@zocomputer/system-api 0.1.3 → 0.2.0

package/dist/generated/operations.d.ts

@@ -1477,9 +1477,10 @@ export interface ZoDatabaseCreateInputV1 {
     tags?: string[];
     workspace_id: string;
     /**
-     * Required but ignored: a retried create can make a second database.
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
      */
-    idempotency_key: string;
+    idempotency_key?: (string | null);
     display_name: string;
     /**
      * What the database holds. Members and their agents choose a database from `zo.database.list` by it.
@@ -2313,14 +2314,14 @@ export interface ZoEventDeleteOutputV1 {
     lifecycle: "retired";
 }
 /**
- * The payload and its caller-scoped idempotency key (1 to 255 printable ASCII
+ * The payload and an optional caller-scoped idempotency key (1 to 255 printable ASCII
  * characters). Every envelope attribute (``id``, ``source``, ``type``, ``time``,
  * the workspace, the definition and the causal fields) is derived by the server
  * and rejected as input.
  */
 export interface ZoEventDispatchInputV1 {
     event_id: string;
-    idempotency_key: string;
+    idempotency_key?: (string | null);
     data: {
         [k: string]: JsonValue;
     };
@@ -2735,6 +2736,7 @@ export interface ZoFunctionGetRunOutputV1 {
     entry_kind: ("direct" | "connection" | "http");
     state: ZoFunctionGetRunOutputV1RunState;
     error_code: (string | null);
+    error_message: (string | null);
     created_at: string;
     deadline: string;
     finished_at: (string | null);
@@ -2825,6 +2827,7 @@ export interface ZoFunctionListRunsOutputV1FunctionRunSummary {
     entry_kind: ("direct" | "connection" | "http");
     state: ZoFunctionListRunsOutputV1RunState;
     error_code: (string | null);
+    error_message: (string | null);
     created_at: string;
     deadline: string;
     finished_at: (string | null);
@@ -2911,7 +2914,11 @@ export interface ZoMachineCreateInputV1 {
      */
     tags?: string[];
     workspace_id: string;
-    idempotency_key: string;
+    /**
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
+     */
+    idempotency_key?: (string | null);
     display_name: string;
     /**
      * Describe what this machine is for in the user's terms.
@@ -3127,7 +3134,11 @@ export interface ZoMachineCreateOutputV1MachineBootedView {
 export interface ZoMachineDestroyInputV1 {
     machine_id: string;
     expected_revision: number;
-    idempotency_key: string;
+    /**
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
+     */
+    idempotency_key?: (string | null);
 }
 export type ZoMachineDestroyOutputV1GpuType = ("T4" | "L4" | "A10" | "L40S" | "A100" | "A100-40GB" | "A100-80GB" | "RTX-PRO-6000" | "H100" | "H100!" | "H200" | "B200" | "B200+" | "B300");
 export type ZoMachineDestroyOutputV1ObservedState = ("creating" | "running" | "stopping" | "stopped" | "resuming" | "destroying" | "destroyed" | "failed");
@@ -3572,7 +3583,11 @@ export interface ZoMachineReadBytesOutputV1 {
 export interface ZoMachineResumeInputV1 {
     machine_id: string;
     expected_revision: number;
-    idempotency_key: string;
+    /**
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
+     */
+    idempotency_key?: (string | null);
     accept_recovery?: boolean;
 }
 export type ZoMachineResumeOutputV1GpuType = ("T4" | "L4" | "A10" | "L40S" | "A100" | "A100-40GB" | "A100-80GB" | "RTX-PRO-6000" | "H100" | "H100!" | "H200" | "B200" | "B200+" | "B300");
@@ -3738,7 +3753,11 @@ export interface ZoMachineSnapshotOutputV1MachineImageProperties {
 export interface ZoMachineStopInputV1 {
     machine_id: string;
     expected_revision: number;
-    idempotency_key: string;
+    /**
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
+     */
+    idempotency_key?: (string | null);
 }
 export type ZoMachineStopOutputV1GpuType = ("T4" | "L4" | "A10" | "L40S" | "A100" | "A100-40GB" | "A100-80GB" | "RTX-PRO-6000" | "H100" | "H100!" | "H200" | "B200" | "B200+" | "B300");
 export type ZoMachineStopOutputV1ObservedState = ("creating" | "running" | "stopping" | "stopped" | "resuming" | "destroying" | "destroyed" | "failed");
@@ -4043,7 +4062,11 @@ export interface ZoMachineWriteBytesOutputV1 {
 export interface ZoMachineImageDeleteInputV1 {
     machine_image_id: string;
     expected_revision: number;
-    idempotency_key: string;
+    /**
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
+     */
+    idempotency_key?: (string | null);
 }
 export type ZoMachineImageDeleteOutputV1ImageOrigin = ("registry" | "build" | "machine_snapshot");
 export type ZoMachineImageDeleteOutputV1ImageStatus = ("pending" | "preparing" | "ready" | "failed" | "deleting" | "deleted");
@@ -4129,7 +4152,11 @@ export interface ZoMachineImageImportInputV1 {
      */
     visibility?: ("workspace" | "protected");
     workspace_id: string;
-    idempotency_key: string;
+    /**
+     * @deprecated
+     * Ignored compatibility field. Omit it; supplying a key does not deduplicate this operation.
+     */
+    idempotency_key?: (string | null);
     source: ZoMachineImageImportInputV1RegistrySourceInput;
 }
 export interface ZoMachineImageImportInputV1RegistrySourceInput {
@@ -5715,7 +5742,7 @@ export interface ZoSubscriptionListOutputV1PrincipalRef {
 }
 export interface ZoSubscriptionListQueryV1 {
     /**
-     * Rows per page, at most 7; a larger value is reduced to it.
+     * Rows per page, at most 100; a larger value is reduced to it.
      */
     limit?: number;
     /**
@@ -5872,7 +5899,7 @@ export interface ZoSubscriptionListOutputV2PrincipalRef {
 }
 export interface ZoSubscriptionListQueryV2 {
     /**
-     * Rows per page, at most 7; a larger value is reduced to it.
+     * Rows per page, at most 100; a larger value is reduced to it.
      */
     limit?: number;
     /**
@@ -7245,6 +7272,10 @@ export interface ZoTaskListQueryV1 {
          * Only blocked tasks, or only unblocked ones.
          */
         is_blocked?: (boolean | null);
+        /**
+         * Tasks carrying any of these workspace tag IDs.
+         */
+        tags?: (string[] | null);
     };
 }
 /**
@@ -7380,493 +7411,6 @@ export interface ZoTaskUpdateOutputV1CommentAuthor {
     display_name: string;
     active: boolean;
 }
-export interface ZoVaultCreateInputV1 {
-    workspace_id: string;
-    display_name: string;
-    description?: string;
-    /**
-     * Secret: the credential. Stored sealed and never returned.
-     */
-    value: string;
-    /**
-     * The environment variable name a machine gets the value under, such as `OPENAI_API_KEY`.
-     */
-    environment_variable?: (string | null);
-    /**
-     * @maxItems 10
-     */
-    injections?: [] | [ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection] | [ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection, ZoVaultCreateInputV1VaultInjection];
-    /**
-     * `workspace` (default): every member can use it. `protected`: only you, and whoever you share it with; workspace-wide grants don't reach it. Fixed at creation.
-     */
-    visibility?: ("workspace" | "protected");
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultCreateInputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultCreateInputV1HeaderLocation;
-    format: (ZoVaultCreateInputV1BearerFormat | ZoVaultCreateInputV1BasicFormat | ZoVaultCreateInputV1RawFormat);
-}
-export interface ZoVaultCreateInputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultCreateInputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultCreateInputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultCreateInputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
-/**
- * A vault's registry envelope and settings. Never its value.
- */
-export interface ZoVaultCreateOutputV1 {
-    id: string;
-    workspace_id: string;
-    type: "vault";
-    type_version: 1;
-    display_name: string;
-    description: string;
-    visibility: ("workspace" | "protected");
-    owner_user_id: (string | null);
-    revision: number;
-    created_at: string;
-    updated_at: string;
-    /**
-     * The environment variable name a machine gets the value under, or null for none.
-     */
-    environment_variable: (string | null);
-    injections: ZoVaultCreateOutputV1VaultInjection[];
-    /**
-     * When the current value was stored, at create or the last rotate.
-     */
-    value_updated_at: string;
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultCreateOutputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultCreateOutputV1HeaderLocation;
-    format: (ZoVaultCreateOutputV1BearerFormat | ZoVaultCreateOutputV1BasicFormat | ZoVaultCreateOutputV1RawFormat);
-}
-export interface ZoVaultCreateOutputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultCreateOutputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultCreateOutputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultCreateOutputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
-export interface ZoVaultDeleteInputV1 {
-    vault_id: string;
-    expected_revision: number;
-}
-export interface ZoVaultDeleteOutputV1 {
-    state: "deleted";
-    revision: number;
-}
-export interface ZoVaultGetInputV1 {
-    vault_id: string;
-}
-/**
- * A vault's registry envelope and settings. Never its value.
- */
-export interface ZoVaultGetOutputV1 {
-    id: string;
-    workspace_id: string;
-    type: "vault";
-    type_version: 1;
-    display_name: string;
-    description: string;
-    visibility: ("workspace" | "protected");
-    owner_user_id: (string | null);
-    revision: number;
-    created_at: string;
-    updated_at: string;
-    /**
-     * The environment variable name a machine gets the value under, or null for none.
-     */
-    environment_variable: (string | null);
-    injections: ZoVaultGetOutputV1VaultInjection[];
-    /**
-     * When the current value was stored, at create or the last rotate.
-     */
-    value_updated_at: string;
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultGetOutputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultGetOutputV1HeaderLocation;
-    format: (ZoVaultGetOutputV1BearerFormat | ZoVaultGetOutputV1BasicFormat | ZoVaultGetOutputV1RawFormat);
-}
-export interface ZoVaultGetOutputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultGetOutputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultGetOutputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultGetOutputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
-export interface ZoVaultListInputV1 {
-    workspace_id: string;
-}
-export interface ZoVaultListOutputV1 {
-    vaults: ZoVaultListOutputV1VaultView[];
-    next_cursor: (string | null);
-}
-/**
- * A vault's registry envelope and settings. Never its value.
- */
-export interface ZoVaultListOutputV1VaultView {
-    id: string;
-    workspace_id: string;
-    type: "vault";
-    type_version: 1;
-    display_name: string;
-    description: string;
-    visibility: ("workspace" | "protected");
-    owner_user_id: (string | null);
-    revision: number;
-    created_at: string;
-    updated_at: string;
-    /**
-     * The environment variable name a machine gets the value under, or null for none.
-     */
-    environment_variable: (string | null);
-    injections: ZoVaultListOutputV1VaultInjection[];
-    /**
-     * When the current value was stored, at create or the last rotate.
-     */
-    value_updated_at: string;
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultListOutputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultListOutputV1HeaderLocation;
-    format: (ZoVaultListOutputV1BearerFormat | ZoVaultListOutputV1BasicFormat | ZoVaultListOutputV1RawFormat);
-}
-export interface ZoVaultListOutputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultListOutputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultListOutputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultListOutputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
-export interface ZoVaultListQueryV1 {
-    /**
-     * Rows per page, at most 100; a larger value is reduced to it.
-     */
-    limit?: number;
-    /**
-     * The previous page's next_cursor, sent with the same sort, filter and search.
-     */
-    cursor?: string;
-    sort?: ("id.asc" | "created_at.desc" | "created_at.asc" | "display_name.asc");
-}
-export interface ZoVaultRotateInputV1 {
-    vault_id: string;
-    expected_revision: number;
-    /**
-     * Secret: the credential. Stored sealed and never returned.
-     */
-    value: string;
-}
-/**
- * A vault's registry envelope and settings. Never its value.
- */
-export interface ZoVaultRotateOutputV1 {
-    id: string;
-    workspace_id: string;
-    type: "vault";
-    type_version: 1;
-    display_name: string;
-    description: string;
-    visibility: ("workspace" | "protected");
-    owner_user_id: (string | null);
-    revision: number;
-    created_at: string;
-    updated_at: string;
-    /**
-     * The environment variable name a machine gets the value under, or null for none.
-     */
-    environment_variable: (string | null);
-    injections: ZoVaultRotateOutputV1VaultInjection[];
-    /**
-     * When the current value was stored, at create or the last rotate.
-     */
-    value_updated_at: string;
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultRotateOutputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultRotateOutputV1HeaderLocation;
-    format: (ZoVaultRotateOutputV1BearerFormat | ZoVaultRotateOutputV1BasicFormat | ZoVaultRotateOutputV1RawFormat);
-}
-export interface ZoVaultRotateOutputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultRotateOutputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultRotateOutputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultRotateOutputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
-/**
- * Omitted fields keep their value; ``injections`` replaces the whole list.
- */
-export interface ZoVaultUpdateInputV1 {
-    vault_id: string;
-    expected_revision: number;
-    display_name?: (string | null);
-    /**
-     * `""` clears the description.
-     */
-    description?: (string | null);
-    /**
-     * `""` clears the variable.
-     */
-    environment_variable?: (string | null);
-    injections?: ([] | [ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | [ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection, ZoVaultUpdateInputV1VaultInjection] | null);
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultUpdateInputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultUpdateInputV1HeaderLocation;
-    format: (ZoVaultUpdateInputV1BearerFormat | ZoVaultUpdateInputV1BasicFormat | ZoVaultUpdateInputV1RawFormat);
-}
-export interface ZoVaultUpdateInputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultUpdateInputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultUpdateInputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultUpdateInputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
-/**
- * A vault's registry envelope and settings. Never its value.
- */
-export interface ZoVaultUpdateOutputV1 {
-    id: string;
-    workspace_id: string;
-    type: "vault";
-    type_version: 1;
-    display_name: string;
-    description: string;
-    visibility: ("workspace" | "protected");
-    owner_user_id: (string | null);
-    revision: number;
-    created_at: string;
-    updated_at: string;
-    /**
-     * The environment variable name a machine gets the value under, or null for none.
-     */
-    environment_variable: (string | null);
-    injections: ZoVaultUpdateOutputV1VaultInjection[];
-    /**
-     * When the current value was stored, at create or the last rotate.
-     */
-    value_updated_at: string;
-}
-/**
- * Where and how the value is sent on requests to ``hosts``. A host appears
- * in at most one entry of a vault's list.
- */
-export interface ZoVaultUpdateOutputV1VaultInjection {
-    /**
-     * @minItems 1
-     * @maxItems 20
-     *
-     * Items: An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.
-     */
-    hosts: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string];
-    location: ZoVaultUpdateOutputV1HeaderLocation;
-    format: (ZoVaultUpdateOutputV1BearerFormat | ZoVaultUpdateOutputV1BasicFormat | ZoVaultUpdateOutputV1RawFormat);
-}
-export interface ZoVaultUpdateOutputV1HeaderLocation {
-    type: "header";
-    /**
-     * The header to set, such as `Authorization` or `X-API-Key`.
-     */
-    name: string;
-}
-export interface ZoVaultUpdateOutputV1BearerFormat {
-    /**
-     * `Bearer <value>`.
-     */
-    type: "bearer";
-}
-export interface ZoVaultUpdateOutputV1BasicFormat {
-    /**
-     * `Basic` with base64 of `<username>:<value>`.
-     */
-    type: "basic";
-    username: string;
-}
-export interface ZoVaultUpdateOutputV1RawFormat {
-    /**
-     * The value as it is.
-     */
-    type: "raw";
-}
 export interface ZoWebFetchInputV1 {
     workspace_id: string;
     /**
@@ -8012,6 +7556,7 @@ export interface ZoWebsiteCreateInputV1 {
      */
     description?: string;
     visibility?: ("workspace" | "protected");
+    access?: ("public" | "authenticated");
 }
 export interface ZoWebsiteCreateOutputV1 {
     id: string;
@@ -8021,7 +7566,7 @@ export interface ZoWebsiteCreateOutputV1 {
     description: string;
     generated_hostname: string;
     custom_hostname: (ZoWebsiteCreateOutputV1WebsiteHostname | null);
-    access: "public";
+    access: ("public" | "authenticated");
     revision: number;
     visibility: ("workspace" | "protected");
     owner_user_id: (string | null);
@@ -8051,7 +7596,7 @@ export interface ZoWebsiteGetOutputV1 {
     description: string;
     generated_hostname: string;
     custom_hostname: (ZoWebsiteGetOutputV1WebsiteHostname | null);
-    access: "public";
+    access: ("public" | "authenticated");
     revision: number;
     visibility: ("workspace" | "protected");
     owner_user_id: (string | null);
@@ -8077,7 +7622,7 @@ export interface ZoWebsiteListOutputV1WebsiteListItem {
     description: string;
     generated_hostname: string;
     custom_hostname: (ZoWebsiteListOutputV1WebsiteHostname | null);
-    access: "public";
+    access: ("public" | "authenticated");
     revision: number;
     visibility: ("workspace" | "protected");
     owner_user_id: (string | null);
@@ -8098,6 +7643,7 @@ export interface ZoWebsiteListOutputV1WebsiteRoute {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteListOutputV1FunctionRouteConfig | ZoWebsiteListOutputV1MachineRouteConfig | ZoWebsiteListOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteListOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8141,6 +7687,7 @@ export interface ZoWebsiteUpdateInputV1 {
      */
     description?: (string | null);
     custom_hostname?: (ZoWebsiteUpdateInputV1CustomHostnameChange | null);
+    access?: (("public" | "authenticated") | null);
 }
 export interface ZoWebsiteUpdateInputV1CustomHostnameChange {
     hostname: (string | null);
@@ -8153,7 +7700,7 @@ export interface ZoWebsiteUpdateOutputV1 {
     description: string;
     generated_hostname: string;
     custom_hostname: (ZoWebsiteUpdateOutputV1WebsiteHostname | null);
-    access: "public";
+    access: ("public" | "authenticated");
     revision: number;
     visibility: ("workspace" | "protected");
     owner_user_id: (string | null);
@@ -8173,6 +7720,7 @@ export interface ZoWebsiteRouteCreateInputV1 {
      * @maxItems 8
      */
     acknowledge_bound_accounts?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+    access?: ("public" | "authenticated");
 }
 export interface ZoWebsiteRouteCreateInputV1FunctionRouteConfigInput {
     kind: "function";
@@ -8204,6 +7752,7 @@ export interface ZoWebsiteRouteCreateOutputV1 {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteRouteCreateOutputV1FunctionRouteConfig | ZoWebsiteRouteCreateOutputV1MachineRouteConfig | ZoWebsiteRouteCreateOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteRouteCreateOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8252,6 +7801,7 @@ export interface ZoWebsiteRouteGetOutputV1 {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteRouteGetOutputV1FunctionRouteConfig | ZoWebsiteRouteGetOutputV1MachineRouteConfig | ZoWebsiteRouteGetOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteRouteGetOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8290,6 +7840,7 @@ export interface ZoWebsiteRouteListOutputV1WebsiteRoute {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteRouteListOutputV1FunctionRouteConfig | ZoWebsiteRouteListOutputV1MachineRouteConfig | ZoWebsiteRouteListOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteRouteListOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8340,6 +7891,7 @@ export interface ZoWebsiteRoutePublishOutputV1 {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteRoutePublishOutputV1FunctionRouteConfig | ZoWebsiteRoutePublishOutputV1MachineRouteConfig | ZoWebsiteRoutePublishOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteRoutePublishOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8380,6 +7932,7 @@ export interface ZoWebsiteRouteUnpublishOutputV1 {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteRouteUnpublishOutputV1FunctionRouteConfig | ZoWebsiteRouteUnpublishOutputV1MachineRouteConfig | ZoWebsiteRouteUnpublishOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteRouteUnpublishOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8413,6 +7966,7 @@ export interface ZoWebsiteRouteUpdateInputV1 {
      * @maxItems 8
      */
     acknowledge_bound_accounts?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+    access?: (("public" | "authenticated") | null);
 }
 export interface ZoWebsiteRouteUpdateInputV1FunctionRouteConfigInput {
     kind: "function";
@@ -8444,6 +7998,7 @@ export interface ZoWebsiteRouteUpdateOutputV1 {
     state: ("unpublished" | "published");
     published_at: (string | null);
     target: (ZoWebsiteRouteUpdateOutputV1FunctionRouteConfig | ZoWebsiteRouteUpdateOutputV1MachineRouteConfig | ZoWebsiteRouteUpdateOutputV1KbRouteConfig);
+    access: ("public" | "authenticated");
 }
 export interface ZoWebsiteRouteUpdateOutputV1FunctionRouteConfig {
     kind: "function";
@@ -8708,7 +8263,7 @@ export interface ZoWorkspaceGetInputV1 {
     workspace_id: string;
 }
 /**
- * A `workspace` resource instance returned by `zo.workspace.get`.
+ * A `workspace` resource instance returned by `zo.workspace.get`, with the caller.
  *
  * `workspace_id` keeps the resource envelope uniform across types; for a
  * workspace resource it equals `id`.
@@ -8721,6 +8276,7 @@ export interface ZoWorkspaceGetOutputV1 {
     display_name: string;
     revision: number;
     properties: ZoWorkspaceGetOutputV1WorkspaceProperties;
+    caller: ZoWorkspaceGetOutputV1WorkspaceCaller;
 }
 /**
  * Public properties of a `workspace` resource, type version 1.
@@ -8730,6 +8286,68 @@ export interface ZoWorkspaceGetOutputV1 {
  */
 export interface ZoWorkspaceGetOutputV1WorkspaceProperties {
 }
+/**
+ * Who is calling, from the verified credential. `authorizes_as` is the
+ * identity policy decided for; `initiated_by` and `owner` are attribution and
+ * grant no permission.
+ */
+export interface ZoWorkspaceGetOutputV1WorkspaceCaller {
+    principal: ZoWorkspaceGetOutputV1CallerIdentity;
+    authorizes_as: ZoWorkspaceGetOutputV1CallerIdentity;
+    initiated_by: (ZoWorkspaceGetOutputV1CallerIdentity | null);
+    /**
+     * The owner of a protected resource principal.
+     */
+    owner: (ZoWorkspaceGetOutputV1CallerPerson | null);
+    person: (ZoWorkspaceGetOutputV1CallerRelatedPerson | null);
+    credential: ZoWorkspaceGetOutputV1CallerCredential;
+    /**
+     * The person's built-in standing in this workspace: Workspace owners, then Workspace members.
+     */
+    workspace_membership: (("owner" | "member") | null);
+}
+/**
+ * A verified identity of the request: its type, ID and current display name.
+ */
+export interface ZoWorkspaceGetOutputV1CallerIdentity {
+    type: ("user" | "agent" | "function" | "service" | "machine" | "service_account" | "workflow");
+    id: string;
+    /**
+     * A person's full name or a resource's display name; never an email.
+     */
+    display_name: (string | null);
+}
+/**
+ * A person, by user ID and current full name.
+ */
+export interface ZoWorkspaceGetOutputV1CallerPerson {
+    user_id: string;
+    display_name: (string | null);
+}
+/**
+ * The person this request relates to and how: as its principal, its policy
+ * authority, its initiator, or the owner of its protected principal.
+ */
+export interface ZoWorkspaceGetOutputV1CallerRelatedPerson {
+    user_id: string;
+    display_name: (string | null);
+    relationship: ("principal" | "authority" | "initiator" | "owner");
+}
+/**
+ * The kind of the verified credential and its client facts.
+ */
+export interface ZoWorkspaceGetOutputV1CallerCredential {
+    kind: ("login" | "agent_runner" | "function_run" | "workflow_run" | "client_credentials" | "authorization_code" | "workload" | "execution" | "delegated" | "persisted");
+    client_id: string;
+    /**
+     * The OAuth client's kind, from the sign-in an `authorization_code` credential belongs to.
+     */
+    client_kind: (("account_app" | "local_app" | "website" | "hosted_app" | "registered_legacy") | null);
+    /**
+     * What an `authorization_code` credential may do.
+     */
+    access: (("act_as_identity" | "login_only") | null);
+}
 export interface ZoWorkspaceListResourcesInputV1 {
     workspace_id: string;
 }
@@ -8902,14 +8520,14 @@ export interface SourceV1 {
 export interface TaskV1 {
 }
 /**
- * A vault's settings live in its credential's configuration, and its value in the secret vault.
+ * The address and access mode live in the Website's typed row.
  */
-export interface VaultV1 {
+export interface WebsiteV1 {
 }
 /**
  * The address and access mode live in the Website's typed row.
  */
-export interface WebsiteV1 {
+export interface WebsiteRouteV1 {
 }
 /**
  * Workflow lifecycle facts are read from the extension row.
@@ -9672,43 +9290,6 @@ export type Operations = {
             output: ZoTaskUpdateOutputV1;
         };
     };
-    "zo.vault.create": {
-        1: {
-            input: ZoVaultCreateInputV1;
-            output: ZoVaultCreateOutputV1;
-        };
-    };
-    "zo.vault.delete": {
-        1: {
-            input: ZoVaultDeleteInputV1;
-            output: ZoVaultDeleteOutputV1;
-        };
-    };
-    "zo.vault.get": {
-        1: {
-            input: ZoVaultGetInputV1;
-            output: ZoVaultGetOutputV1;
-        };
-    };
-    "zo.vault.list": {
-        1: {
-            input: ZoVaultListInputV1;
-            output: ZoVaultListOutputV1;
-            query: ZoVaultListQueryV1;
-        };
-    };
-    "zo.vault.rotate": {
-        1: {
-            input: ZoVaultRotateInputV1;
-            output: ZoVaultRotateOutputV1;
-        };
-    };
-    "zo.vault.update": {
-        1: {
-            input: ZoVaultUpdateInputV1;
-            output: ZoVaultUpdateOutputV1;
-        };
-    };
     "zo.web.fetch": {
         1: {
             input: ZoWebFetchInputV1;
@@ -10000,12 +9581,6 @@ export type DefaultVersions = {
     "zo.task.get": 1;
     "zo.task.list": 1;
     "zo.task.update": 1;
-    "zo.vault.create": 1;
-    "zo.vault.delete": 1;
-    "zo.vault.get": 1;
-    "zo.vault.list": 1;
-    "zo.vault.rotate": 1;
-    "zo.vault.update": 1;
     "zo.web.fetch": 1;
     "zo.web.search": 1;
     "zo.website.create": 1;