@ai-matrx/api 0.0.0-stage → 0.1.1

package/dist/account.d.cts

@@ -0,0 +1,3246 @@
+import { A as Api, C as CallOptions } from './index-wC2vtb70.cjs';
+import { JsonValue, UserAnalysisPreferencesResponse } from './schemas.cjs';
+import './credentials.cjs';
+
+/**
+ * GENERATED by @ai-matrx/api scripts/generate.mjs from aidream/api-contract — never edit by hand.
+ * CONTRACT_SHA256 50a790edb39e682b46e0fa9e674faf5ce2a0ba7de2cd01930a497fca4c47844a
+ */
+
+/** Result of opening, completing, or re-minting an action request. */
+type ActionRequestStatusResponse = {
+    state: string;
+    id?: string | null;
+    message?: string | null;
+    next?: string | null;
+    request_id?: string | null;
+    channels?: string[];
+    skipped?: {
+        [key: string]: string;
+    }[];
+    agent_told?: boolean | null;
+    kind?: string | null;
+    organization_id?: string | null;
+    subject_user_id?: string | null;
+    render?: {
+        [key: string]: JsonValue;
+    } | null;
+    viewer_is_subject?: boolean | null;
+    requires_session?: boolean | null;
+    bearer_allowed?: boolean | null;
+    can_complete?: boolean | null;
+    sign_in_reason?: string | null;
+    answer_by?: string | null;
+    link_expires_at?: string | null;
+    session_ttl_minutes?: number | null;
+    remint_count?: number | null;
+    completed_at?: string | null;
+    approved?: boolean | null;
+    spend_approval_id?: string | null;
+};
+/** ActiveOrganization */
+type ActiveOrganization = {
+    organization_id?: string | null;
+};
+/** One action-time-authorized local-Chrome authenticator delivery. */
+type BrowserAuthenticatorMaterializeRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    conversation_id: string;
+    tool_invocation_id: string;
+    page_url: string;
+    code_selector: string;
+    submit: {
+        [key: string]: string;
+    };
+    extension_instance_id: string;
+    client_build?: string | null;
+};
+/** TRANSIENT local-extension payload. Never log, persist, or return it as */
+type BrowserAuthenticatorMaterializeResponse = {
+    injection_id: string;
+    origin: string;
+    code: string;
+    expires_at: string;
+};
+/** Executor-derived page URL — never agent-supplied. Answers the */
+type BrowserCaptureContextRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    page_url: string;
+    [key: string]: unknown;
+};
+/** One field the agent identified. NAMES + selectors only — no value. */
+type BrowserCaptureFieldSpecIn = {
+    field_key: string;
+    selector: string;
+    label?: string | null;
+    secret?: boolean;
+    step?: number;
+    clear_first?: boolean;
+};
+/** Write a user-typed credential as a NEW vault item stamped with the agent's */
+type BrowserCaptureRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    display_name: string;
+    login_url: string;
+    description?: string | null;
+    provider_key?: string | null;
+    fields: BrowserCaptureFieldSpecIn[];
+    submit_selector?: string | null;
+    uri_match_mode?: "host" | "domain" | "exact" | "never";
+    notes?: string | null;
+    field_values?: {
+        [key: string]: string;
+    };
+    before_capture_id?: string | null;
+    after_capture_id?: string | null;
+    run_id?: string | null;
+    profile_id?: string | null;
+    [key: string]: unknown;
+};
+/** The receipt — field KEYS only, never a value. ``proceed`` is the go */
+type BrowserCaptureResponse = {
+    status: string;
+    credential_item_id?: string | null;
+    branch?: string | null;
+    field_keys?: string[];
+    proceed?: boolean;
+    recipe_id?: string | null;
+    recipe_version?: number | null;
+    login_attempt_id?: string | null;
+    propose_recipe?: boolean;
+    guidance?: string | null;
+    detail?: string | null;
+    [key: string]: unknown;
+};
+/** Safe field inventory for planning one complete login attempt. */
+type BrowserLoginAvailableField = {
+    field_key: string;
+    label: string;
+    fillable: boolean;
+    reason?: string | null;
+};
+/** One usable saved login, destination-independent — metadata only. This is */
+type BrowserLoginInventoryItem = {
+    item_id: string;
+    display_name: string;
+    definition_key?: string;
+    status?: string;
+    browser_fill_enabled?: boolean;
+    uri_match_mode?: string;
+    login_urls?: string[];
+    available_fields?: BrowserLoginAvailableField[];
+    non_secret_fields?: NonSecretFieldIn[];
+    [key: string]: unknown;
+};
+/** BrowserLoginInventoryResponse */
+type BrowserLoginInventoryResponse = {
+    items: BrowserLoginInventoryItem[];
+    count: number;
+};
+/** TRANSIENT credential payload — ``Cache-Control: no-store``. It enters */
+type BrowserLoginLegacyMaterializeResponse = {
+    item_id: string;
+    origin: string;
+    username?: string | null;
+    password: string;
+};
+/** BrowserLoginMatch */
+type BrowserLoginMatch = {
+    item_id: string;
+    display_name: string;
+    definition_key?: string;
+    host: string;
+    available_fields?: BrowserLoginAvailableField[] | null;
+    non_secret_fields?: NonSecretFieldIn[] | null;
+    [key: string]: unknown;
+};
+/** The extension sends the URL of the tab it is ACTUALLY on — never an */
+type BrowserLoginMatchesRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    page_url: string;
+    include_field_inventory?: boolean;
+    [key: string]: unknown;
+};
+/** BrowserLoginMatchesResponse */
+type BrowserLoginMatchesResponse = {
+    matches: BrowserLoginMatch[];
+    count: number;
+};
+/** BrowserLoginMaterializeRequest */
+type BrowserLoginMaterializeRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    page_url: string;
+    field_keys?: string[] | null;
+    tool_invocation_id?: string | null;
+    client_build?: string | null;
+    [key: string]: unknown;
+};
+/** TRANSIENT exact named-field payload for agent-directed login. */
+type BrowserLoginNamedFieldsMaterializeResponse = {
+    item_id: string;
+    origin: string;
+    fields: {
+        [key: string]: string;
+    };
+};
+/** Safe problem report from credential login. Credential values have no */
+type BrowserLoginReportRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    kind: "secret_exposed" | "wrong_verdict" | "recipe_wrong" | "other";
+    where: string;
+    attempt_id?: string | null;
+    description?: string | null;
+};
+/** BrowserLoginReportResponse */
+type BrowserLoginReportResponse = {
+    id: string;
+    status: string;
+};
+/** What the fill achieved. The safe status enum only — never a value. */
+type BrowserLoginResultRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    status: "authenticated" | "needs_mfa" | "captcha_or_takeover" | "credentials_rejected" | "selection_required" | "no_matching_login" | "unsafe_destination" | "unknown";
+    page_url?: string | null;
+    tool_invocation_id?: string | null;
+    [key: string]: unknown;
+};
+/** BrowserRecipeFieldMapIn */
+type BrowserRecipeFieldMapIn = {
+    step?: number;
+    selector: string;
+    field_key?: string | null;
+    literal_key?: string | null;
+    clear_first?: boolean;
+};
+/** The agent's documented experience of an UNKNOWN login → a PROPOSED recipe. */
+type BrowserRecipeProposalRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    normalized_origin: string;
+    match_pattern?: string | null;
+    provider_key?: string | null;
+    field_map: BrowserRecipeFieldMapIn[];
+    submit?: {
+        [key: string]: unknown;
+    };
+    success_signals?: BrowserRecipeSignalIn[];
+    failure_signals?: BrowserRecipeSignalIn[];
+    challenge_signals?: BrowserRecipeSignalIn[];
+    notes?: string | null;
+    human_confirmed?: boolean;
+    [key: string]: unknown;
+};
+/** BrowserRecipeProposalResponse */
+type BrowserRecipeProposalResponse = {
+    status: string;
+    recipe_id?: string | null;
+    normalized_origin: string;
+    provenance: string;
+    recipe: {
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+/** BrowserRecipeSignalIn */
+type BrowserRecipeSignalIn = {
+    kind: "selector_present" | "selector_absent" | "url_prefix" | "cookie_present" | "text_present";
+    value: string;
+    direction: "authenticated" | "challenged" | "rejected";
+    weight?: number;
+    label?: string | null;
+};
+/** CompleteBody */
+type CompleteBody = {
+    token: string;
+    result?: {
+        [key: string]: JsonValue;
+    } | null;
+    field_values?: {
+        [key: string]: string;
+    } | null;
+    authenticator_secret?: string | null;
+    origin?: string | null;
+};
+/** CreateBody */
+type CreateBody = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    resource_type: string;
+    resource_id: string;
+    recipient_email?: string | null;
+    recipient_phone?: string | null;
+    recipient_name?: string | null;
+    field_keys?: string[];
+    link_channel?: ("email" | "sms") | null;
+    note?: string | null;
+};
+/** CreateResponse */
+type CreateResponse = {
+    delivery_id: string;
+    status: string;
+    link_channel: "email" | "sms";
+    code_channel: "email" | "sms";
+    same_channel: boolean;
+    expires_at: string;
+    field_keys: string[];
+    sentence: string;
+};
+/** CredentialCreateRequest */
+type CredentialCreateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    provider: string;
+    display_name: string;
+    is_default?: boolean;
+    api_key?: string | null;
+    refresh_token?: string | null;
+    client_id?: string | null;
+    client_secret?: string | null;
+    service_account_json?: string | null;
+};
+/** CredentialDeletedResponse */
+type CredentialDeletedResponse = {
+    deleted: string;
+};
+/** CredentialListResponse */
+type CredentialListResponse = {
+    items: CredentialOut[];
+};
+/** Non-secret display material derived at write time — never a value. */
+type CredentialMetadata = {
+    key_prefix?: string | null;
+    refresh_token_prefix?: string | null;
+    client_id_prefix?: string | null;
+    service_account_email?: string | null;
+    project_id?: string | null;
+    [key: string]: unknown;
+};
+/** CredentialOut */
+type CredentialOut = {
+    id: string;
+    user_id: string;
+    provider: string;
+    display_name?: string | null;
+    metadata?: CredentialMetadata;
+    is_default?: boolean;
+    last_verified_at?: string | null;
+    last_verified_status?: string | null;
+    last_verified_error?: string | null;
+    created_at?: string | null;
+    updated_at?: string | null;
+};
+/** CredentialUpdateRequest */
+type CredentialUpdateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    display_name?: string | null;
+    is_default?: boolean | null;
+    api_key?: string | null;
+    refresh_token?: string | null;
+    client_id?: string | null;
+    client_secret?: string | null;
+    service_account_json?: string | null;
+};
+/** Provider-specific proof of the one live verification call. */
+type CredentialVerifyDetails = {
+    performance?: number | null;
+    sites?: (string | null)[];
+};
+/** CredentialVerifyResponse */
+type CredentialVerifyResponse = {
+    ok: boolean;
+    provider: string;
+    error?: string | null;
+    details?: CredentialVerifyDetails;
+};
+/** DeliveredField */
+type DeliveredField = {
+    key?: string | null;
+    label?: string | null;
+    value?: string | null;
+    secret?: boolean;
+};
+/** FieldIn */
+type FieldIn = {
+    /** stable lowercase-snake identity within the item */
+    field_key: string;
+    value: string;
+    /** optional environment-variable alias */
+    env_key?: string | null;
+    handling?: "visible" | "revealable" | "sealed";
+    editable?: boolean;
+    inject_into_sandbox?: boolean;
+    description?: string | null;
+    [key: string]: unknown;
+};
+/** GranteeIn */
+type GranteeIn = {
+    user_id: string;
+    can_use?: boolean;
+    can_manage?: boolean;
+    [key: string]: unknown;
+};
+/** GscOauthStartRequest */
+type GscOauthStartRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    display_name: string;
+    redirect_uri: string;
+    client_id?: string | null;
+    client_secret?: string | null;
+    is_default?: boolean;
+};
+/** NativeCompleteBody */
+type NativeCompleteBody = {
+    result?: {
+        [key: string]: JsonValue;
+    } | null;
+    field_values?: {
+        [key: string]: string;
+    } | null;
+    authenticator_secret?: string | null;
+    origin?: string | null;
+};
+/** NativeIdentitiesOut */
+type NativeIdentitiesOut = {
+    snapshot_id: string;
+    identities: (NativePasswordIdentityOut | NativePasskeyIdentityOut)[];
+    next_after?: string | null;
+    complete: boolean;
+    unsupported_count: number;
+};
+/** NativeMatchOut */
+type NativeMatchOut = {
+    item_id: string;
+    display_name: string;
+    request_identifier_index: number;
+};
+/** NativeMatchesIn */
+type NativeMatchesIn = {
+    identifiers: NativeServiceIdentifierIn[];
+};
+/** NativeMatchesOut */
+type NativeMatchesOut = {
+    matches: NativeMatchOut[];
+    truncated: boolean;
+    reason: "no_service_identifiers" | null;
+};
+/** NativeMaterializeIn */
+type NativeMaterializeIn = {
+    identifiers: NativeServiceIdentifierIn[];
+    request_identifier_index: number;
+};
+/** NativeMaterializeOut */
+type NativeMaterializeOut = {
+    username: string;
+    password: string;
+};
+/** NativePasskeyCapabilitiesOut */
+type NativePasskeyCapabilitiesOut = {
+    protocol_version: 1;
+    activation_revision: number;
+    max_source_bytes: number;
+    max_credential_ids: number;
+    max_request_body_bytes: number;
+    algorithms: -7[];
+};
+/** NativePasskeyExportOut */
+type NativePasskeyExportOut = {
+    source: string;
+};
+/** NativePasskeyExportPreflightOut */
+type NativePasskeyExportPreflightOut = {
+    item_id: string;
+    selection_revision: string;
+};
+/** NativePasskeyIdentityOut */
+type NativePasskeyIdentityOut = {
+    kind: "passkey";
+    item_id: string;
+    passkey_id: string;
+    rp_id: string;
+    credential_id: string;
+    user_handle: string;
+    user: string;
+};
+/** NativePasskeyImportCapabilitiesOut */
+type NativePasskeyImportCapabilitiesOut = {
+    protocol_version: 1;
+    activation_revision: number;
+    max_source_bytes: number;
+    max_request_body_bytes: number;
+    max_transfer_items: number;
+    max_file_bytes: number;
+};
+/** NativePasskeyMatchOut */
+type NativePasskeyMatchOut = {
+    item_id: string;
+    passkey_id: string;
+    credential_id: string;
+    user_handle: string;
+    username: string | null;
+    display_name: string | null;
+};
+/** NativePasskeyMatchesOut */
+type NativePasskeyMatchesOut = {
+    matches: NativePasskeyMatchOut[];
+    truncated: boolean;
+};
+/** NativePasskeyMaterializeOut */
+type NativePasskeyMaterializeOut = {
+    source: string;
+};
+/** NativePasskeyReceiptOut */
+type NativePasskeyReceiptOut = {
+    mutation_id: string;
+    item_id: string;
+    field_id: string;
+    passkey_id: string;
+    source_sha256: string;
+    status: "saved_waiting_for_site";
+};
+/** NativePasswordIdentityOut */
+type NativePasswordIdentityOut = {
+    kind: "password";
+    item_id: string;
+    service: NativeUrlService;
+    user: string;
+};
+/** NativeServiceIdentifierIn */
+type NativeServiceIdentifierIn = {
+    type: "domain" | "url";
+    identifier: string;
+};
+/** NativeUrlService */
+type NativeUrlService = {
+    type: "url";
+    identifier: string;
+};
+/** One PLAINTEXT custom field. Never encrypted — the UI labels the whole */
+type NonSecretFieldIn = {
+    /** stable lowercase-snake identity within the item */
+    key: string;
+    label: string;
+    value: string;
+};
+/** Whether the server holds an OAuth client, so the UI can hide the */
+type OauthDefaultsResponse = {
+    has_oauth_client: boolean;
+    client_id?: string | null;
+};
+/** OauthStartResponse */
+type OauthStartResponse = {
+    auth_url: string;
+    state: string;
+};
+/** OptionsResponse */
+type OptionsResponse = {
+    protected_fields: ProtectedFieldOption[];
+    link_ttl_minutes: number;
+    code_ttl_minutes: number;
+};
+/** OrganizationSecretContributeRequest */
+type OrganizationSecretContributeRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    user_secret_id: string;
+    key?: string | null;
+    description?: string | null;
+    category?: ("github" | "openai" | "anthropic" | "google" | "aws" | "stripe" | "supabase" | "vercel" | "linear" | "notion" | "slack" | "custom") | null;
+    inject_into_sandbox?: boolean | null;
+};
+/** OrganizationSecretCreateRequest */
+type OrganizationSecretCreateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    key: string;
+    value: string;
+    description?: string | null;
+    category?: ("github" | "openai" | "anthropic" | "google" | "aws" | "stripe" | "supabase" | "vercel" | "linear" | "notion" | "slack" | "custom") | null;
+    inject_into_sandbox?: boolean;
+};
+/** OrganizationSecretListResponse */
+type OrganizationSecretListResponse = {
+    secrets: OrganizationSecretSummary[];
+};
+/** OrganizationSecretPermissionsRequest */
+type OrganizationSecretPermissionsRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    access_mode: "all_members" | "restricted";
+    user_ids: string[];
+};
+/** OrganizationSecretSummary */
+type OrganizationSecretSummary = {
+    id: string;
+    organization_id: string;
+    key: string;
+    value_hint: string;
+    description: string | null;
+    category: string | null;
+    access_mode: "all_members" | "restricted";
+    inject_into_sandbox: boolean;
+    is_active: boolean;
+    value_version: number;
+    source_user_secret_id: string | null;
+    source_user_secret_version: number | null;
+    source_current_version: number | null;
+    sync_status: "not_linked" | "current" | "out_of_sync" | "source_deleted";
+    can_manage: boolean;
+    grant_user_ids: string[];
+    last_used_at: string | null;
+    created_by: string;
+    updated_by: string;
+    created_at: string;
+    updated_at: string;
+};
+/** OrganizationSecretUpdateRequest */
+type OrganizationSecretUpdateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    value?: string | null;
+    description?: string | null;
+    category?: ("github" | "openai" | "anthropic" | "google" | "aws" | "stripe" | "supabase" | "vercel" | "linear" | "notion" | "slack" | "custom") | null;
+    inject_into_sandbox?: boolean | null;
+    is_active?: boolean | null;
+};
+/** PendingActionRequest */
+type PendingActionRequest = {
+    request_id: string;
+    kind: string;
+    render: {
+        [key: string]: JsonValue;
+    };
+    organization_id: string;
+    conversation_id?: string | null;
+    link_expires_at?: string | null;
+    link_live: boolean;
+    answer_by?: string | null;
+    created_at?: string | null;
+};
+/** PendingActionRequestsResponse */
+type PendingActionRequestsResponse = {
+    requests: PendingActionRequest[];
+};
+/** PreferencesWriteResponse */
+type PreferencesWriteResponse = {
+    status: string;
+};
+/** The owning scope a call operates on. ``user`` == the authenticated */
+type PrincipalIn = {
+    type?: "user" | "organization";
+    organization_id?: string | null;
+    [key: string]: unknown;
+};
+/** ProtectedFieldOption */
+type ProtectedFieldOption = {
+    key: string;
+    label: string;
+    available: boolean;
+    reason?: string | null;
+};
+/** Every state the recipient page draws. ``state`` decides which fields are present. */
+type RecipientPage = {
+    state: "unavailable" | "ready" | "viewed" | "expired" | "revoked" | "locked" | "locked_out" | "wrong_code" | "opened";
+    message?: string | null;
+    remedy?: string | null;
+    sender_name?: string | null;
+    organization_name?: string | null;
+    code_channel?: ("email" | "sms") | null;
+    masked_target?: string | null;
+    expires_at?: string | null;
+    viewed_at?: string | null;
+    locked_until?: string | null;
+    code_sent?: boolean | null;
+    attempts_left?: number | null;
+    label?: string | null;
+    note?: string | null;
+    record?: {
+        [key: string]: string | number | boolean | string[] | null;
+    } | null;
+    fields?: DeliveredField[] | null;
+    sent_at?: string | null;
+};
+/** RevokeResponse */
+type RevokeResponse = {
+    delivery_id: string;
+    status: string;
+    sentence: string;
+};
+/** Decrypted env dict for the current user's next sandbox. */
+type SandboxEnvResponse = {
+    env: {
+        [key: string]: string;
+    };
+    count: number;
+};
+/** SecretBody */
+type SecretBody = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    token: string;
+};
+/** SetActiveOrganization */
+type SetActiveOrganization = {
+    organization_id: string;
+};
+/** SiteCredentialRequest */
+type SiteCredentialRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    provider: string;
+    credential_id?: string | null;
+    gsc_site_url?: string | null;
+};
+/** SiteCredentialResponse */
+type SiteCredentialResponse = {
+    id: string;
+    base_url?: string | null;
+    gsc_credential_id?: string | null;
+    psi_credential_id?: string | null;
+    gsc_site_url?: string | null;
+};
+/** Just the link's token. Used by the open and re-mint doors, which need */
+type TokenBody = {
+    token: string;
+};
+/** UserAnalysisPreferences */
+type UserAnalysisPreferences = {
+    per_detector_enabled?: {
+        [key: string]: boolean;
+    } | null;
+    default_tier_per_detector?: {
+        [key: string]: string;
+    } | null;
+    custom_patterns?: {
+        [key: string]: unknown;
+    }[] | null;
+    default_redaction_mode?: string | null;
+    per_file_type_overrides?: {
+        [key: string]: {
+            [key: string]: unknown;
+        };
+    } | null;
+    substitute_formats?: {
+        [key: string]: string;
+    } | null;
+};
+/** UserSecretBulkEnvRequest */
+type UserSecretBulkEnvRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    env_text: string;
+    default_category?: ("github" | "openai" | "anthropic" | "google" | "aws" | "stripe" | "supabase" | "vercel" | "linear" | "notion" | "slack" | "custom") | null;
+    inject_into_sandbox?: boolean;
+};
+/** UserSecretBulkEnvResponse */
+type UserSecretBulkEnvResponse = {
+    upserted: UserSecretSummary[];
+    count: number;
+};
+/** UserSecretCreateRequest */
+type UserSecretCreateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    key: string;
+    value: string;
+    description?: string | null;
+    category?: ("github" | "openai" | "anthropic" | "google" | "aws" | "stripe" | "supabase" | "vercel" | "linear" | "notion" | "slack" | "custom") | null;
+    inject_into_sandbox?: boolean;
+    upsert?: boolean;
+};
+/** UserSecretListResponse */
+type UserSecretListResponse = {
+    secrets: UserSecretSummary[];
+};
+/** Listing-row shape — NEVER carries the plaintext value. */
+type UserSecretSummary = {
+    id: string;
+    key: string;
+    value_hint?: string;
+    description?: string | null;
+    category?: string | null;
+    is_active?: boolean;
+    inject_into_sandbox?: boolean;
+    value_version?: number;
+    last_used_at?: string | null;
+    created_at: string;
+    updated_at: string;
+    [key: string]: unknown;
+};
+/** UserSecretUpdateRequest */
+type UserSecretUpdateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    value?: string | null;
+    description?: string | null;
+    category?: ("github" | "openai" | "anthropic" | "google" | "aws" | "stripe" | "supabase" | "vercel" | "linear" | "notion" | "slack" | "custom") | null;
+    is_active?: boolean | null;
+    inject_into_sandbox?: boolean | null;
+};
+/** **Create for someone**: the item is born owned by the recipient. */
+type VaultAssignRequest = {
+    login_urls?: string[] | null;
+    uri_match_mode?: ("host" | "domain" | "exact" | "never") | null;
+    notes?: string | null;
+    non_secret_fields?: NonSecretFieldIn[] | null;
+    browser_fill_enabled?: boolean | null;
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    recipient_email: string;
+    display_name: string;
+    fields?: FieldIn[];
+    definition_key?: string;
+    definition_version?: number;
+    provider_key?: string | null;
+    description?: string | null;
+    tags?: string[];
+    generate_field_key?: string | null;
+    [key: string]: unknown;
+};
+/** Safe identity + confirmation ONLY. A generated password never appears */
+type VaultAssignResponse = {
+    id: string;
+    display_name: string;
+    definition_key: string;
+    assigned_to?: {
+        [key: string]: string;
+    };
+    generated?: boolean;
+    [key: string]: unknown;
+};
+/** Safe attachment metadata. File bytes only cross the dedicated */
+type VaultAttachmentOut = {
+    id: string;
+    credential_item_id: string;
+    label: string;
+    description?: string | null;
+    file_name: string;
+    media_type?: string;
+    size_bytes: number;
+    handling?: "visible" | "revealable" | "sealed";
+    value_version?: number;
+    last_used_at?: string | null;
+    created_at: string;
+    updated_at: string;
+};
+/** VaultAttachmentUpdateRequest */
+type VaultAttachmentUpdateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    label?: string | null;
+    description?: string | null;
+    clear_description?: boolean;
+    file_name?: string | null;
+    handling?: ("visible" | "revealable" | "sealed") | null;
+    [key: string]: unknown;
+};
+/** VaultAuditEntry */
+type VaultAuditEntry = {
+    id: string;
+    user_secret_id?: string | null;
+    actor_id?: string | null;
+    action: string;
+    metadata?: {
+        [key: string]: JsonValue;
+    };
+    created_at: string;
+    [key: string]: unknown;
+};
+/** VaultAuditResponse */
+type VaultAuditResponse = {
+    entries: VaultAuditEntry[];
+    count: number;
+};
+/** VaultBackupDownloadPreview */
+type VaultBackupDownloadPreview = {
+    records: VaultBackupRecordSummary[];
+    omissions: VaultBackupOmission[];
+    record_count: number;
+    field_count: number;
+    attachment_count: number;
+    attachment_bytes: number;
+    revision: string;
+};
+/** VaultBackupOmission */
+type VaultBackupOmission = {
+    component: string;
+    reason: string;
+    count?: number | null;
+    source_item_id?: string | null;
+};
+/** VaultBackupRecordSummary */
+type VaultBackupRecordSummary = {
+    source_item_id: string;
+    display_name: string;
+    field_count: number;
+    attachment_count: number;
+};
+/** VaultBackupRestorePreview */
+type VaultBackupRestorePreview = {
+    records: VaultBackupRecordSummary[];
+    omissions: VaultBackupOmission[];
+    record_count: number;
+    field_count: number;
+    attachment_count: number;
+    attachment_bytes: number;
+    envelope_digest: string;
+    actor_id: string;
+    organization_id: string;
+    quarantined: boolean;
+};
+/** VaultBackupRestoreRecordResult */
+type VaultBackupRestoreRecordResult = {
+    source_item_id: string;
+    item_id: string | null;
+    status: "created" | "replayed" | "refused" | "retryable_failure";
+    reason?: "alias_conflict" | null;
+};
+/** VaultBackupRestoreResult */
+type VaultBackupRestoreResult = {
+    restore_run_id: string;
+    results: VaultBackupRestoreRecordResult[];
+    created: number;
+    replayed: number;
+    refused: number;
+    retryable_failure: number;
+};
+/** VaultCapabilities */
+type VaultCapabilities = {
+    can_use?: boolean;
+    can_edit?: boolean;
+    can_reveal?: boolean;
+    can_manage?: boolean;
+};
+/** One user-entered login destination. Secret values never belong here. */
+type VaultDestinationCheckRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    url: string;
+};
+/** VaultDestinationCheckResponse */
+type VaultDestinationCheckResponse = {
+    normalized_url: string;
+    state: "reachable" | "not_found" | "responded" | "unreachable" | "invalid";
+    http_status?: number | null;
+};
+/** VaultEffectiveEnvResponse */
+type VaultEffectiveEnvResponse = {
+    env: {
+        [key: string]: string;
+    };
+    count: number;
+    /** Organization keys you may use but not view (values never returned). */
+    withheld?: string[];
+    withheld_note?: string | null;
+};
+/** Metadata-only field patch — never carries a value; ``value_version`` */
+type VaultFieldMetadataRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    inject_into_sandbox?: boolean | null;
+    handling?: ("visible" | "revealable" | "sealed") | null;
+    editable?: boolean | null;
+    env_key?: string | null;
+    clear_env_key?: boolean;
+    description?: string | null;
+    is_active?: boolean | null;
+    [key: string]: unknown;
+};
+/** Masked field — never carries plaintext. */
+type VaultFieldOut = {
+    id: string;
+    credential_item_id: string;
+    field_key: string;
+    execution_purpose?: "general" | "passkey_private";
+    env_key?: string | null;
+    handling?: string;
+    editable?: boolean;
+    inject_into_sandbox?: boolean;
+    value_hint?: string;
+    value_version?: number;
+    is_active?: boolean;
+    description?: string | null;
+    created_at: string;
+    updated_at: string;
+    [key: string]: unknown;
+};
+/** VaultFieldValueRequest */
+type VaultFieldValueRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    value: string;
+    [key: string]: unknown;
+};
+/** The person approves one fill-device key with their account passkey, on the */
+type VaultFillDeviceApproveRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    key_thumbprint: string;
+    label?: string | null;
+    device_kind?: ("browser" | "mac") | null;
+    challenge_id: string;
+    credential: {
+        [key: string]: unknown;
+    };
+};
+/** VaultFillDeviceApproveResponse */
+type VaultFillDeviceApproveResponse = {
+    approved: boolean;
+    key_thumbprint: string;
+    expires_at: string;
+};
+/** VaultFillDeviceListResponse */
+type VaultFillDeviceListResponse = {
+    devices: VaultFillDeviceOut[];
+};
+/** One browser that may fill saved passwords. Never carries key material */
+type VaultFillDeviceOut = {
+    id: string;
+    label: string;
+    extension_origin?: string | null;
+    registered_at?: string | null;
+    last_used_at?: string | null;
+    revoked_at?: string | null;
+    revoke_reason?: string | null;
+    key_thumbprint: string;
+};
+/** The browser extension registers the PUBLIC half of its non-extractable */
+type VaultFillDeviceRegisterRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    public_key_jwk: {
+        [key: string]: string;
+    };
+    label: string;
+    extension_origin?: string | null;
+    password?: string | null;
+};
+/** How this person can confirm it is them to turn filling on. */
+type VaultFillStepUpMethodsResponse = {
+    password: boolean;
+    passkey: boolean;
+};
+/** VaultForkRequest */
+type VaultForkRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    to_principal: PrincipalIn;
+    [key: string]: unknown;
+};
+/** Grant ONE recipient by EXACT email — no directory search, no */
+type VaultGrantAddRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    recipient_email: string;
+    can_use?: boolean;
+    can_manage?: boolean;
+    [key: string]: unknown;
+};
+/** VaultGrantListResponse */
+type VaultGrantListResponse = {
+    grants: VaultGrantOut[];
+    count: number;
+};
+/** One recipient of a shared item. Safe identity only. */
+type VaultGrantOut = {
+    id: string;
+    user_id?: string | null;
+    organization_id?: string | null;
+    email?: string;
+    organization_name?: string | null;
+    can_use?: boolean;
+    can_manage?: boolean;
+    granted_by?: string | null;
+    created_at: string;
+    [key: string]: unknown;
+};
+/** VaultGrantUpdateRequest */
+type VaultGrantUpdateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    can_use?: boolean | null;
+    can_manage?: boolean | null;
+    [key: string]: unknown;
+};
+/** VaultImportEnvRequest */
+type VaultImportEnvRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    principal?: PrincipalIn;
+    env_text: string;
+    inject_into_sandbox?: boolean;
+    [key: string]: unknown;
+};
+/** VaultItemCreateRequest */
+type VaultItemCreateRequest = {
+    login_urls?: string[] | null;
+    uri_match_mode?: ("host" | "domain" | "exact" | "never") | null;
+    notes?: string | null;
+    non_secret_fields?: NonSecretFieldIn[] | null;
+    browser_fill_enabled?: boolean | null;
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    principal?: PrincipalIn;
+    display_name: string;
+    fields?: FieldIn[];
+    definition_key?: string;
+    definition_version?: number;
+    provider_key?: string | null;
+    description?: string | null;
+    tags?: string[];
+    source?: string;
+    [key: string]: unknown;
+};
+/** VaultItemListResponse */
+type VaultItemListResponse = {
+    items: VaultItemOut[];
+    count: number;
+};
+/** VaultItemOut */
+type VaultItemOut = {
+    id: string;
+    user_id?: string | null;
+    organization_id?: string | null;
+    definition_key?: string;
+    definition_version?: number;
+    provider_key?: string | null;
+    display_name: string;
+    description?: string | null;
+    tags?: string[];
+    status?: string;
+    source?: string;
+    access_mode?: string;
+    lifecycle?: {
+        [key: string]: JsonValue;
+    };
+    login_urls?: string[];
+    uri_match_mode?: string;
+    notes?: string | null;
+    non_secret_fields?: {
+        [key: string]: string;
+    }[];
+    browser_fill_enabled?: boolean;
+    created_at: string;
+    updated_at: string;
+    fields?: VaultFieldOut[];
+    attachments?: VaultAttachmentOut[];
+    capabilities?: VaultCapabilities;
+    [key: string]: unknown;
+};
+/** VaultItemUpdateRequest */
+type VaultItemUpdateRequest = {
+    login_urls?: string[] | null;
+    uri_match_mode?: ("host" | "domain" | "exact" | "never") | null;
+    notes?: string | null;
+    non_secret_fields?: NonSecretFieldIn[] | null;
+    browser_fill_enabled?: boolean | null;
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    display_name?: string | null;
+    description?: string | null;
+    tags?: string[] | null;
+    status?: ("active" | "disabled" | "expired" | "pending_verification") | null;
+    provider_key?: string | null;
+    lifecycle?: {
+        [key: string]: JsonValue;
+    } | null;
+    clear_notes?: boolean;
+    [key: string]: unknown;
+};
+/** VaultLoginCsvDownloadRequest */
+type VaultLoginCsvDownloadRequest = {
+    profile: "matrx_login_csv_v1" | "nordpass_csv_v1" | "google_password_manager_csv_v1" | "dashlane_csv_v1" | "keeper_csv_v1" | "lastpass_csv_v1" | "firefox_csv_v1" | "roboform_csv_v1" | "apple_passwords_csv_v1";
+    item_ids: string[];
+    revision: string;
+};
+/** VaultLoginCsvPreviewItem */
+type VaultLoginCsvPreviewItem = {
+    item_id: string;
+    title: string;
+    eligible: boolean;
+    reason?: string | null;
+    omissions?: {
+        [key: string]: number;
+    };
+};
+/** VaultLoginCsvPreviewRequest */
+type VaultLoginCsvPreviewRequest = {
+    profile: "matrx_login_csv_v1" | "nordpass_csv_v1" | "google_password_manager_csv_v1" | "dashlane_csv_v1" | "keeper_csv_v1" | "lastpass_csv_v1" | "firefox_csv_v1" | "roboform_csv_v1" | "apple_passwords_csv_v1";
+    item_ids: string[];
+};
+/** VaultLoginCsvPreviewResponse */
+type VaultLoginCsvPreviewResponse = {
+    profile: "matrx_login_csv_v1" | "nordpass_csv_v1" | "google_password_manager_csv_v1" | "dashlane_csv_v1" | "keeper_csv_v1" | "lastpass_csv_v1" | "firefox_csv_v1" | "roboform_csv_v1" | "apple_passwords_csv_v1";
+    revision: string;
+    items: VaultLoginCsvPreviewItem[];
+};
+/** VaultMemberAccessListResponse */
+type VaultMemberAccessListResponse = {
+    organization_id: string;
+    default_access: "none" | "use" | "editor";
+    members: VaultMemberAccessOut[];
+};
+/** VaultMemberAccessOut */
+type VaultMemberAccessOut = {
+    user_id: string;
+    email?: string;
+    role: string;
+    vault_access?: ("none" | "use" | "editor") | null;
+    effective_access: "none" | "use" | "editor" | "admin";
+};
+/** VaultMemberAccessSetRequest */
+type VaultMemberAccessSetRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    access?: ("none" | "use" | "editor") | null;
+    [key: string]: unknown;
+};
+/** VaultMemberAccessSetResponse */
+type VaultMemberAccessSetResponse = {
+    organization_id: string;
+    user_id: string;
+    vault_access?: ("none" | "use" | "editor") | null;
+    effective_access: "none" | "use" | "editor" | "admin";
+};
+/** Bind the explicit reenablement request to one recorded deletion. */
+type VaultNativePasskeyEnableRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    deletion_id: string;
+};
+/** VaultNativePasskeyEnableResponse */
+type VaultNativePasskeyEnableResponse = {
+    item_id: string;
+    enabled: true;
+    already_enabled: boolean;
+};
+/** Share a personal item into ONE organization's vault. ``can_manage`` */
+type VaultOrganizationGrantAddRequest = {
+    organization_id: string;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    can_manage?: boolean;
+    [key: string]: unknown;
+};
+/** A value-free entry in the personal password-history timeline. */
+type VaultPasswordHistoryEntry = {
+    /** Positive Postgres int4 revision; this does not define retention. */
+    revision: number;
+    recorded_at: string;
+    field_id: string;
+    capture_started_at: string;
+    value_availability?: "available" | "unavailable";
+};
+/** Value-free password-history timeline metadata. */
+type VaultPasswordHistoryResponse = {
+    entries: VaultPasswordHistoryEntry[];
+    count: number;
+    capture_cutoff_at?: string | null;
+    history_revision: number;
+    value_availability?: "available" | "unavailable";
+    restore_available?: boolean;
+    next_before_revision?: number | null;
+    omitted_count: number;
+    incomplete: boolean;
+};
+/** Restore only if the current history revision remains unchanged. */
+type VaultPasswordHistoryRestoreRequest = {
+    field_id: string;
+    revision: number;
+    expected_history_revision: number;
+};
+/** VaultPasswordHistoryRestoreResponse */
+type VaultPasswordHistoryRestoreResponse = {
+    item_id: string;
+    field_id: string;
+    restored_from_revision: number;
+    history_revision: number;
+};
+/** The exact historical field state the caller wants to reveal. */
+type VaultPasswordHistoryRevealRequest = {
+    field_id: string;
+    /** Positive Postgres int4 revision; this does not define retention. */
+    revision: number;
+};
+/** One explicitly requested old value; never ciphertext or fingerprints. */
+type VaultPasswordHistoryRevealResponse = {
+    item_id: string;
+    field_id: string;
+    revision: number;
+    value: string;
+};
+/** VaultResolveRef */
+type VaultResolveRef = {
+    item_id: string;
+    field_key: string;
+    [key: string]: unknown;
+};
+/** VaultResolveRequest */
+type VaultResolveRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    refs: VaultResolveRef[];
+    [key: string]: unknown;
+};
+/** Browser-facing resolution — sealed fields are structurally refused */
+type VaultResolveResponse = {
+    values: {
+        [key: string]: string;
+    };
+};
+/** VaultRestoreRequest */
+type VaultRestoreRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    deletion_id: string;
+};
+/** VaultRestoreResponse */
+type VaultRestoreResponse = {
+    item: VaultItemOut;
+    restored_fields: number;
+    restored_attachments: number;
+    restored_native_passkeys: number;
+    already_restored: boolean;
+    notice: "sharing_and_automatic_use_off";
+};
+/** VaultRevealRequest */
+type VaultRevealRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    field_key: string;
+    [key: string]: unknown;
+};
+/** The ONLY human-facing plaintext shape. Short-lived, component-local on */
+type VaultRevealResponse = {
+    item_id: string;
+    field_key: string;
+    value: string;
+};
+/** VaultRotateRequest */
+type VaultRotateRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    /** {field_key: new plaintext} */
+    values: {
+        [key: string]: string;
+    };
+    [key: string]: unknown;
+};
+/** VaultShareRequest */
+type VaultShareRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    access_mode: "all_members" | "restricted";
+    grantees?: GranteeIn[];
+    [key: string]: unknown;
+};
+/** Move ownership. Exactly one destination: another user by exact email */
+type VaultTransferRequest = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    to_principal?: PrincipalIn | null;
+    recipient_email?: string | null;
+    [key: string]: unknown;
+};
+/** The sender loses ALL access on success, so this carries confirmation */
+type VaultTransferResponse = {
+    id: string;
+    display_name: string;
+    transferred_to?: {
+        [key: string]: string;
+    };
+    /** Minting keys retired instead of moved — an authenticator seed never changes hands (D-15); the new owner enrolls again. */
+    fields_not_transferred?: string[];
+    [key: string]: unknown;
+};
+/** ViewBody */
+type ViewBody = {
+    /** Organization context for the request; omitted to use the authenticated context. */
+    organization_id?: string | null;
+    /** Optional associated project selected by the caller. */
+    project_id?: string | null;
+    /** Optional associated task selected by the caller. */
+    task_id?: string | null;
+    /** Stable application slug that initiated the request. */
+    source_app?: string | null;
+    /** Stable feature slug within the source application. */
+    source_feature?: string | null;
+    /** How the client initiated this request: 'user' for a direct human action, 'auto' for client-code automation. Omit for API callers. */
+    initiation?: ("user" | "auto") | null;
+    token: string;
+    code: string;
+};
+type OpenActionRequestArgs = {
+    body: TokenBody;
+};
+type OpenActionRequestResult = ActionRequestStatusResponse;
+/** Open Action Request */
+/** `POST /action-requests/open` · aidream · auth scoped · org exempt */
+declare function openActionRequest(api: Api, args: OpenActionRequestArgs, options?: CallOptions): Promise<OpenActionRequestResult>;
+type CompleteActionRequestArgs = {
+    body: CompleteBody;
+};
+type CompleteActionRequestResult = ActionRequestStatusResponse;
+/** Complete Action Request */
+/** `POST /action-requests/complete` · aidream · auth scoped · org exempt */
+declare function completeActionRequest(api: Api, args: CompleteActionRequestArgs, options?: CallOptions): Promise<CompleteActionRequestResult>;
+type RemintActionRequestArgs = {
+    body: TokenBody;
+};
+type RemintActionRequestResult = ActionRequestStatusResponse;
+/** Remint Action Request */
+/** `POST /action-requests/remint` · aidream · auth scoped · org exempt */
+declare function remintActionRequest(api: Api, args: RemintActionRequestArgs, options?: CallOptions): Promise<RemintActionRequestResult>;
+type PendingActionRequestsArgs = {
+    [key: string]: never;
+};
+type PendingActionRequestsResult = PendingActionRequestsResponse;
+/** Pending Action Requests */
+/** `GET /action-requests/pending` · aidream · auth guest · org exempt */
+declare function pendingActionRequests(api: Api, args?: PendingActionRequestsArgs, options?: CallOptions): Promise<PendingActionRequestsResult>;
+type CompleteActionRequestNativeArgs = {
+    path: {
+        request_id: string;
+    };
+    body: NativeCompleteBody;
+};
+type CompleteActionRequestNativeResult = ActionRequestStatusResponse;
+/** Complete Action Request Native */
+/** `POST /action-requests/{request_id}/complete` · aidream · auth guest · org exempt */
+declare function completeActionRequestNative(api: Api, args: CompleteActionRequestNativeArgs, options?: CallOptions): Promise<CompleteActionRequestNativeResult>;
+type OpenSecureDeliveryArgs = {
+    body: SecretBody;
+};
+type OpenSecureDeliveryResult = RecipientPage;
+/** Open Secure Delivery */
+/** `POST /secure-delivery/open` · aidream · auth scoped · org exempt */
+declare function openSecureDelivery(api: Api, args: OpenSecureDeliveryArgs, options?: CallOptions): Promise<OpenSecureDeliveryResult>;
+type SendSecureDeliveryCodeArgs = {
+    body: SecretBody;
+};
+type SendSecureDeliveryCodeResult = RecipientPage;
+/** Send Secure Delivery Code */
+/** `POST /secure-delivery/code` · aidream · auth scoped · org exempt */
+declare function sendSecureDeliveryCode(api: Api, args: SendSecureDeliveryCodeArgs, options?: CallOptions): Promise<SendSecureDeliveryCodeResult>;
+type ViewSecureDeliveryArgs = {
+    body: ViewBody;
+};
+type ViewSecureDeliveryResult = RecipientPage;
+/** View Secure Delivery */
+/** `POST /secure-delivery/view` · aidream · auth scoped · org exempt */
+declare function viewSecureDelivery(api: Api, args: ViewSecureDeliveryArgs, options?: CallOptions): Promise<ViewSecureDeliveryResult>;
+type SecureDeliveryOptionsArgs = {
+    query: {
+        resource_type: string;
+        resource_id: string;
+    };
+};
+type SecureDeliveryOptionsResult = OptionsResponse;
+/** Secure Delivery Options */
+/** `GET /secure-delivery/options` · aidream · auth guest · org optional */
+declare function secureDeliveryOptions(api: Api, args: SecureDeliveryOptionsArgs, options?: CallOptions): Promise<SecureDeliveryOptionsResult>;
+type CreateSecureDeliveryArgs = {
+    body: CreateBody;
+};
+type CreateSecureDeliveryResult = CreateResponse;
+/** Create Secure Delivery */
+/** `POST /secure-delivery` · aidream · auth guest · org required */
+declare function createSecureDelivery(api: Api, args: CreateSecureDeliveryArgs, options?: CallOptions): Promise<CreateSecureDeliveryResult>;
+type RevokeSecureDeliveryArgs = {
+    path: {
+        delivery_id: string;
+    };
+};
+type RevokeSecureDeliveryResult = RevokeResponse;
+/** Revoke Secure Delivery */
+/** `POST /secure-delivery/{delivery_id}/revoke` · aidream · auth guest · org required */
+declare function revokeSecureDelivery(api: Api, args: RevokeSecureDeliveryArgs, options?: CallOptions): Promise<RevokeSecureDeliveryResult>;
+type UserSecretsListSecretsArgs = {
+    query?: {
+        include_inactive?: boolean;
+    };
+};
+type UserSecretsListSecretsResult = UserSecretListResponse;
+/** List Secrets */
+/** `GET /user-secrets` · aidream · auth user · org optional */
+declare function userSecretsListSecrets(api: Api, args?: UserSecretsListSecretsArgs, options?: CallOptions): Promise<UserSecretsListSecretsResult>;
+type UserSecretsCreateSecretArgs = {
+    body: UserSecretCreateRequest;
+};
+type UserSecretsCreateSecretResult = UserSecretSummary;
+/** Create Secret */
+/** `POST /user-secrets/` · aidream · auth user · org required */
+declare function userSecretsCreateSecret(api: Api, args: UserSecretsCreateSecretArgs, options?: CallOptions): Promise<UserSecretsCreateSecretResult>;
+type UserSecretsUpdateSecretArgs = {
+    path: {
+        key: string;
+    };
+    body: UserSecretUpdateRequest;
+};
+type UserSecretsUpdateSecretResult = UserSecretSummary;
+/** Update Secret */
+/** `PATCH /user-secrets/{key}` · aidream · auth user · org required */
+declare function userSecretsUpdateSecret(api: Api, args: UserSecretsUpdateSecretArgs, options?: CallOptions): Promise<UserSecretsUpdateSecretResult>;
+type UserSecretsDeleteSecretArgs = {
+    path: {
+        key: string;
+    };
+};
+type UserSecretsDeleteSecretResult = void;
+/** Delete Secret */
+/** `DELETE /user-secrets/{key}` · aidream · auth user · org required */
+declare function userSecretsDeleteSecret(api: Api, args: UserSecretsDeleteSecretArgs, options?: CallOptions): Promise<UserSecretsDeleteSecretResult>;
+type GetSandboxEnvArgs = {
+    [key: string]: never;
+};
+type GetSandboxEnvResult = SandboxEnvResponse;
+/** Get Sandbox Env */
+/** `GET /user-secrets/sandbox-env` · aidream · auth user · org required */
+declare function getSandboxEnv(api: Api, args?: GetSandboxEnvArgs, options?: CallOptions): Promise<GetSandboxEnvResult>;
+type BulkImportEnvArgs = {
+    body: UserSecretBulkEnvRequest;
+};
+type BulkImportEnvResult = UserSecretBulkEnvResponse;
+/** Bulk Import Env */
+/** `POST /user-secrets/bulk-env` · aidream · auth user · org required */
+declare function bulkImportEnv(api: Api, args: BulkImportEnvArgs, options?: CallOptions): Promise<BulkImportEnvResult>;
+type GetSandboxEnvForUserArgs = {
+    query?: {
+        organization_id?: string | null;
+    };
+};
+type GetSandboxEnvForUserResult = SandboxEnvResponse;
+/** Get Sandbox Env For User */
+/** `GET /user-secrets/internal/sandbox-env-for-user` · aidream · auth service · org required */
+declare function getSandboxEnvForUser(api: Api, args?: GetSandboxEnvForUserArgs, options?: CallOptions): Promise<GetSandboxEnvForUserResult>;
+type OrganizationSecretsListSecretsArgs = {
+    path: {
+        organization_id: string;
+    };
+};
+type OrganizationSecretsListSecretsResult = OrganizationSecretListResponse;
+/** List Secrets */
+/** `GET /organization-secrets/{organization_id}` · aidream · auth user · org required */
+declare function organizationSecretsListSecrets(api: Api, args: OrganizationSecretsListSecretsArgs, options?: CallOptions): Promise<OrganizationSecretsListSecretsResult>;
+type OrganizationSecretsCreateSecretArgs = {
+    path: {
+        organization_id: string;
+    };
+    body: OrganizationSecretCreateRequest;
+};
+type OrganizationSecretsCreateSecretResult = OrganizationSecretSummary;
+/** Create Secret */
+/** `POST /organization-secrets/{organization_id}` · aidream · auth user · org required */
+declare function organizationSecretsCreateSecret(api: Api, args: OrganizationSecretsCreateSecretArgs, options?: CallOptions): Promise<OrganizationSecretsCreateSecretResult>;
+type ContributeSecretArgs = {
+    path: {
+        organization_id: string;
+    };
+    body: OrganizationSecretContributeRequest;
+};
+type ContributeSecretResult = OrganizationSecretSummary;
+/** Contribute Secret */
+/** `POST /organization-secrets/{organization_id}/contribute` · aidream · auth user · org required */
+declare function contributeSecret(api: Api, args: ContributeSecretArgs, options?: CallOptions): Promise<ContributeSecretResult>;
+type OrganizationSecretsUpdateSecretArgs = {
+    path: {
+        organization_id: string;
+        secret_id: string;
+    };
+    body: OrganizationSecretUpdateRequest;
+};
+type OrganizationSecretsUpdateSecretResult = OrganizationSecretSummary;
+/** Update Secret */
+/** `PATCH /organization-secrets/{organization_id}/{secret_id}` · aidream · auth user · org required */
+declare function organizationSecretsUpdateSecret(api: Api, args: OrganizationSecretsUpdateSecretArgs, options?: CallOptions): Promise<OrganizationSecretsUpdateSecretResult>;
+type OrganizationSecretsDeleteSecretArgs = {
+    path: {
+        organization_id: string;
+        secret_id: string;
+    };
+};
+type OrganizationSecretsDeleteSecretResult = void;
+/** Delete Secret */
+/** `DELETE /organization-secrets/{organization_id}/{secret_id}` · aidream · auth user · org required */
+declare function organizationSecretsDeleteSecret(api: Api, args: OrganizationSecretsDeleteSecretArgs, options?: CallOptions): Promise<OrganizationSecretsDeleteSecretResult>;
+type SyncSecretArgs = {
+    path: {
+        organization_id: string;
+        secret_id: string;
+    };
+};
+type SyncSecretResult = OrganizationSecretSummary;
+/** Sync Secret */
+/** `POST /organization-secrets/{organization_id}/{secret_id}/sync` · aidream · auth user · org required */
+declare function syncSecret(api: Api, args: SyncSecretArgs, options?: CallOptions): Promise<SyncSecretResult>;
+type ReplacePermissionsArgs = {
+    path: {
+        organization_id: string;
+        secret_id: string;
+    };
+    body: OrganizationSecretPermissionsRequest;
+};
+type ReplacePermissionsResult = OrganizationSecretSummary;
+/** Replace Permissions */
+/** `PUT /organization-secrets/{organization_id}/{secret_id}/permissions` · aidream · auth user · org required */
+declare function replacePermissions(api: Api, args: ReplacePermissionsArgs, options?: CallOptions): Promise<ReplacePermissionsResult>;
+type PreviewLoginCsvArgs = {
+    body: VaultLoginCsvPreviewRequest;
+};
+type PreviewLoginCsvResult = VaultLoginCsvPreviewResponse;
+/** Preview Login Csv */
+/** `POST /vault/exports/login-csv/preview` · aidream · auth user · org required */
+declare function previewLoginCsv(api: Api, args: PreviewLoginCsvArgs, options?: CallOptions): Promise<PreviewLoginCsvResult>;
+type DownloadLoginCsvArgs = {
+    body: VaultLoginCsvDownloadRequest;
+};
+type DownloadLoginCsvResult = unknown;
+/** Download Login Csv */
+/** `POST /vault/exports/login-csv` · aidream · auth user · org required */
+declare function downloadLoginCsv(api: Api, args: DownloadLoginCsvArgs, options?: CallOptions): Promise<DownloadLoginCsvResult>;
+type ListItemsArgs = {
+    query?: {
+        principal_type?: string;
+        organization_id?: string | null;
+    };
+};
+type ListItemsResult = VaultItemListResponse;
+/** List Items */
+/** `GET /vault/items` · aidream · auth user · org required */
+declare function listItems(api: Api, args?: ListItemsArgs, options?: CallOptions): Promise<ListItemsResult>;
+type CreateItemArgs = {
+    body: VaultItemCreateRequest;
+};
+type CreateItemResult = VaultItemOut;
+/** Create Item */
+/** `POST /vault/items` · aidream · auth user · org required */
+declare function createItem(api: Api, args: CreateItemArgs, options?: CallOptions): Promise<CreateItemResult>;
+type ImportEnvArgs = {
+    body: VaultImportEnvRequest;
+};
+type ImportEnvResult = VaultItemListResponse;
+/** Import Env */
+/** `POST /vault/items/import-env` · aidream · auth user · org required */
+declare function importEnv(api: Api, args: ImportEnvArgs, options?: CallOptions): Promise<ImportEnvResult>;
+type GetItemArgs = {
+    path: {
+        item_id: string;
+    };
+};
+type GetItemResult = VaultItemOut;
+/** Get Item */
+/** `GET /vault/items/{item_id}` · aidream · auth user · org required */
+declare function getItem(api: Api, args: GetItemArgs, options?: CallOptions): Promise<GetItemResult>;
+type UpdateItemArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultItemUpdateRequest;
+};
+type UpdateItemResult = VaultItemOut;
+/** Update Item */
+/** `PATCH /vault/items/{item_id}` · aidream · auth user · org required */
+declare function updateItem(api: Api, args: UpdateItemArgs, options?: CallOptions): Promise<UpdateItemResult>;
+type DeleteItemArgs = {
+    path: {
+        item_id: string;
+    };
+};
+type DeleteItemResult = void;
+/** Delete Item */
+/** `DELETE /vault/items/{item_id}` · aidream · auth user · org required */
+declare function deleteItem(api: Api, args: DeleteItemArgs, options?: CallOptions): Promise<DeleteItemResult>;
+type RestoreItemArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultRestoreRequest;
+};
+type RestoreItemResult = VaultRestoreResponse;
+/** Restore Item */
+/** `POST /vault/items/{item_id}/restore` · aidream · auth user · org required */
+declare function restoreItem(api: Api, args: RestoreItemArgs, options?: CallOptions): Promise<RestoreItemResult>;
+type AddFieldArgs = {
+    path: {
+        item_id: string;
+    };
+    body: FieldIn;
+};
+type AddFieldResult = VaultFieldOut;
+/** Add Field */
+/** `POST /vault/items/{item_id}/fields` · aidream · auth user · org required */
+declare function addField(api: Api, args: AddFieldArgs, options?: CallOptions): Promise<AddFieldResult>;
+type UpdateFieldMetadataArgs = {
+    path: {
+        item_id: string;
+        field_id: string;
+    };
+    body: VaultFieldMetadataRequest;
+};
+type UpdateFieldMetadataResult = VaultFieldOut;
+/** Update Field Metadata */
+/** `PATCH /vault/items/{item_id}/fields/{field_id}` · aidream · auth user · org required */
+declare function updateFieldMetadata(api: Api, args: UpdateFieldMetadataArgs, options?: CallOptions): Promise<UpdateFieldMetadataResult>;
+type DeleteFieldArgs = {
+    path: {
+        item_id: string;
+        field_id: string;
+    };
+};
+type DeleteFieldResult = void;
+/** Delete Field */
+/** `DELETE /vault/items/{item_id}/fields/{field_id}` · aidream · auth user · org required */
+declare function deleteField(api: Api, args: DeleteFieldArgs, options?: CallOptions): Promise<DeleteFieldResult>;
+type UpdateFieldValueArgs = {
+    path: {
+        item_id: string;
+        field_id: string;
+    };
+    body: VaultFieldValueRequest;
+};
+type UpdateFieldValueResult = VaultFieldOut;
+/** Update Field Value */
+/** `PUT /vault/items/{item_id}/fields/{field_id}/value` · aidream · auth user · org required */
+declare function updateFieldValue(api: Api, args: UpdateFieldValueArgs, options?: CallOptions): Promise<UpdateFieldValueResult>;
+type AddAttachmentArgs = {
+    path: {
+        item_id: string;
+    };
+    body: FormData;
+};
+type AddAttachmentResult = VaultAttachmentOut;
+/** Add Attachment */
+/** `POST /vault/items/{item_id}/attachments` · aidream · auth user · org required */
+declare function addAttachment(api: Api, args: AddAttachmentArgs, options?: CallOptions): Promise<AddAttachmentResult>;
+type UpdateAttachmentArgs = {
+    path: {
+        item_id: string;
+        attachment_id: string;
+    };
+    body: VaultAttachmentUpdateRequest;
+};
+type UpdateAttachmentResult = VaultAttachmentOut;
+/** Update Attachment */
+/** `PATCH /vault/items/{item_id}/attachments/{attachment_id}` · aidream · auth user · org required */
+declare function updateAttachment(api: Api, args: UpdateAttachmentArgs, options?: CallOptions): Promise<UpdateAttachmentResult>;
+type DeleteAttachmentArgs = {
+    path: {
+        item_id: string;
+        attachment_id: string;
+    };
+};
+type DeleteAttachmentResult = void;
+/** Delete Attachment */
+/** `DELETE /vault/items/{item_id}/attachments/{attachment_id}` · aidream · auth user · org required */
+declare function deleteAttachment(api: Api, args: DeleteAttachmentArgs, options?: CallOptions): Promise<DeleteAttachmentResult>;
+type ReplaceAttachmentArgs = {
+    path: {
+        item_id: string;
+        attachment_id: string;
+    };
+    body: FormData;
+};
+type ReplaceAttachmentResult = VaultAttachmentOut;
+/** Replace Attachment */
+/** `PUT /vault/items/{item_id}/attachments/{attachment_id}/file` · aidream · auth user · org required */
+declare function replaceAttachment(api: Api, args: ReplaceAttachmentArgs, options?: CallOptions): Promise<ReplaceAttachmentResult>;
+type DownloadAttachmentArgs = {
+    path: {
+        item_id: string;
+        attachment_id: string;
+    };
+};
+type DownloadAttachmentResult = unknown;
+/** Download Attachment */
+/** `GET /vault/items/{item_id}/attachments/{attachment_id}/download` · aidream · auth user · org required */
+declare function downloadAttachment(api: Api, args: DownloadAttachmentArgs, options?: CallOptions): Promise<DownloadAttachmentResult>;
+type RevealArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultRevealRequest;
+};
+type RevealResult = VaultRevealResponse;
+/** Reveal */
+/** `POST /vault/items/{item_id}/reveal` · aidream · auth user · org required */
+declare function reveal(api: Api, args: RevealArgs, options?: CallOptions): Promise<RevealResult>;
+type RotateArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultRotateRequest;
+};
+type RotateResult = VaultItemOut;
+/** Rotate */
+/** `POST /vault/items/{item_id}/rotate` · aidream · auth user · org required */
+declare function rotate(api: Api, args: RotateArgs, options?: CallOptions): Promise<RotateResult>;
+type ResolveOpArgs = {
+    body: VaultResolveRequest;
+};
+type ResolveOpResult = VaultResolveResponse;
+/** Resolve */
+/** `POST /vault/resolve` · aidream · auth user · org required */
+declare function resolve(api: Api, args: ResolveOpArgs, options?: CallOptions): Promise<ResolveOpResult>;
+type EffectiveEnvArgs = {
+    query?: {
+        organization_id?: string | null;
+    };
+};
+type EffectiveEnvResult = VaultEffectiveEnvResponse;
+/** Effective Env */
+/** `GET /vault/effective-env` · aidream · auth user · org required */
+declare function effectiveEnv(api: Api, args?: EffectiveEnvArgs, options?: CallOptions): Promise<EffectiveEnvResult>;
+type ShareArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultShareRequest;
+};
+type ShareResult = VaultItemOut;
+/** Share */
+/** `PUT /vault/items/{item_id}/share` · aidream · auth user · org required */
+declare function share(api: Api, args: ShareArgs, options?: CallOptions): Promise<ShareResult>;
+type ListGrantsArgs = {
+    path: {
+        item_id: string;
+    };
+};
+type ListGrantsResult = VaultGrantListResponse;
+/** List Grants */
+/** `GET /vault/items/{item_id}/grants` · aidream · auth user · org required */
+declare function listGrants(api: Api, args: ListGrantsArgs, options?: CallOptions): Promise<ListGrantsResult>;
+type AddGrantArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultGrantAddRequest;
+};
+type AddGrantResult = VaultGrantOut;
+/** Add Grant */
+/** `POST /vault/items/{item_id}/grants` · aidream · auth user · org required */
+declare function addGrant(api: Api, args: AddGrantArgs, options?: CallOptions): Promise<AddGrantResult>;
+type AddOrganizationGrantArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultOrganizationGrantAddRequest;
+};
+type AddOrganizationGrantResult = VaultGrantOut;
+/** Add Organization Grant */
+/** `POST /vault/items/{item_id}/organization-grants` · aidream · auth user · org required */
+declare function addOrganizationGrant(api: Api, args: AddOrganizationGrantArgs, options?: CallOptions): Promise<AddOrganizationGrantResult>;
+type ListMemberAccessArgs = {
+    path: {
+        organization_id: string;
+    };
+};
+type ListMemberAccessResult = VaultMemberAccessListResponse;
+/** List Member Access */
+/** `GET /vault/organizations/{organization_id}/member-access` · aidream · auth user · org required */
+declare function listMemberAccess(api: Api, args: ListMemberAccessArgs, options?: CallOptions): Promise<ListMemberAccessResult>;
+type SetMemberAccessArgs = {
+    path: {
+        organization_id: string;
+        member_user_id: string;
+    };
+    body: VaultMemberAccessSetRequest;
+};
+type SetMemberAccessResult = VaultMemberAccessSetResponse;
+/** Set Member Access */
+/** `PUT /vault/organizations/{organization_id}/members/{member_user_id}/access` · aidream · auth user · org required */
+declare function setMemberAccess(api: Api, args: SetMemberAccessArgs, options?: CallOptions): Promise<SetMemberAccessResult>;
+type UpdateGrantArgs = {
+    path: {
+        item_id: string;
+        grant_id: string;
+    };
+    body: VaultGrantUpdateRequest;
+};
+type UpdateGrantResult = VaultGrantOut;
+/** Update Grant */
+/** `PATCH /vault/items/{item_id}/grants/{grant_id}` · aidream · auth user · org required */
+declare function updateGrant(api: Api, args: UpdateGrantArgs, options?: CallOptions): Promise<UpdateGrantResult>;
+type RemoveGrantArgs = {
+    path: {
+        item_id: string;
+        grant_id: string;
+    };
+};
+type RemoveGrantResult = void;
+/** Remove Grant */
+/** `DELETE /vault/items/{item_id}/grants/{grant_id}` · aidream · auth user · org required */
+declare function removeGrant(api: Api, args: RemoveGrantArgs, options?: CallOptions): Promise<RemoveGrantResult>;
+type SharedWithMeArgs = {
+    [key: string]: never;
+};
+type SharedWithMeResult = VaultItemListResponse;
+/** Shared With Me */
+/** `GET /vault/shared-with-me` · aidream · auth user · org required */
+declare function sharedWithMe(api: Api, args?: SharedWithMeArgs, options?: CallOptions): Promise<SharedWithMeResult>;
+type AssignToRecipientArgs = {
+    body: VaultAssignRequest;
+};
+type AssignToRecipientResult = VaultAssignResponse;
+/** Assign To Recipient */
+/** `POST /vault/items/assign` · aidream · auth user · org required */
+declare function assignToRecipient(api: Api, args: AssignToRecipientArgs, options?: CallOptions): Promise<AssignToRecipientResult>;
+type TransferArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultTransferRequest;
+};
+type TransferResult = VaultItemOut | VaultTransferResponse;
+/** Transfer */
+/** `POST /vault/items/{item_id}/transfer` · aidream · auth user · org required */
+declare function transfer(api: Api, args: TransferArgs, options?: CallOptions): Promise<TransferResult>;
+type CheckDestinationArgs = {
+    body: VaultDestinationCheckRequest;
+};
+type CheckDestinationResult = VaultDestinationCheckResponse;
+/** Check Destination */
+/** `POST /vault/destination/check` · aidream · auth user · org required */
+declare function checkDestination(api: Api, args: CheckDestinationArgs, options?: CallOptions): Promise<CheckDestinationResult>;
+type BrowserLoginMatchesArgs = {
+    body: BrowserLoginMatchesRequest;
+};
+type BrowserLoginMatchesResult = BrowserLoginMatchesResponse;
+/** Browser Login Matches */
+/** `POST /vault/browser-login/matches` · aidream · auth user · org required */
+declare function browserLoginMatches(api: Api, args: BrowserLoginMatchesArgs, options?: CallOptions): Promise<BrowserLoginMatchesResult>;
+type BrowserLoginInventoryArgs = {
+    [key: string]: never;
+};
+type BrowserLoginInventoryResult = BrowserLoginInventoryResponse;
+/** Browser Login Inventory */
+/** `GET /vault/browser-login/inventory` · aidream · auth user · org required */
+declare function browserLoginInventory(api: Api, args?: BrowserLoginInventoryArgs, options?: CallOptions): Promise<BrowserLoginInventoryResult>;
+type BrowserLoginReportArgs = {
+    body: BrowserLoginReportRequest;
+};
+type BrowserLoginReportResult = BrowserLoginReportResponse;
+/** Browser Login Report */
+/** `POST /vault/browser-login/report` · aidream · auth user · org required */
+declare function browserLoginReport(api: Api, args: BrowserLoginReportArgs, options?: CallOptions): Promise<BrowserLoginReportResult>;
+type BrowserLoginMaterializeArgs = {
+    path: {
+        item_id: string;
+    };
+    body: BrowserLoginMaterializeRequest;
+};
+type BrowserLoginMaterializeResult = BrowserLoginLegacyMaterializeResponse | BrowserLoginNamedFieldsMaterializeResponse;
+/** Browser Login Materialize */
+/** `POST /vault/browser-login/{item_id}/materialize` · aidream · auth user · org required */
+declare function browserLoginMaterialize(api: Api, args: BrowserLoginMaterializeArgs, options?: CallOptions): Promise<BrowserLoginMaterializeResult>;
+type BrowserAuthenticatorMaterializeArgs = {
+    path: {
+        item_id: string;
+    };
+    body: BrowserAuthenticatorMaterializeRequest;
+};
+type BrowserAuthenticatorMaterializeResult = BrowserAuthenticatorMaterializeResponse;
+/** Browser Authenticator Materialize */
+/** `POST /vault/browser-login/{item_id}/authenticator-materialize` · aidream · auth user · org required */
+declare function browserAuthenticatorMaterialize(api: Api, args: BrowserAuthenticatorMaterializeArgs, options?: CallOptions): Promise<BrowserAuthenticatorMaterializeResult>;
+type ListFillDevicesArgs = {
+    [key: string]: never;
+};
+type ListFillDevicesResult = VaultFillDeviceListResponse;
+/** List Fill Devices */
+/** `GET /vault/fill-devices` · aidream · auth user · org required */
+declare function listFillDevices(api: Api, args?: ListFillDevicesArgs, options?: CallOptions): Promise<ListFillDevicesResult>;
+type RegisterFillDeviceArgs = {
+    body: VaultFillDeviceRegisterRequest;
+};
+type RegisterFillDeviceResult = VaultFillDeviceOut;
+/** Register Fill Device */
+/** `POST /vault/fill-devices` · aidream · auth user · org required */
+declare function registerFillDevice(api: Api, args: RegisterFillDeviceArgs, options?: CallOptions): Promise<RegisterFillDeviceResult>;
+type FillDeviceStepUpMethodsArgs = {
+    [key: string]: never;
+};
+type FillDeviceStepUpMethodsResult = VaultFillStepUpMethodsResponse;
+/** Fill Device Step Up Methods */
+/** `GET /vault/fill-devices/step-up-methods` · aidream · auth user · org required */
+declare function fillDeviceStepUpMethods(api: Api, args?: FillDeviceStepUpMethodsArgs, options?: CallOptions): Promise<FillDeviceStepUpMethodsResult>;
+type ApproveFillDeviceArgs = {
+    body: VaultFillDeviceApproveRequest;
+};
+type ApproveFillDeviceResult = VaultFillDeviceApproveResponse;
+/** Approve Fill Device */
+/** `POST /vault/fill-devices/approvals` · aidream · auth user · org required */
+declare function approveFillDevice(api: Api, args: ApproveFillDeviceArgs, options?: CallOptions): Promise<ApproveFillDeviceResult>;
+type RevokeFillDeviceArgs = {
+    path: {
+        device_id: string;
+    };
+};
+type RevokeFillDeviceResult = VaultFillDeviceOut;
+/** Revoke Fill Device */
+/** `POST /vault/fill-devices/{device_id}/revoke` · aidream · auth user · org required */
+declare function revokeFillDevice(api: Api, args: RevokeFillDeviceArgs, options?: CallOptions): Promise<RevokeFillDeviceResult>;
+type BrowserLoginResultArgs = {
+    path: {
+        item_id: string;
+    };
+    body: BrowserLoginResultRequest;
+};
+type BrowserLoginResultResult = void;
+/** Browser Login Result */
+/** `POST /vault/browser-login/{item_id}/result` · aidream · auth user · org required */
+declare function browserLoginResult(api: Api, args: BrowserLoginResultArgs, options?: CallOptions): Promise<BrowserLoginResultResult>;
+type BrowserCaptureContextArgs = {
+    body: BrowserCaptureContextRequest;
+};
+type BrowserCaptureContextResult = unknown;
+/** Browser Capture Context */
+/** `POST /vault/browser-login/capture-context` · aidream · auth user · org required */
+declare function browserCaptureContext(api: Api, args: BrowserCaptureContextArgs, options?: CallOptions): Promise<BrowserCaptureContextResult>;
+type BrowserCaptureArgs = {
+    body: BrowserCaptureRequest;
+};
+type BrowserCaptureResult = BrowserCaptureResponse;
+/** Browser Capture */
+/** `POST /vault/browser-login/capture` · aidream · auth user · org required */
+declare function browserCapture(api: Api, args: BrowserCaptureArgs, options?: CallOptions): Promise<BrowserCaptureResult>;
+type BrowserRecipeProposalArgs = {
+    body: BrowserRecipeProposalRequest;
+};
+type BrowserRecipeProposalResult = BrowserRecipeProposalResponse;
+/** Browser Recipe Proposal */
+/** `POST /vault/browser-login/recipe-proposal` · aidream · auth user · org required */
+declare function browserRecipeProposal(api: Api, args: BrowserRecipeProposalArgs, options?: CallOptions): Promise<BrowserRecipeProposalResult>;
+type ForkArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultForkRequest;
+};
+type ForkResult = VaultItemOut;
+/** Fork */
+/** `POST /vault/items/{item_id}/fork` · aidream · auth user · org required */
+declare function fork(api: Api, args: ForkArgs, options?: CallOptions): Promise<ForkResult>;
+type ListAuditArgs = {
+    path: {
+        item_id: string;
+    };
+    query?: {
+        limit?: number;
+    };
+};
+type ListAuditResult = VaultAuditResponse;
+/** List Audit */
+/** `GET /vault/items/{item_id}/audit` · aidream · auth user · org required */
+declare function listAudit(api: Api, args: ListAuditArgs, options?: CallOptions): Promise<ListAuditResult>;
+type ListPasswordHistoryArgs = {
+    path: {
+        item_id: string;
+    };
+    query?: {
+        limit?: number;
+        before_revision?: number | null;
+    };
+};
+type ListPasswordHistoryResult = VaultPasswordHistoryResponse;
+/** List Password History */
+/** `GET /vault/items/{item_id}/password-history` · aidream · auth user · org required */
+declare function listPasswordHistory(api: Api, args: ListPasswordHistoryArgs, options?: CallOptions): Promise<ListPasswordHistoryResult>;
+type RevealPasswordHistoryArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultPasswordHistoryRevealRequest;
+};
+type RevealPasswordHistoryResult = VaultPasswordHistoryRevealResponse;
+/** Reveal Password History */
+/** `POST /vault/items/{item_id}/password-history/reveal` · aidream · auth user · org required */
+declare function revealPasswordHistory(api: Api, args: RevealPasswordHistoryArgs, options?: CallOptions): Promise<RevealPasswordHistoryResult>;
+type RestorePasswordHistoryArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultPasswordHistoryRestoreRequest;
+};
+type RestorePasswordHistoryResult = VaultPasswordHistoryRestoreResponse;
+/** Restore Password History */
+/** `POST /vault/items/{item_id}/password-history/restore` · aidream · auth user · org required */
+declare function restorePasswordHistory(api: Api, args: RestorePasswordHistoryArgs, options?: CallOptions): Promise<RestorePasswordHistoryResult>;
+type PreviewVaultBackupArgs = {
+    body: {
+        item_ids: string[];
+    };
+};
+type PreviewVaultBackupResult = VaultBackupDownloadPreview;
+/** Preview Vault Backup */
+/** `POST /vault/backups/preview` · aidream · auth user · org required */
+declare function previewVaultBackup(api: Api, args: PreviewVaultBackupArgs, options?: CallOptions): Promise<PreviewVaultBackupResult>;
+type DownloadVaultBackupArgs = {
+    body: {
+        item_ids: string[];
+        revision: string;
+        passphrase: string;
+        accept_omissions: boolean;
+    };
+};
+type DownloadVaultBackupResult = unknown;
+/** Download Vault Backup */
+/** `POST /vault/backups/download` · aidream · auth user · org required */
+declare function downloadVaultBackup(api: Api, args: DownloadVaultBackupArgs, options?: CallOptions): Promise<DownloadVaultBackupResult>;
+type PreviewVaultRestoreArgs = {
+    body: {
+        envelope_base64: string;
+        passphrase: string;
+    };
+};
+type PreviewVaultRestoreResult = VaultBackupRestorePreview;
+/** Preview Vault Restore */
+/** `POST /vault/backups/restore/preview` · aidream · auth user · org required */
+declare function previewVaultRestore(api: Api, args: PreviewVaultRestoreArgs, options?: CallOptions): Promise<PreviewVaultRestoreResult>;
+type RestoreVaultBackupArgs = {
+    body: {
+        envelope_base64: string;
+        passphrase: string;
+        expected_digest: string;
+        preview_actor_id: string;
+        preview_organization_id: string;
+        restore_run_id: string;
+        accept_omissions: boolean;
+    };
+};
+type RestoreVaultBackupResult = VaultBackupRestoreResult;
+/** Restore Vault Backup */
+/** `POST /vault/backups/restore` · aidream · auth user · org required */
+declare function restoreVaultBackup(api: Api, args: RestoreVaultBackupArgs, options?: CallOptions): Promise<RestoreVaultBackupResult>;
+type NativePasswordsMatchesArgs = {
+    body: NativeMatchesIn;
+};
+type NativePasswordsMatchesResult = NativeMatchesOut;
+/** Matches */
+/** `POST /vault/native/passwords/matches` · aidream · auth user · org required */
+declare function nativePasswordsMatches(api: Api, args: NativePasswordsMatchesArgs, options?: CallOptions): Promise<NativePasswordsMatchesResult>;
+type NativePasswordsMaterializeArgs = {
+    path: {
+        item_id: string;
+    };
+    body: NativeMaterializeIn;
+};
+type NativePasswordsMaterializeResult = NativeMaterializeOut;
+/** Materialize */
+/** `POST /vault/native/passwords/{item_id}/materialize` · aidream · auth user · org required */
+declare function nativePasswordsMaterialize(api: Api, args: NativePasswordsMaterializeArgs, options?: CallOptions): Promise<NativePasswordsMaterializeResult>;
+type CreateOpArgs = {
+    body: {
+        mutation_id: string;
+        source: string;
+        label: string;
+        principal_type: "user" | "organization";
+        excluded_credential_ids?: string[];
+    };
+};
+type CreateOpResult = NativePasskeyReceiptOut;
+/** Create */
+/** `POST /vault/native/passkeys` · aidream · auth user · org required */
+declare function create(api: Api, args: CreateOpArgs, options?: CallOptions): Promise<CreateOpResult>;
+type ImportPasskeyArgs = {
+    body: {
+        mutation_id: string;
+        source: string;
+        label: string;
+        principal_type: "user" | "organization";
+        format_version: "cxf1.0";
+    };
+};
+type ImportPasskeyResult = NativePasskeyReceiptOut;
+/** Import Passkey */
+/** `POST /vault/native/passkeys/import` · aidream · auth user · org required */
+declare function importPasskey(api: Api, args: ImportPasskeyArgs, options?: CallOptions): Promise<ImportPasskeyResult>;
+type ImportReceiptArgs = {
+    path: {
+        mutation_id: string;
+    };
+};
+type ImportReceiptResult = NativePasskeyReceiptOut;
+/** Import Receipt */
+/** `GET /vault/native/passkeys/import/receipts/{mutation_id}` · aidream · auth user · org required */
+declare function importReceipt(api: Api, args: ImportReceiptArgs, options?: CallOptions): Promise<ImportReceiptResult>;
+type ReceiptArgs = {
+    path: {
+        mutation_id: string;
+    };
+};
+type ReceiptResult = NativePasskeyReceiptOut;
+/** Receipt */
+/** `GET /vault/native/passkeys/receipts/{mutation_id}` · aidream · auth user · org required */
+declare function receipt(api: Api, args: ReceiptArgs, options?: CallOptions): Promise<ReceiptResult>;
+type NativePasskeysMatchesArgs = {
+    body: {
+        rp_id: string;
+        allowed_credential_ids?: string[];
+    };
+};
+type NativePasskeysMatchesResult = NativePasskeyMatchesOut;
+/** Matches */
+/** `POST /vault/native/passkeys/matches` · aidream · auth user · org required */
+declare function nativePasskeysMatches(api: Api, args: NativePasskeysMatchesArgs, options?: CallOptions): Promise<NativePasskeysMatchesResult>;
+type NativePasskeysMaterializeArgs = {
+    path: {
+        item_id: string;
+    };
+    body: {
+        rp_id: string;
+        allowed_credential_ids?: string[];
+    };
+};
+type NativePasskeysMaterializeResult = NativePasskeyMaterializeOut;
+/** Materialize */
+/** `POST /vault/native/passkeys/{item_id}/materialize` · aidream · auth user · org required */
+declare function nativePasskeysMaterialize(api: Api, args: NativePasskeysMaterializeArgs, options?: CallOptions): Promise<NativePasskeysMaterializeResult>;
+type ExportPreflightArgs = {
+    path: {
+        item_id: string;
+    };
+};
+type ExportPreflightResult = NativePasskeyExportPreflightOut;
+/** Export Preflight */
+/** `POST /vault/native/passkeys/{item_id}/export/preflight` · aidream · auth user · org required */
+declare function exportPreflight(api: Api, args: ExportPreflightArgs, options?: CallOptions): Promise<ExportPreflightResult>;
+type ExportMaterializeArgs = {
+    path: {
+        item_id: string;
+    };
+    body: {
+        selection_revision: string;
+    };
+};
+type ExportMaterializeResult = NativePasskeyExportOut;
+/** Export Materialize */
+/** `POST /vault/native/passkeys/{item_id}/export` · aidream · auth user · org required */
+declare function exportMaterialize(api: Api, args: ExportMaterializeArgs, options?: CallOptions): Promise<ExportMaterializeResult>;
+type CapabilitiesArgs = {
+    [key: string]: never;
+};
+type CapabilitiesResult = NativePasskeyCapabilitiesOut;
+/** Capabilities */
+/** `GET /vault/native/passkeys/capabilities` · aidream · auth user · org required */
+declare function capabilities(api: Api, args?: CapabilitiesArgs, options?: CallOptions): Promise<CapabilitiesResult>;
+type ImportCapabilitiesArgs = {
+    [key: string]: never;
+};
+type ImportCapabilitiesResult = NativePasskeyImportCapabilitiesOut;
+/** Import Capabilities */
+/** `GET /vault/native/passkeys/import/capabilities` · aidream · auth user · org required */
+declare function importCapabilities(api: Api, args?: ImportCapabilitiesArgs, options?: CallOptions): Promise<ImportCapabilitiesResult>;
+type EnableNativePasskeyArgs = {
+    path: {
+        item_id: string;
+    };
+    body: VaultNativePasskeyEnableRequest;
+};
+type EnableNativePasskeyResult = VaultNativePasskeyEnableResponse;
+/** Enable Native Passkey */
+/** `POST /vault/items/{item_id}/native-passkey/enable` · aidream · auth user · org required */
+declare function enableNativePasskey(api: Api, args: EnableNativePasskeyArgs, options?: CallOptions): Promise<EnableNativePasskeyResult>;
+type IdentitiesArgs = {
+    [key: string]: never;
+};
+type IdentitiesResult = NativeIdentitiesOut;
+/** Identities */
+/** `POST /vault/native/identities` · aidream · auth user · org required */
+declare function identities(api: Api, args?: IdentitiesArgs, options?: CallOptions): Promise<IdentitiesResult>;
+type CredentialsOauthDefaultsArgs = {
+    [key: string]: never;
+};
+type CredentialsOauthDefaultsResult = OauthDefaultsResponse;
+/** Credentials Oauth Defaults */
+/** `GET /web-credentials/oauth-defaults` · aidream · auth user · org exempt */
+declare function credentialsOauthDefaults(api: Api, args?: CredentialsOauthDefaultsArgs, options?: CallOptions): Promise<CredentialsOauthDefaultsResult>;
+type ListCredentialsEndpointArgs = {
+    [key: string]: never;
+};
+type ListCredentialsEndpointResult = CredentialListResponse;
+/** List Credentials Endpoint */
+/** `GET /web-credentials` · aidream · auth user · org optional */
+declare function listCredentialsEndpoint(api: Api, args?: ListCredentialsEndpointArgs, options?: CallOptions): Promise<ListCredentialsEndpointResult>;
+type CreateCredentialEndpointArgs = {
+    body: CredentialCreateRequest;
+};
+type CreateCredentialEndpointResult = CredentialOut;
+/** Create Credential Endpoint */
+/** `POST /web-credentials` · aidream · auth user · org required */
+declare function createCredentialEndpoint(api: Api, args: CreateCredentialEndpointArgs, options?: CallOptions): Promise<CreateCredentialEndpointResult>;
+type GscOauthStartArgs = {
+    body: GscOauthStartRequest;
+};
+type GscOauthStartResult = OauthStartResponse;
+/** Gsc Oauth Start */
+/** `POST /web-credentials/gsc/oauth/start` · aidream · auth user · org required */
+declare function gscOauthStart(api: Api, args: GscOauthStartArgs, options?: CallOptions): Promise<GscOauthStartResult>;
+type GscOauthCompleteArgs = {
+    query: {
+        code: string;
+        state: string;
+    };
+};
+type GscOauthCompleteResult = CredentialOut;
+/** Gsc Oauth Complete */
+/** `POST /web-credentials/gsc/oauth/complete` · aidream · auth user · org required */
+declare function gscOauthComplete(api: Api, args: GscOauthCompleteArgs, options?: CallOptions): Promise<GscOauthCompleteResult>;
+type UpdateCredentialEndpointArgs = {
+    path: {
+        credential_id: string;
+    };
+    body: CredentialUpdateRequest;
+};
+type UpdateCredentialEndpointResult = CredentialOut;
+/** Update Credential Endpoint */
+/** `PATCH /web-credentials/{credential_id}` · aidream · auth user · org required */
+declare function updateCredentialEndpoint(api: Api, args: UpdateCredentialEndpointArgs, options?: CallOptions): Promise<UpdateCredentialEndpointResult>;
+type DeleteCredentialEndpointArgs = {
+    path: {
+        credential_id: string;
+    };
+};
+type DeleteCredentialEndpointResult = CredentialDeletedResponse;
+/** Delete Credential Endpoint */
+/** `DELETE /web-credentials/{credential_id}` · aidream · auth user · org required */
+declare function deleteCredentialEndpoint(api: Api, args: DeleteCredentialEndpointArgs, options?: CallOptions): Promise<DeleteCredentialEndpointResult>;
+type TestCredentialEndpointArgs = {
+    path: {
+        credential_id: string;
+    };
+    query?: {
+        sample_url?: string | null;
+    };
+};
+type TestCredentialEndpointResult = CredentialVerifyResponse;
+/** Test Credential Endpoint */
+/** `POST /web-credentials/{credential_id}/test` · aidream · auth user · org required */
+declare function testCredentialEndpoint(api: Api, args: TestCredentialEndpointArgs, options?: CallOptions): Promise<TestCredentialEndpointResult>;
+type SetSiteCredentialEndpointArgs = {
+    path: {
+        site_id: string;
+    };
+    body: SiteCredentialRequest;
+};
+type SetSiteCredentialEndpointResult = SiteCredentialResponse;
+/** Set Site Credential Endpoint */
+/** `POST /web-credentials/sites/{site_id}/credential` · aidream · auth user · org required */
+declare function setSiteCredentialEndpoint(api: Api, args: SetSiteCredentialEndpointArgs, options?: CallOptions): Promise<SetSiteCredentialEndpointResult>;
+type GetMyPreferencesArgs = {
+    [key: string]: never;
+};
+type GetMyPreferencesResult = UserAnalysisPreferencesResponse;
+/** Get My Preferences */
+/** `GET /me/analysis-preferences` · aidream · auth guest · org optional */
+declare function getMyPreferences(api: Api, args?: GetMyPreferencesArgs, options?: CallOptions): Promise<GetMyPreferencesResult>;
+type PutMyPreferencesArgs = {
+    body: UserAnalysisPreferences;
+};
+type PutMyPreferencesResult = PreferencesWriteResponse;
+/** Put My Preferences */
+/** `PUT /me/analysis-preferences` · aidream · auth guest · org required */
+declare function putMyPreferences(api: Api, args: PutMyPreferencesArgs, options?: CallOptions): Promise<PutMyPreferencesResult>;
+type ReadActiveOrganizationArgs = {
+    [key: string]: never;
+};
+type ReadActiveOrganizationResult = ActiveOrganization;
+/** Read Active Organization */
+/** `GET /organization/active` · matrx-local · auth loopback_token · org exempt */
+declare function readActiveOrganization(api: Api, args?: ReadActiveOrganizationArgs, options?: CallOptions): Promise<ReadActiveOrganizationResult>;
+type WriteActiveOrganizationArgs = {
+    body: SetActiveOrganization;
+};
+type WriteActiveOrganizationResult = ActiveOrganization;
+/** Write Active Organization */
+/** `PUT /organization/active` · matrx-local · auth loopback_token · org exempt */
+declare function writeActiveOrganization(api: Api, args: WriteActiveOrganizationArgs, options?: CallOptions): Promise<WriteActiveOrganizationResult>;
+type ForgetActiveOrganizationArgs = {
+    [key: string]: never;
+};
+type ForgetActiveOrganizationResult = ActiveOrganization;
+/** Forget Active Organization */
+/** `DELETE /organization/active` · matrx-local · auth loopback_token · org exempt */
+declare function forgetActiveOrganization(api: Api, args?: ForgetActiveOrganizationArgs, options?: CallOptions): Promise<ForgetActiveOrganizationResult>;
+/** Every JSON operation of this domain by `METHOD path` — for path-keyed calls. */
+interface Operations {
+    "POST /action-requests/open": {
+        args: OpenActionRequestArgs;
+        result: OpenActionRequestResult;
+    };
+    "POST /action-requests/complete": {
+        args: CompleteActionRequestArgs;
+        result: CompleteActionRequestResult;
+    };
+    "POST /action-requests/remint": {
+        args: RemintActionRequestArgs;
+        result: RemintActionRequestResult;
+    };
+    "GET /action-requests/pending": {
+        args: PendingActionRequestsArgs;
+        result: PendingActionRequestsResult;
+    };
+    "POST /action-requests/{request_id}/complete": {
+        args: CompleteActionRequestNativeArgs;
+        result: CompleteActionRequestNativeResult;
+    };
+    "POST /secure-delivery/open": {
+        args: OpenSecureDeliveryArgs;
+        result: OpenSecureDeliveryResult;
+    };
+    "POST /secure-delivery/code": {
+        args: SendSecureDeliveryCodeArgs;
+        result: SendSecureDeliveryCodeResult;
+    };
+    "POST /secure-delivery/view": {
+        args: ViewSecureDeliveryArgs;
+        result: ViewSecureDeliveryResult;
+    };
+    "GET /secure-delivery/options": {
+        args: SecureDeliveryOptionsArgs;
+        result: SecureDeliveryOptionsResult;
+    };
+    "POST /secure-delivery": {
+        args: CreateSecureDeliveryArgs;
+        result: CreateSecureDeliveryResult;
+    };
+    "POST /secure-delivery/{delivery_id}/revoke": {
+        args: RevokeSecureDeliveryArgs;
+        result: RevokeSecureDeliveryResult;
+    };
+    "GET /user-secrets": {
+        args: UserSecretsListSecretsArgs;
+        result: UserSecretsListSecretsResult;
+    };
+    "POST /user-secrets/": {
+        args: UserSecretsCreateSecretArgs;
+        result: UserSecretsCreateSecretResult;
+    };
+    "PATCH /user-secrets/{key}": {
+        args: UserSecretsUpdateSecretArgs;
+        result: UserSecretsUpdateSecretResult;
+    };
+    "DELETE /user-secrets/{key}": {
+        args: UserSecretsDeleteSecretArgs;
+        result: UserSecretsDeleteSecretResult;
+    };
+    "GET /user-secrets/sandbox-env": {
+        args: GetSandboxEnvArgs;
+        result: GetSandboxEnvResult;
+    };
+    "POST /user-secrets/bulk-env": {
+        args: BulkImportEnvArgs;
+        result: BulkImportEnvResult;
+    };
+    "GET /user-secrets/internal/sandbox-env-for-user": {
+        args: GetSandboxEnvForUserArgs;
+        result: GetSandboxEnvForUserResult;
+    };
+    "GET /organization-secrets/{organization_id}": {
+        args: OrganizationSecretsListSecretsArgs;
+        result: OrganizationSecretsListSecretsResult;
+    };
+    "POST /organization-secrets/{organization_id}": {
+        args: OrganizationSecretsCreateSecretArgs;
+        result: OrganizationSecretsCreateSecretResult;
+    };
+    "POST /organization-secrets/{organization_id}/contribute": {
+        args: ContributeSecretArgs;
+        result: ContributeSecretResult;
+    };
+    "PATCH /organization-secrets/{organization_id}/{secret_id}": {
+        args: OrganizationSecretsUpdateSecretArgs;
+        result: OrganizationSecretsUpdateSecretResult;
+    };
+    "DELETE /organization-secrets/{organization_id}/{secret_id}": {
+        args: OrganizationSecretsDeleteSecretArgs;
+        result: OrganizationSecretsDeleteSecretResult;
+    };
+    "POST /organization-secrets/{organization_id}/{secret_id}/sync": {
+        args: SyncSecretArgs;
+        result: SyncSecretResult;
+    };
+    "PUT /organization-secrets/{organization_id}/{secret_id}/permissions": {
+        args: ReplacePermissionsArgs;
+        result: ReplacePermissionsResult;
+    };
+    "POST /vault/exports/login-csv/preview": {
+        args: PreviewLoginCsvArgs;
+        result: PreviewLoginCsvResult;
+    };
+    "POST /vault/exports/login-csv": {
+        args: DownloadLoginCsvArgs;
+        result: DownloadLoginCsvResult;
+    };
+    "GET /vault/items": {
+        args: ListItemsArgs;
+        result: ListItemsResult;
+    };
+    "POST /vault/items": {
+        args: CreateItemArgs;
+        result: CreateItemResult;
+    };
+    "POST /vault/items/import-env": {
+        args: ImportEnvArgs;
+        result: ImportEnvResult;
+    };
+    "GET /vault/items/{item_id}": {
+        args: GetItemArgs;
+        result: GetItemResult;
+    };
+    "PATCH /vault/items/{item_id}": {
+        args: UpdateItemArgs;
+        result: UpdateItemResult;
+    };
+    "DELETE /vault/items/{item_id}": {
+        args: DeleteItemArgs;
+        result: DeleteItemResult;
+    };
+    "POST /vault/items/{item_id}/restore": {
+        args: RestoreItemArgs;
+        result: RestoreItemResult;
+    };
+    "POST /vault/items/{item_id}/fields": {
+        args: AddFieldArgs;
+        result: AddFieldResult;
+    };
+    "PATCH /vault/items/{item_id}/fields/{field_id}": {
+        args: UpdateFieldMetadataArgs;
+        result: UpdateFieldMetadataResult;
+    };
+    "DELETE /vault/items/{item_id}/fields/{field_id}": {
+        args: DeleteFieldArgs;
+        result: DeleteFieldResult;
+    };
+    "PUT /vault/items/{item_id}/fields/{field_id}/value": {
+        args: UpdateFieldValueArgs;
+        result: UpdateFieldValueResult;
+    };
+    "POST /vault/items/{item_id}/attachments": {
+        args: AddAttachmentArgs;
+        result: AddAttachmentResult;
+    };
+    "PATCH /vault/items/{item_id}/attachments/{attachment_id}": {
+        args: UpdateAttachmentArgs;
+        result: UpdateAttachmentResult;
+    };
+    "DELETE /vault/items/{item_id}/attachments/{attachment_id}": {
+        args: DeleteAttachmentArgs;
+        result: DeleteAttachmentResult;
+    };
+    "PUT /vault/items/{item_id}/attachments/{attachment_id}/file": {
+        args: ReplaceAttachmentArgs;
+        result: ReplaceAttachmentResult;
+    };
+    "GET /vault/items/{item_id}/attachments/{attachment_id}/download": {
+        args: DownloadAttachmentArgs;
+        result: DownloadAttachmentResult;
+    };
+    "POST /vault/items/{item_id}/reveal": {
+        args: RevealArgs;
+        result: RevealResult;
+    };
+    "POST /vault/items/{item_id}/rotate": {
+        args: RotateArgs;
+        result: RotateResult;
+    };
+    "POST /vault/resolve": {
+        args: ResolveOpArgs;
+        result: ResolveOpResult;
+    };
+    "GET /vault/effective-env": {
+        args: EffectiveEnvArgs;
+        result: EffectiveEnvResult;
+    };
+    "PUT /vault/items/{item_id}/share": {
+        args: ShareArgs;
+        result: ShareResult;
+    };
+    "GET /vault/items/{item_id}/grants": {
+        args: ListGrantsArgs;
+        result: ListGrantsResult;
+    };
+    "POST /vault/items/{item_id}/grants": {
+        args: AddGrantArgs;
+        result: AddGrantResult;
+    };
+    "POST /vault/items/{item_id}/organization-grants": {
+        args: AddOrganizationGrantArgs;
+        result: AddOrganizationGrantResult;
+    };
+    "GET /vault/organizations/{organization_id}/member-access": {
+        args: ListMemberAccessArgs;
+        result: ListMemberAccessResult;
+    };
+    "PUT /vault/organizations/{organization_id}/members/{member_user_id}/access": {
+        args: SetMemberAccessArgs;
+        result: SetMemberAccessResult;
+    };
+    "PATCH /vault/items/{item_id}/grants/{grant_id}": {
+        args: UpdateGrantArgs;
+        result: UpdateGrantResult;
+    };
+    "DELETE /vault/items/{item_id}/grants/{grant_id}": {
+        args: RemoveGrantArgs;
+        result: RemoveGrantResult;
+    };
+    "GET /vault/shared-with-me": {
+        args: SharedWithMeArgs;
+        result: SharedWithMeResult;
+    };
+    "POST /vault/items/assign": {
+        args: AssignToRecipientArgs;
+        result: AssignToRecipientResult;
+    };
+    "POST /vault/items/{item_id}/transfer": {
+        args: TransferArgs;
+        result: TransferResult;
+    };
+    "POST /vault/destination/check": {
+        args: CheckDestinationArgs;
+        result: CheckDestinationResult;
+    };
+    "POST /vault/browser-login/matches": {
+        args: BrowserLoginMatchesArgs;
+        result: BrowserLoginMatchesResult;
+    };
+    "GET /vault/browser-login/inventory": {
+        args: BrowserLoginInventoryArgs;
+        result: BrowserLoginInventoryResult;
+    };
+    "POST /vault/browser-login/report": {
+        args: BrowserLoginReportArgs;
+        result: BrowserLoginReportResult;
+    };
+    "POST /vault/browser-login/{item_id}/materialize": {
+        args: BrowserLoginMaterializeArgs;
+        result: BrowserLoginMaterializeResult;
+    };
+    "POST /vault/browser-login/{item_id}/authenticator-materialize": {
+        args: BrowserAuthenticatorMaterializeArgs;
+        result: BrowserAuthenticatorMaterializeResult;
+    };
+    "GET /vault/fill-devices": {
+        args: ListFillDevicesArgs;
+        result: ListFillDevicesResult;
+    };
+    "POST /vault/fill-devices": {
+        args: RegisterFillDeviceArgs;
+        result: RegisterFillDeviceResult;
+    };
+    "GET /vault/fill-devices/step-up-methods": {
+        args: FillDeviceStepUpMethodsArgs;
+        result: FillDeviceStepUpMethodsResult;
+    };
+    "POST /vault/fill-devices/approvals": {
+        args: ApproveFillDeviceArgs;
+        result: ApproveFillDeviceResult;
+    };
+    "POST /vault/fill-devices/{device_id}/revoke": {
+        args: RevokeFillDeviceArgs;
+        result: RevokeFillDeviceResult;
+    };
+    "POST /vault/browser-login/{item_id}/result": {
+        args: BrowserLoginResultArgs;
+        result: BrowserLoginResultResult;
+    };
+    "POST /vault/browser-login/capture-context": {
+        args: BrowserCaptureContextArgs;
+        result: BrowserCaptureContextResult;
+    };
+    "POST /vault/browser-login/capture": {
+        args: BrowserCaptureArgs;
+        result: BrowserCaptureResult;
+    };
+    "POST /vault/browser-login/recipe-proposal": {
+        args: BrowserRecipeProposalArgs;
+        result: BrowserRecipeProposalResult;
+    };
+    "POST /vault/items/{item_id}/fork": {
+        args: ForkArgs;
+        result: ForkResult;
+    };
+    "GET /vault/items/{item_id}/audit": {
+        args: ListAuditArgs;
+        result: ListAuditResult;
+    };
+    "GET /vault/items/{item_id}/password-history": {
+        args: ListPasswordHistoryArgs;
+        result: ListPasswordHistoryResult;
+    };
+    "POST /vault/items/{item_id}/password-history/reveal": {
+        args: RevealPasswordHistoryArgs;
+        result: RevealPasswordHistoryResult;
+    };
+    "POST /vault/items/{item_id}/password-history/restore": {
+        args: RestorePasswordHistoryArgs;
+        result: RestorePasswordHistoryResult;
+    };
+    "POST /vault/backups/preview": {
+        args: PreviewVaultBackupArgs;
+        result: PreviewVaultBackupResult;
+    };
+    "POST /vault/backups/download": {
+        args: DownloadVaultBackupArgs;
+        result: DownloadVaultBackupResult;
+    };
+    "POST /vault/backups/restore/preview": {
+        args: PreviewVaultRestoreArgs;
+        result: PreviewVaultRestoreResult;
+    };
+    "POST /vault/backups/restore": {
+        args: RestoreVaultBackupArgs;
+        result: RestoreVaultBackupResult;
+    };
+    "POST /vault/native/passwords/matches": {
+        args: NativePasswordsMatchesArgs;
+        result: NativePasswordsMatchesResult;
+    };
+    "POST /vault/native/passwords/{item_id}/materialize": {
+        args: NativePasswordsMaterializeArgs;
+        result: NativePasswordsMaterializeResult;
+    };
+    "POST /vault/native/passkeys": {
+        args: CreateOpArgs;
+        result: CreateOpResult;
+    };
+    "POST /vault/native/passkeys/import": {
+        args: ImportPasskeyArgs;
+        result: ImportPasskeyResult;
+    };
+    "GET /vault/native/passkeys/import/receipts/{mutation_id}": {
+        args: ImportReceiptArgs;
+        result: ImportReceiptResult;
+    };
+    "GET /vault/native/passkeys/receipts/{mutation_id}": {
+        args: ReceiptArgs;
+        result: ReceiptResult;
+    };
+    "POST /vault/native/passkeys/matches": {
+        args: NativePasskeysMatchesArgs;
+        result: NativePasskeysMatchesResult;
+    };
+    "POST /vault/native/passkeys/{item_id}/materialize": {
+        args: NativePasskeysMaterializeArgs;
+        result: NativePasskeysMaterializeResult;
+    };
+    "POST /vault/native/passkeys/{item_id}/export/preflight": {
+        args: ExportPreflightArgs;
+        result: ExportPreflightResult;
+    };
+    "POST /vault/native/passkeys/{item_id}/export": {
+        args: ExportMaterializeArgs;
+        result: ExportMaterializeResult;
+    };
+    "GET /vault/native/passkeys/capabilities": {
+        args: CapabilitiesArgs;
+        result: CapabilitiesResult;
+    };
+    "GET /vault/native/passkeys/import/capabilities": {
+        args: ImportCapabilitiesArgs;
+        result: ImportCapabilitiesResult;
+    };
+    "POST /vault/items/{item_id}/native-passkey/enable": {
+        args: EnableNativePasskeyArgs;
+        result: EnableNativePasskeyResult;
+    };
+    "POST /vault/native/identities": {
+        args: IdentitiesArgs;
+        result: IdentitiesResult;
+    };
+    "GET /web-credentials/oauth-defaults": {
+        args: CredentialsOauthDefaultsArgs;
+        result: CredentialsOauthDefaultsResult;
+    };
+    "GET /web-credentials": {
+        args: ListCredentialsEndpointArgs;
+        result: ListCredentialsEndpointResult;
+    };
+    "POST /web-credentials": {
+        args: CreateCredentialEndpointArgs;
+        result: CreateCredentialEndpointResult;
+    };
+    "POST /web-credentials/gsc/oauth/start": {
+        args: GscOauthStartArgs;
+        result: GscOauthStartResult;
+    };
+    "POST /web-credentials/gsc/oauth/complete": {
+        args: GscOauthCompleteArgs;
+        result: GscOauthCompleteResult;
+    };
+    "PATCH /web-credentials/{credential_id}": {
+        args: UpdateCredentialEndpointArgs;
+        result: UpdateCredentialEndpointResult;
+    };
+    "DELETE /web-credentials/{credential_id}": {
+        args: DeleteCredentialEndpointArgs;
+        result: DeleteCredentialEndpointResult;
+    };
+    "POST /web-credentials/{credential_id}/test": {
+        args: TestCredentialEndpointArgs;
+        result: TestCredentialEndpointResult;
+    };
+    "POST /web-credentials/sites/{site_id}/credential": {
+        args: SetSiteCredentialEndpointArgs;
+        result: SetSiteCredentialEndpointResult;
+    };
+    "GET /me/analysis-preferences": {
+        args: GetMyPreferencesArgs;
+        result: GetMyPreferencesResult;
+    };
+    "PUT /me/analysis-preferences": {
+        args: PutMyPreferencesArgs;
+        result: PutMyPreferencesResult;
+    };
+    "GET /organization/active": {
+        args: ReadActiveOrganizationArgs;
+        result: ReadActiveOrganizationResult;
+    };
+    "PUT /organization/active": {
+        args: WriteActiveOrganizationArgs;
+        result: WriteActiveOrganizationResult;
+    };
+    "DELETE /organization/active": {
+        args: ForgetActiveOrganizationArgs;
+        result: ForgetActiveOrganizationResult;
+    };
+}
+/** Path-keyed call, scoped to this domain only (never a global path map). */
+declare function call<K extends keyof Operations>(api: Api, key: K, args?: Operations[K]["args"], options?: CallOptions): Promise<Operations[K]["result"]>;
+
+export { type ActionRequestStatusResponse, type ActiveOrganization, type AddAttachmentArgs, type AddAttachmentResult, type AddFieldArgs, type AddFieldResult, type AddGrantArgs, type AddGrantResult, type AddOrganizationGrantArgs, type AddOrganizationGrantResult, type ApproveFillDeviceArgs, type ApproveFillDeviceResult, type AssignToRecipientArgs, type AssignToRecipientResult, type BrowserAuthenticatorMaterializeArgs, type BrowserAuthenticatorMaterializeRequest, type BrowserAuthenticatorMaterializeResponse, type BrowserAuthenticatorMaterializeResult, type BrowserCaptureArgs, type BrowserCaptureContextArgs, type BrowserCaptureContextRequest, type BrowserCaptureContextResult, type BrowserCaptureFieldSpecIn, type BrowserCaptureRequest, type BrowserCaptureResponse, type BrowserCaptureResult, type BrowserLoginAvailableField, type BrowserLoginInventoryArgs, type BrowserLoginInventoryItem, type BrowserLoginInventoryResponse, type BrowserLoginInventoryResult, type BrowserLoginLegacyMaterializeResponse, type BrowserLoginMatch, type BrowserLoginMatchesArgs, type BrowserLoginMatchesRequest, type BrowserLoginMatchesResponse, type BrowserLoginMatchesResult, type BrowserLoginMaterializeArgs, type BrowserLoginMaterializeRequest, type BrowserLoginMaterializeResult, type BrowserLoginNamedFieldsMaterializeResponse, type BrowserLoginReportArgs, type BrowserLoginReportRequest, type BrowserLoginReportResponse, type BrowserLoginReportResult, type BrowserLoginResultArgs, type BrowserLoginResultRequest, type BrowserLoginResultResult, type BrowserRecipeFieldMapIn, type BrowserRecipeProposalArgs, type BrowserRecipeProposalRequest, type BrowserRecipeProposalResponse, type BrowserRecipeProposalResult, type BrowserRecipeSignalIn, type BulkImportEnvArgs, type BulkImportEnvResult, type CapabilitiesArgs, type CapabilitiesResult, type CheckDestinationArgs, type CheckDestinationResult, type CompleteActionRequestArgs, type CompleteActionRequestNativeArgs, type CompleteActionRequestNativeResult, type CompleteActionRequestResult, type CompleteBody, type ContributeSecretArgs, type ContributeSecretResult, type CreateBody, type CreateCredentialEndpointArgs, type CreateCredentialEndpointResult, type CreateItemArgs, type CreateItemResult, type CreateOpArgs, type CreateOpResult, type CreateResponse, type CreateSecureDeliveryArgs, type CreateSecureDeliveryResult, type CredentialCreateRequest, type CredentialDeletedResponse, type CredentialListResponse, type CredentialMetadata, type CredentialOut, type CredentialUpdateRequest, type CredentialVerifyDetails, type CredentialVerifyResponse, type CredentialsOauthDefaultsArgs, type CredentialsOauthDefaultsResult, type DeleteAttachmentArgs, type DeleteAttachmentResult, type DeleteCredentialEndpointArgs, type DeleteCredentialEndpointResult, type DeleteFieldArgs, type DeleteFieldResult, type DeleteItemArgs, type DeleteItemResult, type DeliveredField, type DownloadAttachmentArgs, type DownloadAttachmentResult, type DownloadLoginCsvArgs, type DownloadLoginCsvResult, type DownloadVaultBackupArgs, type DownloadVaultBackupResult, type EffectiveEnvArgs, type EffectiveEnvResult, type EnableNativePasskeyArgs, type EnableNativePasskeyResult, type ExportMaterializeArgs, type ExportMaterializeResult, type ExportPreflightArgs, type ExportPreflightResult, type FieldIn, type FillDeviceStepUpMethodsArgs, type FillDeviceStepUpMethodsResult, type ForgetActiveOrganizationArgs, type ForgetActiveOrganizationResult, type ForkArgs, type ForkResult, type GetItemArgs, type GetItemResult, type GetMyPreferencesArgs, type GetMyPreferencesResult, type GetSandboxEnvArgs, type GetSandboxEnvForUserArgs, type GetSandboxEnvForUserResult, type GetSandboxEnvResult, type GranteeIn, type GscOauthCompleteArgs, type GscOauthCompleteResult, type GscOauthStartArgs, type GscOauthStartRequest, type GscOauthStartResult, type IdentitiesArgs, type IdentitiesResult, type ImportCapabilitiesArgs, type ImportCapabilitiesResult, type ImportEnvArgs, type ImportEnvResult, type ImportPasskeyArgs, type ImportPasskeyResult, type ImportReceiptArgs, type ImportReceiptResult, type ListAuditArgs, type ListAuditResult, type ListCredentialsEndpointArgs, type ListCredentialsEndpointResult, type ListFillDevicesArgs, type ListFillDevicesResult, type ListGrantsArgs, type ListGrantsResult, type ListItemsArgs, type ListItemsResult, type ListMemberAccessArgs, type ListMemberAccessResult, type ListPasswordHistoryArgs, type ListPasswordHistoryResult, type NativeCompleteBody, type NativeIdentitiesOut, type NativeMatchOut, type NativeMatchesIn, type NativeMatchesOut, type NativeMaterializeIn, type NativeMaterializeOut, type NativePasskeyCapabilitiesOut, type NativePasskeyExportOut, type NativePasskeyExportPreflightOut, type NativePasskeyIdentityOut, type NativePasskeyImportCapabilitiesOut, type NativePasskeyMatchOut, type NativePasskeyMatchesOut, type NativePasskeyMaterializeOut, type NativePasskeyReceiptOut, type NativePasskeysMatchesArgs, type NativePasskeysMatchesResult, type NativePasskeysMaterializeArgs, type NativePasskeysMaterializeResult, type NativePasswordIdentityOut, type NativePasswordsMatchesArgs, type NativePasswordsMatchesResult, type NativePasswordsMaterializeArgs, type NativePasswordsMaterializeResult, type NativeServiceIdentifierIn, type NativeUrlService, type NonSecretFieldIn, type OauthDefaultsResponse, type OauthStartResponse, type OpenActionRequestArgs, type OpenActionRequestResult, type OpenSecureDeliveryArgs, type OpenSecureDeliveryResult, type Operations, type OptionsResponse, type OrganizationSecretContributeRequest, type OrganizationSecretCreateRequest, type OrganizationSecretListResponse, type OrganizationSecretPermissionsRequest, type OrganizationSecretSummary, type OrganizationSecretUpdateRequest, type OrganizationSecretsCreateSecretArgs, type OrganizationSecretsCreateSecretResult, type OrganizationSecretsDeleteSecretArgs, type OrganizationSecretsDeleteSecretResult, type OrganizationSecretsListSecretsArgs, type OrganizationSecretsListSecretsResult, type OrganizationSecretsUpdateSecretArgs, type OrganizationSecretsUpdateSecretResult, type PendingActionRequest, type PendingActionRequestsArgs, type PendingActionRequestsResponse, type PendingActionRequestsResult, type PreferencesWriteResponse, type PreviewLoginCsvArgs, type PreviewLoginCsvResult, type PreviewVaultBackupArgs, type PreviewVaultBackupResult, type PreviewVaultRestoreArgs, type PreviewVaultRestoreResult, type PrincipalIn, type ProtectedFieldOption, type PutMyPreferencesArgs, type PutMyPreferencesResult, type ReadActiveOrganizationArgs, type ReadActiveOrganizationResult, type ReceiptArgs, type ReceiptResult, type RecipientPage, type RegisterFillDeviceArgs, type RegisterFillDeviceResult, type RemintActionRequestArgs, type RemintActionRequestResult, type RemoveGrantArgs, type RemoveGrantResult, type ReplaceAttachmentArgs, type ReplaceAttachmentResult, type ReplacePermissionsArgs, type ReplacePermissionsResult, type ResolveOpArgs, type ResolveOpResult, type RestoreItemArgs, type RestoreItemResult, type RestorePasswordHistoryArgs, type RestorePasswordHistoryResult, type RestoreVaultBackupArgs, type RestoreVaultBackupResult, type RevealArgs, type RevealPasswordHistoryArgs, type RevealPasswordHistoryResult, type RevealResult, type RevokeFillDeviceArgs, type RevokeFillDeviceResult, type RevokeResponse, type RevokeSecureDeliveryArgs, type RevokeSecureDeliveryResult, type RotateArgs, type RotateResult, type SandboxEnvResponse, type SecretBody, type SecureDeliveryOptionsArgs, type SecureDeliveryOptionsResult, type SendSecureDeliveryCodeArgs, type SendSecureDeliveryCodeResult, type SetActiveOrganization, type SetMemberAccessArgs, type SetMemberAccessResult, type SetSiteCredentialEndpointArgs, type SetSiteCredentialEndpointResult, type ShareArgs, type ShareResult, type SharedWithMeArgs, type SharedWithMeResult, type SiteCredentialRequest, type SiteCredentialResponse, type SyncSecretArgs, type SyncSecretResult, type TestCredentialEndpointArgs, type TestCredentialEndpointResult, type TokenBody, type TransferArgs, type TransferResult, type UpdateAttachmentArgs, type UpdateAttachmentResult, type UpdateCredentialEndpointArgs, type UpdateCredentialEndpointResult, type UpdateFieldMetadataArgs, type UpdateFieldMetadataResult, type UpdateFieldValueArgs, type UpdateFieldValueResult, type UpdateGrantArgs, type UpdateGrantResult, type UpdateItemArgs, type UpdateItemResult, type UserAnalysisPreferences, type UserSecretBulkEnvRequest, type UserSecretBulkEnvResponse, type UserSecretCreateRequest, type UserSecretListResponse, type UserSecretSummary, type UserSecretUpdateRequest, type UserSecretsCreateSecretArgs, type UserSecretsCreateSecretResult, type UserSecretsDeleteSecretArgs, type UserSecretsDeleteSecretResult, type UserSecretsListSecretsArgs, type UserSecretsListSecretsResult, type UserSecretsUpdateSecretArgs, type UserSecretsUpdateSecretResult, type VaultAssignRequest, type VaultAssignResponse, type VaultAttachmentOut, type VaultAttachmentUpdateRequest, type VaultAuditEntry, type VaultAuditResponse, type VaultBackupDownloadPreview, type VaultBackupOmission, type VaultBackupRecordSummary, type VaultBackupRestorePreview, type VaultBackupRestoreRecordResult, type VaultBackupRestoreResult, type VaultCapabilities, type VaultDestinationCheckRequest, type VaultDestinationCheckResponse, type VaultEffectiveEnvResponse, type VaultFieldMetadataRequest, type VaultFieldOut, type VaultFieldValueRequest, type VaultFillDeviceApproveRequest, type VaultFillDeviceApproveResponse, type VaultFillDeviceListResponse, type VaultFillDeviceOut, type VaultFillDeviceRegisterRequest, type VaultFillStepUpMethodsResponse, type VaultForkRequest, type VaultGrantAddRequest, type VaultGrantListResponse, type VaultGrantOut, type VaultGrantUpdateRequest, type VaultImportEnvRequest, type VaultItemCreateRequest, type VaultItemListResponse, type VaultItemOut, type VaultItemUpdateRequest, type VaultLoginCsvDownloadRequest, type VaultLoginCsvPreviewItem, type VaultLoginCsvPreviewRequest, type VaultLoginCsvPreviewResponse, type VaultMemberAccessListResponse, type VaultMemberAccessOut, type VaultMemberAccessSetRequest, type VaultMemberAccessSetResponse, type VaultNativePasskeyEnableRequest, type VaultNativePasskeyEnableResponse, type VaultOrganizationGrantAddRequest, type VaultPasswordHistoryEntry, type VaultPasswordHistoryResponse, type VaultPasswordHistoryRestoreRequest, type VaultPasswordHistoryRestoreResponse, type VaultPasswordHistoryRevealRequest, type VaultPasswordHistoryRevealResponse, type VaultResolveRef, type VaultResolveRequest, type VaultResolveResponse, type VaultRestoreRequest, type VaultRestoreResponse, type VaultRevealRequest, type VaultRevealResponse, type VaultRotateRequest, type VaultShareRequest, type VaultTransferRequest, type VaultTransferResponse, type ViewBody, type ViewSecureDeliveryArgs, type ViewSecureDeliveryResult, type WriteActiveOrganizationArgs, type WriteActiveOrganizationResult, addAttachment, addField, addGrant, addOrganizationGrant, approveFillDevice, assignToRecipient, browserAuthenticatorMaterialize, browserCapture, browserCaptureContext, browserLoginInventory, browserLoginMatches, browserLoginMaterialize, browserLoginReport, browserLoginResult, browserRecipeProposal, bulkImportEnv, call, capabilities, checkDestination, completeActionRequest, completeActionRequestNative, contributeSecret, create, createCredentialEndpoint, createItem, createSecureDelivery, credentialsOauthDefaults, deleteAttachment, deleteCredentialEndpoint, deleteField, deleteItem, downloadAttachment, downloadLoginCsv, downloadVaultBackup, effectiveEnv, enableNativePasskey, exportMaterialize, exportPreflight, fillDeviceStepUpMethods, forgetActiveOrganization, fork, getItem, getMyPreferences, getSandboxEnv, getSandboxEnvForUser, gscOauthComplete, gscOauthStart, identities, importCapabilities, importEnv, importPasskey, importReceipt, listAudit, listCredentialsEndpoint, listFillDevices, listGrants, listItems, listMemberAccess, listPasswordHistory, nativePasskeysMatches, nativePasskeysMaterialize, nativePasswordsMatches, nativePasswordsMaterialize, openActionRequest, openSecureDelivery, organizationSecretsCreateSecret, organizationSecretsDeleteSecret, organizationSecretsListSecrets, organizationSecretsUpdateSecret, pendingActionRequests, previewLoginCsv, previewVaultBackup, previewVaultRestore, putMyPreferences, readActiveOrganization, receipt, registerFillDevice, remintActionRequest, removeGrant, replaceAttachment, replacePermissions, resolve, restoreItem, restorePasswordHistory, restoreVaultBackup, reveal, revealPasswordHistory, revokeFillDevice, revokeSecureDelivery, rotate, secureDeliveryOptions, sendSecureDeliveryCode, setMemberAccess, setSiteCredentialEndpoint, share, sharedWithMe, syncSecret, testCredentialEndpoint, transfer, updateAttachment, updateCredentialEndpoint, updateFieldMetadata, updateFieldValue, updateGrant, updateItem, userSecretsCreateSecret, userSecretsDeleteSecret, userSecretsListSecrets, userSecretsUpdateSecret, viewSecureDelivery, writeActiveOrganization };