@zocomputer/system-api 0.1.4 → 0.3.0

package/openapi.json

@@ -11208,18 +11208,26 @@
       "description": "Validate a payload against an active event definition and publish the occurrence durably under a caller-scoped idempotency key.",
       "input_schema": {
         "additionalProperties": false,
-        "description": "The payload and its caller-scoped idempotency key (1 to 255 printable ASCII\ncharacters). Every envelope attribute (``id``, ``source``, ``type``, ``time``,\nthe workspace, the definition and the causal fields) is derived by the server\nand rejected as input.",
+        "description": "The payload and an optional caller-scoped idempotency key (1 to 255 printable ASCII\ncharacters). Every envelope attribute (``id``, ``source``, ``type``, ``time``,\nthe workspace, the definition and the causal fields) is derived by the server\nand rejected as input.",
         "properties": {
           "event_id": {
             "title": "Event Id",
             "type": "string"
           },
           "idempotency_key": {
-            "maxLength": 255,
-            "minLength": 1,
-            "pattern": "^[!-~]{1,255}$",
-            "title": "Idempotency Key",
-            "type": "string"
+            "anyOf": [
+              {
+                "maxLength": 255,
+                "minLength": 1,
+                "pattern": "^[!-~]{1,255}$",
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "title": "Idempotency Key"
           },
           "data": {
             "additionalProperties": {
@@ -11245,7 +11253,6 @@
         },
         "required": [
           "event_id",
-          "idempotency_key",
           "data"
         ],
         "title": "EventDispatchInput",
@@ -11299,7 +11306,7 @@
         "resource_not_found",
         "implementation_unavailable"
       ],
-      "digest": "sha256:17e006fbe141aced3e7c001a69c3c779e12b347b17909517bdc190dc8f9ed3f4"
+      "digest": "sha256:beff0adf0ddc6dba27a06791565a9835ec91266e22ad74dc6cb8e2bc8b18de03"
     },
     {
       "name": "zo.event.get",
@@ -13473,6 +13480,18 @@
             ],
             "title": "Error Code"
           },
+          "error_message": {
+            "anyOf": [
+              {
+                "maxLength": 300,
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Error Message"
+          },
           "created_at": {
             "title": "Created At",
             "type": "string"
@@ -13521,6 +13540,7 @@
           "entry_kind",
           "state",
           "error_code",
+          "error_message",
           "created_at",
           "deadline",
           "finished_at",
@@ -13582,7 +13602,7 @@
         "resource_not_found",
         "implementation_unavailable"
       ],
-      "digest": "sha256:8895f14a770afcc87f2b35cd8bb718bcc24ebf9d5acafb02176809155c47b1d4"
+      "digest": "sha256:2505ec5258453629ea98a3d70911387096dbbd4c2f68d5c2c24ee5f32746eaca"
     },
     {
       "name": "zo.function.invoke",
@@ -13980,6 +14000,18 @@
                 ],
                 "title": "Error Code"
               },
+              "error_message": {
+                "anyOf": [
+                  {
+                    "maxLength": 300,
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Error Message"
+              },
               "created_at": {
                 "title": "Created At",
                 "type": "string"
@@ -14007,6 +14039,7 @@
               "entry_kind",
               "state",
               "error_code",
+              "error_message",
               "created_at",
               "deadline",
               "finished_at"
@@ -14040,7 +14073,7 @@
         "resource_not_found",
         "implementation_unavailable"
       ],
-      "digest": "sha256:b21109de2f8e96dd818d1f2ff80d40a692a319bbb68d860cc81310ca09b068e6"
+      "digest": "sha256:5afb66f0e9685192469f0fda5db8ea0cf49cf1a645ab23d22a03bc8698c8a7b4"
     },
     {
       "name": "zo.function.publish_contract",
@@ -22411,6 +22444,501 @@
       ],
       "digest": "sha256:aadcb480b26c475386eb47a4694a413a0b118969638cd9bfd9d9e5d68b5f758e"
     },
+    {
+      "name": "zo.model.list",
+      "version": 1,
+      "publisher": "zo",
+      "description": "List the models this workspace can call, each with its ID, capabilities, accepted file types, reasoning levels, limits and current prices.",
+      "input_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "workspace_id": {
+            "maxLength": 200,
+            "minLength": 1,
+            "title": "Workspace Id",
+            "type": "string"
+          }
+        },
+        "required": [
+          "workspace_id"
+        ],
+        "title": "ModelListInput",
+        "type": "object"
+      },
+      "output_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "models": {
+            "items": {
+              "$ref": "#/$defs/ModelEntry"
+            },
+            "title": "Models",
+            "type": "array"
+          },
+          "next_cursor": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Next Cursor"
+          }
+        },
+        "required": [
+          "models",
+          "next_cursor"
+        ],
+        "title": "ModelListResult",
+        "type": "object",
+        "$defs": {
+          "ModelEntry": {
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "description": "The ID to pass as model.",
+                "title": "Id",
+                "type": "string"
+              },
+              "display_name": {
+                "title": "Display Name",
+                "type": "string"
+              },
+              "provider": {
+                "title": "Provider",
+                "type": "string"
+              },
+              "capabilities": {
+                "items": {
+                  "enum": [
+                    "text",
+                    "structured_output",
+                    "embedding",
+                    "rerank",
+                    "image",
+                    "speech",
+                    "transcription",
+                    "video"
+                  ],
+                  "type": "string"
+                },
+                "title": "Capabilities",
+                "type": "array"
+              },
+              "input_media": {
+                "description": "Media types the model accepts in file parts, such as image/* and text/*.",
+                "items": {
+                  "type": "string"
+                },
+                "title": "Input Media",
+                "type": "array"
+              },
+              "context_window_tokens": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Context Window Tokens"
+              },
+              "max_output_tokens": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Max Output Tokens"
+              },
+              "reasoning_levels": {
+                "description": "The reasoning levels the model offers. Empty when it has none.",
+                "items": {
+                  "type": "string"
+                },
+                "title": "Reasoning Levels",
+                "type": "array"
+              },
+              "settings": {
+                "description": "Every setting the model accepts, with its allowed values. A setting not listed is refused with invalid_input before the call.",
+                "items": {
+                  "$ref": "#/$defs/ModelSetting"
+                },
+                "title": "Settings",
+                "type": "array"
+              },
+              "limits": {
+                "additionalProperties": {
+                  "type": "integer"
+                },
+                "description": "Named limits for the model's actions, such as max_values.",
+                "title": "Limits",
+                "type": "object"
+              },
+              "prices": {
+                "description": "Every rate the model is billed at, the rows zo.billing.list_rates returns for it. A call is charged at the rates whose conditions it meets.",
+                "items": {
+                  "$ref": "#/$defs/ModelPrice"
+                },
+                "title": "Prices",
+                "type": "array"
+              },
+              "status": {
+                "enum": [
+                  "available",
+                  "deprecated"
+                ],
+                "title": "Status",
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "display_name",
+              "provider",
+              "capabilities",
+              "input_media",
+              "context_window_tokens",
+              "max_output_tokens",
+              "reasoning_levels",
+              "settings",
+              "limits",
+              "prices",
+              "status"
+            ],
+            "title": "ModelEntry",
+            "type": "object"
+          },
+          "ModelPrice": {
+            "additionalProperties": false,
+            "description": "One of the model's rates: the row ``zo.billing.list_rates`` returns for it.",
+            "properties": {
+              "rate_key": {
+                "description": "The rate's key in zo.billing.list_rates.",
+                "title": "Rate Key",
+                "type": "string"
+              },
+              "meter": {
+                "description": "The usage meter the rate prices, as zo.billing.list_rates names it.",
+                "title": "Meter",
+                "type": "string"
+              },
+              "unit": {
+                "description": "What one billed unit is. input, output, cache_read and cache_write are tokens: the usage fields input_tokens, output_tokens, cache_read_tokens and cache_write_tokens. request is one generated output, such as an image or a video.",
+                "enum": [
+                  "input",
+                  "output",
+                  "cache_read",
+                  "cache_write",
+                  "request",
+                  "character",
+                  "millisecond",
+                  "audio_minute",
+                  "megapixel",
+                  "video_second"
+                ],
+                "title": "Unit",
+                "type": "string"
+              },
+              "usd": {
+                "description": "The workspace's current price for per units, as a decimal string.",
+                "maxLength": 200,
+                "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                "title": "Usd",
+                "type": "string"
+              },
+              "per": {
+                "description": "How many units usd is for: 1000000 for tokens.",
+                "maxLength": 200,
+                "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                "title": "Per",
+                "type": "string"
+              },
+              "conditions": {
+                "$ref": "#/$defs/RateConditions",
+                "description": "When the rate applies, as zo.billing.list_rates gives it: input-token tiers for text models; operation, selector, resolution, quality, duration and quantity bounds for media models."
+              }
+            },
+            "required": [
+              "rate_key",
+              "meter",
+              "unit",
+              "usd",
+              "per",
+              "conditions"
+            ],
+            "title": "ModelPrice",
+            "type": "object"
+          },
+          "ModelSetting": {
+            "additionalProperties": false,
+            "description": "One setting the model accepts and the values it allows.",
+            "properties": {
+              "name": {
+                "description": "The input field, such as temperature or reasoning.",
+                "title": "Name",
+                "type": "string"
+              },
+              "minimum": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The smallest allowed value, as a decimal string.",
+                "title": "Minimum"
+              },
+              "maximum": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The largest allowed value, as a decimal string.",
+                "title": "Maximum"
+              },
+              "max_items": {
+                "anyOf": [
+                  {
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The most items a list setting takes.",
+                "title": "Max Items"
+              },
+              "values": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The allowed values of a string setting.",
+                "title": "Values"
+              }
+            },
+            "required": [
+              "name",
+              "minimum",
+              "maximum",
+              "max_items",
+              "values"
+            ],
+            "title": "ModelSetting",
+            "type": "object"
+          },
+          "RateConditions": {
+            "additionalProperties": false,
+            "properties": {
+              "request_input_tokens_min": {
+                "anyOf": [
+                  {
+                    "minimum": 0,
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "description": "Inclusive request-size lower bound.",
+                "title": "Request Input Tokens Min"
+              },
+              "request_input_tokens_max": {
+                "anyOf": [
+                  {
+                    "minimum": 0,
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "description": "Exclusive request-size upper bound.",
+                "title": "Request Input Tokens Max"
+              },
+              "whole_request": {
+                "default": true,
+                "description": "The matching tier prices the whole request.",
+                "title": "Whole Request",
+                "type": "boolean"
+              },
+              "operation": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Operation"
+              },
+              "resolution": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Resolution"
+              },
+              "quality": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Quality"
+              },
+              "duration_seconds": {
+                "anyOf": [
+                  {
+                    "maxLength": 200,
+                    "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Duration Seconds"
+              },
+              "quantity_min": {
+                "anyOf": [
+                  {
+                    "maxLength": 200,
+                    "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Quantity Min"
+              },
+              "quantity_max": {
+                "anyOf": [
+                  {
+                    "maxLength": 200,
+                    "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Quantity Max"
+              },
+              "included_quantity": {
+                "anyOf": [
+                  {
+                    "maxLength": 200,
+                    "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Included Quantity"
+              },
+              "default_quantity": {
+                "anyOf": [
+                  {
+                    "maxLength": 200,
+                    "pattern": "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?$",
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Default Quantity"
+              },
+              "quantity_argument": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null,
+                "title": "Quantity Argument"
+              },
+              "selector": {
+                "additionalProperties": {
+                  "x-zo-json-value": true
+                },
+                "title": "Selector",
+                "type": "object"
+              },
+              "rounding": {
+                "default": "none",
+                "enum": [
+                  "none",
+                  "ceil_step"
+                ],
+                "title": "Rounding",
+                "type": "string"
+              }
+            },
+            "title": "RateConditions",
+            "type": "object",
+            "required": []
+          }
+        }
+      },
+      "target": {
+        "type": "workspace",
+        "input_pointer": "/workspace_id"
+      },
+      "additional_checks": [],
+      "effect": "read",
+      "result_kind": "inline",
+      "error_codes": [
+        "implementation_unavailable",
+        "invalid_input",
+        "invalid_cursor"
+      ],
+      "digest": "sha256:33b88b18e759ba942f7bf344798e5f693926666a1bc2947b75b1c1cc6e1a8fbc"
+    },
     {
       "name": "zo.oauth_app.create",
       "version": 1,
@@ -37876,1838 +38404,6 @@
       ],
       "digest": "sha256:cccdb137ca9c3de5abbd8baf2fd733fa7f9f847119b81cfdae2f6087e88f85a3"
     },
-    {
-      "name": "zo.vault.create",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Store a pasted credential, such as an API key, with the hosts it may be sent to. The value is never returned.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "workspace_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Workspace Id",
-            "type": "string"
-          },
-          "display_name": {
-            "maxLength": 256,
-            "minLength": 1,
-            "title": "Display Name",
-            "type": "string"
-          },
-          "description": {
-            "default": "",
-            "maxLength": 2000,
-            "title": "Description",
-            "type": "string"
-          },
-          "value": {
-            "description": "Secret: the credential. Stored sealed and never returned.",
-            "maxLength": 16384,
-            "minLength": 1,
-            "title": "Value",
-            "type": "string"
-          },
-          "environment_variable": {
-            "anyOf": [
-              {
-                "pattern": "^[A-Z_][A-Z0-9_]{0,127}$",
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "description": "The environment variable name a machine gets the value under, such as `OPENAI_API_KEY`.",
-            "title": "Environment Variable"
-          },
-          "injections": {
-            "default": [],
-            "items": {
-              "$ref": "#/$defs/VaultInjection"
-            },
-            "maxItems": 10,
-            "title": "Injections",
-            "type": "array"
-          },
-          "visibility": {
-            "default": "workspace",
-            "description": "`workspace` (default): every member can use it. `protected`: only you, and whoever you share it with; workspace-wide grants don't reach it. Fixed at creation.",
-            "enum": [
-              "workspace",
-              "protected"
-            ],
-            "title": "Visibility",
-            "type": "string"
-          }
-        },
-        "required": [
-          "workspace_id",
-          "display_name",
-          "value"
-        ],
-        "title": "VaultCreateInput",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          }
-        }
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "description": "A vault's registry envelope and settings. Never its value.",
-        "properties": {
-          "id": {
-            "title": "Id",
-            "type": "string"
-          },
-          "workspace_id": {
-            "title": "Workspace Id",
-            "type": "string"
-          },
-          "type": {
-            "const": "vault",
-            "title": "Type",
-            "type": "string"
-          },
-          "type_version": {
-            "const": 1,
-            "title": "Type Version",
-            "type": "integer"
-          },
-          "display_name": {
-            "title": "Display Name",
-            "type": "string"
-          },
-          "description": {
-            "title": "Description",
-            "type": "string"
-          },
-          "visibility": {
-            "enum": [
-              "workspace",
-              "protected"
-            ],
-            "title": "Visibility",
-            "type": "string"
-          },
-          "owner_user_id": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Owner User Id"
-          },
-          "revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Revision",
-            "type": "integer"
-          },
-          "created_at": {
-            "title": "Created At",
-            "type": "string"
-          },
-          "updated_at": {
-            "title": "Updated At",
-            "type": "string"
-          },
-          "environment_variable": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The environment variable name a machine gets the value under, or null for none.",
-            "title": "Environment Variable"
-          },
-          "injections": {
-            "items": {
-              "$ref": "#/$defs/VaultInjection"
-            },
-            "title": "Injections",
-            "type": "array"
-          },
-          "value_updated_at": {
-            "description": "When the current value was stored, at create or the last rotate.",
-            "title": "Value Updated At",
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "workspace_id",
-          "type",
-          "type_version",
-          "display_name",
-          "description",
-          "visibility",
-          "owner_user_id",
-          "revision",
-          "created_at",
-          "updated_at",
-          "environment_variable",
-          "injections",
-          "value_updated_at"
-        ],
-        "title": "VaultView",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          }
-        }
-      },
-      "target": {
-        "type": "workspace",
-        "input_pointer": "/workspace_id"
-      },
-      "additional_checks": [],
-      "effect": "create",
-      "result_kind": "inline",
-      "error_codes": [
-        "invalid_input",
-        "conflict",
-        "implementation_unavailable"
-      ],
-      "digest": "sha256:abf7dd3547db941d3ac5ce77e4b534811afddfd21fc73411ffca3738c756b73c"
-    },
-    {
-      "name": "zo.vault.delete",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Delete a vault: its value is destroyed and every grant on it is revoked.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "vault_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Vault Id",
-            "type": "string"
-          },
-          "expected_revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Expected Revision",
-            "type": "integer"
-          }
-        },
-        "required": [
-          "vault_id",
-          "expected_revision"
-        ],
-        "title": "VaultTargetInput",
-        "type": "object"
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "state": {
-            "const": "deleted",
-            "title": "State",
-            "type": "string"
-          },
-          "revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Revision",
-            "type": "integer"
-          }
-        },
-        "required": [
-          "state",
-          "revision"
-        ],
-        "title": "VaultDeleteResult",
-        "type": "object"
-      },
-      "target": {
-        "type": "vault",
-        "input_pointer": "/vault_id"
-      },
-      "additional_checks": [],
-      "effect": "manage",
-      "result_kind": "inline",
-      "error_codes": [
-        "conflict",
-        "resource_not_found"
-      ],
-      "digest": "sha256:21ca9575b1b5092c8e2010ed56b2ad7f263f76b0bc2c5def3e8d778f4fc5e17e"
-    },
-    {
-      "name": "zo.vault.get",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Read a vault's settings. The value is never returned.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "vault_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Vault Id",
-            "type": "string"
-          }
-        },
-        "required": [
-          "vault_id"
-        ],
-        "title": "VaultGetInput",
-        "type": "object"
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "description": "A vault's registry envelope and settings. Never its value.",
-        "properties": {
-          "id": {
-            "title": "Id",
-            "type": "string"
-          },
-          "workspace_id": {
-            "title": "Workspace Id",
-            "type": "string"
-          },
-          "type": {
-            "const": "vault",
-            "title": "Type",
-            "type": "string"
-          },
-          "type_version": {
-            "const": 1,
-            "title": "Type Version",
-            "type": "integer"
-          },
-          "display_name": {
-            "title": "Display Name",
-            "type": "string"
-          },
-          "description": {
-            "title": "Description",
-            "type": "string"
-          },
-          "visibility": {
-            "enum": [
-              "workspace",
-              "protected"
-            ],
-            "title": "Visibility",
-            "type": "string"
-          },
-          "owner_user_id": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Owner User Id"
-          },
-          "revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Revision",
-            "type": "integer"
-          },
-          "created_at": {
-            "title": "Created At",
-            "type": "string"
-          },
-          "updated_at": {
-            "title": "Updated At",
-            "type": "string"
-          },
-          "environment_variable": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The environment variable name a machine gets the value under, or null for none.",
-            "title": "Environment Variable"
-          },
-          "injections": {
-            "items": {
-              "$ref": "#/$defs/VaultInjection"
-            },
-            "title": "Injections",
-            "type": "array"
-          },
-          "value_updated_at": {
-            "description": "When the current value was stored, at create or the last rotate.",
-            "title": "Value Updated At",
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "workspace_id",
-          "type",
-          "type_version",
-          "display_name",
-          "description",
-          "visibility",
-          "owner_user_id",
-          "revision",
-          "created_at",
-          "updated_at",
-          "environment_variable",
-          "injections",
-          "value_updated_at"
-        ],
-        "title": "VaultView",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          }
-        }
-      },
-      "target": {
-        "type": "vault",
-        "input_pointer": "/vault_id"
-      },
-      "additional_checks": [],
-      "effect": "read",
-      "result_kind": "inline",
-      "error_codes": [
-        "resource_not_found"
-      ],
-      "digest": "sha256:78172cbf9b4b9a5ea41a97f9073111f775a8f13e7c3d4b7a1c20503f3f156e84"
-    },
-    {
-      "name": "zo.vault.list",
-      "version": 1,
-      "publisher": "zo",
-      "description": "List the vaults the caller can read in a workspace.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "workspace_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Workspace Id",
-            "type": "string"
-          }
-        },
-        "required": [
-          "workspace_id"
-        ],
-        "title": "VaultListInput",
-        "type": "object"
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "vaults": {
-            "items": {
-              "$ref": "#/$defs/VaultView"
-            },
-            "title": "Vaults",
-            "type": "array"
-          },
-          "next_cursor": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Next Cursor"
-          }
-        },
-        "required": [
-          "vaults",
-          "next_cursor"
-        ],
-        "title": "VaultListOutput",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          },
-          "VaultView": {
-            "additionalProperties": false,
-            "description": "A vault's registry envelope and settings. Never its value.",
-            "properties": {
-              "id": {
-                "title": "Id",
-                "type": "string"
-              },
-              "workspace_id": {
-                "title": "Workspace Id",
-                "type": "string"
-              },
-              "type": {
-                "const": "vault",
-                "title": "Type",
-                "type": "string"
-              },
-              "type_version": {
-                "const": 1,
-                "title": "Type Version",
-                "type": "integer"
-              },
-              "display_name": {
-                "title": "Display Name",
-                "type": "string"
-              },
-              "description": {
-                "title": "Description",
-                "type": "string"
-              },
-              "visibility": {
-                "enum": [
-                  "workspace",
-                  "protected"
-                ],
-                "title": "Visibility",
-                "type": "string"
-              },
-              "owner_user_id": {
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "title": "Owner User Id"
-              },
-              "revision": {
-                "exclusiveMinimum": 0,
-                "maximum": 9007199254740991,
-                "title": "Revision",
-                "type": "integer"
-              },
-              "created_at": {
-                "title": "Created At",
-                "type": "string"
-              },
-              "updated_at": {
-                "title": "Updated At",
-                "type": "string"
-              },
-              "environment_variable": {
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The environment variable name a machine gets the value under, or null for none.",
-                "title": "Environment Variable"
-              },
-              "injections": {
-                "items": {
-                  "$ref": "#/$defs/VaultInjection"
-                },
-                "title": "Injections",
-                "type": "array"
-              },
-              "value_updated_at": {
-                "description": "When the current value was stored, at create or the last rotate.",
-                "title": "Value Updated At",
-                "type": "string"
-              }
-            },
-            "required": [
-              "id",
-              "workspace_id",
-              "type",
-              "type_version",
-              "display_name",
-              "description",
-              "visibility",
-              "owner_user_id",
-              "revision",
-              "created_at",
-              "updated_at",
-              "environment_variable",
-              "injections",
-              "value_updated_at"
-            ],
-            "title": "VaultView",
-            "type": "object"
-          }
-        }
-      },
-      "target": {
-        "type": "workspace",
-        "input_pointer": "/workspace_id"
-      },
-      "additional_checks": [],
-      "effect": "read",
-      "result_kind": "inline",
-      "error_codes": [
-        "invalid_cursor"
-      ],
-      "digest": "sha256:451cd7005b562af6de1d381a81d57e54bba8def1db9e7c86134c28ed85dab6e4"
-    },
-    {
-      "name": "zo.vault.rotate",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Replace a vault's value. The previous value is destroyed.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "vault_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Vault Id",
-            "type": "string"
-          },
-          "expected_revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Expected Revision",
-            "type": "integer"
-          },
-          "value": {
-            "description": "Secret: the credential. Stored sealed and never returned.",
-            "maxLength": 16384,
-            "minLength": 1,
-            "title": "Value",
-            "type": "string"
-          }
-        },
-        "required": [
-          "vault_id",
-          "expected_revision",
-          "value"
-        ],
-        "title": "VaultRotateInput",
-        "type": "object"
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "description": "A vault's registry envelope and settings. Never its value.",
-        "properties": {
-          "id": {
-            "title": "Id",
-            "type": "string"
-          },
-          "workspace_id": {
-            "title": "Workspace Id",
-            "type": "string"
-          },
-          "type": {
-            "const": "vault",
-            "title": "Type",
-            "type": "string"
-          },
-          "type_version": {
-            "const": 1,
-            "title": "Type Version",
-            "type": "integer"
-          },
-          "display_name": {
-            "title": "Display Name",
-            "type": "string"
-          },
-          "description": {
-            "title": "Description",
-            "type": "string"
-          },
-          "visibility": {
-            "enum": [
-              "workspace",
-              "protected"
-            ],
-            "title": "Visibility",
-            "type": "string"
-          },
-          "owner_user_id": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Owner User Id"
-          },
-          "revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Revision",
-            "type": "integer"
-          },
-          "created_at": {
-            "title": "Created At",
-            "type": "string"
-          },
-          "updated_at": {
-            "title": "Updated At",
-            "type": "string"
-          },
-          "environment_variable": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The environment variable name a machine gets the value under, or null for none.",
-            "title": "Environment Variable"
-          },
-          "injections": {
-            "items": {
-              "$ref": "#/$defs/VaultInjection"
-            },
-            "title": "Injections",
-            "type": "array"
-          },
-          "value_updated_at": {
-            "description": "When the current value was stored, at create or the last rotate.",
-            "title": "Value Updated At",
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "workspace_id",
-          "type",
-          "type_version",
-          "display_name",
-          "description",
-          "visibility",
-          "owner_user_id",
-          "revision",
-          "created_at",
-          "updated_at",
-          "environment_variable",
-          "injections",
-          "value_updated_at"
-        ],
-        "title": "VaultView",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          }
-        }
-      },
-      "target": {
-        "type": "vault",
-        "input_pointer": "/vault_id"
-      },
-      "additional_checks": [],
-      "effect": "manage",
-      "result_kind": "inline",
-      "error_codes": [
-        "invalid_input",
-        "conflict",
-        "permission_denied",
-        "resource_not_found",
-        "implementation_unavailable"
-      ],
-      "digest": "sha256:93570595ef11a357f7cdb50c7f4b8d24a1fc36f9d678cb59627abeb1fa7cff6e"
-    },
-    {
-      "name": "zo.vault.update",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Change a vault's name, description, environment variable or injections against its current revision.",
-      "input_schema": {
-        "additionalProperties": false,
-        "description": "Omitted fields keep their value; ``injections`` replaces the whole list.",
-        "properties": {
-          "vault_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Vault Id",
-            "type": "string"
-          },
-          "expected_revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Expected Revision",
-            "type": "integer"
-          },
-          "display_name": {
-            "anyOf": [
-              {
-                "maxLength": 256,
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "title": "Display Name"
-          },
-          "description": {
-            "anyOf": [
-              {
-                "maxLength": 2000,
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "description": "`\"\"` clears the description.",
-            "title": "Description"
-          },
-          "environment_variable": {
-            "anyOf": [
-              {
-                "pattern": "^([A-Z_][A-Z0-9_]{0,127})?$",
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "description": "`\"\"` clears the variable.",
-            "title": "Environment Variable"
-          },
-          "injections": {
-            "anyOf": [
-              {
-                "items": {
-                  "$ref": "#/$defs/VaultInjection"
-                },
-                "maxItems": 10,
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "default": null,
-            "title": "Injections"
-          }
-        },
-        "required": [
-          "vault_id",
-          "expected_revision"
-        ],
-        "title": "VaultUpdateInput",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          }
-        }
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "description": "A vault's registry envelope and settings. Never its value.",
-        "properties": {
-          "id": {
-            "title": "Id",
-            "type": "string"
-          },
-          "workspace_id": {
-            "title": "Workspace Id",
-            "type": "string"
-          },
-          "type": {
-            "const": "vault",
-            "title": "Type",
-            "type": "string"
-          },
-          "type_version": {
-            "const": 1,
-            "title": "Type Version",
-            "type": "integer"
-          },
-          "display_name": {
-            "title": "Display Name",
-            "type": "string"
-          },
-          "description": {
-            "title": "Description",
-            "type": "string"
-          },
-          "visibility": {
-            "enum": [
-              "workspace",
-              "protected"
-            ],
-            "title": "Visibility",
-            "type": "string"
-          },
-          "owner_user_id": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Owner User Id"
-          },
-          "revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Revision",
-            "type": "integer"
-          },
-          "created_at": {
-            "title": "Created At",
-            "type": "string"
-          },
-          "updated_at": {
-            "title": "Updated At",
-            "type": "string"
-          },
-          "environment_variable": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The environment variable name a machine gets the value under, or null for none.",
-            "title": "Environment Variable"
-          },
-          "injections": {
-            "items": {
-              "$ref": "#/$defs/VaultInjection"
-            },
-            "title": "Injections",
-            "type": "array"
-          },
-          "value_updated_at": {
-            "description": "When the current value was stored, at create or the last rotate.",
-            "title": "Value Updated At",
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "workspace_id",
-          "type",
-          "type_version",
-          "display_name",
-          "description",
-          "visibility",
-          "owner_user_id",
-          "revision",
-          "created_at",
-          "updated_at",
-          "environment_variable",
-          "injections",
-          "value_updated_at"
-        ],
-        "title": "VaultView",
-        "type": "object",
-        "$defs": {
-          "BasicFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "basic",
-                "description": "`Basic` with base64 of `<username>:<value>`.",
-                "title": "Type",
-                "type": "string"
-              },
-              "username": {
-                "pattern": "^[^:]{1,256}$",
-                "title": "Username",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "username"
-            ],
-            "title": "BasicFormat",
-            "type": "object"
-          },
-          "BearerFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "bearer",
-                "description": "`Bearer <value>`.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "BearerFormat",
-            "type": "object"
-          },
-          "HeaderLocation": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "header",
-                "title": "Type",
-                "type": "string"
-              },
-              "name": {
-                "description": "The header to set, such as `Authorization` or `X-API-Key`.",
-                "pattern": "^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,128}$",
-                "title": "Name",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "name"
-            ],
-            "title": "HeaderLocation",
-            "type": "object"
-          },
-          "RawFormat": {
-            "additionalProperties": false,
-            "properties": {
-              "type": {
-                "const": "raw",
-                "description": "The value as it is.",
-                "title": "Type",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "RawFormat",
-            "type": "object"
-          },
-          "VaultInjection": {
-            "additionalProperties": false,
-            "description": "Where and how the value is sent on requests to ``hosts``. A host appears\nin at most one entry of a vault's list.",
-            "properties": {
-              "hosts": {
-                "items": {
-                  "description": "An exact lowercase DNS name, such as `api.openai.com`: no wildcard, port or path.",
-                  "maxLength": 253,
-                  "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$",
-                  "type": "string"
-                },
-                "maxItems": 20,
-                "minItems": 1,
-                "title": "Hosts",
-                "type": "array"
-              },
-              "location": {
-                "$ref": "#/$defs/HeaderLocation"
-              },
-              "format": {
-                "discriminator": {
-                  "mapping": {
-                    "basic": "#/$defs/BasicFormat",
-                    "bearer": "#/$defs/BearerFormat",
-                    "raw": "#/$defs/RawFormat"
-                  },
-                  "propertyName": "type"
-                },
-                "oneOf": [
-                  {
-                    "$ref": "#/$defs/BearerFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/BasicFormat"
-                  },
-                  {
-                    "$ref": "#/$defs/RawFormat"
-                  }
-                ],
-                "title": "Format"
-              }
-            },
-            "required": [
-              "hosts",
-              "location",
-              "format"
-            ],
-            "title": "VaultInjection",
-            "type": "object"
-          }
-        }
-      },
-      "target": {
-        "type": "vault",
-        "input_pointer": "/vault_id"
-      },
-      "additional_checks": [],
-      "effect": "manage",
-      "result_kind": "inline",
-      "error_codes": [
-        "invalid_input",
-        "conflict",
-        "permission_denied",
-        "resource_not_found"
-      ],
-      "digest": "sha256:80aa675da723e68f10b88b4f1663724a0c3e8f3ba11399b420c88cdcb7430d53"
-    },
     {
       "name": "zo.web.fetch",
       "version": 1,
@@ -40254,6 +38950,15 @@
             ],
             "title": "Visibility",
             "type": "string"
+          },
+          "access": {
+            "default": "public",
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -40302,224 +39007,230 @@
             ]
           },
           "access": {
-            "const": "public",
-            "title": "Access",
-            "type": "string"
-          },
-          "revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Revision",
-            "type": "integer"
-          },
-          "visibility": {
             "enum": [
-              "workspace",
-              "protected"
-            ],
-            "title": "Visibility",
-            "type": "string"
-          },
-          "owner_user_id": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Owner User Id"
-          },
-          "created_at": {
-            "title": "Created At",
-            "type": "string"
-          },
-          "updated_at": {
-            "title": "Updated At",
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "workspace_id",
-          "slug",
-          "display_name",
-          "description",
-          "generated_hostname",
-          "custom_hostname",
-          "access",
-          "revision",
-          "visibility",
-          "owner_user_id",
-          "created_at",
-          "updated_at"
-        ],
-        "title": "Website",
-        "type": "object",
-        "$defs": {
-          "WebsiteHostname": {
-            "additionalProperties": false,
-            "properties": {
-              "hostname": {
-                "title": "Hostname",
-                "type": "string"
-              },
-              "state": {
-                "enum": [
-                  "pending_dns",
-                  "pending_ssl",
-                  "active",
-                  "released"
-                ],
-                "title": "State",
-                "type": "string"
-              }
-            },
-            "required": [
-              "hostname",
-              "state"
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
+          },
+          "revision": {
+            "exclusiveMinimum": 0,
+            "maximum": 9007199254740991,
+            "title": "Revision",
+            "type": "integer"
+          },
+          "visibility": {
+            "enum": [
+              "workspace",
+              "protected"
+            ],
+            "title": "Visibility",
+            "type": "string"
+          },
+          "owner_user_id": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Owner User Id"
+          },
+          "created_at": {
+            "title": "Created At",
+            "type": "string"
+          },
+          "updated_at": {
+            "title": "Updated At",
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "workspace_id",
+          "slug",
+          "display_name",
+          "description",
+          "generated_hostname",
+          "custom_hostname",
+          "access",
+          "revision",
+          "visibility",
+          "owner_user_id",
+          "created_at",
+          "updated_at"
+        ],
+        "title": "Website",
+        "type": "object",
+        "$defs": {
+          "WebsiteHostname": {
+            "additionalProperties": false,
+            "properties": {
+              "hostname": {
+                "title": "Hostname",
+                "type": "string"
+              },
+              "state": {
+                "enum": [
+                  "pending_dns",
+                  "pending_ssl",
+                  "active",
+                  "released"
+                ],
+                "title": "State",
+                "type": "string"
+              }
+            },
+            "required": [
+              "hostname",
+              "state"
+            ],
+            "title": "WebsiteHostname",
+            "type": "object"
+          }
+        }
+      },
+      "target": {
+        "type": "workspace",
+        "input_pointer": "/workspace_id"
+      },
+      "additional_checks": [],
+      "effect": "create",
+      "result_kind": "inline",
+      "error_codes": [
+        "implementation_unavailable",
+        "invalid_input",
+        "conflict"
+      ],
+      "digest": "sha256:8c7b48e80e39d01eb6fa121ba0a2688deba2f2ba7396dee8e3f583d7f6c884ff"
+    },
+    {
+      "name": "zo.website.delete",
+      "version": 1,
+      "publisher": "zo",
+      "description": "Delete a Website and retire its routes.",
+      "input_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "website_id": {
+            "maxLength": 200,
+            "minLength": 1,
+            "title": "Website Id",
+            "type": "string"
+          },
+          "expected_revision": {
+            "exclusiveMinimum": 0,
+            "maximum": 9007199254740991,
+            "title": "Expected Revision",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "website_id",
+          "expected_revision"
+        ],
+        "title": "WebsiteRevisionInput",
+        "type": "object"
+      },
+      "output_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "deleted": {
+            "const": true,
+            "title": "Deleted",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "id",
+          "deleted"
+        ],
+        "title": "Deleted",
+        "type": "object"
+      },
+      "target": {
+        "type": "website",
+        "input_pointer": "/website_id"
+      },
+      "additional_checks": [],
+      "effect": "manage",
+      "result_kind": "inline",
+      "error_codes": [
+        "implementation_unavailable",
+        "conflict"
+      ],
+      "digest": "sha256:2db56e54e0b5566279d44af943774876d9996d525a3dab2b7af47389167ec896"
+    },
+    {
+      "name": "zo.website.get",
+      "version": 1,
+      "publisher": "zo",
+      "description": "Read a Website and its hostname.",
+      "input_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "website_id": {
+            "maxLength": 200,
+            "minLength": 1,
+            "title": "Website Id",
+            "type": "string"
+          }
+        },
+        "required": [
+          "website_id"
+        ],
+        "title": "WebsiteGetInput",
+        "type": "object"
+      },
+      "output_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "id": {
+            "title": "Id",
+            "type": "string"
+          },
+          "workspace_id": {
+            "title": "Workspace Id",
+            "type": "string"
+          },
+          "slug": {
+            "title": "Slug",
+            "type": "string"
+          },
+          "display_name": {
+            "title": "Display Name",
+            "type": "string"
+          },
+          "description": {
+            "title": "Description",
+            "type": "string"
+          },
+          "generated_hostname": {
+            "title": "Generated Hostname",
+            "type": "string"
+          },
+          "custom_hostname": {
+            "anyOf": [
+              {
+                "$ref": "#/$defs/WebsiteHostname"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "access": {
+            "enum": [
+              "public",
+              "authenticated"
             ],
-            "title": "WebsiteHostname",
-            "type": "object"
-          }
-        }
-      },
-      "target": {
-        "type": "workspace",
-        "input_pointer": "/workspace_id"
-      },
-      "additional_checks": [],
-      "effect": "create",
-      "result_kind": "inline",
-      "error_codes": [
-        "implementation_unavailable",
-        "invalid_input",
-        "conflict"
-      ],
-      "digest": "sha256:2b3ecdf8b5a8943b54adc1cb3edd6d55bbd2b50f9306d626cea73157ef84f379"
-    },
-    {
-      "name": "zo.website.delete",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Delete a Website and retire its routes.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "website_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Website Id",
-            "type": "string"
-          },
-          "expected_revision": {
-            "exclusiveMinimum": 0,
-            "maximum": 9007199254740991,
-            "title": "Expected Revision",
-            "type": "integer"
-          }
-        },
-        "required": [
-          "website_id",
-          "expected_revision"
-        ],
-        "title": "WebsiteRevisionInput",
-        "type": "object"
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "id": {
-            "title": "Id",
-            "type": "string"
-          },
-          "deleted": {
-            "const": true,
-            "title": "Deleted",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "id",
-          "deleted"
-        ],
-        "title": "Deleted",
-        "type": "object"
-      },
-      "target": {
-        "type": "website",
-        "input_pointer": "/website_id"
-      },
-      "additional_checks": [],
-      "effect": "manage",
-      "result_kind": "inline",
-      "error_codes": [
-        "implementation_unavailable",
-        "conflict"
-      ],
-      "digest": "sha256:2db56e54e0b5566279d44af943774876d9996d525a3dab2b7af47389167ec896"
-    },
-    {
-      "name": "zo.website.get",
-      "version": 1,
-      "publisher": "zo",
-      "description": "Read a Website and its hostname.",
-      "input_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "website_id": {
-            "maxLength": 200,
-            "minLength": 1,
-            "title": "Website Id",
-            "type": "string"
-          }
-        },
-        "required": [
-          "website_id"
-        ],
-        "title": "WebsiteGetInput",
-        "type": "object"
-      },
-      "output_schema": {
-        "additionalProperties": false,
-        "properties": {
-          "id": {
-            "title": "Id",
-            "type": "string"
-          },
-          "workspace_id": {
-            "title": "Workspace Id",
-            "type": "string"
-          },
-          "slug": {
-            "title": "Slug",
-            "type": "string"
-          },
-          "display_name": {
-            "title": "Display Name",
-            "type": "string"
-          },
-          "description": {
-            "title": "Description",
-            "type": "string"
-          },
-          "generated_hostname": {
-            "title": "Generated Hostname",
-            "type": "string"
-          },
-          "custom_hostname": {
-            "anyOf": [
-              {
-                "$ref": "#/$defs/WebsiteHostname"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "access": {
-            "const": "public",
             "title": "Access",
             "type": "string"
           },
@@ -40613,7 +39324,7 @@
         "implementation_unavailable",
         "resource_not_found"
       ],
-      "digest": "sha256:69267cde0d466e6011a6f11dc475ea6b7ef928541ecb2ee0f77db72a6d51dd79"
+      "digest": "sha256:e95171ac43bb4bf95e277a4c6777ee8061c728feb119cbfc2354dc45dfb82d49"
     },
     {
       "name": "zo.website.list",
@@ -40844,7 +39555,10 @@
                 ]
               },
               "access": {
-                "const": "public",
+                "enum": [
+                  "public",
+                  "authenticated"
+                ],
                 "title": "Access",
                 "type": "string"
               },
@@ -40975,6 +39689,14 @@
                   }
                 ],
                 "title": "Target"
+              },
+              "access": {
+                "enum": [
+                  "public",
+                  "authenticated"
+                ],
+                "title": "Access",
+                "type": "string"
               }
             },
             "required": [
@@ -40984,7 +39706,8 @@
               "revision",
               "state",
               "published_at",
-              "target"
+              "target",
+              "access"
             ],
             "title": "WebsiteRoute",
             "type": "object"
@@ -41002,7 +39725,7 @@
         "implementation_unavailable",
         "invalid_input"
       ],
-      "digest": "sha256:54c7ec12e23d6d642a6b738f23797aacb945e4bafebf4604b15c12ecf70d019f"
+      "digest": "sha256:1acce33b16bd903d94f40273da1785d694f99444facb40e166a061190db1bb74"
     },
     {
       "name": "zo.website.update",
@@ -41062,6 +39785,22 @@
               }
             ],
             "default": null
+          },
+          "access": {
+            "anyOf": [
+              {
+                "enum": [
+                  "public",
+                  "authenticated"
+                ],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "title": "Access"
           }
         },
         "required": [
@@ -41134,7 +39873,10 @@
             ]
           },
           "access": {
-            "const": "public",
+            "enum": [
+              "public",
+              "authenticated"
+            ],
             "title": "Access",
             "type": "string"
           },
@@ -41229,7 +39971,7 @@
         "invalid_input",
         "conflict"
       ],
-      "digest": "sha256:6900ed69ecf24c10329a7e4277a228d5d1fa0d68e445e51744e89201d0d675da"
+      "digest": "sha256:99ad2a085bd283d6fee339a8c3c1adf1414065e7f0a5714f0292ba352c9d7655"
     },
     {
       "name": "zo.website_route.create",
@@ -41289,6 +40031,15 @@
             "maxItems": 8,
             "title": "Acknowledge Bound Accounts",
             "type": "array"
+          },
+          "access": {
+            "default": "authenticated",
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -41488,6 +40239,14 @@
               }
             ],
             "title": "Target"
+          },
+          "access": {
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -41497,7 +40256,8 @@
           "revision",
           "state",
           "published_at",
-          "target"
+          "target",
+          "access"
         ],
         "title": "WebsiteRoute",
         "type": "object",
@@ -41633,7 +40393,7 @@
         "conflict",
         "permission_denied"
       ],
-      "digest": "sha256:9dd5792ac451e211437d2e29791df9f95f3bc7e55f5d90dc1d6afdfbc5a25bb8"
+      "digest": "sha256:7e47790fe89cfc69715e870249a89bd770d836ba81b68a6ea5efc889a902bca0"
     },
     {
       "name": "zo.website_route.delete",
@@ -41803,6 +40563,14 @@
               }
             ],
             "title": "Target"
+          },
+          "access": {
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -41812,7 +40580,8 @@
           "revision",
           "state",
           "published_at",
-          "target"
+          "target",
+          "access"
         ],
         "title": "WebsiteRoute",
         "type": "object",
@@ -41946,7 +40715,7 @@
         "implementation_unavailable",
         "resource_not_found"
       ],
-      "digest": "sha256:9d186c5f2887ae961c088459bafcbd44b1e46fb3c5daeaddc9d3d251dfa91f3c"
+      "digest": "sha256:6b3a84ac84b6d88ab2d6220266ae425613246fdc9e3100c4ea2f7039114de352"
     },
     {
       "name": "zo.website_route.list",
@@ -42175,6 +40944,14 @@
                   }
                 ],
                 "title": "Target"
+              },
+              "access": {
+                "enum": [
+                  "public",
+                  "authenticated"
+                ],
+                "title": "Access",
+                "type": "string"
               }
             },
             "required": [
@@ -42184,7 +40961,8 @@
               "revision",
               "state",
               "published_at",
-              "target"
+              "target",
+              "access"
             ],
             "title": "WebsiteRoute",
             "type": "object"
@@ -42201,7 +40979,7 @@
       "error_codes": [
         "implementation_unavailable"
       ],
-      "digest": "sha256:cdf770225f63cd112b61ccd2d03dab43e4ff3f6efd6f3bd926fade80651f16a0"
+      "digest": "sha256:2385bb19164c328895293e07b28a3217eecdb5261cea316cdab32abb7d399ba2"
     },
     {
       "name": "zo.website_route.publish",
@@ -42310,6 +41088,14 @@
               }
             ],
             "title": "Target"
+          },
+          "access": {
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -42319,7 +41105,8 @@
           "revision",
           "state",
           "published_at",
-          "target"
+          "target",
+          "access"
         ],
         "title": "WebsiteRoute",
         "type": "object",
@@ -42455,7 +41242,7 @@
         "conflict",
         "permission_denied"
       ],
-      "digest": "sha256:28b4cf3d5a6a57a8a8337c920c54529de2278d93806bc836c7f44863e7d6e98c"
+      "digest": "sha256:f67678ec3f38d276b70b567b1487eb249772b6442f690ec050b2cfb8af825438"
     },
     {
       "name": "zo.website_route.unpublish",
@@ -42564,6 +41351,14 @@
               }
             ],
             "title": "Target"
+          },
+          "access": {
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -42573,7 +41368,8 @@
           "revision",
           "state",
           "published_at",
-          "target"
+          "target",
+          "access"
         ],
         "title": "WebsiteRoute",
         "type": "object",
@@ -42707,7 +41503,7 @@
         "implementation_unavailable",
         "conflict"
       ],
-      "digest": "sha256:b483fb1010a229d4de97eacb9134e86d43e648bb59f96cd83c4d7b90ac0d71f9"
+      "digest": "sha256:c7b4fd53bac6778012f85a13644d30704ffba13cf4767cc87ccf8927f898036a"
     },
     {
       "name": "zo.website_route.update",
@@ -42789,6 +41585,22 @@
             "maxItems": 8,
             "title": "Acknowledge Bound Accounts",
             "type": "array"
+          },
+          "access": {
+            "anyOf": [
+              {
+                "enum": [
+                  "public",
+                  "authenticated"
+                ],
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "title": "Access"
           }
         },
         "required": [
@@ -42987,6 +41799,14 @@
               }
             ],
             "title": "Target"
+          },
+          "access": {
+            "enum": [
+              "public",
+              "authenticated"
+            ],
+            "title": "Access",
+            "type": "string"
           }
         },
         "required": [
@@ -42996,7 +41816,8 @@
           "revision",
           "state",
           "published_at",
-          "target"
+          "target",
+          "access"
         ],
         "title": "WebsiteRoute",
         "type": "object",
@@ -43132,7 +41953,7 @@
         "conflict",
         "permission_denied"
       ],
-      "digest": "sha256:35ae85e4343e8e223e431b08ec1b6237fcc7bc0cfeb11089105251d40b8c1f8d"
+      "digest": "sha256:7d7b5de1fbfffcd924aa18c8bc2bc8825d6f554bd740a232d7e03362d2799e0e"
     },
     {
       "name": "zo.workflow.activate",
@@ -44657,7 +43478,7 @@
       },
       "output_schema": {
         "additionalProperties": false,
-        "description": "A `workspace` resource instance returned by `zo.workspace.get`.\n\n`workspace_id` keeps the resource envelope uniform across types; for a\nworkspace resource it equals `id`.",
+        "description": "A `workspace` resource instance returned by `zo.workspace.get`, with the caller.\n\n`workspace_id` keeps the resource envelope uniform across types; for a\nworkspace resource it equals `id`.",
         "properties": {
           "id": {
             "title": "Id",
@@ -44690,6 +43511,9 @@
           },
           "properties": {
             "$ref": "#/$defs/WorkspaceProperties"
+          },
+          "caller": {
+            "$ref": "#/$defs/WorkspaceCaller"
           }
         },
         "required": [
@@ -44699,11 +43523,261 @@
           "type_version",
           "display_name",
           "revision",
-          "properties"
+          "properties",
+          "caller"
         ],
         "title": "WorkspaceResource",
         "type": "object",
         "$defs": {
+          "CallerCredential": {
+            "additionalProperties": false,
+            "description": "The kind of the verified credential and its client facts.",
+            "properties": {
+              "kind": {
+                "enum": [
+                  "login",
+                  "agent_runner",
+                  "function_run",
+                  "workflow_run",
+                  "client_credentials",
+                  "authorization_code",
+                  "workload",
+                  "execution",
+                  "delegated",
+                  "persisted"
+                ],
+                "title": "Kind",
+                "type": "string"
+              },
+              "client_id": {
+                "title": "Client Id",
+                "type": "string"
+              },
+              "client_kind": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "account_app",
+                      "local_app",
+                      "website",
+                      "hosted_app",
+                      "registered_legacy"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The OAuth client's kind, from the sign-in an `authorization_code` credential belongs to.",
+                "title": "Client Kind"
+              },
+              "access": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "act_as_identity",
+                      "login_only"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "What an `authorization_code` credential may do.",
+                "title": "Access"
+              }
+            },
+            "required": [
+              "kind",
+              "client_id",
+              "client_kind",
+              "access"
+            ],
+            "title": "CallerCredential",
+            "type": "object"
+          },
+          "CallerIdentity": {
+            "additionalProperties": false,
+            "description": "A verified identity of the request: its type, ID and current display name.",
+            "properties": {
+              "type": {
+                "enum": [
+                  "user",
+                  "agent",
+                  "function",
+                  "service",
+                  "machine",
+                  "service_account",
+                  "workflow"
+                ],
+                "title": "Type",
+                "type": "string"
+              },
+              "id": {
+                "title": "Id",
+                "type": "string"
+              },
+              "display_name": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "A person's full name or a resource's display name; never an email.",
+                "title": "Display Name"
+              }
+            },
+            "required": [
+              "type",
+              "id",
+              "display_name"
+            ],
+            "title": "CallerIdentity",
+            "type": "object"
+          },
+          "CallerPerson": {
+            "additionalProperties": false,
+            "description": "A person, by user ID and current full name.",
+            "properties": {
+              "user_id": {
+                "title": "User Id",
+                "type": "string"
+              },
+              "display_name": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Display Name"
+              }
+            },
+            "required": [
+              "user_id",
+              "display_name"
+            ],
+            "title": "CallerPerson",
+            "type": "object"
+          },
+          "CallerRelatedPerson": {
+            "additionalProperties": false,
+            "description": "The person this request relates to and how: as its principal, its policy\nauthority, its initiator, or the owner of its protected principal.",
+            "properties": {
+              "user_id": {
+                "title": "User Id",
+                "type": "string"
+              },
+              "display_name": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "title": "Display Name"
+              },
+              "relationship": {
+                "enum": [
+                  "principal",
+                  "authority",
+                  "initiator",
+                  "owner"
+                ],
+                "title": "Relationship",
+                "type": "string"
+              }
+            },
+            "required": [
+              "user_id",
+              "display_name",
+              "relationship"
+            ],
+            "title": "CallerRelatedPerson",
+            "type": "object"
+          },
+          "WorkspaceCaller": {
+            "additionalProperties": false,
+            "description": "Who is calling, from the verified credential. `authorizes_as` is the\nidentity policy decided for; `initiated_by` and `owner` are attribution and\ngrant no permission.",
+            "properties": {
+              "principal": {
+                "$ref": "#/$defs/CallerIdentity"
+              },
+              "authorizes_as": {
+                "$ref": "#/$defs/CallerIdentity"
+              },
+              "initiated_by": {
+                "anyOf": [
+                  {
+                    "$ref": "#/$defs/CallerIdentity"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "owner": {
+                "anyOf": [
+                  {
+                    "$ref": "#/$defs/CallerPerson"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The owner of a protected resource principal."
+              },
+              "person": {
+                "anyOf": [
+                  {
+                    "$ref": "#/$defs/CallerRelatedPerson"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "credential": {
+                "$ref": "#/$defs/CallerCredential"
+              },
+              "workspace_membership": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "owner",
+                      "member"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The person's built-in standing in this workspace: Workspace owners, then Workspace members.",
+                "title": "Workspace Membership"
+              }
+            },
+            "required": [
+              "principal",
+              "authorizes_as",
+              "initiated_by",
+              "owner",
+              "person",
+              "credential",
+              "workspace_membership"
+            ],
+            "title": "WorkspaceCaller",
+            "type": "object"
+          },
           "WorkspaceProperties": {
             "additionalProperties": false,
             "description": "Public properties of a `workspace` resource, type version 1.\n\nA workspace exposes its identity and display metadata on the resource\nenvelope and carries no custom registry properties in v1.",
@@ -44724,7 +43798,7 @@
       "error_codes": [
         "implementation_unavailable"
       ],
-      "digest": "sha256:76a80094bb826bb160ed2c82f27e2b1da3b74a89229d5b660abff05540c7c4fb"
+      "digest": "sha256:7146f7e15b6ee636740e282666a7c6ece2bee7d249b4faed1f65a92846f1d653"
     },
     {
       "name": "zo.workspace.list_resources",
@@ -45539,21 +44613,21 @@
       "digest": "sha256:1e355460f3453e487c63f32be9791ef06325d881e5b5c80ff09836860d6f6773"
     },
     {
-      "type": "vault",
+      "type": "website",
       "version": 1,
       "publisher": "zo",
       "properties_schema": {
         "additionalProperties": false,
-        "description": "A vault's settings live in its credential's configuration, and its value in the secret vault.",
+        "description": "The address and access mode live in the Website's typed row.",
         "properties": {},
-        "title": "VaultProperties",
+        "title": "WebsiteProperties",
         "type": "object",
         "required": []
       },
-      "digest": "sha256:9eef8368b0a6d812be0e966f68d1d5db8a6dbffdfefd6d576a3a1947d37ad95d"
+      "digest": "sha256:e340b5846f88e80c1f45ebb17caa711e52d77ea8d213cbc1852e67e043dc0ec9"
     },
     {
-      "type": "website",
+      "type": "website_route",
       "version": 1,
       "publisher": "zo",
       "properties_schema": {
@@ -45564,7 +44638,7 @@
         "type": "object",
         "required": []
       },
-      "digest": "sha256:e340b5846f88e80c1f45ebb17caa711e52d77ea8d213cbc1852e67e043dc0ec9"
+      "digest": "sha256:4c8cbfed69ef84a96a5bafbfd7d4c3eac40b0417945e7054c0835d666f7a0143"
     },
     {
       "type": "workflow",
@@ -45674,6 +44748,7 @@
     "zo.machine_image.list": 1,
     "zo.machine_image.update": 1,
     "zo.message.get": 1,
+    "zo.model.list": 1,
     "zo.oauth_app.create": 1,
     "zo.oauth_app.delete": 1,
     "zo.oauth_app.get": 1,
@@ -45712,12 +44787,6 @@
     "zo.task.get": 1,
     "zo.task.list": 1,
     "zo.task.update": 1,
-    "zo.vault.create": 1,
-    "zo.vault.delete": 1,
-    "zo.vault.get": 1,
-    "zo.vault.list": 1,
-    "zo.vault.rotate": 1,
-    "zo.vault.update": 1,
     "zo.web.fetch": 1,
     "zo.web.search": 1,
     "zo.website.create": 1,
@@ -47260,6 +46329,63 @@
       },
       "required": []
     },
+    "zo.model.list@1": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "limit": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 100,
+          "description": "Rows per page, at most 200; a larger value is reduced to it."
+        },
+        "cursor": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 5504,
+          "description": "The previous page's next_cursor, sent with the same sort, filter and search."
+        },
+        "sort": {
+          "type": "string",
+          "enum": [
+            "id.asc"
+          ],
+          "default": "id.asc"
+        },
+        "filter": {
+          "additionalProperties": false,
+          "properties": {
+            "capability": {
+              "anyOf": [
+                {
+                  "enum": [
+                    "text",
+                    "structured_output",
+                    "embedding",
+                    "rerank",
+                    "image",
+                    "speech",
+                    "transcription",
+                    "video"
+                  ],
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null,
+              "description": "Only models with this capability.",
+              "title": "Capability"
+            }
+          },
+          "type": "object",
+          "required": [],
+          "default": {}
+        }
+      },
+      "required": []
+    },
     "zo.oauth_app.list@1": {
       "type": "object",
       "additionalProperties": false,
@@ -47790,35 +46916,6 @@
         }
       }
     },
-    "zo.vault.list@1": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "limit": {
-          "type": "integer",
-          "minimum": 1,
-          "default": 50,
-          "description": "Rows per page, at most 100; a larger value is reduced to it."
-        },
-        "cursor": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 5504,
-          "description": "The previous page's next_cursor, sent with the same sort, filter and search."
-        },
-        "sort": {
-          "type": "string",
-          "enum": [
-            "id.asc",
-            "created_at.desc",
-            "created_at.asc",
-            "display_name.asc"
-          ],
-          "default": "id.asc"
-        }
-      },
-      "required": []
-    },
     "zo.website.list@1": {
       "type": "object",
       "additionalProperties": false,