uploaded. |
+| `dominus.ai.workflow.getRun` | `runId: string` | `Promise<WorkflowRun>` | `GET /api/orchestration/runs/${runId}` | Get the run status and details. |
+| `dominus.ai.workflow.getManifest` | `runId: string` | `Promise<RunManifest>` | `GET /api/orchestration/runs/${runId}/manifest` | Get the initialization manifest for a run. |
+| `dominus.ai.workflow.registerArtifact` | `runId: string, artifactKey: string, artifactId: string` | `Promise<{ registered: boolean; runId: string; artifactKey: string }>` | `POST /api/orchestration/runs/${runId}/artifacts` | Register an uploaded artifact with a run. |
+| `dominus.ai.workflow.validateRun` | `runId: string` | `Promise<{ ready: boolean; runId: string; status: WorkflowRunStatus; missingArtifacts: string[]; }>` | `POST /api/orchestration/runs/${runId}/validate` | Validate that a run is ready to start. |
+| `dominus.ai.workflow.streamStartRun` | `runId: string, options?: Omit<StartRunOptions, 'mode'>` | `AsyncGenerator<Record<string, unknown>, void, unknown>` | `POST /api/orchestration/runs/${runId}/start` | Start a workflow run with SSE streaming. |
+
+## dominus.workflow
+
+Source: `src/namespaces/workflow.ts` (WorkflowNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.workflow.save` | `options: SaveWorkflowOptions` | `Promise<WorkflowMetadata>` | `POST /api/workflow/workflows` | Save a workflow (create or update). |
+| `dominus.workflow.get` | `workflowId: string, options?: { includeContent?: boolean }` | `Promise<WorkflowWithContent>` | `GET /api/workflow/workflows/${workflowId}[?include_content=true]` | Get a workflow by ID. |
+| `dominus.workflow.list` | `options?: ListWorkflowsOptions` | `Promise<WorkflowMetadata[]>` | `GET /api/workflow/workflows?{filters}` | List workflows. |
+| `dominus.workflow.delete` | `workflowId: string` | `Promise<{ success: boolean }>` | `DELETE /api/workflow/workflows/${workflowId}` | Delete a workflow. |
+| `dominus.workflow.createPipeline` | `options: CreatePipelineOptions` | `Promise<PipelineMetadata>` | `POST /api/workflow/pipelines` | Create a pipeline (execution group). |
+| `dominus.workflow.getPipeline` | `pipelineId: string, options?: { includeWorkflows?: boolean }` | `Promise<PipelineWithWorkflows>` | `GET /api/workflow/pipelines/${pipelineId}[?include_workflows=true]` | Get a pipeline by ID. |
+| `dominus.workflow.listPipelines` | `options?: ListPipelinesOptions` | `Promise<PipelineMetadata[]>` | `GET /api/workflow/pipelines?{filters}` | List pipelines. |
+| `dominus.workflow.deletePipeline` | `pipelineId: string` | `Promise<{ success: boolean }>` | `DELETE /api/workflow/pipelines/${pipelineId}` | Delete a pipeline. |
+| `dominus.workflow.addToPipeline` | `pipelineId: string, workflowId: string, position?: number` | `Promise<{ success: boolean }>` | `POST /api/workflow/pipelines/${pipelineId}/workflows` | Add a workflow to a pipeline. |
+| `dominus.workflow.removeFromPipeline` | `pipelineId: string, workflowId: string` | `Promise<{ success: boolean }>` | `DELETE /api/workflow/pipelines/${pipelineId}/workflows/${workflowId}` | Remove a workflow from a pipeline. |
+| `dominus.workflow.reorderPipeline` | `pipelineId: string, workflowOrder: string[]` | `Promise<{ success: boolean }>` | `PUT /api/workflow/pipelines/${pipelineId}/workflows/order` | Reorder workflows in a pipeline. |
+| `dominus.workflow.listTemplates` | `none` | `Promise<WorkflowMetadata[]>` | `GET /api/workflow/templates` | List available templates. |
+| `dominus.workflow.getTemplate` | `templateId: string, options?: { includeContent?: boolean }` | `Promise<WorkflowWithContent>` | `GET /api/workflow/templates/${templateId}[?include_content=true]` | Get a template by ID. |
+| `dominus.workflow.copyTemplate` | `templateId: string, options?: { name?: string; tenantSlug?: string }` | `Promise<WorkflowMetadata>` | `POST /api/workflow/templates/${templateId}/copy` | Copy a template to create a new workflow. |
+| `dominus.workflow.execute` | `workflowId: string, context?: Record<string, unknown>` | `Promise<ExecutionResult>` | `POST /api/workflow/execute/workflow` | Execute a workflow synchronously. |
+| `dominus.workflow.executeAsync` | `workflowId: string, options?: { context?: Record<string, unknown>; callbackUrl?: string }` | `Promise<AsyncExecutionResult>` | `POST /api/workflow/execute/workflow` | Execute a workflow asynchronously. |
+| `dominus.workflow.executePipeline` | `pipelineId: string, options?: { context?: Record<string, unknown>; callbackUrl?: string }` | `Promise<AsyncExecutionResult>` | `POST /api/workflow/execute/pipeline` | Execute a pipeline (all workflows in sequence). |
+| `dominus.workflow.seed` | `options?: SeedOptions` | `Promise<SeedResult>` | `POST /api/workflow/admin/seed` | Seed workflow storage with base templates and builtin tools. |
+| `dominus.workflow.factoryReset` | `options: FactoryResetOptions` | `Promise<FactoryResetResult>` | `POST /api/workflow/admin/factory-reset` | Factory reset all workflow data - deletes workflows, tools, and B2 objects. |
+| `dominus.workflow.listTools` | `options?: ListToolsOptions` | `Promise<Tool[]>` | `GET /api/workflow/tools?{filters}` | List tools in the registry. |
+| `dominus.workflow.getTool` | `toolId: string` | `Promise<Tool>` | `GET /api/workflow/tools/${toolId}` | Get a tool by ID. |
+| `dominus.workflow.registerTool` | `options: RegisterToolOptions` | `Promise<Tool>` | `POST /api/workflow/tools` | Register a new tool. |
+| `dominus.workflow.updateTool` | `toolId: string, options: UpdateToolOptions` | `Promise<Tool>` | `PUT /api/workflow/tools/${toolId}` | Update a tool. |
+| `dominus.workflow.deleteTool` | `toolId: string` | `Promise<{ success: boolean; deleted: string }>` | `DELETE /api/workflow/tools/${toolId}` | Delete a tool. |
+| `dominus.workflow.enableTool` | `toolId: string` | `Promise<{ success: boolean; tool_id: string; is_enabled: boolean }>` | `POST /api/workflow/tools/${toolId}/enable` | Enable a tool. |
+| `dominus.workflow.disableTool` | `toolId: string` | `Promise<{ success: boolean; tool_id: string; is_enabled: boolean }>` | `POST /api/workflow/tools/${toolId}/disable` | Disable a tool. |
+
+## dominus.sync
+
+Source: `src/namespaces/sync.ts` (SyncNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.sync.triggerSync` | `none` | `Promise<SyncResult>` | `POST /api/sync/` | Trigger a manual KV sync. |
+| `dominus.sync.getHealth` | `none` | `Promise<SyncHealth>` | `GET /api/sync/health` | Check sync worker health. |
+
+## dominus.jobs
+
+Source: `src/namespaces/jobs.ts` (JobsNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.jobs.enqueue` | `jobType: JobType, payload: unknown` | `Promise<EnqueueResult>` | `POST /api/job/enqueue` | Enqueue a new job for asynchronous processing. |
+| `dominus.jobs.getStatus` | `jobId: string` | `Promise<JobStatusResult>` | `POST /api/job/status` | Check the status of a job. |
+| `dominus.jobs.getResult` | `jobId: string, timeoutMs?: number` | `Promise<JobResultResponse>` | `POST /api/job/result` | Poll for a job result (blocks until complete or timeout). |
+| `dominus.jobs.listDeadLetterJobs` | `jobType?: JobType` | `Promise<DeadLetterListResult>` | `POST /api/job/dead-letter` | List dead-lettered jobs, optionally filtered by type. |
+| `dominus.jobs.retryJob` | `jobId: string` | `Promise<{ retried: boolean; job_id: string }>` | `POST /api/job/dead-letter` | Retry a dead-lettered job (re-queues it). |
+| `dominus.jobs.discardJob` | `jobId: string` | `Promise<{ discarded: boolean; job_id: string }>` | `POST /api/job/dead-letter` | Permanently discard a dead-lettered job. |
+| `dominus.jobs.list` | `options?: { status?: JobStatus; job_type?: JobType; limit?: number }` | `Promise<ListJobsResult>` | `POST /api/job/list` | List jobs with optional filters. |
+| `dominus.jobs.getHealth` | `none` | `Promise<JobHealthResult>` | `GET /api/job/health` | Check job worker health. |
+
+## dominus.processor
+
+Source: `src/namespaces/processor.ts` (ProcessorNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.processor.getHealth` | `none` | `Promise<ProcessorHealth>` | `GET /api/processor/health` | Check processor health. |
+| `dominus.processor.processAll` | `jobType?: ProcessorJobType` | `Promise<ProcessAllResult>` | `POST /api/processor/process` | Process all queued jobs for the current project/environment. |
+| `dominus.processor.processOne` | `jobType?: ProcessorJobType` | `Promise<ProcessOneResult>` | `POST /api/processor/process-one` | Process a single job from the queue (debug/testing). |
+
+## dominus.artifacts
+
+Source: `src/namespaces/artifacts.ts` (ArtifactsNamespace)
+
+| Command | Params | Returns | Route | What it does |
+|---|---|---|---|---|
+| `dominus.artifacts.list` | `options?: ArtifactListOptions` | `Promise<ArtifactListResult>` | `POST /api/artifact/list` | List artifacts for the current project/environment. |
+| `dominus.artifacts.getHealth` | `none` | `Promise<ArtifactHealth>` | `GET /api/artifact/health` | Check artifact worker health. |
+| `dominus.artifacts.store` | `options: StoreArtifactOptions` | `Promise<StoreArtifactResult>` | `POST /api/artifact/store` | Store an artifact. |
+| `dominus.artifacts.retrieve` | `key: string` | `Promise<RetrieveArtifactResult>` | `POST /api/artifact/retrieve` | Retrieve an artifact by key. |
+| `dominus.artifacts.delete` | `key: string` | `Promise<DeleteArtifactResult>` | `POST /api/artifact/delete` | Delete an artifact by key. |
+| `dominus.artifacts.cleanup` | `options?: CleanupArtifactOptions` | `Promise<CleanupArtifactResult>` | `POST /api/artifact/cleanup` | Cleanup expired artifacts (admin only). |
+