codai-sdk 0.66.0 → 0.67.0

package/dist/index.d.ts

@@ -7292,6 +7292,26 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/grants/revoke-task': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Revoke the grants of a task
+     * @description Revokes every live grant whose `task` matches (task id, client task id or session key sent as `task` on `/v1/vault/use`). The gateway also does this on task confirm, session delete and every 5 minutes for closed tasks.
+     */
+    readonly post: operations$1['revokeVaultTaskGrants'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/http': {
     readonly parameters: {
       readonly query?: never;
@@ -7376,6 +7396,66 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/items/{id}/limits': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    /**
+     * Set per-handle limits
+     * @description Editor or above on the item's vault. Send all three keys; null removes a cap, all null removes the limits. Over a cap `/v1/vault/use`, `/v1/vault/http` and `/v1/vault/resolve` answer 429 `vault_rate_limited` with `Retry-After`.
+     */
+    readonly put: operations$1['setVaultItemLimits'];
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/limits': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List per-handle limits
+     * @description Usage caps set on your items. Only allowed uses count; an `http` use costs 2 units, other modes 1.
+     */
+    readonly get: operations$1['listVaultLimits'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/lock': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Panic lock
+     * @description Revokes every live grant, denies every pending approval and locks the vault: from then on every agent use is denied with reason `vault_locked` (`/v1/vault/http` and `/v1/vault/resolve` answer 403 `vault_denied`). Device keys stay enrolled. The body is optional; idempotent (a second call keeps the first lock time).
+     */
+    readonly post: operations$1['lockVault'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/resolve': {
     readonly parameters: {
       readonly query?: never;
@@ -7454,12 +7534,52 @@ type paths$1 = {
     readonly options?: never;
     readonly head?: never;
     /**
-     * Change the default agent tier
-     * @description Default approval tier for items without a matching rule (t3 = explicit approval).
+     * Change the default tier and anomaly guards
+     * @description Send `default_tier` (approval tier for items without a matching rule; t3 = explicit approval), `guards` (partial anomaly settings, merged over the current ones) or both. A use on a new host, in a burst or outside the allowed hours is forced to t4 with reason `anomaly:new_host`, `anomaly:burst` or `anomaly:hour`. Answers the effective settings.
      */
     readonly patch: operations$1['patchVaultSettings'];
     readonly trace?: never;
   };
+  readonly '/v1/vault/unlock': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Unlock the vault
+     * @description Ends a panic or honeytoken lock with a device key (phone, desktop) or passkey proof over the unlock challenge. Watch keys are refused (`wear_t3_only`). Errors (403): `challenge_invalid`, `unknown_device`, `device_revoked`, `wear_t3_only`, `invalid_signature`, `passkey_invalid`.
+     */
+    readonly post: operations$1['unlockVault'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/unlock/challenge': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Get an unlock challenge
+     * @description Single-use challenge valid for 5 minutes. Sign `codai-vault/unlock/v1|<challenge>|<device_id>` with a device key, or use base64url(SHA-256(`codai-vault/unlock/v1|<challenge>|passkey`)) as the WebAuthn challenge.
+     */
+    readonly post: operations$1['createVaultUnlockChallenge'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/use': {
     readonly parameters: {
       readonly query?: never;
@@ -16950,6 +17070,17 @@ type components$1 = {
       readonly default_tier: 't1' | 't2' | 't3' | 't4';
       /** @description Public key fingerprint to compare between devices. */
       readonly fingerprint: string;
+      readonly guards?: components$1['schemas']['VaultGuards'];
+      /**
+       * @description Why the vault is locked.
+       * @enum {string|null}
+       */
+      readonly lock_reason?: 'panic' | 'honeytoken' | null;
+      /**
+       * Format: date-time
+       * @description When the vault was locked (panic or honeytoken); null when unlocked. While locked every agent use is denied with reason `vault_locked`.
+       */
+      readonly locked_at?: string | null;
       readonly revision: number;
     };
     /** @description Proven step-up for a decision. `device`: an enrolled device key signs `codai-vault/approve/v2|<approval_id>|<action_hash>|<decision>|<scope>|<device_id>`. `passkey`: a WebAuthn assertion whose challenge is base64url(SHA-256(the same message with device id `passkey`)). With `match_number` the message is v3: `codai-vault/approve/v3|<approval_id>|<action_hash>|<decision>|<scope>|<device_id>|<preview_digest>|<match_number>`, where `preview_digest` = base64url(SHA-256(the canonical text of `request.preview`)). */
@@ -17026,6 +17157,20 @@ type components$1 = {
       /** @enum {string} */
       readonly surface: 'phone' | 'wear' | 'desktop';
     };
+    readonly VaultGuards: {
+      /** @description Agent requests for one item within `burst_window_s` that count as a burst (`anomaly:burst`); 0 = off. */
+      readonly burst_max: number;
+      /** @description Burst window in seconds. */
+      readonly burst_window_s: number;
+      /** @description End of the allowed hours (exclusive) in `tz`; a use outside [hour_start, hour_end) is `anomaly:hour`. */
+      readonly hour_end: number | null;
+      /** @description Start of the allowed hours (inclusive) in `tz`; null together with `hour_end` turns the hours check off. */
+      readonly hour_start: number | null;
+      /** @description Flag a use on a host with no allowed use or grant for that item in the last 30 days (`anomaly:new_host`). */
+      readonly new_host: boolean;
+      /** @description IANA time zone for the hours check, e.g. `Europe/Bucharest`. */
+      readonly tz: string;
+    };
     readonly VaultItemEnvelope: {
       /** @description Public catalogue entry for agents (title, sensitivity, hosts, env var). Never secret values. */
       readonly agent_meta?: {
@@ -17046,6 +17191,35 @@ type components$1 = {
       /** @description Per-item key wrapped under the vault key (`v1.<nonce>.<ciphertext>`). */
       readonly wrapped_key: string;
     };
+    readonly VaultItemLimits: {
+      /** Format: uuid */
+      readonly item_id: string;
+      /** @description Allowed uses per 24 hours; null = no cap. */
+      readonly per_day: number | null;
+      /** @description Allowed uses per minute; null = no cap. */
+      readonly per_minute: number | null;
+      /** @description Units per 24 hours (an `http` use costs 2, other modes 1); null = no cap. */
+      readonly units_per_day: number | null;
+    };
+    readonly VaultLockResult: {
+      /** @description Pending approvals denied by this lock. */
+      readonly approvals_denied: number;
+      /** @description Live grants revoked by this lock. */
+      readonly grants_revoked: number;
+      /** Format: date-time */
+      readonly locked_at: string;
+    };
+    readonly VaultUnlockChallenge: {
+      /** @description 32 random bytes, base64url. Single use. */
+      readonly challenge: string;
+      /**
+       * Format: date-time
+       * @description 5 minutes after issue.
+       */
+      readonly expires_at: string;
+      /** @description `codai-vault/unlock/v1|<challenge>|<device_id or passkey>`: the UTF-8 message the proof covers. */
+      readonly message_template: string;
+    };
     readonly VaultUseDecision: {
       /** @description Hash of the exact request the approver signs. */
       readonly action_hash?: string;
@@ -17055,6 +17229,7 @@ type components$1 = {
       readonly cloud_usable?: boolean;
       /** @description Two digits to show the user with the approval request; they tap the same number on the approving device (number matching). Null when no approval is needed. */
       readonly match_number?: string | null;
+      /** @description Why this tier. Guard reasons: `vault_locked` (the vault is locked, tier `deny`), `anomaly:new_host`, `anomaly:burst`, `anomaly:hour` (tier forced to t4; grants not approved at t4 are ignored). */
       readonly reasons: readonly string[];
       /** @enum {string} */
       readonly tier: 't0' | 't1' | 't2' | 't3' | 't4' | 'deny';
@@ -32265,6 +32440,36 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
+  readonly revokeVaultTaskGrants: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly task: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly revoked: number;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
   readonly vaultHttp: {
     readonly parameters: {
       readonly query?: never;
@@ -32317,7 +32522,7 @@ interface operations$1 {
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
-      /** @description Denied by policy. */
+      /** @description Denied by policy (`vault_denied`; reasons include `vault_locked` while the vault is locked). */
       readonly 403: {
         headers: {
           readonly [name: string]: unknown;
@@ -32329,6 +32534,17 @@ interface operations$1 {
         };
       };
       readonly 404: components$1['responses']['NotFound'];
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
     };
   };
   readonly listVaultItems: {
@@ -32476,6 +32692,96 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
+  readonly setVaultItemLimits: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly per_day: number | null;
+          readonly per_minute: number | null;
+          readonly units_per_day: number | null;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK; `limits` is null when removed. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly limits: components$1['schemas']['VaultItemLimits'];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly listVaultLimits: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly limits: readonly components$1['schemas']['VaultItemLimits'][];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly lockVault: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: {
+      readonly content: {
+        readonly 'application/json': {
+          /** @enum {string} */
+          readonly via?: 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Locked. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultLockResult'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
   readonly vaultResolve: {
     readonly parameters: {
       readonly query?: never;
@@ -32544,6 +32850,17 @@ interface operations$1 {
           };
         };
       };
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
     };
   };
   readonly listVaultRules: {
@@ -32646,27 +32963,112 @@ interface operations$1 {
       readonly content: {
         readonly 'application/json': {
           /** @enum {string} */
-          readonly default_tier: 't1' | 't2' | 't3' | 't4';
+          readonly default_tier?: 't1' | 't2' | 't3' | 't4';
+          /** @description Any subset of `VaultGuards`; `hour_start` and `hour_end` are both null (off) or both set. */
+          readonly guards?: {
+            /** @description Agent requests for one item within `burst_window_s` that count as a burst (`anomaly:burst`); 0 = off. */
+            readonly burst_max?: number;
+            /** @description Burst window in seconds. */
+            readonly burst_window_s?: number;
+            /** @description End of the allowed hours (exclusive) in `tz`; a use outside [hour_start, hour_end) is `anomaly:hour`. */
+            readonly hour_end?: number | null;
+            /** @description Start of the allowed hours (inclusive) in `tz`; null together with `hour_end` turns the hours check off. */
+            readonly hour_start?: number | null;
+            /** @description Flag a use on a host with no allowed use or grant for that item in the last 30 days (`anomaly:new_host`). */
+            readonly new_host?: boolean;
+            /** @description IANA time zone for the hours check, e.g. `Europe/Bucharest`. */
+            readonly tz?: string;
+          };
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Effective settings. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            /** @enum {string} */
+            readonly default_tier: 't1' | 't2' | 't3' | 't4';
+            readonly guards: components$1['schemas']['VaultGuards'];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly unlockVault: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          /** @description Challenge from `POST /v1/vault/unlock/challenge`. */
+          readonly challenge: string;
+          readonly proof: components$1['schemas']['VaultApprovalProof'];
+          /** @enum {string} */
+          readonly via?: 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
         };
       };
     };
     readonly responses: {
-      /** @description OK. */
+      /** @description Unlocked. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
+            readonly unlocked: boolean;
           };
         };
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
+      /** @description `challenge_invalid`, `unknown_device`, `device_revoked`, `wear_t3_only`, `invalid_signature` or `passkey_invalid`. */
+      readonly 403: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
       readonly 404: components$1['responses']['NotFound'];
     };
   };
+  readonly createVaultUnlockChallenge: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultUnlockChallenge'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
   readonly vaultUse: {
     readonly parameters: {
       readonly query?: never;
@@ -32703,6 +33105,17 @@ interface operations$1 {
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
       readonly 404: components$1['responses']['NotFound'];
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
     };
   };
   readonly listVaults: {
@@ -35246,6 +35659,20 @@ export type VaultUseRequest = Mutable<Body<'vaultUse'>>;
 export type VaultHttpRequest = Mutable<Body<'vaultHttp'>>;
 export type VaultResolveRequest = Mutable<Body<'vaultResolve'>>;
 export type VaultTier = VaultAccount['default_tier'];
+/** Anomaly guards (V-32): new host, burst, allowed hours. An anomaly forces t4. */
+export type VaultGuards = Schema<'VaultGuards'>;
+export type VaultSettingsPatch = Mutable<Body<'patchVaultSettings'>>;
+export type VaultSettings = Reply<'patchVaultSettings'>;
+export type VaultLockResult = Schema<'VaultLockResult'>;
+export type VaultUnlockChallenge = Schema<'VaultUnlockChallenge'>;
+export type VaultUnlockRequest = Mutable<Body<'unlockVault'>>;
+/** Per-handle limits (V-21); an `http` use costs 2 units, other modes 1. */
+export type VaultItemLimits = Schema<'VaultItemLimits'>;
+export type VaultItemLimitsInput = Mutable<Body<'setVaultItemLimits'>>;
+/** Where a lock/unlock was triggered from. */
+export type VaultVia = 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
+/** The UTF-8 message an unlock proof covers: `codai-vault/unlock/v1|<challenge>|<device_id or "passkey">`. */
+export declare function vaultUnlockMessage(challenge: string, deviceIdOrPasskey: string): string;
 /** Loose JSON object answers (lists, acks) as documented in the OpenAPI spec. */
 export type VaultObject = Record<string, unknown>;
 type CallOpts$21 = {
@@ -35279,6 +35706,32 @@ export declare class Vault {
   putAccount(body: VaultAccountPut, opts?: CallOpts$21): Promise<VaultObject>;
   /** `PATCH /v1/vault/settings` — default approval tier for items without a matching rule. */
   setDefaultTier(defaultTier: VaultTier, opts?: CallOpts$21): Promise<VaultObject>;
+  /**
+   * `PATCH /v1/vault/settings` — `default_tier` and/or partial anomaly `guards` (merged over the current ones).
+   * Answers the effective `{ default_tier, guards }`.
+   */
+  updateSettings(body: VaultSettingsPatch, opts?: CallOpts$21): Promise<VaultSettings>;
+  /**
+   * `POST /v1/vault/lock` — panic: revoke every live grant, deny every pending approval, lock the vault (agent uses
+   * then answer `vault_locked`). Device keys stay enrolled. Idempotent.
+   */
+  lock(params?: {
+    via?: VaultVia;
+  }, opts?: CallOpts$21): Promise<VaultLockResult>;
+  /** `POST /v1/vault/unlock/challenge` — single-use unlock challenge, valid 5 minutes. */
+  unlockChallenge(opts?: CallOpts$21): Promise<VaultUnlockChallenge>;
+  /**
+   * `POST /v1/vault/unlock` — end a lock with a device-key proof over {@link vaultUnlockMessage} or a passkey whose
+   * challenge is base64url(SHA-256(that message with `passkey`)). 403 `challenge_invalid`, `wear_t3_only`, …
+   */
+  unlock(body: VaultUnlockRequest, opts?: CallOpts$21): Promise<Reply<'unlockVault'>>;
+  /** `GET /v1/vault/limits` — per-handle usage caps on your items. */
+  limits(opts?: CallOpts$21): Promise<VaultItemLimits[]>;
+  /**
+   * `PUT /v1/vault/items/{id}/limits` — all three keys required; `null` removes a cap, all `null` removes the limits
+   * (answers `null`). Over a cap the broker calls answer 429 `vault_rate_limited` with `Retry-After`.
+   */
+  setLimits(id: string, limits: VaultItemLimitsInput, opts?: CallOpts$21): Promise<VaultItemLimits | null>;
   /** `GET /v1/vault/vaults` — vaults you belong to, with your role and sealed vault key. */
   vaults(opts?: CallOpts$21): Promise<VaultObject>;
   /** `POST /v1/vault/vaults` — register a vault created client-side (HTTP 201). */
@@ -35301,6 +35754,8 @@ export declare class Vault {
   grants(opts?: CallOpts$21): Promise<VaultObject>;
   /** `DELETE /v1/vault/grants/{id}` — revoke a grant immediately. */
   revokeGrant(id: string, opts?: CallOpts$21): Promise<VaultObject>;
+  /** `POST /v1/vault/grants/revoke-task` — revoke every live grant of a task / session; answers `{ revoked }`. */
+  revokeTaskGrants(task: string, opts?: CallOpts$21): Promise<Reply<'revokeVaultTaskGrants'>>;
   /** `GET /v1/vault/events` — append-only audit log (never contains secret values). */
   events(params?: QueryOf<'listVaultEvents'>, opts?: CallOpts$21): Promise<VaultObject>;
   /** `GET /v1/vault/approvals` — agent requests waiting for your decision. */