@deepraxis/cli 0.1.0-dev.c01abef → 0.1.0-dev.c45414d

package/dist/praxis.js

@@ -137,25 +137,11 @@ var operations = [
 across all toolsets allowed.`
         },
         {
-          name: "databases",
-          type: "array",
-          itemType: "object",
-          required: false,
-          description: "Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings."
-        },
-        {
-          name: "vector_stores",
-          type: "array",
-          itemType: "object",
-          required: false,
-          description: "Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings."
-        },
-        {
-          name: "files",
+          name: "bindings",
           type: "array",
           itemType: "object",
           required: false,
-          description: "File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings."
+          description: "Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file_..., read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. A resource that is not bound returns 404, a service that is not opened returns 403, and writes to read_only resources are refused. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings."
         },
         {
           name: "kind",
@@ -205,6 +191,12 @@ across all toolsets allowed.`
           required: false,
           description: "Praxis extension: switchable model ids on /agent/v1 only. The default model must be included. When omitted, only the default model is selectable."
         },
+        {
+          name: "avatar",
+          type: "string",
+          required: false,
+          description: "Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. Both personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it."
+        },
         {
           name: "preset",
           type: "string",
@@ -247,7 +239,7 @@ across all toolsets allowed.`
     resource: "agent.agents",
     method: "update",
     summary: "Update agent",
-    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version; existing sessions keep the version they were created with. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; use the native skill tool for available runtime skills.",
+    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version. apply defaults to true and moves active_version to the new version, or to the latest when configuration is unchanged; apply false saves without applying. version_note optionally records up to 280 characters on a newly created version. Existing sessions and tokens keep their version. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; use the native skill tool for available runtime skills.",
     http: "POST",
     path: "/agent/v1/agents/{agent_id}",
     streaming: "no",
@@ -334,25 +326,23 @@ specified. When supplied, the request fails if it does not match the server's
 current version; omit to apply the update unconditionally.`
         },
         {
-          name: "databases",
-          type: "array",
-          itemType: "object",
+          name: "apply",
+          type: "boolean",
           required: false,
-          description: "Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings."
+          description: "Defaults to true: apply the newly saved version, or the latest version when configuration is unchanged. Set false to save without changing active_version. Unlike Managed Agents, saving and applying can be separate."
         },
         {
-          name: "vector_stores",
-          type: "array",
-          itemType: "object",
+          name: "version_note",
+          type: "string",
           required: false,
-          description: "Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings."
+          description: "Optional change explanation stored as note on the new immutable version, up to 280 characters. Omission stores null. A note alone does not create a version or rewrite an existing note."
         },
         {
-          name: "files",
+          name: "bindings",
           type: "array",
           itemType: "object",
           required: false,
-          description: "Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings."
+          description: "Replace the whole bindings list; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept a nonempty list."
         },
         {
           name: "kind",
@@ -402,6 +392,12 @@ current version; omit to apply the update unconditionally.`
           required: false,
           description: "Praxis extension: switchable model ids on /agent/v1 only. The default model must be included. When omitted, only the default model is selectable."
         },
+        {
+          name: "avatar",
+          type: "string",
+          required: false,
+          description: "Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. Both personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it."
+        },
         {
           name: "preset",
           type: "string",
@@ -663,6 +659,27 @@ Removes the user from the blocklist; previously revoked tokens stay revoked. Ide
       }
     ]
   },
+  {
+    resource: "agent.agents.versions",
+    method: "apply",
+    summary: "Apply Agent Version",
+    description: "Apply a version from agents.versions.list by its version number. This idempotent operation changes active_version without creating a version; existing sessions and tokens keep their version. The response is the latest saved agent with its current active_version. Missing versions return 404 Agent version not found; archived agents return 409 Agent is archived. For example, POST /agent/v1/agents/{agent_id}/versions/2/apply with no body.",
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/versions/{version}/apply",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "version",
+        sdkName: "version"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.computers",
     method: "list",
@@ -1919,7 +1936,7 @@ owning account only.`
     resource: "agent.sessions",
     method: "create",
     summary: "Create session",
-    description: `Create a session: one conversation with an agent. Pass agent as an agent id (latest version) or {id, version, type:"agent"}. Unlike Anthropic Managed Agents, omit environment_id to get a light machine, unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, omission returns environment_id=light; explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Inline agent overrides are not supported. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Omitted budget defaults to USD 20; null removes the limit, and a limit object uses a positive integer string of USD cents. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
+    description: `Create a session: one conversation with an agent. Pass agent as an agent id (active_version) or {id, version, type:"agent"}. Unlike Anthropic Managed Agents, omit environment_id to get a light machine, unless computer_id (explicit, or the agent's default) selects a Computer; pass an environment id for a sandbox recipe. For service agents, omission returns environment_id=light; explicit null allocates no machine, so codemode, bash and other machine tools are unavailable. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Inline agent overrides are not supported. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Omitted budget defaults to USD 20; null removes the limit, and a limit object uses a positive integer string of USD cents. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
     http: "POST",
     path: "/agent/v1/sessions",
     streaming: "no",
@@ -3674,13 +3691,13 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
           name: "namespace",
           type: "string",
           required: true,
-          description: "Choose a namespace without prior registration; praxis is read-only. Folded to lowercase; matches [a-z0-9][a-z0-9._-]{0,63}."
+          description: "Choose a namespace without prior registration; praxis is reserved for built-in Actions. Folded to lowercase; matches [a-z0-9][a-z0-9_-]{0,63}."
         },
         {
           name: "name",
           type: "string",
           required: true,
-          description: "Name, folded to lowercase; matches [a-z0-9][a-z0-9._-]{0,63}."
+          description: "Name, folded to lowercase; matches [a-z0-9][a-z0-9_-]{0,63}."
         },
         {
           name: "description",
@@ -3743,8 +3760,8 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
   {
     resource: "automation.actions",
     method: "retrieve",
-    summary: "Get an action",
-    description: "Read the action and its full current implementation. The response ETag is the current revision ID for conditional updates.",
+    summary: "Get an Action with its current input and output JSON Schemas",
+    description: 'Read the Action and its full current implementation, with input and output JSON Schemas at current_revision.input_schema and current_revision.output_schema. To read a built-in Action, use ns=praxis and name=<bare name>, for example name=ocr; invoke it in a script with call("ocr", input). The response ETag is the current revision ID for conditional updates.',
     http: "GET",
     path: "/automation/v1/actions/{ns}/{name}",
     streaming: "no",
@@ -4318,8 +4335,8 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
   {
     resource: "automation.runs",
     method: "create",
-    summary: "Create a run",
-    description: "Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. New non-deterministic run IDs contain 78 characters (run_ + 10-character base36 millisecond timestamp + 64-character hexadecimal DO ID), compared with 46 for legacy random IDs. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed. Minimal body: {\"source\":\"export default async () => ({ok: true});\",\"language\":\"ts\",\"wait\":10}.",
+    summary: "Run a published target or execute draft source",
+    description: 'Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call("ocr", { document: { type: "file", file_id } }); return result; }`; send it as source with language="ts", input={"file_id":"<uploaded file ID>"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: "glm-ocr", document: { type: "file", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke("namespace/name", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 7 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.',
     http: "POST",
     path: "/automation/v1/runs",
     streaming: "no",
@@ -4797,7 +4814,7 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
     resource: "automation.scripts",
     method: "create",
     summary: "Create a script",
-    description: 'Save a TypeScript script as an editable draft for later reuse; this does not publish or start a run. Choose your own namespace without registering it first; praxis is read-only. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. The draft is a source string with a default-exported function, for example `export default async (input: {name: string}) => ({greeting: "Hello, " + input.name});`. To test it, pass that source and language=ts to praxis.automation.runs.create without publishing. To publish later, use the returned draft.revision as expected_draft_revision.',
+    description: 'Save a TypeScript script as an editable draft for later reuse; this does not publish or start a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. The draft is a source string with a default-exported function, for example `export default async (input: {name: string}) => ({greeting: "Hello, " + input.name});`. Scripts provide praxis, call, invoke, console and codemode as module-scope bindings, not on globalThis, with no import needed: praxis.<domain>.<resource>.<method>(...) calls a platform API, call("ocr", input) calls a built-in Action, and invoke("namespace/name", input) starts a child run. Action IDs are strings (bare names for built-ins, namespace/name for your own Actions); praxis.ocr(...) does not exist. To test it, pass that source and language=ts to praxis.automation.runs.create without publishing. To publish later, use the returned draft.revision as expected_draft_revision.',
     http: "POST",
     path: "/automation/v1/scripts",
     streaming: "no",
@@ -4811,13 +4828,13 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
           name: "namespace",
           type: "string",
           required: true,
-          description: "Choose a namespace without prior registration; praxis is read-only. Folded to lowercase; matches [a-z0-9][a-z0-9._-]{0,63}."
+          description: "Choose a namespace without prior registration; praxis is reserved for built-in Actions. Folded to lowercase; matches [a-z0-9][a-z0-9_-]{0,63}."
         },
         {
           name: "name",
           type: "string",
           required: true,
-          description: "Name, folded to lowercase; matches [a-z0-9][a-z0-9._-]{0,63}."
+          description: "Name, folded to lowercase; matches [a-z0-9][a-z0-9_-]{0,63}."
         },
         {
           name: "description",
@@ -4865,7 +4882,7 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
     resource: "automation.scripts",
     method: "update",
     summary: "Update a script draft",
-    description: "Update description, labels or draft with the current draft revision in If-Match. Even metadata-only updates create a new draft revision.",
+    description: 'Update description, labels or draft with the current draft revision in If-Match. Even metadata-only updates create a new draft revision. Scripts provide praxis, call, invoke, console and codemode as module-scope bindings, not on globalThis, with no import needed: praxis.<domain>.<resource>.<method>(...) calls a platform API, call("ocr", input) calls a built-in Action, and invoke("namespace/name", input) starts a child run. Action IDs are strings (bare names for built-ins, namespace/name for your own Actions); praxis.ocr(...) does not exist.',
     http: "PATCH",
     path: "/automation/v1/scripts/{ns}/{name}",
     streaming: "no",
@@ -5819,7 +5836,7 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
     resource: "automation.workflows",
     method: "create",
     summary: "Create a workflow",
-    description: "Save a YAML workflow as an editable draft without publishing or starting a run. Choose your own namespace without registering it first; praxis is read-only. To test the draft, send its source and language=yaml to praxis.automation.runs.create. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.",
+    description: "Save a YAML workflow as an editable draft without publishing or starting a run. Choose your own namespace without registering it first; praxis is reserved for built-in Actions. To test the draft, send its source and language=yaml to praxis.automation.runs.create. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.",
     http: "POST",
     path: "/automation/v1/workflows",
     streaming: "no",
@@ -5833,13 +5850,13 @@ Own-face extension. Use a readable session and a run_id from its events. Each su
           name: "namespace",
           type: "string",
           required: true,
-          description: "Choose a namespace without prior registration; praxis is read-only. Folded to lowercase; matches [a-z0-9][a-z0-9._-]{0,63}."
+          description: "Choose a namespace without prior registration; praxis is reserved for built-in Actions. Folded to lowercase; matches [a-z0-9][a-z0-9_-]{0,63}."
         },
         {
           name: "name",
           type: "string",
           required: true,
-          description: "Name, folded to lowercase; matches [a-z0-9][a-z0-9._-]{0,63}."
+          description: "Name, folded to lowercase; matches [a-z0-9][a-z0-9_-]{0,63}."
         },
         {
           name: "description",
@@ -12626,7 +12643,7 @@ for more details.`
     resource: "sandbox.sandboxes",
     method: "create",
     summary: "Create sandbox (v2)",
-    description: "Start an isolated environment using a templateID from templates.list, then retain sandboxID for lifecycle calls. Unlike E2B, templateID resolves to your ready Environment or a public Base; omit it to use the default base template (`base`), as the E2B SDK does. timeout is seconds from creation and defaults to 300. envVars supplies environment variables and metadata stores your string labels. All system communication is secured; use the returned envdAccessToken for files and commands through the envd data plane, not the management methods. Never print that token.",
+    description: "Create a sandbox from the template. All system communication with the sandbox is secured.",
     http: "POST",
     path: "/sandbox/v1/sandboxes",
     streaming: "no",
@@ -12640,7 +12657,7 @@ for more details.`
           name: "templateID",
           type: "string",
           required: true,
-          description: "Template ID or alias from templates.list; resolves to your ready Environment first, then a public Base. Omit it to use the default base template (`base`)."
+          description: "Identifier of the required template"
         },
         {
           name: "timeout",
@@ -12778,7 +12795,7 @@ for more details.`
     resource: "sandbox.sandboxes",
     method: "connect",
     summary: "Connect sandbox (v2)",
-    description: "Reconnect to an existing sandbox and resume it if paused. The optional timeout is seconds from now and defaults to 300; a later existing deadline is preserved. A running sandbox returns 200 and a resumed sandbox returns 201. Read sandboxID, domain and envdAccessToken from the response for subsequent data-plane access; never treat connecting as executing a command.",
+    description: "Returns sandbox details. If the sandbox is paused, it will be resumed. TTL is only extended. The request body is optional; an omitted timeout defaults to 300 seconds.",
     http: "POST",
     path: "/sandbox/v1/sandboxes/{sandboxID}/connect",
     streaming: "no",
@@ -12937,7 +12954,7 @@ for more details.`
     resource: "sandbox.sandboxes.metrics",
     method: "list",
     summary: "Sandbox metrics",
-    description: "Read CPU, memory and disk usage over the requested interval; start and end are Unix seconds. Unlike E2B, light sandboxes do not provide metrics; check the returned capabilities before requesting them.",
+    description: "Read CPU, memory and disk usage samples of a sandbox over a time window. Use it to size a sandbox or find out why it is slow. start and end are Unix timestamps in seconds; without them the recent samples are returned. An unknown id answers 404.",
     http: "GET",
     path: "/sandbox/v1/sandboxes/{sandboxID}/metrics",
     streaming: "no",
@@ -13022,7 +13039,7 @@ for more details.`
     resource: "sandbox.sandboxes",
     method: "pause",
     summary: "Pause sandbox",
-    description: "Suspend a running sandbox for later connection; use delete to discard it instead. Unlike E2B, light sandboxes preserve disk rather than memory, and persistent sandboxes can resume on data-plane traffic even when autoResume is false. Inspect paused state with the management retrieve operation to avoid waking the sandbox. Explicitly ephemeral sandboxes cannot pause. memory defaults to true, but only a memory-capable sandbox preserves running processes; memory=false saves disk state and resumes with a cold boot. Success returns 204; connect resumes the saved sandbox.",
+    description: "Pause a running sandbox, keeping its files and memory so that connectSandbox can resume it later. Use it to stop paying for compute without losing state; to discard the sandbox use killSandbox. Success answers 204. A sandbox that is not running answers 409.",
     http: "POST",
     path: "/sandbox/v1/sandboxes/{sandboxID}/pause",
     streaming: "no",
@@ -13414,7 +13431,7 @@ for more details.`
     resource: "sandbox.templates",
     method: "list",
     summary: "List templates (v2)",
-    description: "Choose a templateID before creating a sandbox. Unlike E2B, this catalog lists your ready Environments and public Bases; use a returned ID or alias; `base` is the default template that create uses when templateID is omitted. Page through results using nextToken.",
+    description: "List the templates you can create sandboxes from. Use it to pick the template id or alias for createSandbox. `base` is the default template that createSandbox uses when templateID is omitted. limit is 1 to 100 (default 100); send the cursor from the response back as nextToken to continue.",
     http: "GET",
     path: "/sandbox/v1/templates",
     streaming: "no",
@@ -14176,704 +14193,2164 @@ for more details.`
     }
   },
   {
-    resource: "vault.authorizations",
-    method: "create",
-    summary: "Create authorization",
-    description: "Connect an OAuth service to an active vault using either an OAuth template or a resource URL. Unlike Anthropic mcp_oauth credential creation, this flow obtains tokens through user consent rather than accepting an auth token bundle; compatible mcp_oauth creation and updates return 501. Open connect_url, then poll praxis.vault.authorizations.retrieve until completed, failed or expired; only completed supplies the resulting secret_id. This stores a credential but does not enable vault-backed MCP authentication in Agent sessions.",
-    http: "POST",
-    path: "/vault/v1/authorizations",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: [],
-    body: {
-      required: true,
-      fields: [
-        {
-          name: "vault_id",
-          type: "string",
-          required: true,
-          description: "Identifier of the active vault in your account that will receive the OAuth secret."
-        },
-        {
-          name: "template_id",
-          type: "string",
-          enum: [
-            "linear",
-            "atlassian"
-          ],
-          required: false,
-          description: "OAuth template ID from List templates. Provide exactly one of template_id or resource_url."
-        },
-        {
-          name: "resource_url",
-          type: "string",
-          required: false,
-          description: "HTTPS resource URL to authorize, such as an MCP server. Provide it instead of template_id. Must use a public domain and the default HTTPS port, with no credentials or fragment; IP literals, local and platform hosts are rejected."
-        },
-        {
-          name: "return_url",
-          type: "string",
-          required: false,
-          description: "URL to return the user to after completion or failure. Must match your return URL allowlist exactly; HTTPS is required, without credentials or a fragment. The redirect includes authorization_id and status."
-        }
-      ]
-    }
-  },
-  {
-    resource: "vault.authorizations",
-    method: "retrieveCallback",
-    summary: "Authorization callback",
-    description: "Receive the authorization server's OAuth callback with single-use state and an authorization code or error. Completion creates or updates an OAuth secret; the browser is redirected to return_url when provided, otherwise shown a result page.",
+    resource: "ticket.activity",
+    method: "retrieve",
+    summary: "List activity",
+    description: "List activity within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
     http: "GET",
-    path: "/vault/v1/authorizations/callback",
+    path: "/ticket/v1/activity",
     streaming: "no",
     pagination: false,
     pathParams: [],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      },
+      {
+        name: "filter",
+        type: "string",
+        required: false,
+        description: "Activity qualifiers: actor, actor-kind, action, ticket, source and since; passed unchanged to the service."
+      }
+    ]
   },
   {
-    resource: "vault.authorizations",
-    method: "retrieve",
-    summary: "Get authorization",
-    description: "Retrieve an authorization belonging to your account, including its current status and resulting secret_id. An unfinished authorization past expires_at is reported as expired.",
-    http: "GET",
-    path: "/vault/v1/authorizations/{authorization_id}",
+    resource: "ticket.comments",
+    method: "delete",
+    summary: "Remove comments",
+    description: "Remove comments within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "DELETE",
+    path: "/ticket/v1/comments/{id}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "authorization_id",
-        sdkName: "authorization_id"
+        name: "id",
+        sdkName: "id"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.connect",
+    resource: "ticket.comments",
     method: "retrieve",
-    summary: "Connect page",
-    description: "Display the user consent page for a connect_url token without requiring an API key. The page shows the requester, resource host and requested scopes before the user continues or denies.",
+    summary: "Read comments",
+    description: "Read comments within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
     http: "GET",
-    path: "/vault/v1/connect/{token}",
+    path: "/ticket/v1/comments/{id}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "token",
-        sdkName: "token"
+        name: "id",
+        sdkName: "id"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.connect.continue",
-    method: "create",
-    summary: "Continue authorization",
-    description: "Consume a pending authorization's one-time connect token and redirect the browser to the authorization server. Expired or already used links cannot start another authorization flow.",
-    http: "POST",
-    path: "/vault/v1/connect/{token}/continue",
+    resource: "ticket.comments",
+    method: "update",
+    summary: "Update comments",
+    description: "Update comments within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "PATCH",
+    path: "/ticket/v1/comments/{id}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "token",
-        sdkName: "token"
+        name: "id",
+        sdkName: "id"
       }
     ],
-    query: []
-  },
-  {
-    resource: "vault.connect.deny",
-    method: "create",
-    summary: "Deny authorization",
-    description: "Consume a pending authorization's one-time connect token and mark it failed with access_denied. Redirect to the configured return URL, or display a result page when none was supplied.",
-    http: "POST",
-    path: "/vault/v1/connect/{token}/deny",
-    streaming: "no",
-    pagination: false,
-    pathParams: [
+    query: [
       {
-        name: "token",
-        sdkName: "token"
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
     ],
-    query: []
-  },
-  {
-    resource: "vault.oauth",
-    method: "retrieveClientMetadata",
-    summary: "OAuth client metadata",
-    description: "Return the public OAuth client metadata used by authorization servers that support CIMD. The document declares the Praxis client identity and callback URL; no API key is required.",
-    http: "GET",
-    path: "/vault/v1/oauth/client.json",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: []
-  },
-  {
-    resource: "vault.settings.returnUrls",
-    method: "list",
-    summary: "Get return URLs",
-    description: "Read your account's allowlist of OAuth return URLs. The list is empty until configured, and authorization return_url values must match an entry exactly.",
-    http: "GET",
-    path: "/vault/v1/settings/return_urls",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: []
-  },
-  {
-    resource: "vault.settings.returnUrls",
-    method: "update",
-    summary: "Set return URLs",
-    description: "Replace your account's complete allowlist of OAuth return URLs. Entries are deduplicated after validation; an empty array clears the allowlist.",
-    http: "PUT",
-    path: "/vault/v1/settings/return_urls",
-    streaming: "no",
-    pagination: false,
-    pathParams: [],
-    query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "urls",
-          type: "array",
-          itemType: "string",
+          name: "body",
+          type: "string",
           required: true,
-          description: "Complete account allowlist of return URLs, matched exactly as supplied. At most 10 HTTPS URLs without credentials or fragments; duplicates are removed. Send an empty array to clear the list."
+          description: "Markdown text, at most 65536 characters."
+        },
+        {
+          name: "in_reply_to",
+          type: "string",
+          required: false,
+          description: "Opaque identifier returned by this resource's create or list operation."
         }
       ]
     }
   },
   {
-    resource: "vault.templates",
+    resource: "ticket.comments.reactions",
     method: "list",
-    summary: "List templates",
-    description: "List templates for manually supplied static secrets and OAuth authorizations. Templates provide suggested names and allowed hosts; they are not stored secrets.",
+    summary: "List reactions",
+    description: "List reactions within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
     http: "GET",
-    path: "/vault/v1/templates",
+    path: "/ticket/v1/comments/{id}/reactions",
     streaming: "no",
     pagination: false,
-    pathParams: [],
-    query: []
-  },
-  {
-    resource: "vault.vaults",
-    method: "list",
-    summary: "List vaults",
-    description: "List vaults belonging to your account, newest first. Archived vaults are excluded unless include_archived is true; use next_cursor to request another page.",
-    http: "GET",
-    path: "/vault/v1/vaults",
-    streaming: "no",
-    pagination: true,
-    pathParams: [],
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
     query: [
       {
-        name: "cursor",
+        name: "repository",
         type: "string",
         required: false,
-        description: "next_cursor from the previous page."
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       },
       {
-        name: "limit",
+        name: "page_size",
         type: "integer",
         required: false,
-        description: "Items per page."
+        description: "Records per page; defaults to 30, maximum 100."
       },
       {
-        name: "include_archived",
-        type: "boolean",
+        name: "page_token",
+        type: "string",
         required: false,
-        description: "Include archived items."
+        description: "Cursor returned as next_page_token; omit for the first page."
       }
     ]
   },
   {
-    resource: "vault.vaults",
+    resource: "ticket.comments.reactions",
     method: "create",
-    summary: "Create vault",
-    description: "Create an empty, active vault to hold credentials for your account, with a display name and optional metadata. Use its returned id as vault_id when creating secrets or OAuth authorizations. Unlike Anthropic, Agent sessions do not accept nonempty vault_ids; storing a credential or adding its ID to metadata does not enable vault-backed MCP authentication. Application vault references are also unavailable; praxis_vault_ref version bindings and secret writes with a vault source return 501, so creating a vault does not yet enable either consumer.",
+    summary: "Create or add reactions",
+    description: "Create or add reactions within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
     http: "POST",
-    path: "/vault/v1/vaults",
+    path: "/ticket/v1/comments/{id}/reactions",
     streaming: "no",
     pagination: false,
-    pathParams: [],
-    query: [],
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
     body: {
       required: true,
       fields: [
         {
-          name: "display_name",
+          name: "content",
           type: "string",
+          enum: [
+            "+1",
+            "-1",
+            "laugh",
+            "confused",
+            "heart",
+            "hooray",
+            "eyes",
+            "rocket"
+          ],
           required: true,
-          description: "Human-readable vault name. Leading and trailing whitespace is removed; the result must contain 1–255 Unicode code points."
-        },
-        {
-          name: "metadata",
-          type: "object",
-          required: false,
-          description: "Initial labels for the vault; omitted metadata defaults to an empty object. The same key and pair limits as Vault.metadata apply."
+          description: "Reaction to add or remove: +1 approves, -1 disapproves, laugh, confused, heart, hooray, eyes, or rocket."
         }
       ]
     }
   },
   {
-    resource: "vault.vaults",
+    resource: "ticket.comments.reactions",
     method: "delete",
-    summary: "Delete vault",
-    description: "Permanently delete a vault, its secrets, authorizations and previous audit events. Only a vault deletion event remains; the deleted vault can no longer be retrieved.",
+    summary: "Remove reactions",
+    description: "Remove reactions within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
     http: "DELETE",
-    path: "/vault/v1/vaults/{vault_id}",
+    path: "/ticket/v1/comments/{id}/reactions/{content}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "id",
+        sdkName: "id"
+      },
+      {
+        name: "content",
+        sdkName: "content"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.vaults",
-    method: "retrieve",
-    summary: "Get vault",
-    description: "Retrieve a vault belonging to your account, including archived vaults and secret counts. Missing or other accounts' vaults return VAULT_NOT_FOUND.",
+    resource: "ticket.labels",
+    method: "list",
+    summary: "List labels",
+    description: "List labels within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
     http: "GET",
-    path: "/vault/v1/vaults/{vault_id}",
+    path: "/ticket/v1/labels",
     streaming: "no",
     pagination: false,
-    pathParams: [
+    pathParams: [],
+    query: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
       }
-    ],
-    query: []
+    ]
   },
   {
-    resource: "vault.vaults",
-    method: "update",
-    summary: "Update vault",
-    description: "Update an active vault's display name or patch its metadata. Omitted fields are preserved; archived vaults cannot be updated.",
+    resource: "ticket.labels",
+    method: "create",
+    summary: "Create or add labels",
+    description: "Create or add labels within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
     http: "POST",
-    path: "/vault/v1/vaults/{vault_id}",
+    path: "/ticket/v1/labels",
     streaming: "no",
     pagination: false,
-    pathParams: [
+    pathParams: [],
+    query: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
     ],
-    query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "display_name",
+          name: "name",
           type: "string",
-          required: false,
-          description: "Human-readable vault name. Leading and trailing whitespace is removed; the result must contain 1–255 Unicode code points."
+          required: true,
+          description: "Case-insensitive label name within the repository."
         },
         {
-          name: "metadata",
-          type: "object",
+          name: "color",
+          type: "string",
+          required: true,
+          description: "Six hexadecimal digits without #."
+        },
+        {
+          name: "description",
+          type: "string",
           required: false,
-          description: "Patch: a string upserts the key, null deletes it, omitted keys are kept."
+          description: "Label's purpose."
         }
       ]
     }
   },
   {
-    resource: "vault.vaults",
-    method: "archive",
-    summary: "Archive vault",
-    description: "Archive a vault and all its remaining secrets, erasing their values while retaining metadata and audit history. An already archived vault is returned unchanged.",
-    http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/archive",
+    resource: "ticket.labels",
+    method: "delete",
+    summary: "Remove labels",
+    description: "Remove labels within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
+    http: "DELETE",
+    path: "/ticket/v1/labels/{name}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "name",
+        sdkName: "name"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.vaults.events",
-    method: "list",
-    summary: "List events",
-    description: "List a vault's audit events, newest first, without secret values. Filter by secret ID or name; a name includes archived and deleted secrets that carried it. An unknown secret returns an empty page.",
-    http: "GET",
-    path: "/vault/v1/vaults/{vault_id}/events",
+    resource: "ticket.labels",
+    method: "update",
+    summary: "Update labels",
+    description: "Update labels within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
+    http: "PATCH",
+    path: "/ticket/v1/labels/{name}",
     streaming: "no",
-    pagination: true,
+    pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "name",
+        sdkName: "name"
       }
     ],
     query: [
       {
-        name: "secret",
-        type: "string",
-        required: false,
-        description: "Only events of this secret (name or vsec_ ID)."
-      },
-      {
-        name: "cursor",
+        name: "repository",
         type: "string",
         required: false,
-        description: "next_cursor from the previous page."
-      },
-      {
-        name: "limit",
-        type: "integer",
-        required: false,
-        description: "Items per page."
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
-    ]
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "color",
+          type: "string",
+          required: false,
+          description: "Six hexadecimal digits without #."
+        },
+        {
+          name: "description",
+          type: "string",
+          required: false,
+          description: "Label's purpose."
+        },
+        {
+          name: "new_name",
+          type: "string",
+          required: false,
+          description: "Case-insensitive label name within the repository."
+        }
+      ]
+    }
   },
   {
-    resource: "vault.vaults.secrets",
+    resource: "ticket.milestones",
     method: "list",
-    summary: "List secrets",
-    description: "List secret metadata in a vault, newest first, without returning values. Archived secrets are excluded unless include_archived is true.",
+    summary: "List milestones",
+    description: "List milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
     http: "GET",
-    path: "/vault/v1/vaults/{vault_id}/secrets",
+    path: "/ticket/v1/milestones",
     streaming: "no",
-    pagination: true,
-    pathParams: [
-      {
-        name: "vault_id",
-        sdkName: "vault_id"
-      }
-    ],
+    pagination: false,
+    pathParams: [],
     query: [
       {
-        name: "cursor",
+        name: "repository",
         type: "string",
         required: false,
-        description: "next_cursor from the previous page."
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       },
       {
-        name: "limit",
+        name: "page_size",
         type: "integer",
         required: false,
-        description: "Items per page."
+        description: "Records per page; defaults to 30, maximum 100."
       },
       {
-        name: "include_archived",
-        type: "boolean",
+        name: "page_token",
+        type: "string",
         required: false,
-        description: "Include archived items."
+        description: "Cursor returned as next_page_token; omit for the first page."
       }
     ]
   },
   {
-    resource: "vault.vaults.secrets",
+    resource: "ticket.milestones",
     method: "create",
-    summary: "Create secret",
-    description: "Store a manually supplied token in an active vault for use on requests to its allowed_hosts. Unlike Anthropic credentials, this native operation takes name, value and allowed_hosts directly and creates only static secrets; use praxis.vault.authorizations.create for OAuth. Its name must be unused by any non-archived secret in that vault; the response contains metadata but never the supplied value. Application praxis_vault_ref bindings declare vault_id and secret (the secret name), but currently return 501; do not copy the value into a plain-text binding or metadata as a substitute.",
+    summary: "Create or add milestones",
+    description: "Create or add milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
     http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/secrets",
+    path: "/ticket/v1/milestones",
     streaming: "no",
     pagination: false,
-    pathParams: [
+    pathParams: [],
+    query: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
     ],
-    query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "name",
-          type: "string",
-          required: true,
-          description: "Immutable lookup name: an uppercase ASCII letter or underscore, followed by up to 127 uppercase letters, digits or underscores. Must be unused by non-archived secrets in this vault."
-        },
-        {
-          name: "value",
+          name: "title",
           type: "string",
           required: true,
-          description: "Write-only secret value. Must be nonempty and at most 16384 UTF-8 bytes; it is never returned."
-        },
-        {
-          name: "allowed_hosts",
-          type: "array",
-          itemType: "string",
-          required: true,
-          description: "Allowed destinations for the secret. Unlike Anthropic's unrestricted networking option, an explicit allowlist is required. Supply 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed."
+          description: "Short title, at most 256 Unicode characters."
         },
         {
           name: "description",
           type: "string",
           required: false,
-          description: "Human-readable note about the secret, or null when absent; at most 1024 Unicode code points."
-        },
-        {
-          name: "metadata",
-          type: "object",
-          required: false,
-          description: "Your own labels. source, template and keys starting with anthropic. are reserved and cannot be supplied."
+          description: "Milestone description."
         },
         {
-          name: "template_id",
+          name: "due_on",
           type: "string",
-          enum: [
-            "github",
-            "openai",
-            "anthropic",
-            "stripe"
-          ],
           required: false,
-          description: "Static template ID from List templates. Records metadata.template; name, value and allowed_hosts must still be supplied explicitly."
+          description: "Due date, or null if unset."
         },
         {
-          name: "kind",
+          name: "state",
           type: "string",
           enum: [
-            "static"
+            "open",
+            "closed"
           ],
           required: false,
-          description: "Secret kind; only static is accepted here and is the default. Create oauth secrets through an authorization."
+          description: "open means actionable; closed means resolved or declined."
         }
       ]
     }
   },
   {
-    resource: "vault.vaults.secrets",
+    resource: "ticket.milestones",
     method: "delete",
-    summary: "Delete secret",
-    description: "Permanently delete a secret and its previous audit events. A deletion event retaining the secret ID and name remains, and other secrets are unchanged.",
+    summary: "Remove milestones",
+    description: "Remove milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
     http: "DELETE",
-    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+    path: "/ticket/v1/milestones/{number}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
-      },
-      {
-        name: "secret",
-        sdkName: "secret"
+        name: "number",
+        sdkName: "number"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.vaults.secrets",
+    resource: "ticket.milestones",
     method: "retrieve",
-    summary: "Get secret",
-    description: "Inspect a secret's kind, allowed_hosts, status and version without reading its value. Unlike Anthropic credential lookup by ID, this native operation accepts either the name or the vsec_ ID returned by secret creation or listing. A name selects a non-archived secret; use the secret ID to retrieve an archived secret.",
+    summary: "Read milestones",
+    description: "Read milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
     http: "GET",
-    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+    path: "/ticket/v1/milestones/{number}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
-      },
-      {
-        name: "secret",
-        sdkName: "secret"
+        name: "number",
+        sdkName: "number"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.vaults.secrets",
+    resource: "ticket.milestones",
     method: "update",
-    summary: "Update secret",
-    description: "Rotate a non-archived secret in an active vault by supplying value, or patch its hosts, description or metadata. Unlike Anthropic credential updates, this native operation accepts the replacement value directly, without an auth object. Each supplied value increments version, even if unchanged, and can recover an OAuth secret from refresh_failed; the secret ID, name and kind stay unchanged. Omit value for a metadata-only edit; existing references do not need a new secret ID or name.",
-    http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+    summary: "Update milestones",
+    description: "Update milestones within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
+    http: "PATCH",
+    path: "/ticket/v1/milestones/{number}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
-      },
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
       {
-        name: "secret",
-        sdkName: "secret"
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
     ],
-    query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "value",
+          name: "title",
           type: "string",
           required: false,
-          description: "Write-only replacement value. Must be nonempty and at most 16384 UTF-8 bytes; supplying it increments version, even when equal to the old value."
+          description: "Short title, at most 256 Unicode characters."
         },
         {
-          name: "allowed_hosts",
-          type: "array",
-          itemType: "string",
+          name: "description",
+          type: "string",
           required: false,
-          description: "Allowed destinations for the secret. Unlike Anthropic's unrestricted networking option, an explicit allowlist is required. Supply 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed."
+          description: "Milestone description."
         },
         {
-          name: "description",
+          name: "due_on",
           type: "string",
           required: false,
-          description: "Human-readable note about the secret. Omit to preserve it or send null to clear it; at most 1024 Unicode code points."
+          description: "Due date, or null if unset."
         },
         {
-          name: "metadata",
-          type: "object",
+          name: "state",
+          type: "string",
+          enum: [
+            "open",
+            "closed"
+          ],
           required: false,
-          description: "Metadata patch: a string upserts a key, null deletes it and omitted keys are kept. source, template and keys starting with anthropic. cannot be set or deleted."
+          description: "open means actionable; closed means resolved or declined."
         }
       ]
     }
   },
   {
-    resource: "vault.vaults.secrets",
-    method: "archive",
-    summary: "Archive secret",
-    description: "Archive a secret, erase its value and release its name for reuse. Metadata and audit history remain; use its ID for subsequent reads or repeated archive requests.",
-    http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}/archive",
+    resource: "ticket.repositories",
+    method: "list",
+    summary: "List repositories",
+    description: "List repositories within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/repositories",
     streaming: "no",
     pagination: false,
-    pathParams: [
+    pathParams: [],
+    query: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
       },
       {
-        name: "secret",
-        sdkName: "secret"
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
       }
-    ],
-    query: []
+    ]
   },
   {
-    resource: "vault.vaults.secrets.refresh",
-    method: "create",
-    summary: "Refresh secret",
-    description: "Request an OAuth secret refresh and return its current metadata without token values. Refresh may be skipped if already in progress, unavailable or in refresh_failed; inspect the returned status and oauth fields.",
-    http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}/refresh",
+    resource: "ticket.tickets",
+    method: "list",
+    summary: "List tickets",
+    description: "List tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets",
     streaming: "no",
     pagination: false,
-    pathParams: [
+    pathParams: [],
+    query: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       },
       {
-        name: "secret",
-        sdkName: "secret"
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      },
+      {
+        name: "filter",
+        type: "string",
+        required: false,
+        description: "Search qualifier subset: is/state, reason, label/-label, no, assignee, author, mentions, milestone, type, kind, assignee-kind, in and sort; unknown qualifiers return INVALID_PARAMS. Passed unchanged to the service."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets",
+    method: "create",
+    summary: "Create or add tickets",
+    description: "Create or add tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "POST",
+    path: "/ticket/v1/tickets",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
     ],
-    query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "reason",
+          name: "title",
+          type: "string",
+          required: true,
+          description: "Short title, at most 256 Unicode characters."
+        },
+        {
+          name: "body",
           type: "string",
-          enum: [
-            "unauthorized"
-          ],
           required: false,
-          description: "Optional refresh trigger: unauthorized reports that the resource rejected the access token. Omit for a manual refresh; both request a refresh regardless of its scheduled time."
+          description: "Markdown text, at most 65536 characters."
+        },
+        {
+          name: "type",
+          type: "string",
+          required: false,
+          description: "Built-in type name; null clears an existing type."
+        },
+        {
+          name: "labels",
+          type: "array",
+          itemType: "string",
+          required: false,
+          description: "Labels attached to this ticket; updates replace the complete list."
+        },
+        {
+          name: "assignees",
+          type: "array",
+          itemType: "string",
+          required: false,
+          description: "Complete assignee list, at most ten."
+        },
+        {
+          name: "milestone",
+          type: "integer",
+          required: false,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
+        },
+        {
+          name: "parent",
+          type: "integer",
+          required: false,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
         }
       ]
     }
   },
   {
-    resource: "vault.vaults.secrets.validate",
-    method: "create",
-    summary: "Validate secret",
-    description: "Probe an OAuth secret's resource with its access token, attempting refresh first if the token has expired. Return the validation verdict and sanitized HTTP summaries; static secrets are unsupported.",
-    http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}/validate",
+    resource: "ticket.tickets",
+    method: "retrieve",
+    summary: "Read tickets",
+    description: "Read tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
-      },
-      {
-        name: "secret",
-        sdkName: "secret"
+        name: "number",
+        sdkName: "number"
       }
     ],
-    query: []
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
   },
   {
-    resource: "vault.vaults.secrets",
-    method: "import",
-    summary: "Import secrets",
-    description: "Import lines or dotenv text into an active vault, reporting success or failure for each entry. Existing names have their values replaced; their hosts change only when that line supplies allowed_hosts. Shared hosts apply only to newly created secrets.",
-    http: "POST",
-    path: "/vault/v1/vaults/{vault_id}/secrets:import",
+    resource: "ticket.tickets",
+    method: "update",
+    summary: "Update tickets",
+    description: "Update tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "PATCH",
+    path: "/ticket/v1/tickets/{number}",
     streaming: "no",
     pagination: false,
     pathParams: [
       {
-        name: "vault_id",
-        sdkName: "vault_id"
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
       }
     ],
-    query: [],
     body: {
       required: true,
       fields: [
         {
-          name: "lines",
-          type: "array",
-          itemType: "object",
+          name: "title",
+          type: "string",
           required: false,
-          description: "Entries to import, each succeeding or failing independently. Supply 1–50 entries and omit dotenv."
+          description: "Short title, at most 256 Unicode characters."
         },
         {
-          name: "dotenv",
+          name: "body",
           type: "string",
           required: false,
-          description: "KEY=VALUE text to import instead of lines. Blank lines and comments are ignored; export prefixes and single- or double-quoted values are supported. Supply 1–50 parsed entries; multiline quoted values are unsupported."
+          description: "Markdown text, at most 65536 characters."
         },
         {
-          name: "allowed_hosts",
+          name: "type",
+          type: "string",
+          required: false,
+          description: "Built-in type name; null clears an existing type."
+        },
+        {
+          name: "labels",
           type: "array",
           itemType: "string",
           required: false,
-          description: "Default hosts for newly created secrets whose entry omits allowed_hosts. Never changes the hosts of an existing secret; use per-line allowed_hosts for that. Uses the same host rules as Create secret."
+          description: "Labels attached to this ticket; updates replace the complete list."
+        },
+        {
+          name: "assignees",
+          type: "array",
+          itemType: "string",
+          required: false,
+          description: "Complete assignee list, at most ten."
+        },
+        {
+          name: "milestone",
+          type: "integer",
+          required: false,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
+        },
+        {
+          name: "state",
+          type: "string",
+          enum: [
+            "open",
+            "closed"
+          ],
+          required: false,
+          description: "open means actionable; closed means resolved or declined."
+        },
+        {
+          name: "state_reason",
+          type: "string",
+          enum: [
+            "completed",
+            "not_planned",
+            "duplicate"
+          ],
+          required: false,
+          description: "Reason for closing: completed resolves, not_planned declines, duplicate marks a duplicate."
+        },
+        {
+          name: "duplicate_of",
+          type: "integer",
+          required: false,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
         }
       ]
     }
   },
   {
-    resource: "vault.vaults",
-    method: "check",
-    summary: "Check vaults",
-    description: "Check the availability of each supplied vault ID in request order. Missing, malformed and other accounts' IDs all return not_found; duplicate IDs are preserved.",
+    resource: "ticket.tickets.comments",
+    method: "list",
+    summary: "List comments",
+    description: "List comments within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/comments",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.comments",
+    method: "create",
+    summary: "Create or add comments",
+    description: "Create or add comments within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
     http: "POST",
-    path: "/vault/v1/vaults:check",
+    path: "/ticket/v1/tickets/{number}/comments",
     streaming: "no",
     pagination: false,
-    pathParams: [],
-    query: [],
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "body",
+          type: "string",
+          required: true,
+          description: "Markdown text, at most 65536 characters."
+        },
+        {
+          name: "in_reply_to",
+          type: "string",
+          required: false,
+          description: "Opaque identifier returned by this resource's create or list operation."
+        }
+      ]
+    }
+  },
+  {
+    resource: "ticket.tickets.dependencies",
+    method: "retrieveBlockedBy",
+    summary: "List blocked by",
+    description: "List blocked by within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/dependencies/blocked_by",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.dependencies.blockedBy",
+    method: "create",
+    summary: "Create or add blocked by",
+    description: "Create or add blocked by within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "POST",
+    path: "/ticket/v1/tickets/{number}/dependencies/blocked_by",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "blocked_by",
+          type: "integer",
+          required: true,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
+        }
+      ]
+    }
+  },
+  {
+    resource: "ticket.tickets.dependencies.blockedBy",
+    method: "delete",
+    summary: "Remove blocked by",
+    description: "Remove blocked by within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "DELETE",
+    path: "/ticket/v1/tickets/{number}/dependencies/blocked_by/{n}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      },
+      {
+        name: "n",
+        sdkName: "n"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.dependencies",
+    method: "retrieveBlocking",
+    summary: "List blocking",
+    description: "List blocking within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/dependencies/blocking",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.events",
+    method: "list",
+    summary: "List events",
+    description: "List events within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/events",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets",
+    method: "deleteLock",
+    summary: "Remove lock",
+    description: "Remove lock within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
+    http: "DELETE",
+    path: "/ticket/v1/tickets/{number}/lock",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets",
+    method: "updateLock",
+    summary: "Update lock",
+    description: "Update lock within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Organization owner or admin authority is required for this write; API keys without role information act as members.",
+    http: "PUT",
+    path: "/ticket/v1/tickets/{number}/lock",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
+    body: {
+      required: false,
+      fields: [
+        {
+          name: "lock_reason",
+          type: "string",
+          enum: [
+            "off-topic",
+            "too heated",
+            "resolved",
+            "spam"
+          ],
+          required: false,
+          description: "Reason for locking: off-topic, too heated, resolved, or spam."
+        }
+      ]
+    }
+  },
+  {
+    resource: "ticket.tickets.reactions",
+    method: "list",
+    summary: "List reactions",
+    description: "List reactions within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/reactions",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.reactions",
+    method: "create",
+    summary: "Create or add reactions",
+    description: "Create or add reactions within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "POST",
+    path: "/ticket/v1/tickets/{number}/reactions",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "content",
+          type: "string",
+          enum: [
+            "+1",
+            "-1",
+            "laugh",
+            "confused",
+            "heart",
+            "hooray",
+            "eyes",
+            "rocket"
+          ],
+          required: true,
+          description: "Reaction to add or remove: +1 approves, -1 disapproves, laugh, confused, heart, hooray, eyes, or rocket."
+        }
+      ]
+    }
+  },
+  {
+    resource: "ticket.tickets.reactions",
+    method: "delete",
+    summary: "Remove reactions",
+    description: "Remove reactions within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "DELETE",
+    path: "/ticket/v1/tickets/{number}/reactions/{content}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      },
+      {
+        name: "content",
+        sdkName: "content"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.relations",
+    method: "list",
+    summary: "List relations",
+    description: "List relations within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/relations",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.relations",
+    method: "create",
+    summary: "Create or add relations",
+    description: "Create or add relations within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "POST",
+    path: "/ticket/v1/tickets/{number}/relations",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "relates_to",
+          type: "integer",
+          required: true,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
+        }
+      ]
+    }
+  },
+  {
+    resource: "ticket.tickets.relations",
+    method: "delete",
+    summary: "Remove relations",
+    description: "Remove relations within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "DELETE",
+    path: "/ticket/v1/tickets/{number}/relations/{n}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      },
+      {
+        name: "n",
+        sdkName: "n"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.subTickets",
+    method: "list",
+    summary: "List sub tickets",
+    description: "List sub tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Pass next_page_token as page_token to continue with the same filter. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/tickets/{number}/sub_tickets",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      },
+      {
+        name: "page_size",
+        type: "integer",
+        required: false,
+        description: "Records per page; defaults to 30, maximum 100."
+      },
+      {
+        name: "page_token",
+        type: "string",
+        required: false,
+        description: "Cursor returned as next_page_token; omit for the first page."
+      }
+    ]
+  },
+  {
+    resource: "ticket.tickets.subTickets",
+    method: "create",
+    summary: "Create or add sub tickets",
+    description: "Create or add sub tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "POST",
+    path: "/ticket/v1/tickets/{number}/sub_tickets",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "child",
+          type: "integer",
+          required: true,
+          description: "Repository-local number returned by create or list; distinct from the object's id."
+        },
+        {
+          name: "replace_parent",
+          type: "boolean",
+          required: false,
+          description: "Allow replacing an existing parent."
+        }
+      ]
+    }
+  },
+  {
+    resource: "ticket.tickets.subTickets",
+    method: "delete",
+    summary: "Remove sub tickets",
+    description: "Remove sub tickets within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "DELETE",
+    path: "/ticket/v1/tickets/{number}/sub_tickets/{child}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "number",
+        sdkName: "number"
+      },
+      {
+        name: "child",
+        sdkName: "child"
+      }
+    ],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
+  },
+  {
+    resource: "ticket.types",
+    method: "list",
+    summary: "Read types",
+    description: "Read types within the authenticated organization. Obtain resource identifiers from the corresponding list or create response. Writes complete synchronously; read the returned resource to observe the result. Service authorization applies to the verified human subject.",
+    http: "GET",
+    path: "/ticket/v1/types",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [
+      {
+        name: "repository",
+        type: "string",
+        required: false,
+        description: "Repository id from GET /ticket/v1/repositories; omit for the default tickets container."
+      }
+    ]
+  },
+  {
+    resource: "vault.authorizations",
+    method: "create",
+    summary: "Create authorization",
+    description: "Connect an OAuth service to an active vault using either an OAuth template or a resource URL. Unlike Anthropic mcp_oauth credential creation, this flow obtains tokens through user consent rather than accepting an auth token bundle; compatible mcp_oauth creation and updates return 501. Open connect_url, then poll praxis.vault.authorizations.retrieve until completed, failed or expired; only completed supplies the resulting secret_id. This stores a credential but does not enable vault-backed MCP authentication in Agent sessions.",
+    http: "POST",
+    path: "/vault/v1/authorizations",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "vault_id",
+          type: "string",
+          required: true,
+          description: "Identifier of the active vault in your account that will receive the OAuth secret."
+        },
+        {
+          name: "template_id",
+          type: "string",
+          enum: [
+            "linear",
+            "atlassian"
+          ],
+          required: false,
+          description: "OAuth template ID from List templates. Provide exactly one of template_id or resource_url."
+        },
+        {
+          name: "resource_url",
+          type: "string",
+          required: false,
+          description: "HTTPS resource URL to authorize, such as an MCP server. Provide it instead of template_id. Must use a public domain and the default HTTPS port, with no credentials or fragment; IP literals, local and platform hosts are rejected."
+        },
+        {
+          name: "return_url",
+          type: "string",
+          required: false,
+          description: "URL to return the user to after completion or failure. Must match your return URL allowlist exactly; HTTPS is required, without credentials or a fragment. The redirect includes authorization_id and status."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.authorizations",
+    method: "retrieveCallback",
+    summary: "Authorization callback",
+    description: "Receive the authorization server's OAuth callback with single-use state and an authorization code or error. Completion creates or updates an OAuth secret; the browser is redirected to return_url when provided, otherwise shown a result page.",
+    http: "GET",
+    path: "/vault/v1/authorizations/callback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "vault.authorizations",
+    method: "retrieve",
+    summary: "Get authorization",
+    description: "Retrieve an authorization belonging to your account, including its current status and resulting secret_id. An unfinished authorization past expires_at is reported as expired.",
+    http: "GET",
+    path: "/vault/v1/authorizations/{authorization_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "authorization_id",
+        sdkName: "authorization_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.connect",
+    method: "retrieve",
+    summary: "Connect page",
+    description: "Display the user consent page for a connect_url token without requiring an API key. The page shows the requester, resource host and requested scopes before the user continues or denies.",
+    http: "GET",
+    path: "/vault/v1/connect/{token}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "token",
+        sdkName: "token"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.connect.continue",
+    method: "create",
+    summary: "Continue authorization",
+    description: "Consume a pending authorization's one-time connect token and redirect the browser to the authorization server. Expired or already used links cannot start another authorization flow.",
+    http: "POST",
+    path: "/vault/v1/connect/{token}/continue",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "token",
+        sdkName: "token"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.connect.deny",
+    method: "create",
+    summary: "Deny authorization",
+    description: "Consume a pending authorization's one-time connect token and mark it failed with access_denied. Redirect to the configured return URL, or display a result page when none was supplied.",
+    http: "POST",
+    path: "/vault/v1/connect/{token}/deny",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "token",
+        sdkName: "token"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.oauth",
+    method: "retrieveClientMetadata",
+    summary: "OAuth client metadata",
+    description: "Return the public OAuth client metadata used by authorization servers that support CIMD. The document declares the Praxis client identity and callback URL; no API key is required.",
+    http: "GET",
+    path: "/vault/v1/oauth/client.json",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "vault.settings.returnUrls",
+    method: "list",
+    summary: "Get return URLs",
+    description: "Read your account's allowlist of OAuth return URLs. The list is empty until configured, and authorization return_url values must match an entry exactly.",
+    http: "GET",
+    path: "/vault/v1/settings/return_urls",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "vault.settings.returnUrls",
+    method: "update",
+    summary: "Set return URLs",
+    description: "Replace your account's complete allowlist of OAuth return URLs. Entries are deduplicated after validation; an empty array clears the allowlist.",
+    http: "PUT",
+    path: "/vault/v1/settings/return_urls",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "urls",
+          type: "array",
+          itemType: "string",
+          required: true,
+          description: "Complete account allowlist of return URLs, matched exactly as supplied. At most 10 HTTPS URLs without credentials or fragments; duplicates are removed. Send an empty array to clear the list."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.templates",
+    method: "list",
+    summary: "List templates",
+    description: "List templates for manually supplied static secrets and OAuth authorizations. Templates provide suggested names and allowed hosts; they are not stored secrets.",
+    http: "GET",
+    path: "/vault/v1/templates",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "vault.vaults",
+    method: "list",
+    summary: "List vaults",
+    description: "List vaults belonging to your account, newest first. Archived vaults are excluded unless include_archived is true; use next_cursor to request another page.",
+    http: "GET",
+    path: "/vault/v1/vaults",
+    streaming: "no",
+    pagination: true,
+    pathParams: [],
+    query: [
+      {
+        name: "cursor",
+        type: "string",
+        required: false,
+        description: "next_cursor from the previous page."
+      },
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page."
+      },
+      {
+        name: "include_archived",
+        type: "boolean",
+        required: false,
+        description: "Include archived items."
+      }
+    ]
+  },
+  {
+    resource: "vault.vaults",
+    method: "create",
+    summary: "Create vault",
+    description: "Create an empty, active vault to hold credentials for your account, with a display name and optional metadata. Use its returned id as vault_id when creating secrets or OAuth authorizations. Unlike Anthropic, Agent sessions do not accept nonempty vault_ids; storing a credential or adding its ID to metadata does not enable vault-backed MCP authentication. Application vault references are also unavailable; praxis_vault_ref version bindings and secret writes with a vault source return 501, so creating a vault does not yet enable either consumer.",
+    http: "POST",
+    path: "/vault/v1/vaults",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "display_name",
+          type: "string",
+          required: true,
+          description: "Human-readable vault name. Leading and trailing whitespace is removed; the result must contain 1–255 Unicode code points."
+        },
+        {
+          name: "metadata",
+          type: "object",
+          required: false,
+          description: "Initial labels for the vault; omitted metadata defaults to an empty object. The same key and pair limits as Vault.metadata apply."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.vaults",
+    method: "delete",
+    summary: "Delete vault",
+    description: "Permanently delete a vault, its secrets, authorizations and previous audit events. Only a vault deletion event remains; the deleted vault can no longer be retrieved.",
+    http: "DELETE",
+    path: "/vault/v1/vaults/{vault_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults",
+    method: "retrieve",
+    summary: "Get vault",
+    description: "Retrieve a vault belonging to your account, including archived vaults and secret counts. Missing or other accounts' vaults return VAULT_NOT_FOUND.",
+    http: "GET",
+    path: "/vault/v1/vaults/{vault_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults",
+    method: "update",
+    summary: "Update vault",
+    description: "Update an active vault's display name or patch its metadata. Omitted fields are preserved; archived vaults cannot be updated.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "display_name",
+          type: "string",
+          required: false,
+          description: "Human-readable vault name. Leading and trailing whitespace is removed; the result must contain 1–255 Unicode code points."
+        },
+        {
+          name: "metadata",
+          type: "object",
+          required: false,
+          description: "Patch: a string upserts the key, null deletes it, omitted keys are kept."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.vaults",
+    method: "archive",
+    summary: "Archive vault",
+    description: "Archive a vault and all its remaining secrets, erasing their values while retaining metadata and audit history. An already archived vault is returned unchanged.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/archive",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults.events",
+    method: "list",
+    summary: "List events",
+    description: "List a vault's audit events, newest first, without secret values. Filter by secret ID or name; a name includes archived and deleted secrets that carried it. An unknown secret returns an empty page.",
+    http: "GET",
+    path: "/vault/v1/vaults/{vault_id}/events",
+    streaming: "no",
+    pagination: true,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: [
+      {
+        name: "secret",
+        type: "string",
+        required: false,
+        description: "Only events of this secret (name or vsec_ ID)."
+      },
+      {
+        name: "cursor",
+        type: "string",
+        required: false,
+        description: "next_cursor from the previous page."
+      },
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page."
+      }
+    ]
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "list",
+    summary: "List secrets",
+    description: "List secret metadata in a vault, newest first, without returning values. Archived secrets are excluded unless include_archived is true.",
+    http: "GET",
+    path: "/vault/v1/vaults/{vault_id}/secrets",
+    streaming: "no",
+    pagination: true,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: [
+      {
+        name: "cursor",
+        type: "string",
+        required: false,
+        description: "next_cursor from the previous page."
+      },
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page."
+      },
+      {
+        name: "include_archived",
+        type: "boolean",
+        required: false,
+        description: "Include archived items."
+      }
+    ]
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "create",
+    summary: "Create secret",
+    description: "Store a manually supplied token in an active vault for use on requests to its allowed_hosts. Unlike Anthropic credentials, this native operation takes name, value and allowed_hosts directly and creates only static secrets; use praxis.vault.authorizations.create for OAuth. Its name must be unused by any non-archived secret in that vault; the response contains metadata but never the supplied value. Application praxis_vault_ref bindings declare vault_id and secret (the secret name), but currently return 501; do not copy the value into a plain-text binding or metadata as a substitute.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/secrets",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "name",
+          type: "string",
+          required: true,
+          description: "Immutable lookup name: an uppercase ASCII letter or underscore, followed by up to 127 uppercase letters, digits or underscores. Must be unused by non-archived secrets in this vault."
+        },
+        {
+          name: "value",
+          type: "string",
+          required: true,
+          description: "Write-only secret value. Must be nonempty and at most 16384 UTF-8 bytes; it is never returned."
+        },
+        {
+          name: "allowed_hosts",
+          type: "array",
+          itemType: "string",
+          required: true,
+          description: "Allowed destinations for the secret. Unlike Anthropic's unrestricted networking option, an explicit allowlist is required. Supply 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed."
+        },
+        {
+          name: "description",
+          type: "string",
+          required: false,
+          description: "Human-readable note about the secret, or null when absent; at most 1024 Unicode code points."
+        },
+        {
+          name: "metadata",
+          type: "object",
+          required: false,
+          description: "Your own labels. source, template and keys starting with anthropic. are reserved and cannot be supplied."
+        },
+        {
+          name: "template_id",
+          type: "string",
+          enum: [
+            "github",
+            "openai",
+            "anthropic",
+            "stripe"
+          ],
+          required: false,
+          description: "Static template ID from List templates. Records metadata.template; name, value and allowed_hosts must still be supplied explicitly."
+        },
+        {
+          name: "kind",
+          type: "string",
+          enum: [
+            "static"
+          ],
+          required: false,
+          description: "Secret kind; only static is accepted here and is the default. Create oauth secrets through an authorization."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "delete",
+    summary: "Delete secret",
+    description: "Permanently delete a secret and its previous audit events. A deletion event retaining the secret ID and name remains, and other secrets are unchanged.",
+    http: "DELETE",
+    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      },
+      {
+        name: "secret",
+        sdkName: "secret"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "retrieve",
+    summary: "Get secret",
+    description: "Inspect a secret's kind, allowed_hosts, status and version without reading its value. Unlike Anthropic credential lookup by ID, this native operation accepts either the name or the vsec_ ID returned by secret creation or listing. A name selects a non-archived secret; use the secret ID to retrieve an archived secret.",
+    http: "GET",
+    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      },
+      {
+        name: "secret",
+        sdkName: "secret"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "update",
+    summary: "Update secret",
+    description: "Rotate a non-archived secret in an active vault by supplying value, or patch its hosts, description or metadata. Unlike Anthropic credential updates, this native operation accepts the replacement value directly, without an auth object. Each supplied value increments version, even if unchanged, and can recover an OAuth secret from refresh_failed; the secret ID, name and kind stay unchanged. Omit value for a metadata-only edit; existing references do not need a new secret ID or name.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      },
+      {
+        name: "secret",
+        sdkName: "secret"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "value",
+          type: "string",
+          required: false,
+          description: "Write-only replacement value. Must be nonempty and at most 16384 UTF-8 bytes; supplying it increments version, even when equal to the old value."
+        },
+        {
+          name: "allowed_hosts",
+          type: "array",
+          itemType: "string",
+          required: false,
+          description: "Allowed destinations for the secret. Unlike Anthropic's unrestricted networking option, an explicit allowlist is required. Supply 1–16 bare domain names, dotted-decimal IPv4 addresses or leading *. domain wildcards. A wildcard matches subdomains, not the domain itself. URLs, ports, paths, IPv6, local/private and platform hosts are rejected. Entries are lowercased, one trailing dot is removed, internationalized domains use Punycode, and duplicates are removed."
+        },
+        {
+          name: "description",
+          type: "string",
+          required: false,
+          description: "Human-readable note about the secret. Omit to preserve it or send null to clear it; at most 1024 Unicode code points."
+        },
+        {
+          name: "metadata",
+          type: "object",
+          required: false,
+          description: "Metadata patch: a string upserts a key, null deletes it and omitted keys are kept. source, template and keys starting with anthropic. cannot be set or deleted."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "archive",
+    summary: "Archive secret",
+    description: "Archive a secret, erase its value and release its name for reuse. Metadata and audit history remain; use its ID for subsequent reads or repeated archive requests.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}/archive",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      },
+      {
+        name: "secret",
+        sdkName: "secret"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults.secrets.refresh",
+    method: "create",
+    summary: "Refresh secret",
+    description: "Request an OAuth secret refresh and return its current metadata without token values. Refresh may be skipped if already in progress, unavailable or in refresh_failed; inspect the returned status and oauth fields.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}/refresh",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      },
+      {
+        name: "secret",
+        sdkName: "secret"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "reason",
+          type: "string",
+          enum: [
+            "unauthorized"
+          ],
+          required: false,
+          description: "Optional refresh trigger: unauthorized reports that the resource rejected the access token. Omit for a manual refresh; both request a refresh regardless of its scheduled time."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.vaults.secrets.validate",
+    method: "create",
+    summary: "Validate secret",
+    description: "Probe an OAuth secret's resource with its access token, attempting refresh first if the token has expired. Return the validation verdict and sanitized HTTP summaries; static secrets are unsupported.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/secrets/{secret}/validate",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      },
+      {
+        name: "secret",
+        sdkName: "secret"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "vault.vaults.secrets",
+    method: "import",
+    summary: "Import secrets",
+    description: "Import lines or dotenv text into an active vault, reporting success or failure for each entry. Existing names have their values replaced; their hosts change only when that line supplies allowed_hosts. Shared hosts apply only to newly created secrets.",
+    http: "POST",
+    path: "/vault/v1/vaults/{vault_id}/secrets:import",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "vault_id",
+        sdkName: "vault_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "lines",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Entries to import, each succeeding or failing independently. Supply 1–50 entries and omit dotenv."
+        },
+        {
+          name: "dotenv",
+          type: "string",
+          required: false,
+          description: "KEY=VALUE text to import instead of lines. Blank lines and comments are ignored; export prefixes and single- or double-quoted values are supported. Supply 1–50 parsed entries; multiline quoted values are unsupported."
+        },
+        {
+          name: "allowed_hosts",
+          type: "array",
+          itemType: "string",
+          required: false,
+          description: "Default hosts for newly created secrets whose entry omits allowed_hosts. Never changes the hosts of an existing secret; use per-line allowed_hosts for that. Uses the same host rules as Create secret."
+        }
+      ]
+    }
+  },
+  {
+    resource: "vault.vaults",
+    method: "check",
+    summary: "Check vaults",
+    description: "Check the availability of each supplied vault ID in request order. Missing, malformed and other accounts' IDs all return not_found; duplicate IDs are preserved.",
+    http: "POST",
+    path: "/vault/v1/vaults:check",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
     body: {
       required: true,
       fields: [
@@ -15937,6 +17414,19 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ baseUrl: "https://api.deepraxis.com" }));
 
 // ../../packages/sdk/typescript/src/generated/sdk.gen.ts
+var applyAgentVersion = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/versions/{version}/apply",
+  ...options
+});
 var unarchiveAgent = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
@@ -20047,96 +21537,436 @@ var mediaVisualSearch = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
-var mediaSemanticSearch = (options) => (options.client ?? client).post({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/search/semantic",
+var mediaSemanticSearch = (options) => (options.client ?? client).post({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/search/semantic",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var mediaSearch = (options) => (options.client ?? client).post({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/search",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var mediaListFolders = (options) => (options.client ?? client).get({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/folders",
+  ...options
+});
+var mediaCreateBatch = (options) => (options.client ?? client).post({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/batches",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var mediaGetBatch = (options) => (options.client ?? client).get({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/batches/{job_id}",
+  ...options
+});
+var mediaBatchAssets = (options) => (options.client ?? client).post({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/assets:batch",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var mediaGetJob = (options) => (options.client ?? client).get({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/jobs/{job_id}",
+  ...options
+});
+var mediaListEvents = (options) => (options.client ?? client).get({
+  security: [{
+    key: "media-BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/media/v1/libraries/{library_id}/events",
+  ...options
+});
+var getSandboxV1Sandboxes = (options) => (options?.client ?? client).get({
+  querySerializer: { parameters: { state: { array: { explode: false } } } },
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/sandboxes",
+  ...options
+});
+var postSandboxV1Sandboxes = (options) => (options.client ?? client).post({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/sandboxes",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var getSandboxV1SandboxesBySandboxIdMetrics = (options) => (options.client ?? client).get({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/sandboxes/{sandboxID}/metrics",
+  ...options
+});
+var postSandboxV1SandboxesBySandboxIdPause = (options) => (options.client ?? client).post({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/sandboxes/{sandboxID}/pause",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.client ?? client).post({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/sandboxes/{sandboxID}/timeout",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var mediaSearch = (options) => (options.client ?? client).post({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/search",
+var postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.client ?? client).post({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/sandboxes/{sandboxID}/connect",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var mediaListFolders = (options) => (options.client ?? client).get({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/folders",
+var getSandboxV1Templates = (options) => (options?.client ?? client).get({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/templates",
   ...options
 });
-var mediaCreateBatch = (options) => (options.client ?? client).post({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/batches",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
-});
-var mediaGetBatch = (options) => (options.client ?? client).get({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/batches/{job_id}",
+var getSandboxV1Volumes = (options) => (options?.client ?? client).get({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/volumes",
   ...options
 });
-var mediaBatchAssets = (options) => (options.client ?? client).post({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/assets:batch",
+var postSandboxV1Volumes = (options) => (options.client ?? client).post({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/volumes",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var mediaGetJob = (options) => (options.client ?? client).get({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/jobs/{job_id}",
-  ...options
-});
-var mediaListEvents = (options) => (options.client ?? client).get({
-  security: [{
-    key: "media-BearerAuth",
-    scheme: "bearer",
-    type: "http"
-  }],
-  url: "/media/v1/libraries/{library_id}/events",
+var deleteSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).delete({
+  security: [
+    {
+      key: "sandbox-ApiKeyAuth",
+      name: "X-API-Key",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AuthProviderBearerAuth",
+      scheme: "bearer",
+      type: "http"
+    },
+    {
+      key: "sandbox-AuthProviderTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    { name: "X-Admin-Token", type: "apiKey" },
+    {
+      key: "sandbox-AdminTeamAuth",
+      name: "X-Team-ID",
+      type: "apiKey"
+    },
+    {
+      key: "sandbox-AdminJWTAuth",
+      scheme: "bearer",
+      type: "http"
+    }
+  ],
+  url: "/sandbox/v1/volumes/{volumeID}",
   ...options
 });
-var getSandboxV1Sandboxes = (options) => (options?.client ?? client).get({
-  querySerializer: { parameters: { state: { array: { explode: false } } } },
+var getSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).get({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20165,10 +21995,10 @@ var getSandboxV1Sandboxes = (options) => (options?.client ?? client).get({
       type: "http"
     }
   ],
-  url: "/sandbox/v1/sandboxes",
+  url: "/sandbox/v1/volumes/{volumeID}",
   ...options
 });
-var postSandboxV1Sandboxes = (options) => (options.client ?? client).post({
+var postSandboxV1SandboxesBySandboxIdFork = (options) => (options.client ?? client).post({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20197,14 +22027,14 @@ var postSandboxV1Sandboxes = (options) => (options.client ?? client).post({
       type: "http"
     }
   ],
-  url: "/sandbox/v1/sandboxes",
+  url: "/sandbox/v1/sandboxes/{sandboxID}/fork",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var getSandboxV1SandboxesBySandboxIdMetrics = (options) => (options.client ?? client).get({
+var postSandboxV1SandboxesBySandboxIdSnapshots = (options) => (options.client ?? client).post({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20233,10 +22063,14 @@ var getSandboxV1SandboxesBySandboxIdMetrics = (options) => (options.client ?? cl
       type: "http"
     }
   ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/metrics",
-  ...options
+  url: "/sandbox/v1/sandboxes/{sandboxID}/snapshots",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
 });
-var postSandboxV1SandboxesBySandboxIdPause = (options) => (options.client ?? client).post({
+var getSandboxV1Snapshots = (options) => (options?.client ?? client).get({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20265,14 +22099,10 @@ var postSandboxV1SandboxesBySandboxIdPause = (options) => (options.client ?? cli
       type: "http"
     }
   ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/pause",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/sandbox/v1/snapshots",
+  ...options
 });
-var postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.client ?? client).post({
+var deleteSandboxV1SnapshotsBySnapshotId = (options) => (options.client ?? client).delete({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20301,14 +22131,10 @@ var postSandboxV1SandboxesBySandboxIdTimeout = (options) => (options.client ?? c
       type: "http"
     }
   ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/timeout",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/sandbox/v1/snapshots/{snapshotID}",
+  ...options
 });
-var postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.client ?? client).post({
+var putSandboxV1SandboxesBySandboxIdNetwork = (options) => (options.client ?? client).put({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20337,14 +22163,14 @@ var postSandboxV1SandboxesBySandboxIdConnect = (options) => (options.client ?? c
       type: "http"
     }
   ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/connect",
+  url: "/sandbox/v1/sandboxes/{sandboxID}/network",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var getSandboxV1Templates = (options) => (options?.client ?? client).get({
+var getSandboxV1SandboxesBySandboxIdLogs = (options) => (options.client ?? client).get({
   security: [
     {
       key: "sandbox-ApiKeyAuth",
@@ -20373,636 +22199,876 @@ var getSandboxV1Templates = (options) => (options?.client ?? client).get({
       type: "http"
     }
   ],
-  url: "/sandbox/v1/templates",
+  url: "/sandbox/v1/sandboxes/{sandboxID}/logs",
+  ...options
+});
+var searchSearch = (options) => (options.client ?? client).post({
+  security: [{
+    key: "search-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/search/v1/search",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var searchExtract = (options) => (options.client ?? client).post({
+  security: [{
+    key: "search-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/search/v1/extract",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var searchCrawl = (options) => (options.client ?? client).post({
+  security: [{
+    key: "search-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/search/v1/crawl",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var searchMap = (options) => (options.client ?? client).post({
+  security: [{
+    key: "search-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/search/v1/map",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultListVaults = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults",
+  ...options
+});
+var vaultCreateVault = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultCheckVaults = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults:check",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultDeleteVault = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}",
+  ...options
+});
+var vaultGetVault = (options) => (options.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}",
+  ...options
+});
+var vaultUpdateVault = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultArchiveVault = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/archive",
+  ...options
+});
+var vaultListEvents = (options) => (options.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/events",
+  ...options
+});
+var vaultListSecrets = (options) => (options.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets",
+  ...options
+});
+var vaultCreateSecret = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultImportSecrets = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets:import",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultDeleteSecret = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+  ...options
+});
+var vaultGetSecret = (options) => (options.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+  ...options
+});
+var vaultUpdateSecret = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultArchiveSecret = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}/archive",
   ...options
 });
-var getSandboxV1Volumes = (options) => (options?.client ?? client).get({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/volumes",
+var vaultValidateSecret = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}/validate",
   ...options
 });
-var postSandboxV1Volumes = (options) => (options.client ?? client).post({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/volumes",
+var vaultRefreshSecret = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}/refresh",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var deleteSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).delete({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/volumes/{volumeID}",
+var vaultListTemplates = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/templates",
   ...options
 });
-var getSandboxV1VolumesByVolumeId = (options) => (options.client ?? client).get({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/volumes/{volumeID}",
+var vaultCreateAuthorization = (options) => (options.client ?? client).post({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/authorizations",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var vaultGetAuthorization = (options) => (options.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/authorizations/{authorization_id}",
   ...options
 });
-var postSandboxV1SandboxesBySandboxIdFork = (options) => (options.client ?? client).post({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/fork",
+var vaultGetReturnUrls = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/settings/return_urls",
+  ...options
+});
+var vaultSetReturnUrls = (options) => (options.client ?? client).put({
+  security: [{
+    key: "vault-bearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }],
+  url: "/vault/v1/settings/return_urls",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var postSandboxV1SandboxesBySandboxIdSnapshots = (options) => (options.client ?? client).post({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/snapshots",
+var vaultAuthorizationCallback = (options) => (options?.client ?? client).get({ url: "/vault/v1/authorizations/callback", ...options });
+var vaultOAuthClientMetadata = (options) => (options?.client ?? client).get({ url: "/vault/v1/oauth/client.json", ...options });
+var vaultConnectPage = (options) => (options.client ?? client).get({ url: "/vault/v1/connect/{token}", ...options });
+var vaultConnectContinue = (options) => (options.client ?? client).post({ url: "/vault/v1/connect/{token}/continue", ...options });
+var vaultConnectDeny = (options) => (options.client ?? client).post({ url: "/vault/v1/connect/{token}/deny", ...options });
+var ticketGetTickets = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets",
+  ...options
+});
+var ticketPostTickets = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var getSandboxV1Snapshots = (options) => (options?.client ?? client).get({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/snapshots",
+var ticketGetTicketsNumber = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets/{number}",
   ...options
 });
-var deleteSandboxV1SnapshotsBySnapshotId = (options) => (options.client ?? client).delete({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/snapshots/{snapshotID}",
+var ticketPatchTicketsNumber = (options) => (options.client ?? client).patch({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets/{number}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var ticketDeleteTicketsNumberLock = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets/{number}/lock",
   ...options
 });
-var putSandboxV1SandboxesBySandboxIdNetwork = (options) => (options.client ?? client).put({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/network",
+var ticketPutTicketsNumberLock = (options) => (options.client ?? client).put({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets/{number}/lock",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var getSandboxV1SandboxesBySandboxIdLogs = (options) => (options.client ?? client).get({
-  security: [
-    {
-      key: "sandbox-ApiKeyAuth",
-      name: "X-API-Key",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AuthProviderBearerAuth",
-      scheme: "bearer",
-      type: "http"
-    },
-    {
-      key: "sandbox-AuthProviderTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    { name: "X-Admin-Token", type: "apiKey" },
-    {
-      key: "sandbox-AdminTeamAuth",
-      name: "X-Team-ID",
-      type: "apiKey"
-    },
-    {
-      key: "sandbox-AdminJWTAuth",
-      scheme: "bearer",
-      type: "http"
-    }
-  ],
-  url: "/sandbox/v1/sandboxes/{sandboxID}/logs",
+var ticketGetTicketsNumberComments = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/tickets/{number}/comments",
   ...options
 });
-var searchSearch = (options) => (options.client ?? client).post({
+var ticketPostTicketsNumberComments = (options) => (options.client ?? client).post({
   security: [{
-    key: "search-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/search/v1/search",
+  url: "/ticket/v1/tickets/{number}/comments",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var searchExtract = (options) => (options.client ?? client).post({
+var ticketDeleteCommentsId = (options) => (options.client ?? client).delete({
   security: [{
-    key: "search-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/search/v1/extract",
+  url: "/ticket/v1/comments/{id}",
+  ...options
+});
+var ticketGetCommentsId = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/comments/{id}",
+  ...options
+});
+var ticketPatchCommentsId = (options) => (options.client ?? client).patch({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/comments/{id}",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var searchCrawl = (options) => (options.client ?? client).post({
+var ticketGetLabels = (options) => (options?.client ?? client).get({
   security: [{
-    key: "search-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/search/v1/crawl",
+  url: "/ticket/v1/labels",
+  ...options
+});
+var ticketPostLabels = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/labels",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var searchMap = (options) => (options.client ?? client).post({
+var ticketDeleteLabelsName = (options) => (options.client ?? client).delete({
   security: [{
-    key: "search-bearerAuth",
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/labels/{name}",
+  ...options
+});
+var ticketPatchLabelsName = (options) => (options.client ?? client).patch({
+  security: [{
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/search/v1/map",
+  url: "/ticket/v1/labels/{name}",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultListVaults = (options) => (options?.client ?? client).get({
+var ticketGetTypes = (options) => (options?.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults",
+  url: "/ticket/v1/types",
   ...options
 });
-var vaultCreateVault = (options) => (options.client ?? client).post({
+var ticketGetMilestones = (options) => (options?.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/ticket/v1/milestones",
+  ...options
 });
-var vaultCheckVaults = (options) => (options.client ?? client).post({
+var ticketPostMilestones = (options) => (options.client ?? client).post({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults:check",
+  url: "/ticket/v1/milestones",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultDeleteVault = (options) => (options.client ?? client).delete({
+var ticketDeleteMilestonesNumber = (options) => (options.client ?? client).delete({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}",
+  url: "/ticket/v1/milestones/{number}",
   ...options
 });
-var vaultGetVault = (options) => (options.client ?? client).get({
+var ticketGetMilestonesNumber = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}",
+  url: "/ticket/v1/milestones/{number}",
   ...options
 });
-var vaultUpdateVault = (options) => (options.client ?? client).post({
+var ticketPatchMilestonesNumber = (options) => (options.client ?? client).patch({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}",
+  url: "/ticket/v1/milestones/{number}",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultArchiveVault = (options) => (options.client ?? client).post({
+var ticketGetTicketsNumberSubTickets = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/archive",
+  url: "/ticket/v1/tickets/{number}/sub_tickets",
   ...options
 });
-var vaultListEvents = (options) => (options.client ?? client).get({
+var ticketPostTicketsNumberSubTickets = (options) => (options.client ?? client).post({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/events",
-  ...options
+  url: "/ticket/v1/tickets/{number}/sub_tickets",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
 });
-var vaultListSecrets = (options) => (options.client ?? client).get({
+var ticketDeleteTicketsNumberSubTicketsChild = (options) => (options.client ?? client).delete({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets",
+  url: "/ticket/v1/tickets/{number}/sub_tickets/{child}",
   ...options
 });
-var vaultCreateSecret = (options) => (options.client ?? client).post({
+var ticketGetTicketsNumberDependenciesBlockedBy = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/ticket/v1/tickets/{number}/dependencies/blocked_by",
+  ...options
 });
-var vaultImportSecrets = (options) => (options.client ?? client).post({
+var ticketPostTicketsNumberDependenciesBlockedBy = (options) => (options.client ?? client).post({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets:import",
+  url: "/ticket/v1/tickets/{number}/dependencies/blocked_by",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultDeleteSecret = (options) => (options.client ?? client).delete({
+var ticketDeleteTicketsNumberDependenciesBlockedByN = (options) => (options.client ?? client).delete({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+  url: "/ticket/v1/tickets/{number}/dependencies/blocked_by/{n}",
   ...options
 });
-var vaultGetSecret = (options) => (options.client ?? client).get({
+var ticketGetTicketsNumberRelations = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+  url: "/ticket/v1/tickets/{number}/relations",
   ...options
 });
-var vaultUpdateSecret = (options) => (options.client ?? client).post({
+var ticketPostTicketsNumberRelations = (options) => (options.client ?? client).post({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}",
+  url: "/ticket/v1/tickets/{number}/relations",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultArchiveSecret = (options) => (options.client ?? client).post({
+var ticketDeleteTicketsNumberRelationsN = (options) => (options.client ?? client).delete({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}/archive",
+  url: "/ticket/v1/tickets/{number}/relations/{n}",
   ...options
 });
-var vaultValidateSecret = (options) => (options.client ?? client).post({
+var ticketGetTicketsNumberDependenciesBlocking = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}/validate",
+  url: "/ticket/v1/tickets/{number}/dependencies/blocking",
   ...options
 });
-var vaultRefreshSecret = (options) => (options.client ?? client).post({
+var ticketGetTicketsNumberEvents = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/vaults/{vault_id}/secrets/{secret}/refresh",
-  ...options,
-  headers: {
-    "Content-Type": "application/json",
-    ...options.headers
-  }
+  url: "/ticket/v1/tickets/{number}/events",
+  ...options
 });
-var vaultListTemplates = (options) => (options?.client ?? client).get({
+var ticketGetTicketsNumberReactions = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/templates",
+  url: "/ticket/v1/tickets/{number}/reactions",
   ...options
 });
-var vaultCreateAuthorization = (options) => (options.client ?? client).post({
+var ticketPostTicketsNumberReactions = (options) => (options.client ?? client).post({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/authorizations",
+  url: "/ticket/v1/tickets/{number}/reactions",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultGetAuthorization = (options) => (options.client ?? client).get({
+var ticketDeleteTicketsNumberReactionsContent = (options) => (options.client ?? client).delete({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/authorizations/{authorization_id}",
+  url: "/ticket/v1/tickets/{number}/reactions/{content}",
   ...options
 });
-var vaultGetReturnUrls = (options) => (options?.client ?? client).get({
+var ticketGetCommentsIdReactions = (options) => (options.client ?? client).get({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/settings/return_urls",
+  url: "/ticket/v1/comments/{id}/reactions",
   ...options
 });
-var vaultSetReturnUrls = (options) => (options.client ?? client).put({
+var ticketPostCommentsIdReactions = (options) => (options.client ?? client).post({
   security: [{
-    key: "vault-bearerAuth",
+    key: "BearerAuth",
     scheme: "bearer",
     type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
   }],
-  url: "/vault/v1/settings/return_urls",
+  url: "/ticket/v1/comments/{id}/reactions",
   ...options,
   headers: {
     "Content-Type": "application/json",
     ...options.headers
   }
 });
-var vaultAuthorizationCallback = (options) => (options?.client ?? client).get({ url: "/vault/v1/authorizations/callback", ...options });
-var vaultOAuthClientMetadata = (options) => (options?.client ?? client).get({ url: "/vault/v1/oauth/client.json", ...options });
-var vaultConnectPage = (options) => (options.client ?? client).get({ url: "/vault/v1/connect/{token}", ...options });
-var vaultConnectContinue = (options) => (options.client ?? client).post({ url: "/vault/v1/connect/{token}/continue", ...options });
-var vaultConnectDeny = (options) => (options.client ?? client).post({ url: "/vault/v1/connect/{token}/deny", ...options });
+var ticketDeleteCommentsIdReactionsContent = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/comments/{id}/reactions/{content}",
+  ...options
+});
+var ticketGetActivity = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/activity",
+  ...options
+});
+var ticketGetRepositories = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/ticket/v1/repositories",
+  ...options
+});
 
 // ../../packages/sdk/typescript/src/core/pagination.ts
 class Page {
@@ -21106,6 +23172,7 @@ function createAgent(transport) {
       },
       update: bind(transport, agentsUpdate),
       versions: {
+        apply: bind(transport, applyAgentVersion),
         list: bind(transport, agentsVersionsList)
       }
     },
@@ -21780,6 +23847,80 @@ function createSearch(transport) {
     }
   };
 }
+function createTicket(transport) {
+  return {
+    activity: {
+      retrieve: bind(transport, ticketGetActivity)
+    },
+    comments: {
+      delete: bind(transport, ticketDeleteCommentsId),
+      reactions: {
+        create: bind(transport, ticketPostCommentsIdReactions),
+        delete: bind(transport, ticketDeleteCommentsIdReactionsContent),
+        list: bind(transport, ticketGetCommentsIdReactions)
+      },
+      retrieve: bind(transport, ticketGetCommentsId),
+      update: bind(transport, ticketPatchCommentsId)
+    },
+    labels: {
+      create: bind(transport, ticketPostLabels),
+      delete: bind(transport, ticketDeleteLabelsName),
+      list: bind(transport, ticketGetLabels),
+      update: bind(transport, ticketPatchLabelsName)
+    },
+    milestones: {
+      create: bind(transport, ticketPostMilestones),
+      delete: bind(transport, ticketDeleteMilestonesNumber),
+      list: bind(transport, ticketGetMilestones),
+      retrieve: bind(transport, ticketGetMilestonesNumber),
+      update: bind(transport, ticketPatchMilestonesNumber)
+    },
+    repositories: {
+      list: bind(transport, ticketGetRepositories)
+    },
+    tickets: {
+      comments: {
+        create: bind(transport, ticketPostTicketsNumberComments),
+        list: bind(transport, ticketGetTicketsNumberComments)
+      },
+      create: bind(transport, ticketPostTickets),
+      deleteLock: bind(transport, ticketDeleteTicketsNumberLock),
+      dependencies: {
+        blockedBy: {
+          create: bind(transport, ticketPostTicketsNumberDependenciesBlockedBy),
+          delete: bind(transport, ticketDeleteTicketsNumberDependenciesBlockedByN)
+        },
+        retrieveBlockedBy: bind(transport, ticketGetTicketsNumberDependenciesBlockedBy),
+        retrieveBlocking: bind(transport, ticketGetTicketsNumberDependenciesBlocking)
+      },
+      events: {
+        list: bind(transport, ticketGetTicketsNumberEvents)
+      },
+      list: bind(transport, ticketGetTickets),
+      reactions: {
+        create: bind(transport, ticketPostTicketsNumberReactions),
+        delete: bind(transport, ticketDeleteTicketsNumberReactionsContent),
+        list: bind(transport, ticketGetTicketsNumberReactions)
+      },
+      relations: {
+        create: bind(transport, ticketPostTicketsNumberRelations),
+        delete: bind(transport, ticketDeleteTicketsNumberRelationsN),
+        list: bind(transport, ticketGetTicketsNumberRelations)
+      },
+      retrieve: bind(transport, ticketGetTicketsNumber),
+      subTickets: {
+        create: bind(transport, ticketPostTicketsNumberSubTickets),
+        delete: bind(transport, ticketDeleteTicketsNumberSubTicketsChild),
+        list: bind(transport, ticketGetTicketsNumberSubTickets)
+      },
+      update: bind(transport, ticketPatchTicketsNumber),
+      updateLock: bind(transport, ticketPutTicketsNumberLock)
+    },
+    types: {
+      list: bind(transport, ticketGetTypes)
+    }
+  };
+}
 function createVault(transport) {
   return {
     authorizations: {
@@ -21851,6 +23992,7 @@ var resourceFactories = {
   organization: createOrganization,
   sandbox: createSandbox,
   search: createSearch,
+  ticket: createTicket,
   vault: createVault
 };
 
@@ -23839,7 +25981,7 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.1.0-dev.c01abef";
+var version = "0.1.0-dev.c45414d";
 var commands = commandTree(operations);
 var manual = [["login"], ["logout"], ["whoami"], ["org", "list"], ["org", "switch"], ["api"], ["skill"]];
 function route(argv) {