@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/dist/vaults.d.ts

@@ -0,0 +1,1286 @@
+/**
+ * Vaults: the Opengeni secrets model (replaces variable sets).
+ *
+ * A vault holds a flat list of items; an item holds named fields; hosted
+ * fields keep encrypted versions. Every type here is `z.infer` of its schema.
+ *
+ * This module must not import runtime values from `./index` (the index
+ * re-exports it); only types cross that edge.
+ */
+import { z } from "zod";
+export declare const VaultOwnerKind: z.ZodEnum<{
+    organization: "organization";
+    task: "task";
+    user: "user";
+    workspace: "workspace";
+}>;
+export type VaultOwnerKind = z.infer<typeof VaultOwnerKind>;
+export declare const VaultSource: z.ZodEnum<{
+    host: "host";
+    onepassword: "onepassword";
+    opengeni: "opengeni";
+}>;
+export type VaultSource = z.infer<typeof VaultSource>;
+export declare const VaultMode: z.ZodEnum<{
+    read_only: "read_only";
+    read_write: "read_write";
+}>;
+export type VaultMode = z.infer<typeof VaultMode>;
+export declare const VaultSyncStatus: z.ZodEnum<{
+    auth_expired: "auth_expired";
+    error: "error";
+    ok: "ok";
+    rate_limited: "rate_limited";
+    syncing: "syncing";
+}>;
+export type VaultSyncStatus = z.infer<typeof VaultSyncStatus>;
+export declare const VaultItemType: z.ZodEnum<{
+    api_key: "api_key";
+    file: "file";
+    login: "login";
+    note: "note";
+    passkey: "passkey";
+}>;
+export type VaultItemType = z.infer<typeof VaultItemType>;
+export declare const VaultFieldKind: z.ZodEnum<{
+    concealed: "concealed";
+    file: "file";
+    text: "text";
+    totp: "totp";
+}>;
+export type VaultFieldKind = z.infer<typeof VaultFieldKind>;
+/** Lookup order for references that name no vault; index = tier. */
+export declare const VAULT_LOOKUP_TIERS: readonly ["task", "user", "workspace", "organization"];
+export type VaultLookupTier = (typeof VAULT_LOOKUP_TIERS)[number];
+export declare const VAULT_LIMITS: {
+    readonly vaultsPerOwnerScope: 200;
+    readonly itemsPerVault: 2000;
+    readonly fieldsPerItem: 50;
+    readonly versionsPerField: 10;
+    readonly nameMaxChars: 120;
+    readonly descriptionMaxChars: 2000;
+    readonly websitesPerItem: 20;
+    readonly websiteMaxChars: 2048;
+    readonly textValueMaxBytes: 65536;
+    readonly fileValueMaxBytes: 262144;
+    readonly referenceMaxChars: 300;
+    readonly execEnvMaxBytes: 262144;
+    readonly execValueMaxBytes: 102400;
+    readonly policyVaultIdsMax: 200;
+    readonly searchResultsMax: 50;
+    /** Items one agent search call examines before it returns a cursor. */
+    readonly searchScanMax: 1000;
+    readonly searchCursorMaxChars: 1024;
+    readonly providerReadsPerAttempt: 50;
+    readonly providerValueCacheMs: 60000;
+};
+/** Default names of lazily created hosted vaults (Q-06). */
+export declare const DEFAULT_VAULT_NAMES: {
+    readonly user: "Private";
+    readonly workspace: "Shared";
+    readonly task: "Task";
+};
+/** Default primary field per item type (§10B.2); passkeys have none. */
+export declare const VAULT_DEFAULT_PRIMARY_FIELD: Readonly<Record<VaultItemType, string | null>>;
+/** Fixed passkey fields (D20). `privateKey` is concealed; the rest are text. */
+export declare const PASSKEY_FIELD_NAMES: readonly ["rpId", "credentialId", "userHandle", "userName", "privateKey"];
+/**
+ * Q-10: 1–120 characters, no `/ { } # \` or control characters, no leading
+ * or trailing whitespace, and not starting with `id:` (reserved for the ID
+ * reference form). Interior spaces and any other Unicode are allowed.
+ */
+export declare function isValidSecretName(name: string): boolean;
+/** True when `name` is reserved as a field name (the `/otp` suffix). */
+export declare function isReservedVaultFieldName(name: string): boolean;
+export declare const VaultName: z.ZodString;
+export declare const VaultFieldName: z.ZodString;
+export declare const VaultPolicy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"all">;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"selected">;
+    vaultIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "mode">;
+export type VaultPolicy = z.infer<typeof VaultPolicy>;
+export declare const VAULT_POLICY_ALL: VaultPolicy;
+/**
+ * Intersect two policies. `all` is the identity; two selections keep the IDs
+ * present in both (order of `a`).
+ */
+export declare function intersectVaultPolicies(a: VaultPolicy, b: VaultPolicy): VaultPolicy;
+export declare const VaultAvailability: z.ZodObject<{
+    allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    allowPersonalWorkspaces: z.ZodBoolean;
+}, z.core.$strict>;
+export type VaultAvailability = z.infer<typeof VaultAvailability>;
+export declare const VaultSummary: z.ZodObject<{
+    id: z.ZodString;
+    workspaceId: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        task: "task";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    ownerLabel: z.ZodString;
+    rootSessionId: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    source: z.ZodEnum<{
+        host: "host";
+        onepassword: "onepassword";
+        opengeni: "opengeni";
+    }>;
+    mode: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+    }>;
+    syncStatus: z.ZodEnum<{
+        auth_expired: "auth_expired";
+        error: "error";
+        ok: "ok";
+        rate_limited: "rate_limited";
+        syncing: "syncing";
+    }>;
+    syncErrorCode: z.ZodNullable<z.ZodString>;
+    syncErrorMessage: z.ZodNullable<z.ZodString>;
+    lastSyncedAt: z.ZodNullable<z.ZodString>;
+    rateLimitedUntil: z.ZodNullable<z.ZodString>;
+    providerConnectionId: z.ZodNullable<z.ZodString>;
+    availability: z.ZodNullable<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+    isDefault: z.ZodBoolean;
+    itemCount: z.ZodNumber;
+    canWrite: z.ZodBoolean;
+    canManage: z.ZodBoolean;
+    generation: z.ZodNumber;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type VaultSummary = z.infer<typeof VaultSummary>;
+export declare const VaultItemReferences: z.ZodObject<{
+    primary: z.ZodNullable<z.ZodString>;
+    otp: z.ZodNullable<z.ZodString>;
+    byField: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+export type VaultItemReferences = z.infer<typeof VaultItemReferences>;
+export declare const VaultItemSummary: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>;
+    name: z.ZodString;
+    websites: z.ZodArray<z.ZodString>;
+    username: z.ZodNullable<z.ZodString>;
+    hasTotp: z.ZodBoolean;
+    hasPasskey: z.ZodBoolean;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    archivedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type VaultItemSummary = z.infer<typeof VaultItemSummary>;
+export declare const VaultItemField: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>;
+    position: z.ZodNumber;
+    currentVersion: z.ZodNullable<z.ZodNumber>;
+    value: z.ZodNullable<z.ZodString>;
+    fileName: z.ZodNullable<z.ZodString>;
+    fileSize: z.ZodNullable<z.ZodNumber>;
+    reference: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type VaultItemField = z.infer<typeof VaultItemField>;
+export declare const PasskeySummary: z.ZodObject<{
+    rpId: z.ZodString;
+    userName: z.ZodNullable<z.ZodString>;
+    credentialIdSuffix: z.ZodString;
+    signCount: z.ZodNumber;
+    leasedUntil: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PasskeySummary = z.infer<typeof PasskeySummary>;
+export declare const VaultItem: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>;
+    name: z.ZodString;
+    websites: z.ZodArray<z.ZodString>;
+    username: z.ZodNullable<z.ZodString>;
+    hasTotp: z.ZodBoolean;
+    hasPasskey: z.ZodBoolean;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    archivedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+    fields: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>;
+        position: z.ZodNumber;
+        currentVersion: z.ZodNullable<z.ZodNumber>;
+        value: z.ZodNullable<z.ZodString>;
+        fileName: z.ZodNullable<z.ZodString>;
+        fileSize: z.ZodNullable<z.ZodNumber>;
+        reference: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+    passkey: z.ZodNullable<z.ZodObject<{
+        rpId: z.ZodString;
+        userName: z.ZodNullable<z.ZodString>;
+        credentialIdSuffix: z.ZodString;
+        signCount: z.ZodNumber;
+        leasedUntil: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    aliases: z.ZodArray<z.ZodString>;
+    primaryFieldId: z.ZodNullable<z.ZodString>;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    generation: z.ZodNumber;
+}, z.core.$strip>;
+export type VaultItem = z.infer<typeof VaultItem>;
+export declare const VaultVersionCreatedByKind: z.ZodEnum<{
+    agent: "agent";
+    api_key: "api_key";
+    human: "human";
+    migration: "migration";
+    provider: "provider";
+    system: "system";
+}>;
+export type VaultVersionCreatedByKind = z.infer<typeof VaultVersionCreatedByKind>;
+export declare const VaultFieldVersionMeta: z.ZodObject<{
+    version: z.ZodNumber;
+    current: z.ZodBoolean;
+    createdAt: z.ZodString;
+    createdByKind: z.ZodEnum<{
+        agent: "agent";
+        api_key: "api_key";
+        human: "human";
+        migration: "migration";
+        provider: "provider";
+        system: "system";
+    }>;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type VaultFieldVersionMeta = z.infer<typeof VaultFieldVersionMeta>;
+export declare const CreateVaultRequest: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    availability: z.ZodOptional<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CreateVaultRequest = z.infer<typeof CreateVaultRequest>;
+export declare const UpdateVaultRequest: z.ZodObject<{
+    expectedGeneration: z.ZodNumber;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availability: z.ZodOptional<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type UpdateVaultRequest = z.infer<typeof UpdateVaultRequest>;
+export declare const DeleteVaultRequest: z.ZodObject<{
+    confirmName: z.ZodString;
+}, z.core.$strict>;
+export type DeleteVaultRequest = z.infer<typeof DeleteVaultRequest>;
+declare const VALUE_SOURCE_KEYS: readonly ["value", "generate", "fromReference", "fileBase64", "restoreVersion", "remove"];
+/** Exactly one value source per field input. */
+export declare function exactlyOneValueSource(input: Partial<Record<(typeof VALUE_SOURCE_KEYS)[number], unknown>>): boolean;
+export declare const VaultFieldInput: z.ZodObject<{
+    fieldId: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>>;
+    value: z.ZodOptional<z.ZodString>;
+    generate: z.ZodOptional<z.ZodObject<{
+        length: z.ZodDefault<z.ZodNumber>;
+        lowercase: z.ZodDefault<z.ZodBoolean>;
+        uppercase: z.ZodDefault<z.ZodBoolean>;
+        digits: z.ZodDefault<z.ZodBoolean>;
+        symbols: z.ZodDefault<z.ZodBoolean>;
+        symbolSet: z.ZodDefault<z.ZodString>;
+        excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+        requireEachClass: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    fromReference: z.ZodOptional<z.ZodString>;
+    fileBase64: z.ZodOptional<z.ZodString>;
+    fileName: z.ZodOptional<z.ZodString>;
+    restoreVersion: z.ZodOptional<z.ZodNumber>;
+    remove: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type VaultFieldInput = z.infer<typeof VaultFieldInput>;
+export declare const CreateVaultItemRequest: z.ZodObject<{
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>;
+    name: z.ZodString;
+    websites: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    fields: z.ZodArray<z.ZodObject<{
+        fieldId: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>>;
+        value: z.ZodOptional<z.ZodString>;
+        generate: z.ZodOptional<z.ZodObject<{
+            length: z.ZodDefault<z.ZodNumber>;
+            lowercase: z.ZodDefault<z.ZodBoolean>;
+            uppercase: z.ZodDefault<z.ZodBoolean>;
+            digits: z.ZodDefault<z.ZodBoolean>;
+            symbols: z.ZodDefault<z.ZodBoolean>;
+            symbolSet: z.ZodDefault<z.ZodString>;
+            excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+            requireEachClass: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        fromReference: z.ZodOptional<z.ZodString>;
+        fileBase64: z.ZodOptional<z.ZodString>;
+        fileName: z.ZodOptional<z.ZodString>;
+        restoreVersion: z.ZodOptional<z.ZodNumber>;
+        remove: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>;
+    primaryFieldName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CreateVaultItemRequest = z.infer<typeof CreateVaultItemRequest>;
+export declare const UpdateVaultItemRequest: z.ZodObject<{
+    type: z.ZodOptional<z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>>;
+    name: z.ZodOptional<z.ZodString>;
+    websites: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    expiresAt: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        fieldId: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>>;
+        value: z.ZodOptional<z.ZodString>;
+        generate: z.ZodOptional<z.ZodObject<{
+            length: z.ZodDefault<z.ZodNumber>;
+            lowercase: z.ZodDefault<z.ZodBoolean>;
+            uppercase: z.ZodDefault<z.ZodBoolean>;
+            digits: z.ZodDefault<z.ZodBoolean>;
+            symbols: z.ZodDefault<z.ZodBoolean>;
+            symbolSet: z.ZodDefault<z.ZodString>;
+            excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+            requireEachClass: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        fromReference: z.ZodOptional<z.ZodString>;
+        fileBase64: z.ZodOptional<z.ZodString>;
+        fileName: z.ZodOptional<z.ZodString>;
+        restoreVersion: z.ZodOptional<z.ZodNumber>;
+        remove: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>>;
+    primaryFieldName: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    expectedGeneration: z.ZodNumber;
+}, z.core.$strict>;
+export type UpdateVaultItemRequest = z.infer<typeof UpdateVaultItemRequest>;
+export declare const MoveVaultItemRequest: z.ZodObject<{
+    targetVaultId: z.ZodString;
+    mode: z.ZodEnum<{
+        copy: "copy";
+        move: "move";
+    }>;
+    newName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type MoveVaultItemRequest = z.infer<typeof MoveVaultItemRequest>;
+export declare const RevealVaultFieldRequest: z.ZodObject<{
+    version: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type RevealVaultFieldRequest = z.infer<typeof RevealVaultFieldRequest>;
+export declare const RevealVaultFieldResponse: z.ZodObject<{
+    value: z.ZodString;
+    encoding: z.ZodEnum<{
+        base64: "base64";
+        utf8: "utf8";
+    }>;
+    version: z.ZodNullable<z.ZodNumber>;
+    totp: z.ZodNullable<z.ZodObject<{
+        code: z.ZodString;
+        periodSeconds: z.ZodNumber;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type RevealVaultFieldResponse = z.infer<typeof RevealVaultFieldResponse>;
+export declare const RestoreVaultFieldVersionRequest: z.ZodObject<{
+    version: z.ZodNumber;
+}, z.core.$strict>;
+export type RestoreVaultFieldVersionRequest = z.infer<typeof RestoreVaultFieldVersionRequest>;
+/** Query strings are accepted as strings too ("true", "50"). */
+export declare const ListVaultItemsQuery: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>>;
+    includeArchived: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodPreprocess<z.ZodNumber>>;
+}, z.core.$strip>;
+export type ListVaultItemsQuery = z.infer<typeof ListVaultItemsQuery>;
+export declare const ListVaultsResponse: z.ZodObject<{
+    vaults: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        workspaceId: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerLabel: z.ZodString;
+        rootSessionId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            host: "host";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        syncStatus: z.ZodEnum<{
+            auth_expired: "auth_expired";
+            error: "error";
+            ok: "ok";
+            rate_limited: "rate_limited";
+            syncing: "syncing";
+        }>;
+        syncErrorCode: z.ZodNullable<z.ZodString>;
+        syncErrorMessage: z.ZodNullable<z.ZodString>;
+        lastSyncedAt: z.ZodNullable<z.ZodString>;
+        rateLimitedUntil: z.ZodNullable<z.ZodString>;
+        providerConnectionId: z.ZodNullable<z.ZodString>;
+        availability: z.ZodNullable<z.ZodObject<{
+            allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+            allowPersonalWorkspaces: z.ZodBoolean;
+        }, z.core.$strict>>;
+        isDefault: z.ZodBoolean;
+        itemCount: z.ZodNumber;
+        canWrite: z.ZodBoolean;
+        canManage: z.ZodBoolean;
+        generation: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListVaultsResponse = z.infer<typeof ListVaultsResponse>;
+export declare const ListVaultItemsResponse: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            file: "file";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+        }>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ListVaultItemsResponse = z.infer<typeof ListVaultItemsResponse>;
+export declare const ListVaultFieldVersionsResponse: z.ZodObject<{
+    versions: z.ZodArray<z.ZodObject<{
+        version: z.ZodNumber;
+        current: z.ZodBoolean;
+        createdAt: z.ZodString;
+        createdByKind: z.ZodEnum<{
+            agent: "agent";
+            api_key: "api_key";
+            human: "human";
+            migration: "migration";
+            provider: "provider";
+            system: "system";
+        }>;
+        createdBySubjectId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListVaultFieldVersionsResponse = z.infer<typeof ListVaultFieldVersionsResponse>;
+export declare const SetSessionVaultPolicyRequest: z.ZodObject<{
+    policy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"selected">;
+        vaultIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "mode">;
+}, z.core.$strict>;
+export type SetSessionVaultPolicyRequest = z.infer<typeof SetSessionVaultPolicyRequest>;
+export declare const SessionSecretsView: z.ZodObject<{
+    capabilityEnabled: z.ZodBoolean;
+    policy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"selected">;
+        vaultIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "mode">;
+    effectiveVaultIds: z.ZodArray<z.ZodString>;
+    narrowedBySessionId: z.ZodNullable<z.ZodString>;
+    taskVault: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        workspaceId: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerLabel: z.ZodString;
+        rootSessionId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            host: "host";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        syncStatus: z.ZodEnum<{
+            auth_expired: "auth_expired";
+            error: "error";
+            ok: "ok";
+            rate_limited: "rate_limited";
+            syncing: "syncing";
+        }>;
+        syncErrorCode: z.ZodNullable<z.ZodString>;
+        syncErrorMessage: z.ZodNullable<z.ZodString>;
+        lastSyncedAt: z.ZodNullable<z.ZodString>;
+        rateLimitedUntil: z.ZodNullable<z.ZodString>;
+        providerConnectionId: z.ZodNullable<z.ZodString>;
+        availability: z.ZodNullable<z.ZodObject<{
+            allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+            allowPersonalWorkspaces: z.ZodBoolean;
+        }, z.core.$strict>>;
+        isDefault: z.ZodBoolean;
+        itemCount: z.ZodNumber;
+        canWrite: z.ZodBoolean;
+        canManage: z.ZodBoolean;
+        generation: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+    taskItems: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            file: "file";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+        }>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    reachableVaults: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        workspaceId: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerLabel: z.ZodString;
+        rootSessionId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            host: "host";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        syncStatus: z.ZodEnum<{
+            auth_expired: "auth_expired";
+            error: "error";
+            ok: "ok";
+            rate_limited: "rate_limited";
+            syncing: "syncing";
+        }>;
+        syncErrorCode: z.ZodNullable<z.ZodString>;
+        syncErrorMessage: z.ZodNullable<z.ZodString>;
+        lastSyncedAt: z.ZodNullable<z.ZodString>;
+        rateLimitedUntil: z.ZodNullable<z.ZodString>;
+        providerConnectionId: z.ZodNullable<z.ZodString>;
+        availability: z.ZodNullable<z.ZodObject<{
+            allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+            allowPersonalWorkspaces: z.ZodBoolean;
+        }, z.core.$strict>>;
+        isDefault: z.ZodBoolean;
+        itemCount: z.ZodNumber;
+        canWrite: z.ZodBoolean;
+        canManage: z.ZodBoolean;
+        generation: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+        selected: z.ZodBoolean;
+        selectable: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SessionSecretsView = z.infer<typeof SessionSecretsView>;
+export declare const InstallOnePasswordRequest: z.ZodObject<{
+    token: z.ZodString;
+    ownership: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    planTier: z.ZodDefault<z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InstallOnePasswordRequest = z.infer<typeof InstallOnePasswordRequest>;
+export declare const ProviderVaultMeta: z.ZodObject<{
+    externalVaultId: z.ZodString;
+    name: z.ZodString;
+    itemCount: z.ZodNullable<z.ZodNumber>;
+    linkedVaultId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ProviderVaultMeta = z.infer<typeof ProviderVaultMeta>;
+export declare const InstallOnePasswordResponse: z.ZodObject<{
+    connectionId: z.ZodString;
+    accountName: z.ZodNullable<z.ZodString>;
+    vaults: z.ZodArray<z.ZodObject<{
+        externalVaultId: z.ZodString;
+        name: z.ZodString;
+        itemCount: z.ZodNullable<z.ZodNumber>;
+        linkedVaultId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type InstallOnePasswordResponse = z.infer<typeof InstallOnePasswordResponse>;
+/** A 1Password service account connected in a workspace. Never carries the token. */
+export declare const OnePasswordConnectionSummary: z.ZodObject<{
+    id: z.ZodString;
+    ownership: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    accountName: z.ZodNullable<z.ZodString>;
+    label: z.ZodNullable<z.ZodString>;
+    planTier: z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>;
+    verifiedAt: z.ZodString;
+    createdAt: z.ZodString;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+    canManage: z.ZodBoolean;
+}, z.core.$strip>;
+export type OnePasswordConnectionSummary = z.infer<typeof OnePasswordConnectionSummary>;
+export declare const ListOnePasswordConnectionsResponse: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        ownership: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        accountName: z.ZodNullable<z.ZodString>;
+        label: z.ZodNullable<z.ZodString>;
+        planTier: z.ZodEnum<{
+            business: "business";
+            family: "family";
+            teams: "teams";
+        }>;
+        verifiedAt: z.ZodString;
+        createdAt: z.ZodString;
+        createdBySubjectId: z.ZodNullable<z.ZodString>;
+        canManage: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListOnePasswordConnectionsResponse = z.infer<typeof ListOnePasswordConnectionsResponse>;
+/** A new token for an existing connection; its linked vaults keep working. */
+export declare const ReplaceOnePasswordTokenRequest: z.ZodObject<{
+    token: z.ZodString;
+    planTier: z.ZodOptional<z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>>;
+}, z.core.$strict>;
+export type ReplaceOnePasswordTokenRequest = z.infer<typeof ReplaceOnePasswordTokenRequest>;
+export declare const DisconnectOnePasswordResponse: z.ZodObject<{
+    unlinkedVaultIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type DisconnectOnePasswordResponse = z.infer<typeof DisconnectOnePasswordResponse>;
+export declare const LinkProviderVaultRequest: z.ZodObject<{
+    provider: z.ZodEnum<{
+        host: "host";
+        onepassword: "onepassword";
+    }>;
+    connectionId: z.ZodOptional<z.ZodString>;
+    externalVaultId: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    mode: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+    availability: z.ZodOptional<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type LinkProviderVaultRequest = z.infer<typeof LinkProviderVaultRequest>;
+export declare const CreateManagedProviderVaultRequest: z.ZodObject<{
+    name: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    groupId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CreateManagedProviderVaultRequest = z.infer<typeof CreateManagedProviderVaultRequest>;
+export declare const VaultErrorCode: z.ZodEnum<{
+    encryption_key_missing: "encryption_key_missing";
+    human_auth_required: "human_auth_required";
+    invalid_secret_name: "invalid_secret_name";
+    provider_auth_expired: "provider_auth_expired";
+    provider_auth_invalid: "provider_auth_invalid";
+    provider_conflict: "provider_conflict";
+    provider_rate_limited: "provider_rate_limited";
+    provider_unavailable: "provider_unavailable";
+    secret_save_forbidden: "secret_save_forbidden";
+    secret_search_cursor_invalid: "secret_search_cursor_invalid";
+    secret_value_too_large: "secret_value_too_large";
+    variable_sets_removed: "variable_sets_removed";
+    vault_field_not_found: "vault_field_not_found";
+    vault_generation_conflict: "vault_generation_conflict";
+    vault_item_name_conflict: "vault_item_name_conflict";
+    vault_item_not_found: "vault_item_not_found";
+    vault_limit_reached: "vault_limit_reached";
+    vault_name_conflict: "vault_name_conflict";
+    vault_not_found: "vault_not_found";
+    vault_permission_denied: "vault_permission_denied";
+    vault_policy_outside_parent: "vault_policy_outside_parent";
+    vault_read_only: "vault_read_only";
+    vault_reveal_requires_human: "vault_reveal_requires_human";
+}>;
+export type VaultErrorCode = z.infer<typeof VaultErrorCode>;
+export declare const VaultApiError: z.ZodObject<{
+    error: z.ZodEnum<{
+        encryption_key_missing: "encryption_key_missing";
+        human_auth_required: "human_auth_required";
+        invalid_secret_name: "invalid_secret_name";
+        provider_auth_expired: "provider_auth_expired";
+        provider_auth_invalid: "provider_auth_invalid";
+        provider_conflict: "provider_conflict";
+        provider_rate_limited: "provider_rate_limited";
+        provider_unavailable: "provider_unavailable";
+        secret_save_forbidden: "secret_save_forbidden";
+        secret_search_cursor_invalid: "secret_search_cursor_invalid";
+        secret_value_too_large: "secret_value_too_large";
+        variable_sets_removed: "variable_sets_removed";
+        vault_field_not_found: "vault_field_not_found";
+        vault_generation_conflict: "vault_generation_conflict";
+        vault_item_name_conflict: "vault_item_name_conflict";
+        vault_item_not_found: "vault_item_not_found";
+        vault_limit_reached: "vault_limit_reached";
+        vault_name_conflict: "vault_name_conflict";
+        vault_not_found: "vault_not_found";
+        vault_permission_denied: "vault_permission_denied";
+        vault_policy_outside_parent: "vault_policy_outside_parent";
+        vault_read_only: "vault_read_only";
+        vault_reveal_requires_human: "vault_reveal_requires_human";
+    }>;
+    message: z.ZodString;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type VaultApiError = z.infer<typeof VaultApiError>;
+/** HTTP status for every vault error code (§10B.1.1). */
+export declare const VAULT_ERROR_HTTP_STATUS: Readonly<Record<VaultErrorCode, number>>;
+export declare const SECRET_TOOL_NAMES: readonly ["secret_search", "secret_save", "secret_get", "secret_move", "secret_delete"];
+export type SecretToolName = (typeof SECRET_TOOL_NAMES)[number];
+export declare const SECRET_SAVE_TO: z.ZodEnum<{
+    task: "task";
+    user: "user";
+    workspace: "workspace";
+}>;
+export type SecretSaveTo = z.infer<typeof SECRET_SAVE_TO>;
+export declare const SecretSearchInput: z.ZodObject<{
+    query: z.ZodOptional<z.ZodString>;
+    website: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>>;
+    vault: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretSearchInput = z.infer<typeof SecretSearchInput>;
+export declare const SecretSearchResult: z.ZodObject<{
+    vault: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        source: z.ZodEnum<{
+            host: "host";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+    }, z.core.$strip>;
+    item: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            file: "file";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+        }>;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    fields: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>;
+    }, z.core.$strip>>;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SecretSearchResult = z.infer<typeof SecretSearchResult>;
+export declare const SecretSearchVault: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        task: "task";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    source: z.ZodEnum<{
+        host: "host";
+        onepassword: "onepassword";
+        opengeni: "opengeni";
+    }>;
+    mode: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+    }>;
+    itemCount: z.ZodNumber;
+}, z.core.$strip>;
+export type SecretSearchVault = z.infer<typeof SecretSearchVault>;
+export declare const SecretSearchOutput: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        vault: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            ownerKind: z.ZodEnum<{
+                organization: "organization";
+                task: "task";
+                user: "user";
+                workspace: "workspace";
+            }>;
+            source: z.ZodEnum<{
+                host: "host";
+                onepassword: "onepassword";
+                opengeni: "opengeni";
+            }>;
+            mode: z.ZodEnum<{
+                read_only: "read_only";
+                read_write: "read_write";
+            }>;
+        }, z.core.$strip>;
+        item: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                api_key: "api_key";
+                file: "file";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+            }>;
+            websites: z.ZodArray<z.ZodString>;
+            username: z.ZodNullable<z.ZodString>;
+            hasTotp: z.ZodBoolean;
+            hasPasskey: z.ZodBoolean;
+            expiresAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                concealed: "concealed";
+                file: "file";
+                text: "text";
+                totp: "totp";
+            }>;
+        }, z.core.$strip>>;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    truncated: z.ZodBoolean;
+    nextCursor: z.ZodNullable<z.ZodString>;
+    vaults: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        source: z.ZodEnum<{
+            host: "host";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        itemCount: z.ZodNumber;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SecretSearchOutput = z.infer<typeof SecretSearchOutput>;
+export declare const SecretSaveFieldInput: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>>;
+    value: z.ZodOptional<z.ZodString>;
+    generate: z.ZodOptional<z.ZodObject<{
+        length: z.ZodDefault<z.ZodNumber>;
+        lowercase: z.ZodDefault<z.ZodBoolean>;
+        uppercase: z.ZodDefault<z.ZodBoolean>;
+        digits: z.ZodDefault<z.ZodBoolean>;
+        symbols: z.ZodDefault<z.ZodBoolean>;
+        symbolSet: z.ZodDefault<z.ZodString>;
+        excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+        requireEachClass: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    fromReference: z.ZodOptional<z.ZodString>;
+    restoreVersion: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type SecretSaveFieldInput = z.infer<typeof SecretSaveFieldInput>;
+export declare const SecretSaveInput: z.ZodObject<{
+    item: z.ZodString;
+    vault: z.ZodOptional<z.ZodString>;
+    saveTo: z.ZodOptional<z.ZodEnum<{
+        task: "task";
+        user: "user";
+        workspace: "workspace";
+    }>>;
+    type: z.ZodDefault<z.ZodEnum<{
+        api_key: "api_key";
+        file: "file";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+    }>>;
+    websites: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    username: z.ZodOptional<z.ZodString>;
+    fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>>;
+        value: z.ZodOptional<z.ZodString>;
+        generate: z.ZodOptional<z.ZodObject<{
+            length: z.ZodDefault<z.ZodNumber>;
+            lowercase: z.ZodDefault<z.ZodBoolean>;
+            uppercase: z.ZodDefault<z.ZodBoolean>;
+            digits: z.ZodDefault<z.ZodBoolean>;
+            symbols: z.ZodDefault<z.ZodBoolean>;
+            symbolSet: z.ZodDefault<z.ZodString>;
+            excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+            requireEachClass: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        fromReference: z.ZodOptional<z.ZodString>;
+        restoreVersion: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        create: "create";
+        update: "update";
+        upsert: "upsert";
+    }>>;
+}, z.core.$strict>;
+export type SecretSaveInput = z.infer<typeof SecretSaveInput>;
+export declare const SecretSaveOutput: z.ZodObject<{
+    item: z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            file: "file";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+        }>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+    generatedFields: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SecretSaveOutput = z.infer<typeof SecretSaveOutput>;
+export declare const SecretGetInput: z.ZodObject<{
+    reference: z.ZodString;
+    version: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type SecretGetInput = z.infer<typeof SecretGetInput>;
+export declare const SecretGetOutput: z.ZodObject<{
+    value: z.ZodString;
+    encoding: z.ZodEnum<{
+        base64: "base64";
+        utf8: "utf8";
+    }>;
+    version: z.ZodNullable<z.ZodNumber>;
+    totp: z.ZodNullable<z.ZodObject<{
+        code: z.ZodString;
+        periodSeconds: z.ZodNumber;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SecretGetOutput = RevealVaultFieldResponse;
+export declare const SecretMoveInput: z.ZodObject<{
+    reference: z.ZodString;
+    toVault: z.ZodString;
+    mode: z.ZodDefault<z.ZodEnum<{
+        copy: "copy";
+        move: "move";
+    }>>;
+    newName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretMoveInput = z.infer<typeof SecretMoveInput>;
+export declare const SecretMoveOutput: z.ZodObject<{
+    item: z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            file: "file";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+        }>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SecretMoveOutput = z.infer<typeof SecretMoveOutput>;
+export declare const SecretDeleteInput: z.ZodObject<{
+    reference: z.ZodString;
+}, z.core.$strict>;
+export type SecretDeleteInput = z.infer<typeof SecretDeleteInput>;
+export declare const SecretDeleteOutput: z.ZodObject<{
+    archived: z.ZodLiteral<true>;
+    restoreHint: z.ZodString;
+}, z.core.$strip>;
+export type SecretDeleteOutput = z.infer<typeof SecretDeleteOutput>;
+export declare const VAULT_POLICY_UPDATED_EVENT_TYPE: "session.vaultPolicy.updated";
+export declare const VAULT_AUDIT_ACTIONS: readonly ["vault.created", "vault.updated", "vault.deleted", "vault.item.created", "vault.item.updated", "vault.item.archived", "vault.item.restored", "vault.item.deleted", "vault.item.moved", "vault.item.copied", "vault.field.set", "vault.field.revealed", "vault.secret.used", "vault.secret.read", "vault.secret.read.denied", "vault.reference.failed", "vault.provider.connected", "vault.provider.linked", "vault.provider.synced", "vault.provider.error", "vault.passkey.registered", "vault.passkey.asserted", "vault.policy.updated", "vault.migrated"];
+export declare const VaultAuditAction: z.ZodEnum<{
+    "vault.created": "vault.created";
+    "vault.deleted": "vault.deleted";
+    "vault.field.revealed": "vault.field.revealed";
+    "vault.field.set": "vault.field.set";
+    "vault.item.archived": "vault.item.archived";
+    "vault.item.copied": "vault.item.copied";
+    "vault.item.created": "vault.item.created";
+    "vault.item.deleted": "vault.item.deleted";
+    "vault.item.moved": "vault.item.moved";
+    "vault.item.restored": "vault.item.restored";
+    "vault.item.updated": "vault.item.updated";
+    "vault.migrated": "vault.migrated";
+    "vault.passkey.asserted": "vault.passkey.asserted";
+    "vault.passkey.registered": "vault.passkey.registered";
+    "vault.policy.updated": "vault.policy.updated";
+    "vault.provider.connected": "vault.provider.connected";
+    "vault.provider.error": "vault.provider.error";
+    "vault.provider.linked": "vault.provider.linked";
+    "vault.provider.synced": "vault.provider.synced";
+    "vault.reference.failed": "vault.reference.failed";
+    "vault.secret.read": "vault.secret.read";
+    "vault.secret.read.denied": "vault.secret.read.denied";
+    "vault.secret.used": "vault.secret.used";
+    "vault.updated": "vault.updated";
+}>;
+export type VaultAuditAction = z.infer<typeof VaultAuditAction>;
+export declare const VAULT_AUDIT_TARGET_TYPES: readonly ["vault", "vault_item"];
+export declare const VAULT_METRIC_NAMES: {
+    readonly resolutions: "opengeni_secret_resolutions_total";
+    readonly resolutionDuration: "opengeni_secret_resolution_duration_seconds";
+    readonly execEnvBytes: "opengeni_secret_exec_env_bytes";
+    readonly providerCalls: "opengeni_vault_provider_calls_total";
+    readonly providerRateLimited: "opengeni_vault_provider_rate_limited_total";
+    readonly passkeyAssertions: "opengeni_passkey_assertions_total";
+};
+export {};