authgebra 0.1.0__py3-none-any.whl

authgebra/_generated/aio.py

@@ -0,0 +1,1535 @@
+"""GENERATED by tools/generate.py from sdks/contracts/openapi.json - do not edit."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from .._core import AsyncRequester
+from .._core import path_with as _path
+from .._model import request_body, typed_result
+from . import models
+
+
+class AttributesApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def attributes_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.AttributesStatsResponse:
+        """属性定义计数。
+
+        ``GET /api/v1/attributes/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/attributes/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.AttributesStatsResponse, '#/components/schemas/ApiResponse_AttributesStatsDto/properties/data')
+
+    async def create_attribute(self, *, body: models.CreateAttributeRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateAttributeResponse:
+        """create attribute
+
+        ``POST /api/v1/attributes``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/attributes",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateAttributeResponse, '#/components/schemas/ApiResponse_AttributeDto/properties/data')
+
+    async def delete_attribute(self, id: str, *, if_match: str, request_id: str | None = None, traceparent: str | None = None) -> models.DeleteAttributeResponse:
+        """delete attribute
+
+        ``DELETE /api/v1/attributes/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/attributes/{id}", id=id),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeleteAttributeResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def get_attribute(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetAttributeResponse:
+        """get attribute
+
+        ``GET /api/v1/attributes/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/attributes/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetAttributeResponse, '#/components/schemas/ApiResponse_AttributeDto/properties/data')
+
+    async def get_user_attributes(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetUserAttributesResponse:
+        """get user attributes
+
+        ``GET /api/v1/users/{id}/attributes``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/users/{id}/attributes", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetUserAttributesResponse, '#/components/schemas/ApiResponse_AttributesDto/properties/data')
+
+    async def list_attributes(self, *, cursor: str | None = None, limit: int | None = None, owner_type: str | None = None, value_type: str | None = None, q: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListAttributesResponse:
+        """list attributes
+
+        ``GET /api/v1/attributes``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/attributes",
+            query={"cursor": cursor, "limit": limit, "owner_type": owner_type, "value_type": value_type, "q": q},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListAttributesResponse, '#/components/schemas/PagedResponse_AttributeDto/properties/data')
+
+    async def patch_attribute(self, id: str, *, if_match: str, body: models.PatchAttributeRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PatchAttributeResponse:
+        """patch attribute
+
+        ``PATCH /api/v1/attributes/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/attributes/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchAttributeResponse, '#/components/schemas/ApiResponse_AttributeDto/properties/data')
+
+    async def replace_user_attributes(self, id: str, *, if_match: str, body: models.ReplaceAttributesRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ReplaceUserAttributesResponse:
+        """replace user attributes
+
+        ``PUT /api/v1/users/{id}/attributes``
+        """
+        _sdk_result = await self._c.request(
+            "PUT",
+            _path("/api/v1/users/{id}/attributes", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ReplaceUserAttributesResponse, '#/components/schemas/ApiResponse_AttributesDto/properties/data')
+
+
+class AuditApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def audit_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.AuditStatsResponse:
+        """审计今日计数。
+
+        ``GET /api/v1/audit/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/audit/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.AuditStatsResponse, '#/components/schemas/ApiResponse_AuditStatsDto/properties/data')
+
+    async def list_audit_events(self, *, cursor: str | None = None, limit: int | None = None, actor_user_id: str | None = None, action: str | None = None, target_type: str | None = None, target_id: str | None = None, result: str | None = None, from_: str | None = None, to: str | None = None, query_request_id: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListAuditEventsResponse:
+        """查询审计事件（分页、可筛选、metadata 已脱敏）。
+
+        ``GET /api/v1/audit``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/audit",
+            query={"cursor": cursor, "limit": limit, "actor_user_id": actor_user_id, "action": action, "target_type": target_type, "target_id": target_id, "result": result, "from": from_, "to": to, "request_id": query_request_id},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListAuditEventsResponse, '#/components/schemas/PagedResponse_AuditEventDto/properties/data')
+
+
+class AuthApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def change_password(self, *, body: models.ChangePasswordRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.ChangePasswordResponse:
+        """change password
+
+        ``POST /api/v1/auth/change-password``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/change-password",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ChangePasswordResponse, '#/components/schemas/ApiResponse_AuthOkDto/properties/data')
+
+    async def list_sessions(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.ListSessionsResponse:
+        """list sessions
+
+        ``GET /api/v1/auth/sessions``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/auth/sessions",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListSessionsResponse, '#/components/schemas/ApiResponse_Vec_SessionDto/properties/data')
+
+    async def login(self, *, body: models.LoginRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.LoginOperationResponse:
+        """login
+
+        ``POST /api/v1/auth/login``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/login",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.LoginOperationResponse, '#/components/schemas/ApiResponse_LoginResponse/properties/data')
+
+    async def logout(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.LogoutResponse:
+        """logout
+
+        ``POST /api/v1/auth/logout``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/logout",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.LogoutResponse, '#/components/schemas/ApiResponse_AuthOkDto/properties/data')
+
+    async def logout_all(self, *, body: models.LogoutAllRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.LogoutAllResponse:
+        """logout all
+
+        ``POST /api/v1/auth/logout-all``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/logout-all",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.LogoutAllResponse, '#/components/schemas/ApiResponse_AuthOkDto/properties/data')
+
+    async def me(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.MeOperationResponse:
+        """me
+
+        ``GET /api/v1/auth/me``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/auth/me",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MeOperationResponse, '#/components/schemas/ApiResponse_MeResponse/properties/data')
+
+    async def mfa_disable(self, *, body: models.MfaDisableRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaDisableResponse:
+        """mfa disable
+
+        ``DELETE /api/v1/auth/mfa``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            "/api/v1/auth/mfa",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaDisableResponse, '#/components/schemas/ApiResponse_AuthOkDto/properties/data')
+
+    async def mfa_enroll(self, *, body: models.MfaEnrollRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaEnrollOperationResponse:
+        """mfa enroll
+
+        ``POST /api/v1/auth/mfa/enroll``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/enroll",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaEnrollOperationResponse, '#/components/schemas/ApiResponse_MfaEnrollResponse/properties/data')
+
+    async def mfa_enroll_verify(self, *, body: models.MfaEnrollVerifyRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaEnrollVerifyResponse:
+        """mfa enroll verify
+
+        ``POST /api/v1/auth/mfa/enroll/verify``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/enroll/verify",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaEnrollVerifyResponse, '#/components/schemas/ApiResponse_MfaRecoveryCodesResponse/properties/data')
+
+    async def mfa_enrollment_start(self, *, body: models.EnrollmentStartRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaEnrollmentStartResponse:
+        """mfa enrollment start
+
+        ``POST /api/v1/auth/mfa/enrollment/start``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/enrollment/start",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaEnrollmentStartResponse, '#/components/schemas/ApiResponse_EnrollmentStartResponse/properties/data')
+
+    async def mfa_enrollment_verify(self, *, body: models.EnrollmentVerifyRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaEnrollmentVerifyResponse:
+        """mfa enrollment verify
+
+        ``POST /api/v1/auth/mfa/enrollment/verify``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/enrollment/verify",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaEnrollmentVerifyResponse, '#/components/schemas/ApiResponse_EnrollmentVerifyResponse/properties/data')
+
+    async def mfa_recovery(self, *, body: models.MfaRecoveryRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaRecoveryResponse:
+        """mfa recovery
+
+        ``POST /api/v1/auth/mfa/recovery``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/recovery",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaRecoveryResponse, '#/components/schemas/ApiResponse_TokenPair/properties/data')
+
+    async def mfa_regenerate_recovery_codes(self, *, body: models.MfaRegenerateRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaRegenerateRecoveryCodesResponse:
+        """mfa regenerate recovery codes
+
+        ``POST /api/v1/auth/mfa/recovery-codes/regenerate``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/recovery-codes/regenerate",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaRegenerateRecoveryCodesResponse, '#/components/schemas/ApiResponse_MfaRecoveryCodesResponse/properties/data')
+
+    async def mfa_status(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.MfaStatusOperationResponse:
+        """mfa status
+
+        ``GET /api/v1/auth/mfa/status``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/auth/mfa/status",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaStatusOperationResponse, '#/components/schemas/ApiResponse_MfaStatusResponse/properties/data')
+
+    async def mfa_verify(self, *, body: models.MfaVerifyRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.MfaVerifyResponse:
+        """mfa verify
+
+        ``POST /api/v1/auth/mfa/verify``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/mfa/verify",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.MfaVerifyResponse, '#/components/schemas/ApiResponse_TokenPair/properties/data')
+
+    async def refresh(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.RefreshResponse:
+        """refresh
+
+        ``POST /api/v1/auth/refresh``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/auth/refresh",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.RefreshResponse, '#/components/schemas/ApiResponse_TokenPair/properties/data')
+
+    async def revoke_session(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.RevokeSessionResponse:
+        """revoke session
+
+        ``DELETE /api/v1/auth/sessions/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/auth/sessions/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.RevokeSessionResponse, '#/components/schemas/ApiResponse_AuthOkDto/properties/data')
+
+
+class AuthzApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def batch_check(self, *, body: models.BatchCheckRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.BatchCheckOperationResponse:
+        """batch check
+
+        ``POST /api/v1/authz/batch-check``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/authz/batch-check",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.BatchCheckOperationResponse, '#/components/schemas/ApiResponse_BatchCheckResponse/properties/data')
+
+    async def check(self, *, body: models.CheckRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.CheckOperationResponse:
+        """check
+
+        ``POST /api/v1/authz/check``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/authz/check",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CheckOperationResponse, '#/components/schemas/ApiResponse_CheckResponse/properties/data')
+
+    async def explain(self, *, body: models.ExplainRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.ExplainOperationResponse:
+        """explain
+
+        ``POST /api/v1/authz/explain``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/authz/explain",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ExplainOperationResponse, '#/components/schemas/ApiResponse_ExplainResponse/properties/data')
+
+    async def list_authorized_resources(self, *, body: models.ListResourcesRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.ListAuthorizedResourcesResponse:
+        """list authorized resources
+
+        ``POST /api/v1/authz/list-resources``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/authz/list-resources",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListAuthorizedResourcesResponse, '#/components/schemas/PagedResponse_AuthzResourceRef/properties/data')
+
+    async def revision(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.RevisionOperationResponse:
+        """revision
+
+        ``GET /api/v1/authz/revision``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/authz/revision",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.RevisionOperationResponse, '#/components/schemas/ApiResponse_RevisionResponse/properties/data')
+
+
+class DashboardApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def dashboard_summary(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.DashboardSummaryResponse:
+        """控制台摘要。
+
+        ``GET /api/v1/dashboard/summary``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/dashboard/summary",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DashboardSummaryResponse, '#/components/schemas/ApiResponse_DashboardSummaryDto/properties/data')
+
+
+class HealthApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def live(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.LiveOperationResponse:
+        """`GET /health/live`：只证明进程可响应，不触碰数据库。
+
+        ``GET /health/live``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/health/live",
+            request_id=request_id,
+            traceparent=traceparent,
+            envelope=False,
+        )
+        return typed_result(_sdk_result, models.LiveOperationResponse, '#/components/schemas/LiveResponse')
+
+    async def ready(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.ReadyOperationResponse:
+        """`GET /health/ready`：全部检查通过才 200，否则 503 + `NOT_READY`。
+
+        ``GET /health/ready``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/health/ready",
+            request_id=request_id,
+            traceparent=traceparent,
+            envelope=False,
+        )
+        return typed_result(_sdk_result, models.ReadyOperationResponse, '#/components/schemas/ReadyResponse')
+
+
+class PermissionsApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_permission(self, *, body: models.CreatePermissionRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreatePermissionResponse:
+        """创建权限点（`code` 由服务端按 `resource_type:action` 生成）。
+
+        ``POST /api/v1/permissions``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/permissions",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreatePermissionResponse, '#/components/schemas/ApiResponse_PermissionDto/properties/data')
+
+    async def deprecate_permission(self, id: str, *, if_match: str, idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.DeprecatePermissionResponse:
+        """弃用权限点（阻止新引用；不物理删除）。
+
+        ``POST /api/v1/permissions/{id}/deprecate``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/permissions/{id}/deprecate", id=id),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeprecatePermissionResponse, '#/components/schemas/ApiResponse_PermissionDto/properties/data')
+
+    async def get_permission(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetPermissionResponse:
+        """权限点详情（含引用计数）。
+
+        ``GET /api/v1/permissions/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/permissions/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetPermissionResponse, '#/components/schemas/ApiResponse_PermissionDto/properties/data')
+
+    async def list_permissions(self, *, cursor: str | None = None, limit: int | None = None, resource_type: str | None = None, action: str | None = None, q: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListPermissionsResponse:
+        """权限点分页。
+
+        ``GET /api/v1/permissions``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/permissions",
+            query={"cursor": cursor, "limit": limit, "resource_type": resource_type, "action": action, "q": q},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListPermissionsResponse, '#/components/schemas/PagedResponse_PermissionDto/properties/data')
+
+    async def undeprecate_permission(self, id: str, *, if_match: str, idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.UndeprecatePermissionResponse:
+        """取消弃用权限点（允许新增引用；保留既有引用）。
+
+        ``POST /api/v1/permissions/{id}/undeprecate``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/permissions/{id}/undeprecate", id=id),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.UndeprecatePermissionResponse, '#/components/schemas/ApiResponse_PermissionDto/properties/data')
+
+
+class PoliciesApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def compile_preview(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.CompilePreviewResponse:
+        """compile preview
+
+        ``POST /api/v1/policies/{id}/compile-preview``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/policies/{id}/compile-preview", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CompilePreviewResponse, '#/components/schemas/ApiResponse_CompilePreviewDto/properties/data')
+
+    async def create_policy(self, *, body: models.CreatePolicyRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreatePolicyResponse:
+        """create policy
+
+        ``POST /api/v1/policies``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/policies",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreatePolicyResponse, '#/components/schemas/ApiResponse_PolicyDetailDto/properties/data')
+
+    async def delete_policy(self, id: str, *, if_match: str, idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.DeletePolicyResponse:
+        """delete policy
+
+        ``DELETE /api/v1/policies/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/policies/{id}", id=id),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeletePolicyResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def disable_policy(self, id: str, *, if_match: str, idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.DisablePolicyResponse:
+        """disable policy
+
+        ``POST /api/v1/policies/{id}/disable``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/policies/{id}/disable", id=id),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DisablePolicyResponse, '#/components/schemas/ApiResponse_PolicyDto/properties/data')
+
+    async def get_policy(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetPolicyResponse:
+        """get policy
+
+        ``GET /api/v1/policies/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/policies/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetPolicyResponse, '#/components/schemas/ApiResponse_PolicyDetailDto/properties/data')
+
+    async def impact_preview(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.ImpactPreviewResponse:
+        """impact preview
+
+        ``POST /api/v1/policies/{id}/impact-preview``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/policies/{id}/impact-preview", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ImpactPreviewResponse, '#/components/schemas/ApiResponse_ImpactPreviewDto/properties/data')
+
+    async def list_policies(self, *, cursor: str | None = None, limit: int | None = None, lifecycle: str | None = None, q: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListPoliciesResponse:
+        """list policies
+
+        ``GET /api/v1/policies``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/policies",
+            query={"cursor": cursor, "limit": limit, "lifecycle": lifecycle, "q": q},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListPoliciesResponse, '#/components/schemas/PagedResponse_PolicyDto/properties/data')
+
+    async def list_policy_tests(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.ListPolicyTestsResponse:
+        """list policy tests
+
+        ``GET /api/v1/policies/{id}/tests``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/policies/{id}/tests", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListPolicyTestsResponse, '#/components/schemas/ApiResponse_Vec_PolicyTestCaseDto/properties/data')
+
+    async def patch_policy(self, id: str, *, if_match: str, body: models.PatchPolicyRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PatchPolicyResponse:
+        """patch policy
+
+        ``PATCH /api/v1/policies/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/policies/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchPolicyResponse, '#/components/schemas/ApiResponse_PolicyDetailDto/properties/data')
+
+    async def policies_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.PoliciesStatsResponse:
+        """策略计数。
+
+        ``GET /api/v1/policies/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/policies/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PoliciesStatsResponse, '#/components/schemas/ApiResponse_PoliciesStatsDto/properties/data')
+
+    async def publish_policy(self, id: str, *, if_match: str, body: models.PublishPolicyRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PublishPolicyResponse:
+        """publish policy
+
+        ``POST /api/v1/policies/{id}/publish``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/policies/{id}/publish", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PublishPolicyResponse, '#/components/schemas/ApiResponse_PublishPolicyResultDto/properties/data')
+
+    async def upsert_policy_test(self, id: str, *, if_match: str, body: models.UpsertPolicyTestCaseRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.UpsertPolicyTestResponse:
+        """upsert policy test
+
+        ``POST /api/v1/policies/{id}/tests``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/policies/{id}/tests", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.UpsertPolicyTestResponse, '#/components/schemas/ApiResponse_PolicyTestCaseWriteDto/properties/data')
+
+    async def validate_expression(self, *, body: models.ValidatePolicyRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.ValidateExpressionResponse:
+        """validate expression
+
+        ``POST /api/v1/policies/validate``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/policies/validate",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ValidateExpressionResponse, '#/components/schemas/ApiResponse_PolicyValidationDto/properties/data')
+
+    async def validate_policy(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.ValidatePolicyResponse:
+        """validate policy
+
+        ``POST /api/v1/policies/{id}/validate``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/policies/{id}/validate", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ValidatePolicyResponse, '#/components/schemas/ApiResponse_PolicyValidationDto/properties/data')
+
+
+class PolicyBindingsApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_policy_binding(self, *, body: models.CreatePolicyBindingRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreatePolicyBindingResponse:
+        """create policy binding
+
+        ``POST /api/v1/policy-bindings``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/policy-bindings",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreatePolicyBindingResponse, '#/components/schemas/ApiResponse_PolicyBindingDto/properties/data')
+
+    async def delete_policy_binding(self, id: str, *, if_match: str, request_id: str | None = None, traceparent: str | None = None) -> models.DeletePolicyBindingResponse:
+        """delete policy binding
+
+        ``DELETE /api/v1/policy-bindings/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/policy-bindings/{id}", id=id),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeletePolicyBindingResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def list_policy_bindings(self, *, cursor: str | None = None, limit: int | None = None, policy_id: str | None = None, resource_type: str | None = None, permission: str | None = None, enabled: bool | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListPolicyBindingsResponse:
+        """list policy bindings
+
+        ``GET /api/v1/policy-bindings``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/policy-bindings",
+            query={"cursor": cursor, "limit": limit, "policy_id": policy_id, "resource_type": resource_type, "permission": permission, "enabled": enabled},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListPolicyBindingsResponse, '#/components/schemas/PagedResponse_PolicyBindingDto/properties/data')
+
+    async def patch_policy_binding(self, id: str, *, if_match: str, body: models.PatchPolicyBindingRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.PatchPolicyBindingResponse:
+        """patch policy binding
+
+        ``PATCH /api/v1/policy-bindings/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/policy-bindings/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchPolicyBindingResponse, '#/components/schemas/ApiResponse_PolicyBindingDto/properties/data')
+
+    async def policy_bindings_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.PolicyBindingsStatsResponse:
+        """Binding 计数。
+
+        ``GET /api/v1/policy-bindings/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/policy-bindings/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PolicyBindingsStatsResponse, '#/components/schemas/ApiResponse_BindingsStatsDto/properties/data')
+
+
+class RelationDefinitionsApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_relation_definition(self, *, body: models.CreateRelationDefinitionRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateRelationDefinitionResponse:
+        """create relation definition
+
+        ``POST /api/v1/relation-definitions``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/relation-definitions",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateRelationDefinitionResponse, '#/components/schemas/ApiResponse_RelationDefinitionDto/properties/data')
+
+    async def delete_relation_definition(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.DeleteRelationDefinitionResponse:
+        """delete relation definition
+
+        ``DELETE /api/v1/relation-definitions/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/relation-definitions/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeleteRelationDefinitionResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def list_relation_definitions(self, *, cursor: str | None = None, limit: int | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListRelationDefinitionsResponse:
+        """list relation definitions
+
+        ``GET /api/v1/relation-definitions``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/relation-definitions",
+            query={"cursor": cursor, "limit": limit},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListRelationDefinitionsResponse, '#/components/schemas/PagedResponse_RelationDefinitionDto/properties/data')
+
+
+class RelationTuplesApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_relation_tuple(self, *, body: models.CreateRelationTupleRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateRelationTupleResponse:
+        """create relation tuple
+
+        ``POST /api/v1/relation-tuples``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/relation-tuples",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateRelationTupleResponse, '#/components/schemas/ApiResponse_RelationTupleDto/properties/data')
+
+    async def delete_relation_tuple(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.DeleteRelationTupleResponse:
+        """delete relation tuple
+
+        ``DELETE /api/v1/relation-tuples/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/relation-tuples/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeleteRelationTupleResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def list_relation_tuples(self, *, subject_type: str | None = None, subject_id: str | None = None, relation: str | None = None, object_type: str | None = None, object_id: str | None = None, cursor: str | None = None, limit: int | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListRelationTuplesResponse:
+        """list relation tuples
+
+        ``GET /api/v1/relation-tuples``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/relation-tuples",
+            query={"subject_type": subject_type, "subject_id": subject_id, "relation": relation, "object_type": object_type, "object_id": object_id, "cursor": cursor, "limit": limit},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListRelationTuplesResponse, '#/components/schemas/PagedResponse_RelationTupleDto/properties/data')
+
+
+class ResourceTypesApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_resource_type(self, *, body: models.CreateResourceTypeRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateResourceTypeResponse:
+        """create resource type
+
+        ``POST /api/v1/resource-types``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/resource-types",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateResourceTypeResponse, '#/components/schemas/ApiResponse_ResourceTypeDto/properties/data')
+
+    async def get_resource_type(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetResourceTypeResponse:
+        """get resource type
+
+        ``GET /api/v1/resource-types/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/resource-types/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetResourceTypeResponse, '#/components/schemas/ApiResponse_ResourceTypeDto/properties/data')
+
+    async def list_resource_types(self, *, cursor: str | None = None, limit: int | None = None, q: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListResourceTypesResponse:
+        """list resource types
+
+        ``GET /api/v1/resource-types``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/resource-types",
+            query={"cursor": cursor, "limit": limit, "q": q},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListResourceTypesResponse, '#/components/schemas/PagedResponse_ResourceTypeDto/properties/data')
+
+    async def patch_resource_type(self, id: str, *, if_match: str, body: models.PatchResourceTypeRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PatchResourceTypeResponse:
+        """patch resource type
+
+        ``PATCH /api/v1/resource-types/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/resource-types/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchResourceTypeResponse, '#/components/schemas/ApiResponse_ResourceTypeDto/properties/data')
+
+    async def resource_types_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.ResourceTypesStatsResponse:
+        """资源类型计数。
+
+        ``GET /api/v1/resource-types/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/resource-types/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ResourceTypesStatsResponse, '#/components/schemas/ApiResponse_ResourceTypesStatsDto/properties/data')
+
+
+class ResourcesApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_resource(self, *, body: models.CreateResourceRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateResourceResponse:
+        """create resource
+
+        ``POST /api/v1/resources``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/resources",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateResourceResponse, '#/components/schemas/ApiResponse_ResourceDto/properties/data')
+
+    async def delete_resource(self, id: str, *, if_match: str, request_id: str | None = None, traceparent: str | None = None) -> models.DeleteResourceResponse:
+        """delete resource
+
+        ``DELETE /api/v1/resources/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/resources/{id}", id=id),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeleteResourceResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def get_resource(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetResourceResponse:
+        """get resource
+
+        ``GET /api/v1/resources/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/resources/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetResourceResponse, '#/components/schemas/ApiResponse_ResourceDto/properties/data')
+
+    async def get_resource_attributes(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetResourceAttributesResponse:
+        """get resource attributes
+
+        ``GET /api/v1/resources/{id}/attributes``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/resources/{id}/attributes", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetResourceAttributesResponse, '#/components/schemas/ApiResponse_AttributesDto/properties/data')
+
+    async def list_resources(self, *, cursor: str | None = None, limit: int | None = None, resource_type: str | None = None, status: str | None = None, q: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListResourcesResponse:
+        """list resources
+
+        ``GET /api/v1/resources``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/resources",
+            query={"cursor": cursor, "limit": limit, "resource_type": resource_type, "status": status, "q": q},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListResourcesResponse, '#/components/schemas/PagedResponse_ResourceDto/properties/data')
+
+    async def patch_resource(self, id: str, *, if_match: str, body: models.PatchResourceRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PatchResourceResponse:
+        """patch resource
+
+        ``PATCH /api/v1/resources/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/resources/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchResourceResponse, '#/components/schemas/ApiResponse_ResourceDto/properties/data')
+
+    async def replace_resource_attributes(self, id: str, *, if_match: str, body: models.ReplaceAttributesRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ReplaceResourceAttributesResponse:
+        """replace resource attributes
+
+        ``PUT /api/v1/resources/{id}/attributes``
+        """
+        _sdk_result = await self._c.request(
+            "PUT",
+            _path("/api/v1/resources/{id}/attributes", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ReplaceResourceAttributesResponse, '#/components/schemas/ApiResponse_AttributesDto/properties/data')
+
+    async def resources_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.ResourcesStatsResponse:
+        """资源计数。
+
+        ``GET /api/v1/resources/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/resources/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ResourcesStatsResponse, '#/components/schemas/ApiResponse_ResourcesStatsDto/properties/data')
+
+
+class RolesApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_role(self, *, body: models.CreateRoleRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateRoleResponse:
+        """创建角色。
+
+        ``POST /api/v1/roles``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/roles",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateRoleResponse, '#/components/schemas/ApiResponse_RoleDto/properties/data')
+
+    async def delete_role(self, id: str, *, if_match: str, request_id: str | None = None, traceparent: str | None = None) -> models.DeleteRoleResponse:
+        """删除角色（有成员或系统角色时 409，不级联）。
+
+        ``DELETE /api/v1/roles/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "DELETE",
+            _path("/api/v1/roles/{id}", id=id),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DeleteRoleResponse, '#/components/schemas/ApiResponse_MutationAckDto/properties/data')
+
+    async def get_role(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetRoleResponse:
+        """角色详情。
+
+        ``GET /api/v1/roles/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/roles/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetRoleResponse, '#/components/schemas/ApiResponse_RoleDto/properties/data')
+
+    async def get_role_permissions(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetRolePermissionsResponse:
+        """角色权限集合。
+
+        ``GET /api/v1/roles/{id}/permissions``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/roles/{id}/permissions", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetRolePermissionsResponse, '#/components/schemas/ApiResponse_RolePermissionsDto/properties/data')
+
+    async def list_roles(self, *, cursor: str | None = None, limit: int | None = None, q: str | None = None, enabled: bool | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListRolesResponse:
+        """角色分页。
+
+        ``GET /api/v1/roles``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/roles",
+            query={"cursor": cursor, "limit": limit, "q": q, "enabled": enabled},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListRolesResponse, '#/components/schemas/PagedResponse_RoleDto/properties/data')
+
+    async def patch_role(self, id: str, *, if_match: str, body: models.PatchRoleRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PatchRoleResponse:
+        """更新角色（`code` / `is_system` 不可变）。
+
+        ``PATCH /api/v1/roles/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/roles/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchRoleResponse, '#/components/schemas/ApiResponse_RoleDto/properties/data')
+
+    async def replace_role_permissions(self, id: str, *, if_match: str, body: models.ReplaceRolePermissionsRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ReplaceRolePermissionsResponse:
+        """全量替换角色权限（exact set）。
+
+        ``PUT /api/v1/roles/{id}/permissions``
+        """
+        _sdk_result = await self._c.request(
+            "PUT",
+            _path("/api/v1/roles/{id}/permissions", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ReplaceRolePermissionsResponse, '#/components/schemas/ApiResponse_RolePermissionsDto/properties/data')
+
+    async def roles_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.RolesStatsResponse:
+        """角色计数。
+
+        ``GET /api/v1/roles/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/roles/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.RolesStatsResponse, '#/components/schemas/ApiResponse_RolesStatsDto/properties/data')
+
+
+class SetupApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_admin(self, *, body: models.SetupAdminRequest | Mapping[str, object], request_id: str | None = None, traceparent: str | None = None) -> models.CreateAdminResponse:
+        """`POST /api/v1/setup/admin`。
+
+        ``POST /api/v1/setup/admin``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/setup/admin",
+            json=request_body(body),
+            request_id=request_id,
+            traceparent=traceparent,
+            envelope=False,
+        )
+        return typed_result(_sdk_result, models.CreateAdminResponse, '#/components/schemas/SetupAdminDto')
+
+    async def setup_state(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.SetupStateResponse:
+        """`GET /api/v1/setup/admin`。
+
+        ``GET /api/v1/setup/admin``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/setup/admin",
+            request_id=request_id,
+            traceparent=traceparent,
+            envelope=False,
+        )
+        return typed_result(_sdk_result, models.SetupStateResponse, '#/components/schemas/SetupStatusDto')
+
+
+class UsersApi:
+    def __init__(self, client: AsyncRequester) -> None:
+        self._c = client
+
+    async def create_user(self, *, body: models.CreateUserRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.CreateUserResponse:
+        """创建用户（Argon2id 散列；可带 `Idempotency-Key`）。
+
+        ``POST /api/v1/users``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            "/api/v1/users",
+            json=request_body(body),
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.CreateUserResponse, '#/components/schemas/ApiResponse_UserDto/properties/data')
+
+    async def disable_user(self, id: str, *, if_match: str, request_id: str | None = None, traceparent: str | None = None) -> models.DisableUserResponse:
+        """禁用用户（`auth_version++` 并撤销会话；含身份安全副作用）。
+
+        ``POST /api/v1/users/{id}/disable``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/users/{id}/disable", id=id),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.DisableUserResponse, '#/components/schemas/ApiResponse_UserDto/properties/data')
+
+    async def effective_permissions(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.EffectivePermissionsResponse:
+        """有效权限（只统计功能权限，不含资源级预测）。
+
+        ``GET /api/v1/users/{id}/effective-permissions``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/users/{id}/effective-permissions", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.EffectivePermissionsResponse, '#/components/schemas/ApiResponse_EffectivePermissionsDto/properties/data')
+
+    async def enable_user(self, id: str, *, if_match: str, request_id: str | None = None, traceparent: str | None = None) -> models.EnableUserResponse:
+        """启用用户。
+
+        ``POST /api/v1/users/{id}/enable``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/users/{id}/enable", id=id),
+            if_match=if_match,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.EnableUserResponse, '#/components/schemas/ApiResponse_UserDto/properties/data')
+
+    async def get_user(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetUserResponse:
+        """读取用户详情。
+
+        ``GET /api/v1/users/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/users/{id}", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetUserResponse, '#/components/schemas/ApiResponse_UserDto/properties/data')
+
+    async def get_user_mfa_policy(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetUserMfaPolicyResponse:
+        """读取用户 MFA 策略（ETag 锚定 `users.version`）。
+
+        ``GET /api/v1/users/{id}/mfa-policy``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/users/{id}/mfa-policy", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetUserMfaPolicyResponse, '#/components/schemas/ApiResponse_UserMfaPolicyDto/properties/data')
+
+    async def get_user_roles(self, id: str, *, request_id: str | None = None, traceparent: str | None = None) -> models.GetUserRolesResponse:
+        """读取用户的角色集合。
+
+        ``GET /api/v1/users/{id}/roles``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            _path("/api/v1/users/{id}/roles", id=id),
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.GetUserRolesResponse, '#/components/schemas/ApiResponse_UserRolesDto/properties/data')
+
+    async def list_users(self, *, cursor: str | None = None, page: int | None = None, limit: int | None = None, q: str | None = None, status: str | None = None, role_id: str | None = None, mfa_status: str | None = None, created_from: str | None = None, created_to: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ListUsersResponse:
+        """统一的 404/403 语义：资源模式路由由端口按「存在性 + 权限」返回，Handler 不自行猜测。
+
+        ``GET /api/v1/users``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/users",
+            query={"cursor": cursor, "page": page, "limit": limit, "q": q, "status": status, "role_id": role_id, "mfa_status": mfa_status, "created_from": created_from, "created_to": created_to},
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ListUsersResponse, '#/components/schemas/PagedResponse_UserDto/properties/data')
+
+    async def patch_user(self, id: str, *, if_match: str, body: models.PatchUserRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.PatchUserResponse:
+        """更新用户资料（白名单字段；未知字段 400）。
+
+        ``PATCH /api/v1/users/{id}``
+        """
+        _sdk_result = await self._c.request(
+            "PATCH",
+            _path("/api/v1/users/{id}", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.PatchUserResponse, '#/components/schemas/ApiResponse_UserDto/properties/data')
+
+    async def replace_user_roles(self, id: str, *, if_match: str, body: models.ReplaceUserRolesRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ReplaceUserRolesResponse:
+        """全量替换用户角色（exact set）。
+
+        ``PUT /api/v1/users/{id}/roles``
+        """
+        _sdk_result = await self._c.request(
+            "PUT",
+            _path("/api/v1/users/{id}/roles", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ReplaceUserRolesResponse, '#/components/schemas/ApiResponse_UserRolesDto/properties/data')
+
+    async def reset_password(self, id: str, *, if_match: str, body: models.ResetPasswordRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.ResetPasswordResponse:
+        """重置他人密码（高风险：要求 assurance + `user:reset_password`）。
+
+        ``POST /api/v1/users/{id}/reset-password``
+        """
+        _sdk_result = await self._c.request(
+            "POST",
+            _path("/api/v1/users/{id}/reset-password", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.ResetPasswordResponse, '#/components/schemas/ApiResponse_UserDto/properties/data')
+
+    async def set_user_mfa_policy(self, id: str, *, if_match: str, body: models.SetUserMfaPolicyRequest | Mapping[str, object], idempotency_key: str | None = None, request_id: str | None = None, traceparent: str | None = None) -> models.SetUserMfaPolicyResponse:
+        """设置或清除用户 MFA 覆盖（必填可 null 的 mode；本次重验）。
+
+        ``PUT /api/v1/users/{id}/mfa-policy``
+        """
+        _sdk_result = await self._c.request(
+            "PUT",
+            _path("/api/v1/users/{id}/mfa-policy", id=id),
+            json=request_body(body),
+            if_match=if_match,
+            idempotency_key=idempotency_key,
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.SetUserMfaPolicyResponse, '#/components/schemas/ApiResponse_UserMfaPolicyDto/properties/data')
+
+    async def users_stats(self, *, request_id: str | None = None, traceparent: str | None = None) -> models.UsersStatsResponse:
+        """用户计数。
+
+        ``GET /api/v1/users/stats``
+        """
+        _sdk_result = await self._c.request(
+            "GET",
+            "/api/v1/users/stats",
+            request_id=request_id,
+            traceparent=traceparent,
+        )
+        return typed_result(_sdk_result, models.UsersStatsResponse, '#/components/schemas/ApiResponse_UsersStatsDto/properties/data')
+
+
+class AsyncAdminClient:
+    """Every ``/api/v1`` operation grouped by OpenAPI tag (``admin.users.list_users`` ...)."""
+
+    def __init__(self, client: AsyncRequester) -> None:
+        self.attributes = AttributesApi(client)
+        self.audit = AuditApi(client)
+        self.auth = AuthApi(client)
+        self.authz = AuthzApi(client)
+        self.dashboard = DashboardApi(client)
+        self.health = HealthApi(client)
+        self.permissions = PermissionsApi(client)
+        self.policies = PoliciesApi(client)
+        self.policy_bindings = PolicyBindingsApi(client)
+        self.relation_definitions = RelationDefinitionsApi(client)
+        self.relation_tuples = RelationTuplesApi(client)
+        self.resource_types = ResourceTypesApi(client)
+        self.resources = ResourcesApi(client)
+        self.roles = RolesApi(client)
+        self.setup = SetupApi(client)
+        self.users = UsersApi(client)