@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/vaults.d.ts

@@ -0,0 +1,2185 @@
+/**
+ * Vaults: the Opengeni secrets model (replaces variable sets).
+ *
+ * A vault holds a flat list of items; an item holds named fields; hosted
+ * fields keep encrypted versions. Every type here is `z.infer` of its schema.
+ *
+ * This module must not import runtime values from `./index` (the index
+ * re-exports it); only types cross that edge.
+ */
+import { z } from "zod";
+export declare const VaultOwnerKind: z.ZodEnum<{
+    organization: "organization";
+    task: "task";
+    user: "user";
+    workspace: "workspace";
+}>;
+export type VaultOwnerKind = z.infer<typeof VaultOwnerKind>;
+export declare const VaultSource: z.ZodEnum<{
+    bitwarden: "bitwarden";
+    external: "external";
+    host: "host";
+    keeper: "keeper";
+    onepassword: "onepassword";
+    opengeni: "opengeni";
+    protonpass: "protonpass";
+}>;
+export type VaultSource = z.infer<typeof VaultSource>;
+export declare const VaultMode: z.ZodEnum<{
+    read_only: "read_only";
+    read_write: "read_write";
+}>;
+export type VaultMode = z.infer<typeof VaultMode>;
+export declare const VaultSyncStatus: z.ZodEnum<{
+    auth_expired: "auth_expired";
+    error: "error";
+    ok: "ok";
+    rate_limited: "rate_limited";
+    syncing: "syncing";
+}>;
+export type VaultSyncStatus = z.infer<typeof VaultSyncStatus>;
+/**
+ * The kind of item, which decides its standard fields and its primary field.
+ * Each provider item maps to one type; anything more specific (a database
+ * login, a bank account, a passport) is its `category` (see
+ * `VAULT_ITEM_CATEGORIES`), so an item keeps both when it moves between
+ * providers.
+ */
+export declare const VaultItemType: z.ZodEnum<{
+    api_key: "api_key";
+    card: "card";
+    file: "file";
+    identity: "identity";
+    login: "login";
+    note: "note";
+    passkey: "passkey";
+    ssh_key: "ssh_key";
+}>;
+export type VaultItemType = z.infer<typeof VaultItemType>;
+/** The item types that exist; `createItemTypes` lists at most all of them. */
+export declare const VAULT_ITEM_TYPE_COUNT = 8;
+/**
+ * A provider-specific kind of item, as a lower-case snake_case token. Known
+ * categories use the names in `VAULT_ITEM_CATEGORIES`; a provider category
+ * Opengeni does not know is kept as the snake_case form of its own name.
+ */
+export declare const VAULT_ITEM_CATEGORY_PATTERN: RegExp;
+export declare const VaultItemCategory: z.ZodString;
+export type VaultItemCategory = z.infer<typeof VaultItemCategory>;
+/**
+ * Categories with a shared meaning across providers, and the item type each
+ * belongs to. An item with no category is the plain form of its type.
+ */
+export declare const VAULT_ITEM_CATEGORIES: {
+    readonly password: "api_key";
+    readonly database: "api_key";
+    readonly server: "api_key";
+    readonly wifi: "api_key";
+    readonly email_account: "api_key";
+    readonly software_license: "api_key";
+    readonly crypto_wallet: "api_key";
+    readonly bank_account: "note";
+    readonly membership: "note";
+    readonly passport: "note";
+    readonly driver_license: "note";
+    readonly outdoor_license: "note";
+    readonly reward_program: "note";
+    readonly national_id: "note";
+    readonly medical_record: "note";
+    readonly health_insurance: "note";
+    readonly birth_certificate: "note";
+    readonly email_alias: "note";
+    readonly address: "identity";
+    readonly person: "identity";
+    readonly photo: "file";
+};
+export type KnownVaultItemCategory = keyof typeof VAULT_ITEM_CATEGORIES;
+/**
+ * The category token for a provider's own category or record-type name:
+ * "BankAccount", "bank account" and "bankAccount" all become "bank_account".
+ * Null when nothing usable remains.
+ */
+export declare function vaultItemCategoryToken(raw: string): string | null;
+/**
+ * The standard fields of each type, in display order, as Opengeni names them
+ * in every vault. Providers store them in their own built-in slots; any other
+ * field is kept as a custom field under its own name.
+ */
+export declare const VAULT_ITEM_TYPE_FIELDS: Readonly<Record<VaultItemType, ReadonlyArray<{
+    name: string;
+    kind: "text" | "concealed" | "totp";
+}>>>;
+/**
+ * A freshly generated SSH key pair for an `ssh_key` item's "private key"
+ * field. Opengeni writes the private key in OpenSSH format and fills in the
+ * "public key" and "fingerprint" fields; the private key never leaves the
+ * vault.
+ */
+export declare const GenerateSshKeySpec: z.ZodObject<{
+    algorithm: z.ZodDefault<z.ZodEnum<{
+        ed25519: "ed25519";
+        rsa4096: "rsa4096";
+    }>>;
+}, z.core.$strict>;
+export type GenerateSshKeySpec = z.infer<typeof GenerateSshKeySpec>;
+/**
+ * Other names password managers give a type's standard fields (1Password's
+ * "verification number" is Bitwarden's "security code"). A write stores a
+ * field under any of these names in the provider's own slot, and a reference
+ * that names one of them still resolves when the item names it another way.
+ */
+export declare const VAULT_FIELD_NAME_SYNONYMS: Readonly<Partial<Record<VaultItemType, Readonly<Record<string, readonly string[]>>>>>;
+/**
+ * The standard field a field name stands for in an item of this type, as
+ * Opengeni names it ("cvv" is a card's "security code"), or null for a
+ * custom field.
+ */
+export declare function standardVaultFieldName(type: VaultItemType, name: string): string | null;
+/**
+ * Every other name a reference's field name may have in another password
+ * manager, across all types: a group's names when it belongs to one, else
+ * nothing. Used only when the exact name finds no field.
+ */
+export declare function vaultFieldNameAlternatives(name: string): string[];
+export declare const VaultFieldKind: z.ZodEnum<{
+    concealed: "concealed";
+    file: "file";
+    text: "text";
+    totp: "totp";
+}>;
+export type VaultFieldKind = z.infer<typeof VaultFieldKind>;
+/** Effective operations, not a promise that upstream permissions cannot change. */
+export declare const VaultProviderOperations: z.ZodObject<{
+    createItemTypes: z.ZodArray<z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>>;
+    updateItem: z.ZodBoolean;
+    removeField: z.ZodBoolean;
+    archiveItem: z.ZodBoolean;
+    archiveKind: z.ZodEnum<{
+        archive: "archive";
+        none: "none";
+        trash: "trash";
+    }>;
+    deleteItem: z.ZodLiteral<false>;
+    restoreItem: z.ZodBoolean;
+    readFiles: z.ZodBoolean;
+    writeFiles: z.ZodBoolean;
+    createTotp: z.ZodBoolean;
+    updateTotp: z.ZodBoolean;
+    createVault: z.ZodBoolean;
+    restoreFieldHistory: z.ZodBoolean;
+}, z.core.$strict>;
+export type VaultProviderOperations = z.infer<typeof VaultProviderOperations>;
+/**
+ * The weaker of two archive kinds: an archive (hidden, restorable as is) is
+ * stronger than a trash (restorable until emptied), which is stronger than
+ * none. A vault may narrow its adapter's archive to a trash, never widen it.
+ */
+export declare function weakerArchiveKind(left: VaultProviderOperations["archiveKind"], right: VaultProviderOperations["archiveKind"]): VaultProviderOperations["archiveKind"];
+/** A successful mirror check does not prove a customer's upstream cache is current. */
+export declare const VaultProviderFreshness: z.ZodObject<{
+    state: z.ZodEnum<{
+        current: "current";
+        refreshing: "refreshing";
+        stale: "stale";
+        unavailable: "unavailable";
+    }>;
+    lastCheckedAt: z.ZodNullable<z.ZodString>;
+    sourceSyncedAt: z.ZodNullable<z.ZodString>;
+    source: z.ZodEnum<{
+        cache: "cache";
+        live: "live";
+        unknown: "unknown";
+    }>;
+    errorCode: z.ZodNullable<z.ZodString>;
+    retryAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderFreshness = z.infer<typeof VaultProviderFreshness>;
+/** Lookup order for references that name no vault; index = tier. */
+export declare const VAULT_LOOKUP_TIERS: readonly ["task", "user", "workspace", "organization"];
+export type VaultLookupTier = (typeof VAULT_LOOKUP_TIERS)[number];
+export declare const VAULT_LIMITS: {
+    readonly vaultsPerOwnerScope: 200;
+    readonly itemsPerVault: 2000;
+    readonly fieldsPerItem: 50;
+    readonly versionsPerField: 10;
+    readonly nameMaxChars: 120;
+    readonly descriptionMaxChars: 2000;
+    readonly websitesPerItem: 20;
+    readonly websiteMaxChars: 2048;
+    readonly usernameMaxChars: 1024;
+    readonly textValueMaxBytes: 65536;
+    readonly fileValueMaxBytes: 262144;
+    readonly referenceMaxChars: 300;
+    readonly execEnvMaxBytes: 262144;
+    readonly execValueMaxBytes: 102400;
+    readonly policyVaultIdsMax: 200;
+    readonly searchResultsMax: 50;
+    /** Items one agent search call examines before it returns a cursor. */
+    readonly searchScanMax: 1000;
+    readonly searchCursorMaxChars: 1024;
+    readonly providerReadsPerAttempt: 50;
+    readonly providerValueCacheMs: 60000;
+};
+/** Default names of lazily created hosted vaults (Q-06). */
+export declare const DEFAULT_VAULT_NAMES: {
+    readonly user: "Private";
+    readonly workspace: "Shared";
+    readonly task: "Task";
+};
+/**
+ * Default primary field per item type (§10B.2); passkeys have none, and an
+ * identity's primary is its first concealed field.
+ */
+export declare const VAULT_DEFAULT_PRIMARY_FIELD: Readonly<Record<VaultItemType, string | null>>;
+/** Fixed passkey fields (D20). `privateKey` is concealed; the rest are text. */
+export declare const PASSKEY_FIELD_NAMES: readonly ["rpId", "credentialId", "userHandle", "userName", "privateKey"];
+/**
+ * Q-10: 1–120 characters, no `/ { } # \` or control characters, no leading
+ * or trailing whitespace, and not starting with `id:` (reserved for the ID
+ * reference form). Interior spaces and any other Unicode are allowed.
+ */
+export declare function isValidSecretName(name: string): boolean;
+/** True when `name` is reserved as a field name (the `/otp` suffix). */
+export declare function isReservedVaultFieldName(name: string): boolean;
+export declare const VaultName: z.ZodString;
+export declare const VaultFieldName: z.ZodString;
+export declare const VaultPolicy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"all">;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"selected">;
+    vaultIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "mode">;
+export type VaultPolicy = z.infer<typeof VaultPolicy>;
+export declare const VAULT_POLICY_ALL: VaultPolicy;
+/**
+ * Intersect two policies. `all` is the identity; two selections keep the IDs
+ * present in both (order of `a`).
+ */
+export declare function intersectVaultPolicies(a: VaultPolicy, b: VaultPolicy): VaultPolicy;
+export declare const VaultAvailability: z.ZodObject<{
+    allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    allowPersonalWorkspaces: z.ZodBoolean;
+}, z.core.$strict>;
+export type VaultAvailability = z.infer<typeof VaultAvailability>;
+export declare const VaultSummary: z.ZodObject<{
+    id: z.ZodString;
+    workspaceId: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        task: "task";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    ownerLabel: z.ZodString;
+    rootSessionId: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    source: z.ZodEnum<{
+        bitwarden: "bitwarden";
+        external: "external";
+        host: "host";
+        keeper: "keeper";
+        onepassword: "onepassword";
+        opengeni: "opengeni";
+        protonpass: "protonpass";
+    }>;
+    mode: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+    }>;
+    syncStatus: z.ZodEnum<{
+        auth_expired: "auth_expired";
+        error: "error";
+        ok: "ok";
+        rate_limited: "rate_limited";
+        syncing: "syncing";
+    }>;
+    syncErrorCode: z.ZodNullable<z.ZodString>;
+    syncErrorMessage: z.ZodNullable<z.ZodString>;
+    lastSyncedAt: z.ZodNullable<z.ZodString>;
+    rateLimitedUntil: z.ZodNullable<z.ZodString>;
+    providerConnectionId: z.ZodNullable<z.ZodString>;
+    providerOperations: z.ZodOptional<z.ZodObject<{
+        createItemTypes: z.ZodArray<z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>>;
+        updateItem: z.ZodBoolean;
+        removeField: z.ZodBoolean;
+        archiveItem: z.ZodBoolean;
+        archiveKind: z.ZodEnum<{
+            archive: "archive";
+            none: "none";
+            trash: "trash";
+        }>;
+        deleteItem: z.ZodLiteral<false>;
+        restoreItem: z.ZodBoolean;
+        readFiles: z.ZodBoolean;
+        writeFiles: z.ZodBoolean;
+        createTotp: z.ZodBoolean;
+        updateTotp: z.ZodBoolean;
+        createVault: z.ZodBoolean;
+        restoreFieldHistory: z.ZodBoolean;
+    }, z.core.$strict>>;
+    freshness: z.ZodOptional<z.ZodObject<{
+        state: z.ZodEnum<{
+            current: "current";
+            refreshing: "refreshing";
+            stale: "stale";
+            unavailable: "unavailable";
+        }>;
+        lastCheckedAt: z.ZodNullable<z.ZodString>;
+        sourceSyncedAt: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            cache: "cache";
+            live: "live";
+            unknown: "unknown";
+        }>;
+        errorCode: z.ZodNullable<z.ZodString>;
+        retryAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    availability: z.ZodNullable<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+    isDefault: z.ZodBoolean;
+    itemCount: z.ZodNumber;
+    canWrite: z.ZodBoolean;
+    canManage: z.ZodBoolean;
+    generation: z.ZodNumber;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type VaultSummary = z.infer<typeof VaultSummary>;
+export declare const VaultItemReferences: z.ZodObject<{
+    primary: z.ZodNullable<z.ZodString>;
+    otp: z.ZodNullable<z.ZodString>;
+    byField: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+export type VaultItemReferences = z.infer<typeof VaultItemReferences>;
+export declare const VaultItemSummary: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>;
+    category: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    websites: z.ZodArray<z.ZodString>;
+    username: z.ZodNullable<z.ZodString>;
+    hasTotp: z.ZodBoolean;
+    hasPasskey: z.ZodBoolean;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    archivedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type VaultItemSummary = z.infer<typeof VaultItemSummary>;
+export declare const VaultItemField: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>;
+    position: z.ZodNumber;
+    currentVersion: z.ZodNullable<z.ZodNumber>;
+    value: z.ZodNullable<z.ZodString>;
+    fileName: z.ZodNullable<z.ZodString>;
+    fileSize: z.ZodNullable<z.ZodNumber>;
+    reference: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type VaultItemField = z.infer<typeof VaultItemField>;
+export declare const PasskeySummary: z.ZodObject<{
+    rpId: z.ZodString;
+    userName: z.ZodNullable<z.ZodString>;
+    credentialIdSuffix: z.ZodString;
+    signCount: z.ZodNumber;
+    leasedUntil: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PasskeySummary = z.infer<typeof PasskeySummary>;
+export declare const VaultItem: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>;
+    category: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    websites: z.ZodArray<z.ZodString>;
+    username: z.ZodNullable<z.ZodString>;
+    hasTotp: z.ZodBoolean;
+    hasPasskey: z.ZodBoolean;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    archivedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+    fields: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>;
+        position: z.ZodNumber;
+        currentVersion: z.ZodNullable<z.ZodNumber>;
+        value: z.ZodNullable<z.ZodString>;
+        fileName: z.ZodNullable<z.ZodString>;
+        fileSize: z.ZodNullable<z.ZodNumber>;
+        reference: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+    passkey: z.ZodNullable<z.ZodObject<{
+        rpId: z.ZodString;
+        userName: z.ZodNullable<z.ZodString>;
+        credentialIdSuffix: z.ZodString;
+        signCount: z.ZodNumber;
+        leasedUntil: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    aliases: z.ZodArray<z.ZodString>;
+    primaryFieldId: z.ZodNullable<z.ZodString>;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    generation: z.ZodNumber;
+}, z.core.$strip>;
+export type VaultItem = z.infer<typeof VaultItem>;
+export declare const VaultVersionCreatedByKind: z.ZodEnum<{
+    agent: "agent";
+    api_key: "api_key";
+    human: "human";
+    migration: "migration";
+    provider: "provider";
+    system: "system";
+}>;
+export type VaultVersionCreatedByKind = z.infer<typeof VaultVersionCreatedByKind>;
+export declare const VaultFieldVersionMeta: z.ZodObject<{
+    version: z.ZodNumber;
+    current: z.ZodBoolean;
+    createdAt: z.ZodString;
+    createdByKind: z.ZodEnum<{
+        agent: "agent";
+        api_key: "api_key";
+        human: "human";
+        migration: "migration";
+        provider: "provider";
+        system: "system";
+    }>;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type VaultFieldVersionMeta = z.infer<typeof VaultFieldVersionMeta>;
+export declare const CreateVaultRequest: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    availability: z.ZodOptional<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CreateVaultRequest = z.infer<typeof CreateVaultRequest>;
+export declare const UpdateVaultRequest: z.ZodObject<{
+    expectedGeneration: z.ZodNumber;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    availability: z.ZodOptional<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type UpdateVaultRequest = z.infer<typeof UpdateVaultRequest>;
+export declare const DeleteVaultRequest: z.ZodObject<{
+    confirmName: z.ZodString;
+}, z.core.$strict>;
+export type DeleteVaultRequest = z.infer<typeof DeleteVaultRequest>;
+declare const VALUE_SOURCE_KEYS: readonly ["value", "generate", "generateKey", "fromReference", "fileBase64", "restoreVersion", "remove"];
+/** Exactly one value source per field input. */
+export declare function exactlyOneValueSource(input: Partial<Record<(typeof VALUE_SOURCE_KEYS)[number], unknown>>): boolean;
+export declare const VaultFieldInput: z.ZodObject<{
+    fieldId: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>>;
+    value: z.ZodOptional<z.ZodString>;
+    generate: z.ZodOptional<z.ZodObject<{
+        length: z.ZodDefault<z.ZodNumber>;
+        lowercase: z.ZodDefault<z.ZodBoolean>;
+        uppercase: z.ZodDefault<z.ZodBoolean>;
+        digits: z.ZodDefault<z.ZodBoolean>;
+        symbols: z.ZodDefault<z.ZodBoolean>;
+        symbolSet: z.ZodDefault<z.ZodString>;
+        excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+        requireEachClass: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    generateKey: z.ZodOptional<z.ZodObject<{
+        algorithm: z.ZodDefault<z.ZodEnum<{
+            ed25519: "ed25519";
+            rsa4096: "rsa4096";
+        }>>;
+    }, z.core.$strict>>;
+    fromReference: z.ZodOptional<z.ZodString>;
+    fileBase64: z.ZodOptional<z.ZodString>;
+    fileName: z.ZodOptional<z.ZodString>;
+    restoreVersion: z.ZodOptional<z.ZodNumber>;
+    remove: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type VaultFieldInput = z.infer<typeof VaultFieldInput>;
+export declare const CreateVaultItemRequest: z.ZodObject<{
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>;
+    category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    name: z.ZodString;
+    websites: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    fields: z.ZodArray<z.ZodObject<{
+        fieldId: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>>;
+        value: z.ZodOptional<z.ZodString>;
+        generate: z.ZodOptional<z.ZodObject<{
+            length: z.ZodDefault<z.ZodNumber>;
+            lowercase: z.ZodDefault<z.ZodBoolean>;
+            uppercase: z.ZodDefault<z.ZodBoolean>;
+            digits: z.ZodDefault<z.ZodBoolean>;
+            symbols: z.ZodDefault<z.ZodBoolean>;
+            symbolSet: z.ZodDefault<z.ZodString>;
+            excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+            requireEachClass: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        generateKey: z.ZodOptional<z.ZodObject<{
+            algorithm: z.ZodDefault<z.ZodEnum<{
+                ed25519: "ed25519";
+                rsa4096: "rsa4096";
+            }>>;
+        }, z.core.$strict>>;
+        fromReference: z.ZodOptional<z.ZodString>;
+        fileBase64: z.ZodOptional<z.ZodString>;
+        fileName: z.ZodOptional<z.ZodString>;
+        restoreVersion: z.ZodOptional<z.ZodNumber>;
+        remove: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>;
+    primaryFieldName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CreateVaultItemRequest = z.infer<typeof CreateVaultItemRequest>;
+export declare const UpdateVaultItemRequest: z.ZodObject<{
+    type: z.ZodOptional<z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>>;
+    category: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    name: z.ZodOptional<z.ZodString>;
+    websites: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    expiresAt: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        fieldId: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>>;
+        value: z.ZodOptional<z.ZodString>;
+        generate: z.ZodOptional<z.ZodObject<{
+            length: z.ZodDefault<z.ZodNumber>;
+            lowercase: z.ZodDefault<z.ZodBoolean>;
+            uppercase: z.ZodDefault<z.ZodBoolean>;
+            digits: z.ZodDefault<z.ZodBoolean>;
+            symbols: z.ZodDefault<z.ZodBoolean>;
+            symbolSet: z.ZodDefault<z.ZodString>;
+            excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+            requireEachClass: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        generateKey: z.ZodOptional<z.ZodObject<{
+            algorithm: z.ZodDefault<z.ZodEnum<{
+                ed25519: "ed25519";
+                rsa4096: "rsa4096";
+            }>>;
+        }, z.core.$strict>>;
+        fromReference: z.ZodOptional<z.ZodString>;
+        fileBase64: z.ZodOptional<z.ZodString>;
+        fileName: z.ZodOptional<z.ZodString>;
+        restoreVersion: z.ZodOptional<z.ZodNumber>;
+        remove: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>>;
+    primaryFieldName: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    expectedGeneration: z.ZodNumber;
+}, z.core.$strict>;
+export type UpdateVaultItemRequest = z.infer<typeof UpdateVaultItemRequest>;
+export declare const MoveVaultItemRequest: z.ZodObject<{
+    targetVaultId: z.ZodString;
+    mode: z.ZodEnum<{
+        copy: "copy";
+        move: "move";
+    }>;
+    newName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type MoveVaultItemRequest = z.infer<typeof MoveVaultItemRequest>;
+export declare const RevealVaultFieldRequest: z.ZodObject<{
+    version: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type RevealVaultFieldRequest = z.infer<typeof RevealVaultFieldRequest>;
+export declare const RevealVaultFieldResponse: z.ZodObject<{
+    value: z.ZodString;
+    encoding: z.ZodEnum<{
+        base64: "base64";
+        utf8: "utf8";
+    }>;
+    version: z.ZodNullable<z.ZodNumber>;
+    totp: z.ZodNullable<z.ZodObject<{
+        code: z.ZodString;
+        periodSeconds: z.ZodNumber;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type RevealVaultFieldResponse = z.infer<typeof RevealVaultFieldResponse>;
+export declare const RestoreVaultFieldVersionRequest: z.ZodObject<{
+    version: z.ZodNumber;
+}, z.core.$strict>;
+export type RestoreVaultFieldVersionRequest = z.infer<typeof RestoreVaultFieldVersionRequest>;
+/**
+ * Query strings are accepted as strings too ("true", "1", "50"). Archived
+ * items are left out unless `includeArchived` is set; a connected vault's
+ * archived items are the ones its connected account archived.
+ */
+export declare const ListVaultItemsQuery: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>>;
+    includeArchived: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodPreprocess<z.ZodNumber>>;
+}, z.core.$strip>;
+export type ListVaultItemsQuery = z.infer<typeof ListVaultItemsQuery>;
+export declare const ListVaultsResponse: z.ZodObject<{
+    vaults: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        workspaceId: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerLabel: z.ZodString;
+        rootSessionId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            host: "host";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+            protonpass: "protonpass";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        syncStatus: z.ZodEnum<{
+            auth_expired: "auth_expired";
+            error: "error";
+            ok: "ok";
+            rate_limited: "rate_limited";
+            syncing: "syncing";
+        }>;
+        syncErrorCode: z.ZodNullable<z.ZodString>;
+        syncErrorMessage: z.ZodNullable<z.ZodString>;
+        lastSyncedAt: z.ZodNullable<z.ZodString>;
+        rateLimitedUntil: z.ZodNullable<z.ZodString>;
+        providerConnectionId: z.ZodNullable<z.ZodString>;
+        providerOperations: z.ZodOptional<z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        freshness: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                current: "current";
+                refreshing: "refreshing";
+                stale: "stale";
+                unavailable: "unavailable";
+            }>;
+            lastCheckedAt: z.ZodNullable<z.ZodString>;
+            sourceSyncedAt: z.ZodNullable<z.ZodString>;
+            source: z.ZodEnum<{
+                cache: "cache";
+                live: "live";
+                unknown: "unknown";
+            }>;
+            errorCode: z.ZodNullable<z.ZodString>;
+            retryAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        availability: z.ZodNullable<z.ZodObject<{
+            allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+            allowPersonalWorkspaces: z.ZodBoolean;
+        }, z.core.$strict>>;
+        isDefault: z.ZodBoolean;
+        itemCount: z.ZodNumber;
+        canWrite: z.ZodBoolean;
+        canManage: z.ZodBoolean;
+        generation: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListVaultsResponse = z.infer<typeof ListVaultsResponse>;
+export declare const ListVaultItemsResponse: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        category: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ListVaultItemsResponse = z.infer<typeof ListVaultItemsResponse>;
+export declare const ListVaultFieldVersionsResponse: z.ZodObject<{
+    versions: z.ZodArray<z.ZodObject<{
+        version: z.ZodNumber;
+        current: z.ZodBoolean;
+        createdAt: z.ZodString;
+        createdByKind: z.ZodEnum<{
+            agent: "agent";
+            api_key: "api_key";
+            human: "human";
+            migration: "migration";
+            provider: "provider";
+            system: "system";
+        }>;
+        createdBySubjectId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListVaultFieldVersionsResponse = z.infer<typeof ListVaultFieldVersionsResponse>;
+export declare const SetSessionVaultPolicyRequest: z.ZodObject<{
+    policy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"selected">;
+        vaultIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "mode">;
+}, z.core.$strict>;
+export type SetSessionVaultPolicyRequest = z.infer<typeof SetSessionVaultPolicyRequest>;
+export declare const SessionSecretsView: z.ZodObject<{
+    capabilityEnabled: z.ZodBoolean;
+    policy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"selected">;
+        vaultIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "mode">;
+    effectiveVaultIds: z.ZodArray<z.ZodString>;
+    narrowedBySessionId: z.ZodNullable<z.ZodString>;
+    taskVault: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        workspaceId: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerLabel: z.ZodString;
+        rootSessionId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            host: "host";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+            protonpass: "protonpass";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        syncStatus: z.ZodEnum<{
+            auth_expired: "auth_expired";
+            error: "error";
+            ok: "ok";
+            rate_limited: "rate_limited";
+            syncing: "syncing";
+        }>;
+        syncErrorCode: z.ZodNullable<z.ZodString>;
+        syncErrorMessage: z.ZodNullable<z.ZodString>;
+        lastSyncedAt: z.ZodNullable<z.ZodString>;
+        rateLimitedUntil: z.ZodNullable<z.ZodString>;
+        providerConnectionId: z.ZodNullable<z.ZodString>;
+        providerOperations: z.ZodOptional<z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        freshness: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                current: "current";
+                refreshing: "refreshing";
+                stale: "stale";
+                unavailable: "unavailable";
+            }>;
+            lastCheckedAt: z.ZodNullable<z.ZodString>;
+            sourceSyncedAt: z.ZodNullable<z.ZodString>;
+            source: z.ZodEnum<{
+                cache: "cache";
+                live: "live";
+                unknown: "unknown";
+            }>;
+            errorCode: z.ZodNullable<z.ZodString>;
+            retryAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        availability: z.ZodNullable<z.ZodObject<{
+            allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+            allowPersonalWorkspaces: z.ZodBoolean;
+        }, z.core.$strict>>;
+        isDefault: z.ZodBoolean;
+        itemCount: z.ZodNumber;
+        canWrite: z.ZodBoolean;
+        canManage: z.ZodBoolean;
+        generation: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+    taskItems: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        category: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    reachableVaults: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        workspaceId: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerLabel: z.ZodString;
+        rootSessionId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            host: "host";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+            protonpass: "protonpass";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        syncStatus: z.ZodEnum<{
+            auth_expired: "auth_expired";
+            error: "error";
+            ok: "ok";
+            rate_limited: "rate_limited";
+            syncing: "syncing";
+        }>;
+        syncErrorCode: z.ZodNullable<z.ZodString>;
+        syncErrorMessage: z.ZodNullable<z.ZodString>;
+        lastSyncedAt: z.ZodNullable<z.ZodString>;
+        rateLimitedUntil: z.ZodNullable<z.ZodString>;
+        providerConnectionId: z.ZodNullable<z.ZodString>;
+        providerOperations: z.ZodOptional<z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        freshness: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                current: "current";
+                refreshing: "refreshing";
+                stale: "stale";
+                unavailable: "unavailable";
+            }>;
+            lastCheckedAt: z.ZodNullable<z.ZodString>;
+            sourceSyncedAt: z.ZodNullable<z.ZodString>;
+            source: z.ZodEnum<{
+                cache: "cache";
+                live: "live";
+                unknown: "unknown";
+            }>;
+            errorCode: z.ZodNullable<z.ZodString>;
+            retryAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        availability: z.ZodNullable<z.ZodObject<{
+            allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+            allowPersonalWorkspaces: z.ZodBoolean;
+        }, z.core.$strict>>;
+        isDefault: z.ZodBoolean;
+        itemCount: z.ZodNumber;
+        canWrite: z.ZodBoolean;
+        canManage: z.ZodBoolean;
+        generation: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+        selected: z.ZodBoolean;
+        selectable: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SessionSecretsView = z.infer<typeof SessionSecretsView>;
+export declare const InstallOnePasswordRequest: z.ZodObject<{
+    token: z.ZodString;
+    ownership: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    planTier: z.ZodDefault<z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InstallOnePasswordRequest = z.infer<typeof InstallOnePasswordRequest>;
+export declare const ProviderVaultMeta: z.ZodObject<{
+    externalVaultId: z.ZodString;
+    name: z.ZodString;
+    itemCount: z.ZodNullable<z.ZodNumber>;
+    linkedVaultId: z.ZodNullable<z.ZodString>;
+    writeAccess: z.ZodOptional<z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+        unknown: "unknown";
+    }>>;
+    operations: z.ZodOptional<z.ZodObject<{
+        createItemTypes: z.ZodArray<z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>>;
+        updateItem: z.ZodBoolean;
+        removeField: z.ZodBoolean;
+        archiveItem: z.ZodBoolean;
+        archiveKind: z.ZodEnum<{
+            archive: "archive";
+            none: "none";
+            trash: "trash";
+        }>;
+        deleteItem: z.ZodLiteral<false>;
+        restoreItem: z.ZodBoolean;
+        readFiles: z.ZodBoolean;
+        writeFiles: z.ZodBoolean;
+        createTotp: z.ZodBoolean;
+        updateTotp: z.ZodBoolean;
+        createVault: z.ZodBoolean;
+        restoreFieldHistory: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strip>;
+export type ProviderVaultMeta = z.infer<typeof ProviderVaultMeta>;
+export declare const InstallOnePasswordResponse: z.ZodObject<{
+    connectionId: z.ZodString;
+    accountName: z.ZodNullable<z.ZodString>;
+    vaults: z.ZodArray<z.ZodObject<{
+        externalVaultId: z.ZodString;
+        name: z.ZodString;
+        itemCount: z.ZodNullable<z.ZodNumber>;
+        linkedVaultId: z.ZodNullable<z.ZodString>;
+        writeAccess: z.ZodOptional<z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+            unknown: "unknown";
+        }>>;
+        operations: z.ZodOptional<z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type InstallOnePasswordResponse = z.infer<typeof InstallOnePasswordResponse>;
+/** A 1Password service account connected in a workspace. Never carries the token. */
+export declare const OnePasswordConnectionSummary: z.ZodObject<{
+    id: z.ZodString;
+    ownership: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    accountName: z.ZodNullable<z.ZodString>;
+    label: z.ZodNullable<z.ZodString>;
+    planTier: z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>;
+    verifiedAt: z.ZodString;
+    createdAt: z.ZodString;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+    canManage: z.ZodBoolean;
+}, z.core.$strip>;
+export type OnePasswordConnectionSummary = z.infer<typeof OnePasswordConnectionSummary>;
+export declare const ListOnePasswordConnectionsResponse: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        ownership: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        accountName: z.ZodNullable<z.ZodString>;
+        label: z.ZodNullable<z.ZodString>;
+        planTier: z.ZodEnum<{
+            business: "business";
+            family: "family";
+            teams: "teams";
+        }>;
+        verifiedAt: z.ZodString;
+        createdAt: z.ZodString;
+        createdBySubjectId: z.ZodNullable<z.ZodString>;
+        canManage: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListOnePasswordConnectionsResponse = z.infer<typeof ListOnePasswordConnectionsResponse>;
+/** A new token for an existing connection; its linked vaults keep working. */
+export declare const ReplaceOnePasswordTokenRequest: z.ZodObject<{
+    token: z.ZodString;
+    planTier: z.ZodOptional<z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>>;
+}, z.core.$strict>;
+export type ReplaceOnePasswordTokenRequest = z.infer<typeof ReplaceOnePasswordTokenRequest>;
+export declare const DisconnectOnePasswordResponse: z.ZodObject<{
+    unlinkedVaultIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type DisconnectOnePasswordResponse = z.infer<typeof DisconnectOnePasswordResponse>;
+/** Providers installed through the generic connection lifecycle. */
+export declare const ExternalVaultProviderKind: z.ZodEnum<{
+    bitwarden: "bitwarden";
+    external: "external";
+    keeper: "keeper";
+    protonpass: "protonpass";
+}>;
+export type ExternalVaultProviderKind = z.infer<typeof ExternalVaultProviderKind>;
+/** Write-only setup material. Never included in connection summaries or logs. */
+export declare const VaultProviderCredentials: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    provider: z.ZodLiteral<"external">;
+    endpoint: z.ZodString;
+    signingSecret: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    provider: z.ZodLiteral<"bitwarden">;
+    serverUrl: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    masterPassword: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    provider: z.ZodLiteral<"protonpass">;
+    token: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    provider: z.ZodLiteral<"keeper">;
+    oneTimeToken: z.ZodString;
+    hostname: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "provider">;
+export type VaultProviderCredentials = z.infer<typeof VaultProviderCredentials>;
+export declare const InstallVaultProviderRequest: z.ZodObject<{
+    credentials: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        provider: z.ZodLiteral<"external">;
+        endpoint: z.ZodString;
+        signingSecret: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        provider: z.ZodLiteral<"bitwarden">;
+        serverUrl: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+        masterPassword: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        provider: z.ZodLiteral<"protonpass">;
+        token: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        provider: z.ZodLiteral<"keeper">;
+        oneTimeToken: z.ZodString;
+        hostname: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "provider">;
+    ownership: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InstallVaultProviderRequest = z.infer<typeof InstallVaultProviderRequest>;
+export declare const ReplaceVaultProviderCredentialsRequest: z.ZodObject<{
+    credentials: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        provider: z.ZodLiteral<"external">;
+        endpoint: z.ZodString;
+        signingSecret: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        provider: z.ZodLiteral<"bitwarden">;
+        serverUrl: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+        masterPassword: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        provider: z.ZodLiteral<"protonpass">;
+        token: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        provider: z.ZodLiteral<"keeper">;
+        oneTimeToken: z.ZodString;
+        hostname: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "provider">;
+}, z.core.$strict>;
+export type ReplaceVaultProviderCredentialsRequest = z.infer<typeof ReplaceVaultProviderCredentialsRequest>;
+/** Includes legacy 1Password connections; existing 1Password routes remain supported. */
+export declare const VaultProviderConnectionSummary: z.ZodObject<{
+    id: z.ZodString;
+    provider: z.ZodEnum<{
+        bitwarden: "bitwarden";
+        external: "external";
+        keeper: "keeper";
+        onepassword: "onepassword";
+        protonpass: "protonpass";
+    }>;
+    ownership: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    accountName: z.ZodNullable<z.ZodString>;
+    label: z.ZodNullable<z.ZodString>;
+    verifiedAt: z.ZodString;
+    createdAt: z.ZodString;
+    createdBySubjectId: z.ZodNullable<z.ZodString>;
+    canManage: z.ZodBoolean;
+    operations: z.ZodObject<{
+        createItemTypes: z.ZodArray<z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>>;
+        updateItem: z.ZodBoolean;
+        removeField: z.ZodBoolean;
+        archiveItem: z.ZodBoolean;
+        archiveKind: z.ZodEnum<{
+            archive: "archive";
+            none: "none";
+            trash: "trash";
+        }>;
+        deleteItem: z.ZodLiteral<false>;
+        restoreItem: z.ZodBoolean;
+        readFiles: z.ZodBoolean;
+        writeFiles: z.ZodBoolean;
+        createTotp: z.ZodBoolean;
+        updateTotp: z.ZodBoolean;
+        createVault: z.ZodBoolean;
+        restoreFieldHistory: z.ZodBoolean;
+    }, z.core.$strict>;
+    planTier: z.ZodOptional<z.ZodEnum<{
+        business: "business";
+        family: "family";
+        teams: "teams";
+    }>>;
+    available: z.ZodBoolean;
+    verificationStatus: z.ZodOptional<z.ZodEnum<{
+        pending: "pending";
+        ready: "ready";
+    }>>;
+}, z.core.$strip>;
+export type VaultProviderConnectionSummary = z.infer<typeof VaultProviderConnectionSummary>;
+/** Deployment configuration, independent of whether anyone has connected yet. */
+export declare const VaultProviderAvailability: z.ZodObject<{
+    provider: z.ZodEnum<{
+        bitwarden: "bitwarden";
+        external: "external";
+        keeper: "keeper";
+        onepassword: "onepassword";
+        protonpass: "protonpass";
+    }>;
+    available: z.ZodBoolean;
+    reason: z.ZodNullable<z.ZodEnum<{
+        not_enabled: "not_enabled";
+    }>>;
+}, z.core.$strip>;
+export type VaultProviderAvailability = z.infer<typeof VaultProviderAvailability>;
+export declare const ListVaultProviderConnectionsResponse: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        provider: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            protonpass: "protonpass";
+        }>;
+        ownership: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        accountName: z.ZodNullable<z.ZodString>;
+        label: z.ZodNullable<z.ZodString>;
+        verifiedAt: z.ZodString;
+        createdAt: z.ZodString;
+        createdBySubjectId: z.ZodNullable<z.ZodString>;
+        canManage: z.ZodBoolean;
+        operations: z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>;
+        planTier: z.ZodOptional<z.ZodEnum<{
+            business: "business";
+            family: "family";
+            teams: "teams";
+        }>>;
+        available: z.ZodBoolean;
+        verificationStatus: z.ZodOptional<z.ZodEnum<{
+            pending: "pending";
+            ready: "ready";
+        }>>;
+    }, z.core.$strip>>;
+    providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            protonpass: "protonpass";
+        }>;
+        available: z.ZodBoolean;
+        reason: z.ZodNullable<z.ZodEnum<{
+            not_enabled: "not_enabled";
+        }>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ListVaultProviderConnectionsResponse = z.infer<typeof ListVaultProviderConnectionsResponse>;
+export declare const InstallVaultProviderResponse: z.ZodObject<{
+    connectionId: z.ZodString;
+    accountName: z.ZodNullable<z.ZodString>;
+    provider: z.ZodEnum<{
+        bitwarden: "bitwarden";
+        external: "external";
+        keeper: "keeper";
+        protonpass: "protonpass";
+    }>;
+    operations: z.ZodObject<{
+        createItemTypes: z.ZodArray<z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>>;
+        updateItem: z.ZodBoolean;
+        removeField: z.ZodBoolean;
+        archiveItem: z.ZodBoolean;
+        archiveKind: z.ZodEnum<{
+            archive: "archive";
+            none: "none";
+            trash: "trash";
+        }>;
+        deleteItem: z.ZodLiteral<false>;
+        restoreItem: z.ZodBoolean;
+        readFiles: z.ZodBoolean;
+        writeFiles: z.ZodBoolean;
+        createTotp: z.ZodBoolean;
+        updateTotp: z.ZodBoolean;
+        createVault: z.ZodBoolean;
+        restoreFieldHistory: z.ZodBoolean;
+    }, z.core.$strict>;
+    vaults: z.ZodArray<z.ZodObject<{
+        externalVaultId: z.ZodString;
+        name: z.ZodString;
+        itemCount: z.ZodNullable<z.ZodNumber>;
+        linkedVaultId: z.ZodNullable<z.ZodString>;
+        writeAccess: z.ZodOptional<z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+            unknown: "unknown";
+        }>>;
+        operations: z.ZodOptional<z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>>;
+    }, z.core.$strip>>;
+    discoveryPending: z.ZodOptional<z.ZodBoolean>;
+    errorCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InstallVaultProviderResponse = z.infer<typeof InstallVaultProviderResponse>;
+export declare const DisconnectVaultProviderResponse: z.ZodObject<{
+    unlinkedVaultIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type DisconnectVaultProviderResponse = z.infer<typeof DisconnectVaultProviderResponse>;
+export declare const LinkProviderVaultRequest: z.ZodObject<{
+    provider: z.ZodEnum<{
+        bitwarden: "bitwarden";
+        external: "external";
+        host: "host";
+        keeper: "keeper";
+        onepassword: "onepassword";
+        protonpass: "protonpass";
+    }>;
+    connectionId: z.ZodOptional<z.ZodString>;
+    externalVaultId: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    mode: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+    availability: z.ZodOptional<z.ZodObject<{
+        allowedWorkspaceIds: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        allowPersonalWorkspaces: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type LinkProviderVaultRequest = z.infer<typeof LinkProviderVaultRequest>;
+export declare const CreateManagedProviderVaultRequest: z.ZodObject<{
+    name: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    groupId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CreateManagedProviderVaultRequest = z.infer<typeof CreateManagedProviderVaultRequest>;
+export declare const VaultErrorCode: z.ZodEnum<{
+    encryption_key_missing: "encryption_key_missing";
+    human_auth_required: "human_auth_required";
+    invalid_secret_name: "invalid_secret_name";
+    provider_auth_expired: "provider_auth_expired";
+    provider_auth_invalid: "provider_auth_invalid";
+    provider_conflict: "provider_conflict";
+    provider_inventory_incomplete: "provider_inventory_incomplete";
+    provider_locked: "provider_locked";
+    provider_outcome_unknown: "provider_outcome_unknown";
+    provider_rate_limited: "provider_rate_limited";
+    provider_unavailable: "provider_unavailable";
+    secret_save_forbidden: "secret_save_forbidden";
+    secret_search_cursor_invalid: "secret_search_cursor_invalid";
+    secret_value_too_large: "secret_value_too_large";
+    variable_sets_removed: "variable_sets_removed";
+    vault_field_not_found: "vault_field_not_found";
+    vault_generation_conflict: "vault_generation_conflict";
+    vault_item_name_conflict: "vault_item_name_conflict";
+    vault_item_not_found: "vault_item_not_found";
+    vault_limit_reached: "vault_limit_reached";
+    vault_name_conflict: "vault_name_conflict";
+    vault_not_found: "vault_not_found";
+    vault_operation_unsupported: "vault_operation_unsupported";
+    vault_permission_denied: "vault_permission_denied";
+    vault_policy_outside_parent: "vault_policy_outside_parent";
+    vault_read_only: "vault_read_only";
+    vault_reveal_requires_human: "vault_reveal_requires_human";
+}>;
+export type VaultErrorCode = z.infer<typeof VaultErrorCode>;
+export declare const VaultApiError: z.ZodObject<{
+    error: z.ZodEnum<{
+        encryption_key_missing: "encryption_key_missing";
+        human_auth_required: "human_auth_required";
+        invalid_secret_name: "invalid_secret_name";
+        provider_auth_expired: "provider_auth_expired";
+        provider_auth_invalid: "provider_auth_invalid";
+        provider_conflict: "provider_conflict";
+        provider_inventory_incomplete: "provider_inventory_incomplete";
+        provider_locked: "provider_locked";
+        provider_outcome_unknown: "provider_outcome_unknown";
+        provider_rate_limited: "provider_rate_limited";
+        provider_unavailable: "provider_unavailable";
+        secret_save_forbidden: "secret_save_forbidden";
+        secret_search_cursor_invalid: "secret_search_cursor_invalid";
+        secret_value_too_large: "secret_value_too_large";
+        variable_sets_removed: "variable_sets_removed";
+        vault_field_not_found: "vault_field_not_found";
+        vault_generation_conflict: "vault_generation_conflict";
+        vault_item_name_conflict: "vault_item_name_conflict";
+        vault_item_not_found: "vault_item_not_found";
+        vault_limit_reached: "vault_limit_reached";
+        vault_name_conflict: "vault_name_conflict";
+        vault_not_found: "vault_not_found";
+        vault_operation_unsupported: "vault_operation_unsupported";
+        vault_permission_denied: "vault_permission_denied";
+        vault_policy_outside_parent: "vault_policy_outside_parent";
+        vault_read_only: "vault_read_only";
+        vault_reveal_requires_human: "vault_reveal_requires_human";
+    }>;
+    message: z.ZodString;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type VaultApiError = z.infer<typeof VaultApiError>;
+/** HTTP status for every vault error code (§10B.1.1). */
+export declare const VAULT_ERROR_HTTP_STATUS: Readonly<Record<VaultErrorCode, number>>;
+export declare const SECRET_TOOL_NAMES: readonly ["secret_search", "secret_save", "secret_get", "secret_move", "secret_delete"];
+export type SecretToolName = (typeof SECRET_TOOL_NAMES)[number];
+export declare const SECRET_SAVE_TO: z.ZodEnum<{
+    task: "task";
+    user: "user";
+    workspace: "workspace";
+}>;
+export type SecretSaveTo = z.infer<typeof SECRET_SAVE_TO>;
+export declare const SecretSearchInput: z.ZodObject<{
+    query: z.ZodOptional<z.ZodString>;
+    website: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>>;
+    vault: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+    refresh: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type SecretSearchInput = z.infer<typeof SecretSearchInput>;
+export declare const SecretSearchResult: z.ZodObject<{
+    vault: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        source: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            host: "host";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+            protonpass: "protonpass";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+    }, z.core.$strip>;
+    item: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        category: z.ZodNullable<z.ZodString>;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    fields: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>;
+    }, z.core.$strip>>;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SecretSearchResult = z.infer<typeof SecretSearchResult>;
+export declare const SecretSearchVault: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    ownerKind: z.ZodEnum<{
+        organization: "organization";
+        task: "task";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    source: z.ZodEnum<{
+        bitwarden: "bitwarden";
+        external: "external";
+        host: "host";
+        keeper: "keeper";
+        onepassword: "onepassword";
+        opengeni: "opengeni";
+        protonpass: "protonpass";
+    }>;
+    mode: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+    }>;
+    itemCount: z.ZodNumber;
+    freshness: z.ZodOptional<z.ZodObject<{
+        state: z.ZodEnum<{
+            current: "current";
+            refreshing: "refreshing";
+            stale: "stale";
+            unavailable: "unavailable";
+        }>;
+        lastCheckedAt: z.ZodNullable<z.ZodString>;
+        sourceSyncedAt: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            cache: "cache";
+            live: "live";
+            unknown: "unknown";
+        }>;
+        errorCode: z.ZodNullable<z.ZodString>;
+        retryAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strip>;
+export type SecretSearchVault = z.infer<typeof SecretSearchVault>;
+export declare const SecretSearchOutput: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        vault: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            ownerKind: z.ZodEnum<{
+                organization: "organization";
+                task: "task";
+                user: "user";
+                workspace: "workspace";
+            }>;
+            source: z.ZodEnum<{
+                bitwarden: "bitwarden";
+                external: "external";
+                host: "host";
+                keeper: "keeper";
+                onepassword: "onepassword";
+                opengeni: "opengeni";
+                protonpass: "protonpass";
+            }>;
+            mode: z.ZodEnum<{
+                read_only: "read_only";
+                read_write: "read_write";
+            }>;
+        }, z.core.$strip>;
+        item: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>;
+            category: z.ZodNullable<z.ZodString>;
+            websites: z.ZodArray<z.ZodString>;
+            username: z.ZodNullable<z.ZodString>;
+            hasTotp: z.ZodBoolean;
+            hasPasskey: z.ZodBoolean;
+            expiresAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                concealed: "concealed";
+                file: "file";
+                text: "text";
+                totp: "totp";
+            }>;
+        }, z.core.$strip>>;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    truncated: z.ZodBoolean;
+    nextCursor: z.ZodNullable<z.ZodString>;
+    vaults: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        ownerKind: z.ZodEnum<{
+            organization: "organization";
+            task: "task";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        source: z.ZodEnum<{
+            bitwarden: "bitwarden";
+            external: "external";
+            host: "host";
+            keeper: "keeper";
+            onepassword: "onepassword";
+            opengeni: "opengeni";
+            protonpass: "protonpass";
+        }>;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+        }>;
+        itemCount: z.ZodNumber;
+        freshness: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                current: "current";
+                refreshing: "refreshing";
+                stale: "stale";
+                unavailable: "unavailable";
+            }>;
+            lastCheckedAt: z.ZodNullable<z.ZodString>;
+            sourceSyncedAt: z.ZodNullable<z.ZodString>;
+            source: z.ZodEnum<{
+                cache: "cache";
+                live: "live";
+                unknown: "unknown";
+            }>;
+            errorCode: z.ZodNullable<z.ZodString>;
+            retryAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strip>>>;
+    complete: z.ZodOptional<z.ZodBoolean>;
+    sources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vaultId: z.ZodString;
+        freshness: z.ZodObject<{
+            state: z.ZodEnum<{
+                current: "current";
+                refreshing: "refreshing";
+                stale: "stale";
+                unavailable: "unavailable";
+            }>;
+            lastCheckedAt: z.ZodNullable<z.ZodString>;
+            sourceSyncedAt: z.ZodNullable<z.ZodString>;
+            source: z.ZodEnum<{
+                cache: "cache";
+                live: "live";
+                unknown: "unknown";
+            }>;
+            errorCode: z.ZodNullable<z.ZodString>;
+            retryAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SecretSearchOutput = z.infer<typeof SecretSearchOutput>;
+export declare const SecretSaveFieldInput: z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodOptional<z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>>;
+    value: z.ZodOptional<z.ZodString>;
+    generate: z.ZodOptional<z.ZodObject<{
+        length: z.ZodDefault<z.ZodNumber>;
+        lowercase: z.ZodDefault<z.ZodBoolean>;
+        uppercase: z.ZodDefault<z.ZodBoolean>;
+        digits: z.ZodDefault<z.ZodBoolean>;
+        symbols: z.ZodDefault<z.ZodBoolean>;
+        symbolSet: z.ZodDefault<z.ZodString>;
+        excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+        requireEachClass: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    generateKey: z.ZodOptional<z.ZodObject<{
+        algorithm: z.ZodDefault<z.ZodEnum<{
+            ed25519: "ed25519";
+            rsa4096: "rsa4096";
+        }>>;
+    }, z.core.$strict>>;
+    fromReference: z.ZodOptional<z.ZodString>;
+    restoreVersion: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type SecretSaveFieldInput = z.infer<typeof SecretSaveFieldInput>;
+export declare const SecretSaveInput: z.ZodObject<{
+    item: z.ZodString;
+    vault: z.ZodOptional<z.ZodString>;
+    saveTo: z.ZodOptional<z.ZodEnum<{
+        task: "task";
+        user: "user";
+        workspace: "workspace";
+    }>>;
+    type: z.ZodDefault<z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>>;
+    category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    websites: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    username: z.ZodOptional<z.ZodString>;
+    fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>>;
+        value: z.ZodOptional<z.ZodString>;
+        generate: z.ZodOptional<z.ZodObject<{
+            length: z.ZodDefault<z.ZodNumber>;
+            lowercase: z.ZodDefault<z.ZodBoolean>;
+            uppercase: z.ZodDefault<z.ZodBoolean>;
+            digits: z.ZodDefault<z.ZodBoolean>;
+            symbols: z.ZodDefault<z.ZodBoolean>;
+            symbolSet: z.ZodDefault<z.ZodString>;
+            excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+            requireEachClass: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        generateKey: z.ZodOptional<z.ZodObject<{
+            algorithm: z.ZodDefault<z.ZodEnum<{
+                ed25519: "ed25519";
+                rsa4096: "rsa4096";
+            }>>;
+        }, z.core.$strict>>;
+        fromReference: z.ZodOptional<z.ZodString>;
+        restoreVersion: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        create: "create";
+        update: "update";
+        upsert: "upsert";
+    }>>;
+}, z.core.$strict>;
+export type SecretSaveInput = z.infer<typeof SecretSaveInput>;
+export declare const SecretSaveOutput: z.ZodObject<{
+    item: z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        category: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+    generatedFields: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SecretSaveOutput = z.infer<typeof SecretSaveOutput>;
+export declare const SecretGetInput: z.ZodObject<{
+    reference: z.ZodString;
+    version: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type SecretGetInput = z.infer<typeof SecretGetInput>;
+export declare const SecretGetOutput: z.ZodObject<{
+    value: z.ZodString;
+    encoding: z.ZodEnum<{
+        base64: "base64";
+        utf8: "utf8";
+    }>;
+    version: z.ZodNullable<z.ZodNumber>;
+    totp: z.ZodNullable<z.ZodObject<{
+        code: z.ZodString;
+        periodSeconds: z.ZodNumber;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SecretGetOutput = RevealVaultFieldResponse;
+export declare const SecretMoveInput: z.ZodObject<{
+    reference: z.ZodString;
+    toVault: z.ZodString;
+    mode: z.ZodDefault<z.ZodEnum<{
+        copy: "copy";
+        move: "move";
+    }>>;
+    newName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretMoveInput = z.infer<typeof SecretMoveInput>;
+export declare const SecretMoveOutput: z.ZodObject<{
+    item: z.ZodObject<{
+        id: z.ZodString;
+        vaultId: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        category: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        websites: z.ZodArray<z.ZodString>;
+        username: z.ZodNullable<z.ZodString>;
+        hasTotp: z.ZodBoolean;
+        hasPasskey: z.ZodBoolean;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodString;
+        references: z.ZodObject<{
+            primary: z.ZodNullable<z.ZodString>;
+            otp: z.ZodNullable<z.ZodString>;
+            byField: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    references: z.ZodObject<{
+        primary: z.ZodNullable<z.ZodString>;
+        otp: z.ZodNullable<z.ZodString>;
+        byField: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SecretMoveOutput = z.infer<typeof SecretMoveOutput>;
+export declare const SecretDeleteInput: z.ZodObject<{
+    reference: z.ZodString;
+}, z.core.$strict>;
+export type SecretDeleteInput = z.infer<typeof SecretDeleteInput>;
+export declare const SecretDeleteOutput: z.ZodObject<{
+    archived: z.ZodLiteral<true>;
+    restoreHint: z.ZodString;
+}, z.core.$strip>;
+export type SecretDeleteOutput = z.infer<typeof SecretDeleteOutput>;
+export declare const VAULT_POLICY_UPDATED_EVENT_TYPE: "session.vaultPolicy.updated";
+export declare const VAULT_AUDIT_ACTIONS: readonly ["vault.created", "vault.updated", "vault.deleted", "vault.item.created", "vault.item.updated", "vault.item.archived", "vault.item.restored", "vault.item.deleted", "vault.item.moved", "vault.item.copied", "vault.field.set", "vault.field.revealed", "vault.secret.used", "vault.secret.read", "vault.secret.read.denied", "vault.reference.failed", "vault.provider.connected", "vault.provider.linked", "vault.provider.synced", "vault.provider.error", "vault.passkey.registered", "vault.passkey.asserted", "vault.policy.updated", "vault.migrated"];
+export declare const VaultAuditAction: z.ZodEnum<{
+    "vault.created": "vault.created";
+    "vault.deleted": "vault.deleted";
+    "vault.field.revealed": "vault.field.revealed";
+    "vault.field.set": "vault.field.set";
+    "vault.item.archived": "vault.item.archived";
+    "vault.item.copied": "vault.item.copied";
+    "vault.item.created": "vault.item.created";
+    "vault.item.deleted": "vault.item.deleted";
+    "vault.item.moved": "vault.item.moved";
+    "vault.item.restored": "vault.item.restored";
+    "vault.item.updated": "vault.item.updated";
+    "vault.migrated": "vault.migrated";
+    "vault.passkey.asserted": "vault.passkey.asserted";
+    "vault.passkey.registered": "vault.passkey.registered";
+    "vault.policy.updated": "vault.policy.updated";
+    "vault.provider.connected": "vault.provider.connected";
+    "vault.provider.error": "vault.provider.error";
+    "vault.provider.linked": "vault.provider.linked";
+    "vault.provider.synced": "vault.provider.synced";
+    "vault.reference.failed": "vault.reference.failed";
+    "vault.secret.read": "vault.secret.read";
+    "vault.secret.read.denied": "vault.secret.read.denied";
+    "vault.secret.used": "vault.secret.used";
+    "vault.updated": "vault.updated";
+}>;
+export type VaultAuditAction = z.infer<typeof VaultAuditAction>;
+export declare const VAULT_AUDIT_TARGET_TYPES: readonly ["vault", "vault_item"];
+export declare const VAULT_METRIC_NAMES: {
+    readonly resolutions: "opengeni_secret_resolutions_total";
+    readonly resolutionDuration: "opengeni_secret_resolution_duration_seconds";
+    readonly execEnvBytes: "opengeni_secret_exec_env_bytes";
+    readonly providerCalls: "opengeni_vault_provider_calls_total";
+    readonly providerRateLimited: "opengeni_vault_provider_rate_limited_total";
+    readonly passkeyAssertions: "opengeni_passkey_assertions_total";
+};
+export {};