codai-sdk 0.66.0 → 0.68.0

package/dist/index.d.ts

@@ -5157,7 +5157,7 @@ type paths$1 = {
      *     `GET /v1/studio/renders/{id}` with the returned `render_id`; the render reports `creative_id`. Billed like
      *     `POST /v1/studio/renders`, once, when it has succeeded. The format must be 1920×1080, 1080×1920 or 1080×1080
      *     (400 `unsupported_format`); every referenced asset must be yours and ready (400 `asset_not_found`). Video
-     *     creatives only for now.
+     *     creatives; an `audio` creative renders a mixdown instead (see below).
      *
      *     Renders are composed from per-scene segments: scenes unchanged since an earlier render are reused (the charge
      *     is still per second of output). When the same render already exists for this exact version, format, quality and
@@ -5168,6 +5168,13 @@ type paths$1 = {
      *     When omitted it is `corner` if the render uses TTS narration (synthetic voice) or AI-generated images, else
      *     `none`; an explicit `none` with TTS narration is rejected (400 `ai_label_required`). The response returns the
      *     resolved `ai_label`. As the deployer you remain responsible for labelling deepfakes you publish.
+     *
+     *     **Audio creatives** (`kind: audio`) take `CreativeAudioRenderRequest`: `formats` (`wav` / `mp3` / `flac`,
+     *     default WAV + MP3), `stems` (one WAV per audible track), `lrc` and `loudness` (preset or LUFS). The document is
+     *     mixed with ffmpeg, mastered to the loudness target (two-pass loudnorm + true-peak limiter) and every output is
+     *     AI-marked in the file (RIFF ICMT / ID3v2.4 / Vorbis comment). The 202 is a `CreativeAudioRenderAccepted`; poll
+     *     `GET /v1/studio/renders/{id}`, whose `data[]` holds one signed asset per output. Price: 1 000 µUSD per output
+     *     second (minimum 10 000 µUSD), `stems: true` adds 50 %; at most 20 minutes per render.
      *     Places a wallet hold of the quote before dispatch (402 `insufficient_funds` when short); the hold is settled with the billed amount when the job finishes and released on failure.
      *     Supports `Idempotency-Key` (24 h): a retry with the same key and body replays the first response; a different body is 422 `idempotency_key_mismatch`; the first request still running is 409 `idempotency_in_progress`.
      */
@@ -5706,6 +5713,150 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/studio/lyrics': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Write song lyrics
+     * @description Writes original song lyrics for a brief in Romanian or English: one bounded `codai` turn with a forced tool,
+     *     checked line by line for syllables (`syllables_per_line`, tolerance ±1) and the rhyme scheme (`AABB`, `ABAB` or
+     *     `free`). When more than 30 % of the lines miss, ONE repair turn names the problems and the better of the two answers
+     *     is returned (`repaired`). Billing: token-metered (usage model `codai::lyrics`, prompt caching on) under a small
+     *     wallet hold (20 000 µUSD, settled with the real cost; 402 `insufficient_funds` when short). Briefs and lyrics are
+     *     never logged. Supports `Idempotency-Key` (24 h).
+     */
+    readonly post: operations$1['writeStudioLyrics'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/studio/lyrics/align': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Align lyrics to an audio clip
+     * @description Karaoke alignment: matches written lyrics to the word timestamps of one clip of an audio (or video) creative and
+     *     writes the timed lines with one `setLyrics` edit (`apply: false` only returns them), plus an LRC file. The clip's
+     *     words come from the transcription cached on its asset (free, `cached: true`); otherwise the clip is transcribed
+     *     (Whisper, at most 25 MB) and billed `codai::lyrics-align` at the speech-to-text rate (6 000 µUSD per started minute)
+     *     under a wallet hold. Not available for EU data-residency accounts (403 `residency_unavailable`). Supports
+     *     `Idempotency-Key` (24 h).
+     */
+    readonly post: operations$1['alignStudioLyrics'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/studio/media-ops': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List media operations
+     * @description The media-op catalogue: one entry per op (`image.remove_background`, `audio.separate_stems`,
+     *     `music.generate_ace`…) with its engine, lane, sync/async mode, accepted inputs, output kind, whether the lane is
+     *     configured on this gateway (`available`) and a list quote for a reference input (default params, 60 s of input
+     *     audio or a 1024×1024 image; `quote_basis`). Free. Ask `POST /v1/studio/media-ops/{op}/quote` for the exact price
+     *     of a real request.
+     */
+    readonly get: operations$1['listStudioMediaOps'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/studio/media-ops/{op}': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Run a media operation
+     * @description Runs one op on your Studio assets: `asset_ids` (0–4 owned, ready assets, in the order the op expects) and
+     *     `params` (validated strictly per op, see `MediaOpRequest`). Sync ops (`mode: sync`: background removal,
+     *     upscale, inpaint / outpaint / erase, analyze) answer **200** with the stored outputs; async ops (stems, denoise,
+     *     MIDI, mastering, music and sound-effect generation) answer **202** with a job — poll
+     *     `GET /v1/studio/media-ops/jobs/{id}`; the sweeper settles it even when nobody polls. At most 3 async jobs run per
+     *     user (429 beyond). Money gate: the quote is held on the wallet first (402 `insufficient_funds` when it does not
+     *     fit), the measured cost is billed once and the rest of the hold released. Every output is marked as
+     *     AI-generated (C2PA / XMP on images, RIFF INFO / ID3 on audio, GCS metadata) and carries lineage:
+     *     `parent_asset_id` = the first input, `op` and `op_inputs`. Supports `Idempotency-Key`.
+     */
+    readonly post: operations$1['runStudioMediaOp'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/studio/media-ops/{op}/quote': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Quote a media operation
+     * @description The exact price of `{ asset_ids, params }` for one op, after the same validation as the run (op id, params,
+     *     asset ownership, kinds and mimes, lane configured). Nothing is held or billed. `quote_micro_eur` is what the
+     *     wallet hold would be; the run bills the measured cost, never more than the quote.
+     */
+    readonly post: operations$1['quoteStudioMediaOp'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/studio/media-ops/jobs/{id}': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Retrieve a media job
+     * @description The state of an async media job; a pending job whose result is ready is settled on the spot (outputs stored, billed once). Unknown or foreign ids are 404.
+     */
+    readonly get: operations$1['getStudioMediaOpJob'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/studio/previews/{id}': {
     readonly parameters: {
       readonly query?: never;
@@ -5862,6 +6013,9 @@ type paths$1 = {
      *     Timeline renders (`POST /v1/studio/timelines`) also return `timeline` (scenes with their assets),
      *     `parent_render_id` and `root_render_id`; while a regenerated video scene is still being generated the render
      *     stays `queued` with `stage: generating_scene`.
+     *
+     *     Audio creative renders (`target: audio`) answer `StudioAudioRender`: `data` holds one asset per output
+     *     (`output`: `mix` / `stem` / `lrc`, `format`, `track_id`), `qa` the measured loudness and true peak.
      */
     readonly get: operations$1['getRender'];
     readonly put?: never;
@@ -7292,6 +7446,26 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/grants/revoke-task': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Revoke the grants of a task
+     * @description Revokes every live grant whose `task` matches (task id, client task id or session key sent as `task` on `/v1/vault/use`). The gateway also does this on task confirm, session delete and every 5 minutes for closed tasks.
+     */
+    readonly post: operations$1['revokeVaultTaskGrants'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/http': {
     readonly parameters: {
       readonly query?: never;
@@ -7376,6 +7550,66 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/items/{id}/limits': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    /**
+     * Set per-handle limits
+     * @description Editor or above on the item's vault. Send all three keys; null removes a cap, all null removes the limits. Over a cap `/v1/vault/use`, `/v1/vault/http` and `/v1/vault/resolve` answer 429 `vault_rate_limited` with `Retry-After`.
+     */
+    readonly put: operations$1['setVaultItemLimits'];
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/limits': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List per-handle limits
+     * @description Usage caps set on your items. Only allowed uses count; an `http` use costs 2 units, other modes 1.
+     */
+    readonly get: operations$1['listVaultLimits'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/lock': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Panic lock
+     * @description Revokes every live grant, denies every pending approval and locks the vault: from then on every agent use is denied with reason `vault_locked` (`/v1/vault/http` and `/v1/vault/resolve` answer 403 `vault_denied`). Device keys stay enrolled. The body is optional; idempotent (a second call keeps the first lock time).
+     */
+    readonly post: operations$1['lockVault'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/resolve': {
     readonly parameters: {
       readonly query?: never;
@@ -7454,12 +7688,52 @@ type paths$1 = {
     readonly options?: never;
     readonly head?: never;
     /**
-     * Change the default agent tier
-     * @description Default approval tier for items without a matching rule (t3 = explicit approval).
+     * Change the default tier and anomaly guards
+     * @description Send `default_tier` (approval tier for items without a matching rule; t3 = explicit approval), `guards` (partial anomaly settings, merged over the current ones) or both. A use on a new host, in a burst or outside the allowed hours is forced to t4 with reason `anomaly:new_host`, `anomaly:burst` or `anomaly:hour`. Answers the effective settings.
      */
     readonly patch: operations$1['patchVaultSettings'];
     readonly trace?: never;
   };
+  readonly '/v1/vault/unlock': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Unlock the vault
+     * @description Ends a panic or honeytoken lock with a device key (phone, desktop) or passkey proof over the unlock challenge. Watch keys are refused (`wear_t3_only`). Errors (403): `challenge_invalid`, `unknown_device`, `device_revoked`, `wear_t3_only`, `invalid_signature`, `passkey_invalid`.
+     */
+    readonly post: operations$1['unlockVault'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/unlock/challenge': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Get an unlock challenge
+     * @description Single-use challenge valid for 5 minutes. Sign `codai-vault/unlock/v1|<challenge>|<device_id>` with a device key, or use base64url(SHA-256(`codai-vault/unlock/v1|<challenge>|passkey`)) as the WebAuthn challenge.
+     */
+    readonly post: operations$1['createVaultUnlockChallenge'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/use': {
     readonly parameters: {
       readonly query?: never;
@@ -9686,6 +9960,223 @@ type components$1 = {
       readonly seq: number;
       readonly warnings: readonly string[];
     };
+    /**
+     * Creative audio part
+     * @description `doc.audio`: the audio timeline of every creative (voice / music / sfx tracks of a video) and the whole document
+     *     of an `audio` creative (song or podcast). Milliseconds are the source of truth; bars and beats are derived from
+     *     `meta.bpm` / `meta.timeSignature`. Every field but `tracks` is optional.
+     */
+    readonly CreativeAudio: {
+      /** @description Human-contribution log of an `audio` creative, appended by the server for each edit (who: `human` or `ai`). */
+      readonly humanLog?: readonly {
+        /** @enum {string} */
+        readonly actor: 'human' | 'ai';
+        readonly detail?: string;
+        readonly op: string;
+        /** Format: date-time */
+        readonly ts: string;
+      }[];
+      /** @description Timed lyric lines (exported as LRC). */
+      readonly lyrics?: readonly {
+        readonly endMs: number;
+        readonly sectionId?: string;
+        readonly startMs: number;
+        readonly text: string;
+      }[];
+      /** @description Master bus. Unset fields resolve to `meta.loudnessTarget` (or -14 LUFS) and a -1 dBTP true peak. */
+      readonly master?: {
+        readonly fx?: readonly components$1['schemas']['CreativeAudioFx'][];
+        readonly limiter?: boolean;
+        readonly targetLufs?: number;
+        readonly truePeakDb?: number;
+      };
+      /** @description Song / episode metadata. */
+      readonly meta?: {
+        readonly bpm?: number;
+        readonly key?: {
+          /** @enum {string} */
+          readonly mode: 'major' | 'minor';
+          /** @enum {string} */
+          readonly tonic: 'C' | 'C#' | 'Db' | 'D' | 'D#' | 'Eb' | 'E' | 'F' | 'F#' | 'Gb' | 'G' | 'G#' | 'Ab' | 'A' | 'A#' | 'Bb' | 'B';
+        };
+        readonly language?: string;
+        /** @description `streaming` (-14 LUFS), `podcast` (-16), `broadcast` (-23) or an integrated LUFS number (-40…-5). */
+        readonly loudnessTarget?: ('streaming' | 'podcast' | 'broadcast') | number;
+        /** @enum {integer} */
+        readonly sampleRate?: 44100 | 48000;
+        /** @description `[beats per bar, beat unit]`, e.g. `[4, 4]`. */
+        readonly timeSignature?: readonly number[];
+      };
+      readonly sections?: readonly components$1['schemas']['CreativeAudioSection'][];
+      readonly tracks: readonly components$1['schemas']['CreativeAudioTrack'][];
+    };
+    /**
+     * Creative audio clip
+     * @description One clip of an audio asset on a track. `inMs` / `outMs` are SOURCE offsets: the clip ends on the timeline at `startMs + (outMs - inMs) × stretch`.
+     */
+    readonly CreativeAudioClip: {
+      /** @description Studio asset id (uuid). */
+      readonly assetId: string;
+      readonly color?: string;
+      /** @description Duck under voice / vocal tracks (default on for music tracks of an `audio` creative). */
+      readonly duck?: boolean;
+      /** @enum {string} */
+      readonly fadeCurve?: 'linear' | 'exp' | 's';
+      readonly fadeInMs?: number;
+      readonly fadeOutMs?: number;
+      readonly gainDb?: number;
+      /** @description How the clip was generated (public codai provider / model ids, never an upstream name). */
+      readonly generation?: {
+        readonly model: string;
+        readonly op?: string;
+        readonly parentClipId?: string;
+        readonly prompt?: string;
+        readonly provider: string;
+        readonly seed?: number;
+      };
+      readonly id: string;
+      readonly inMs?: number;
+      readonly locked?: boolean;
+      readonly loop?: boolean;
+      readonly outMs?: number;
+      readonly pan?: number;
+      readonly pitchSemitones?: number;
+      readonly startMs: number;
+      /** @description Timeline length / source length (pitch kept). */
+      readonly stretch?: number;
+    };
+    /** Creative audio effect */
+    readonly CreativeAudioFx: {
+      readonly bypass?: boolean;
+      readonly id: string;
+      /** @description Numeric effect parameters by name (`threshold`, `ratio`, `mix`…). */
+      readonly params: {
+        readonly [key: string]: number;
+      };
+      /** @enum {string} */
+      readonly type: 'eq' | 'compressor' | 'reverb' | 'delay' | 'limiter' | 'gate' | 'deesser' | 'pitch' | 'chorus' | 'saturation';
+    };
+    /** Queued audio render */
+    readonly CreativeAudioRenderAccepted: {
+      /** @enum {boolean} */
+      readonly cached: false;
+      /** Format: uuid */
+      readonly creative_id: string;
+      readonly duration_seconds: number;
+      readonly formats: readonly ('wav' | 'mp3' | 'flac')[];
+      /** Format: uuid */
+      readonly id: string;
+      readonly lrc: boolean;
+      readonly minimum_micro_usd: string;
+      readonly model: string;
+      /** @enum {string} */
+      readonly object: 'studio.render';
+      /** @description The files this render will produce, in result order: mixes, stems, LRC. */
+      readonly outputs: readonly components$1['schemas']['CreativeAudioRenderOutput'][];
+      readonly price_micro_usd_per_second: string;
+      /** @description The amount held on the wallet (micro-USD); the bill uses the measured length. */
+      readonly quote_micro_usd: string;
+      /**
+       * Format: uuid
+       * @description Poll it with `GET /v1/studio/renders/{id}`.
+       */
+      readonly render_id: string;
+      readonly seq: number;
+      /** @enum {string} */
+      readonly status: 'queued';
+      readonly stems: boolean;
+      readonly stems_surcharge_pct: number;
+      /** @enum {string} */
+      readonly target: 'audio';
+      readonly target_lufs: number;
+      readonly true_peak_db: number;
+    };
+    readonly CreativeAudioRenderOutput: {
+      /** @enum {string} */
+      readonly format: 'wav' | 'mp3' | 'flac' | 'lrc';
+      /** @enum {string} */
+      readonly kind: 'mix' | 'stem' | 'lrc';
+      readonly mime_type: string;
+      /** @description The track of a stem; null for the mix and the LRC. */
+      readonly track_id: string | null;
+    };
+    /**
+     * Audio creative render request
+     * @description Body of `POST /v1/studio/creatives/{id}/render` for a creative of `kind: audio` (mixdown + mastering + exports).
+     *     Any other kind uses `CreativeRenderRequest`.
+     */
+    readonly CreativeAudioRenderRequest: {
+      /**
+       * @default [
+       *       "wav",
+       *       "mp3"
+       *     ]
+       */
+      readonly formats?: readonly ('wav' | 'mp3' | 'flac')[];
+      /** @description Mastering target: a preset (streaming -14, podcast -16, broadcast -23 LUFS) or integrated LUFS (-40...-5). Default the document master or meta.loudnessTarget, else -14. */
+      readonly loudness?: ('streaming' | 'podcast' | 'broadcast') | number;
+      /** @description Export an LRC file (default on when the document has timed lyrics; true without lyrics is 400 `no_lyrics`). */
+      readonly lrc?: boolean;
+      /**
+       * @description Also export one WAV stem per audible track (+50 % price).
+       * @default false
+       */
+      readonly stems?: boolean;
+      readonly title?: string;
+    };
+    /** Creative audio section */
+    readonly CreativeAudioSection: {
+      readonly durationMs: number;
+      readonly id: string;
+      /** @enum {string} */
+      readonly kind: 'intro' | 'verse' | 'pre_chorus' | 'chorus' | 'bridge' | 'outro' | 'instrumental' | 'custom';
+      readonly label?: string;
+      readonly locked?: boolean;
+      readonly lyrics?: string;
+      readonly startMs: number;
+      readonly styleHint?: string;
+    };
+    /** Creative audio track */
+    readonly CreativeAudioTrack: {
+      /** @description Breakpoint envelopes; `target` is `gainDb`, `pan` or `fx.<fxId>.<param>`. */
+      readonly automation?: readonly {
+        readonly points: readonly {
+          readonly tMs: number;
+          readonly value: number;
+        }[];
+        readonly target: string;
+      }[];
+      readonly clips: readonly components$1['schemas']['CreativeAudioClip'][];
+      readonly fx?: readonly components$1['schemas']['CreativeAudioFx'][];
+      readonly gainDb?: number;
+      readonly id: string;
+      /**
+       * @description Absent = `audio`. MIDI tracks hold `midiClips` only; buses hold no clips.
+       * @enum {string}
+       */
+      readonly kind?: 'audio' | 'midi' | 'bus';
+      readonly locked?: boolean;
+      readonly midiClips?: readonly ({
+        readonly durationMs: number;
+        readonly id: string;
+        readonly notes: readonly {
+          readonly [key: string]: unknown;
+        }[];
+        readonly startMs: number;
+      } & {
+        readonly [key: string]: unknown;
+      })[];
+      readonly mute?: boolean;
+      readonly name?: string;
+      readonly pan?: number;
+      /** @enum {string} */
+      readonly role: 'voice' | 'music' | 'sfx' | 'drums' | 'bass' | 'keys' | 'guitar' | 'vocal' | 'lead' | 'pad' | 'fx' | 'bus' | 'podcast_host' | 'podcast_guest';
+      readonly sends?: readonly {
+        readonly busId: string;
+        readonly gainDb: number;
+      }[];
+      readonly solo?: boolean;
+    };
     /**
      * Creative build request
      * @example {
@@ -9934,10 +10425,8 @@ type components$1 = {
       readonly assets: {
         readonly [key: string]: unknown;
       };
-      /** @description `{ tracks: [{ id, role: voice | music | sfx, clips[] }] }`. */
-      readonly audio: {
-        readonly [key: string]: unknown;
-      };
+      /** @description Audio timeline: `{ tracks[], meta?, sections?, master?, lyrics?, humanLog? }` (see `CreativeAudio`). */
+      readonly audio: components$1['schemas']['CreativeAudio'];
       /** @description `{ kitId?, tokens }`; nodes reference tokens as `{ "$token": "primary" }`. */
       readonly brand: {
         readonly [key: string]: unknown;
@@ -9994,7 +10483,7 @@ type components$1 = {
     readonly CreativeError: {
       readonly error: {
         /** @enum {string} */
-        readonly code: 'invalid_request' | 'stale' | 'invalid' | 'not_found' | 'locked' | 'duplicate_id' | 'too_large' | 'not_supported_for_kind' | 'unsupported_format' | 'asset_not_found' | 'not_implemented' | 'frame_failed' | 'too_many_frame_jobs' | 'no_edit' | 'timeout' | 'fetch_failed' | 'extract_failed' | 'kind_mismatch' | 'node_not_found' | 'invalid_pick' | 'duplicate_key' | 'unknown_var' | 'invalid_var_value' | 'unsupported_kind' | 'too_long' | 'ai_label_required';
+        readonly code: 'invalid_request' | 'stale' | 'invalid' | 'not_found' | 'locked' | 'duplicate_id' | 'too_large' | 'not_supported_for_kind' | 'unsupported_format' | 'asset_not_found' | 'not_implemented' | 'frame_failed' | 'too_many_frame_jobs' | 'no_edit' | 'timeout' | 'fetch_failed' | 'extract_failed' | 'kind_mismatch' | 'node_not_found' | 'invalid_pick' | 'duplicate_key' | 'unknown_var' | 'invalid_var_value' | 'unsupported_kind' | 'too_long' | 'ai_label_required' | 'no_lyrics' | 'unsupported_media';
         readonly conflicts?: readonly {
           readonly head_prop?: string;
           readonly prop?: string;
@@ -10119,7 +10608,7 @@ type components$1 = {
      * Creative kind
      * @enum {string}
      */
-    readonly CreativeKind: 'video' | 'image' | 'deck' | 'doc' | 'sheet';
+    readonly CreativeKind: 'video' | 'image' | 'deck' | 'doc' | 'sheet' | 'audio';
     /**
      * Lint code
      * @description `off_brand_color`, `outside_platform_safe_zone`, `text_too_small`, `flashing` (keyframes) and `text_overflow_locale` (the text shrinks to fit) can be fixed with `POST /v1/studio/creatives/{id}/lint/fix`. `missing_translation` and `stale_translation` are fixed with `POST /v1/studio/creatives/{id}/localize`.
@@ -10436,6 +10925,14 @@ type components$1 = {
      *     (`control: null` clears it), `setMeta { title?, locale?, formats?, defaultFormat?, fps? }`,
      *     `setLocaleText { locale, texts, by? }` (`texts`: unit key → translation, `null` removes it),
      *     `setLocale { locale, tone?, audio?, captions?, remove? }`, `setLocalization { source?, glossary?, forkOf?, reset? }`.
+     *     Audio ops (any creative's `doc.audio`; songs and podcasts): `addSection { section }`, `updateSection { target, patch }`,
+     *     `removeSection { target }`, `moveSection { target, startMs }`, `addTrack { track, index? }`,
+     *     `updateTrack { target, patch }`, `removeTrack { target }`, `splitClip { clipId, atMs, newId }`,
+     *     `trimClip { clipId, startMs?, endMs? }`, `moveClip { clipId, startMs?, trackId? }`,
+     *     `setFades { clipId, fadeInMs?, fadeOutMs?, fadeCurve? }`, `addMidiClip { trackId, clip }`, `removeMidiClip { clipId }`,
+     *     `updateMidiNotes { clipId, update?, remove?, add?, replace? }`, `setMaster { master }`, `setLyrics { lines }`;
+     *     `setMeta` also takes `audio` (bpm, key, timeSignature, language, loudnessTarget, sampleRate) and `setAudioClip` a
+     *     `trackId`. `null` in a patch removes an optional field.
      * @example {
      *       "op": "setProps",
      *       "target": "title",
@@ -10446,7 +10943,7 @@ type components$1 = {
      */
     readonly CreativeOp: {
       /** @enum {string} */
-      readonly op: 'setProps' | 'setLayout' | 'setTiming' | 'setAnim' | 'insertNode' | 'removeNode' | 'moveNode' | 'addScene' | 'removeScene' | 'updateScene' | 'moveScene' | 'setVar' | 'removeVar' | 'setAsset' | 'replaceAsset' | 'setAudioClip' | 'removeAudioClip' | 'setBrand' | 'restyle' | 'adaptFormat' | 'setControl' | 'setMeta' | 'setLocaleText' | 'setLocale' | 'setLocalization';
+      readonly op: 'setProps' | 'setLayout' | 'setTiming' | 'setAnim' | 'insertNode' | 'removeNode' | 'moveNode' | 'addScene' | 'removeScene' | 'updateScene' | 'moveScene' | 'setVar' | 'removeVar' | 'setAsset' | 'replaceAsset' | 'setAudioClip' | 'removeAudioClip' | 'setBrand' | 'restyle' | 'adaptFormat' | 'setControl' | 'setMeta' | 'setLocaleText' | 'setLocale' | 'setLocalization' | 'addSection' | 'updateSection' | 'removeSection' | 'moveSection' | 'addTrack' | 'updateTrack' | 'removeTrack' | 'splitClip' | 'trimClip' | 'moveClip' | 'setFades' | 'addMidiClip' | 'removeMidiClip' | 'updateMidiNotes' | 'setMaster' | 'setLyrics';
     } & {
       readonly [key: string]: unknown;
     };
@@ -12457,6 +12954,157 @@ type components$1 = {
       readonly price_watch?: boolean;
       readonly show_in_share?: boolean;
     };
+    /**
+     * Media op
+     * @description One catalogue entry of `GET /v1/studio/media-ops`.
+     */
+    readonly MediaOp: {
+      /** @description False when the lane is not configured on this gateway (a run then answers 503 `media_ops_unavailable`). */
+      readonly available: boolean;
+      /** @description Engine that runs the op (`birefnet`, `real-esrgan-x4plus`, `gemini-image-edit`, `htdemucs`, `deepfilternet3`, `basic-pitch`, `ffmpeg-loudnorm`, `librosa`, `ace-step-1.5`). */
+      readonly engine: string;
+      readonly id: components$1['schemas']['MediaOpId'];
+      /** @description Asset kinds accepted as input (`image`, `upload`, `frame` for image ops; `music`, `speech`, `sfx`, `upload` for audio ops). */
+      readonly input_kinds: readonly string[];
+      /**
+       * @description `gpu` / `cpu` = the codai Studio media service, `vertex` = Gemini image edit.
+       * @enum {string}
+       */
+      readonly lane: 'gpu' | 'vertex' | 'cpu';
+      readonly max_inputs: number;
+      readonly min_inputs: number;
+      /**
+       * @description `sync` answers 200 with the outputs; `async` answers 202 with a job.
+       * @enum {string}
+       */
+      readonly mode: 'sync' | 'async';
+      /** @description Caveat for the op, when there is one (mask ops: the mask is followed closely, not pixel-exactly). */
+      readonly note?: string;
+      /** @description Kind of the stored outputs (`image`, `music`, `sfx`, `midi`), `same` (the kind of the first input) or `analysis` (JSON only, no asset). */
+      readonly output_kind: string;
+      /** @description The same as a wallet amount, EUR micros. */
+      readonly quote_micro_eur: number;
+      /** @description List price for the reference input (`quote_basis`), USD micros. */
+      readonly quote_micro_usd: number;
+      /** @description Human-readable name. */
+      readonly title: string;
+    };
+    /**
+     * Media op id
+     * @enum {string}
+     */
+    readonly MediaOpId: 'image.remove_background' | 'image.upscale' | 'image.inpaint' | 'image.outpaint' | 'image.erase' | 'audio.separate_stems' | 'audio.denoise' | 'audio.to_midi' | 'audio.master' | 'audio.analyze' | 'music.generate_ace' | 'music.repaint' | 'music.extend' | 'music.cover' | 'sfx.generate';
+    /** Media op job */
+    readonly MediaOpJob: {
+      readonly analysis: {
+        readonly [key: string]: unknown;
+      } | null;
+      /** @description Billed cost, USD micros (0 until settled). */
+      readonly cost_micro_usd: number;
+      /** Format: date-time */
+      readonly created_at: string;
+      /** @description Failure reason (`timeout`, `input_refused`, `dispatch_failed`, `store_failed` or an engine message). */
+      readonly error: string | null;
+      /** Format: uuid */
+      readonly id: string;
+      /** @enum {string} */
+      readonly object: 'media_op.job';
+      readonly op: components$1['schemas']['MediaOpId'];
+      /** @description Stored outputs once `ready` (stems: one asset per stem). */
+      readonly outputs: readonly components$1['schemas']['AssetDto'][];
+      /**
+       * Format: uuid
+       * @description The first input asset (lineage).
+       */
+      readonly parent_asset_id: string | null;
+      /**
+       * @description `pending` while the engine runs; `ready` with outputs; `failed` with `error` (the hold is released, nothing billed).
+       * @enum {string}
+       */
+      readonly status: 'pending' | 'ready' | 'failed';
+      /** Format: date-time */
+      readonly updated_at: string;
+    };
+    /** Media op catalogue */
+    readonly MediaOpList: {
+      readonly data: readonly components$1['schemas']['MediaOp'][];
+      /** @enum {string} */
+      readonly object: 'list';
+      /** @description Reference input of the list quotes. */
+      readonly quote_basis: string;
+    };
+    /** Media op quote */
+    readonly MediaOpQuote: {
+      /** @enum {string} */
+      readonly mode: 'sync' | 'async';
+      /** @enum {string} */
+      readonly object: 'media_op.quote';
+      readonly op: components$1['schemas']['MediaOpId'];
+      /** @description Wallet hold for this request, EUR micros. */
+      readonly quote_micro_eur: number;
+      /** @description Upstream cost ceiling, USD micros. */
+      readonly quote_micro_usd: number;
+    };
+    /**
+     * Media op request
+     * @description `asset_ids` are the inputs, in order; `params` are validated strictly per op (unknown keys are rejected):
+     *
+     *     | Op | Assets | Params (defaults) |
+     *     | --- | --- | --- |
+     *     | `image.remove_background` | 1 image | `format`: `png` \| `webp` (`png`) |
+     *     | `image.upscale` | 1 image | `scale`: 2 \| 4 (4); output at most 64 MP |
+     *     | `image.inpaint` | image + PNG mask | `prompt` (required, ≤ 2000), `model`, `image_size`: `1K` \| `2K` \| `4K` |
+     *     | `image.erase` | image + PNG mask | `prompt` (optional), `model`, `image_size` |
+     *     | `image.outpaint` | 1 image | `aspect_ratio` (required: `1:1`, `2:3`, `3:2`, `3:4`, `4:3`, `4:5`, `5:4`, `9:16`, `16:9`, `21:9`, `9:21`), `prompt`, `model`, `image_size` |
+     *     | `audio.separate_stems` | 1 audio | `stems`: 2 \| 4 (4: vocals, drums, bass, other; 2: vocals, accompaniment) |
+     *     | `audio.denoise` | 1 audio | `strength`: 0–1 (1) |
+     *     | `audio.to_midi` | 1 audio | `onset_threshold`: 0.05–0.95 (0.5), `min_note_ms`: 10–1000 (58) |
+     *     | `audio.master` | 1 audio | `target_lufs`: -14 \| -16 \| -23 (-14), `true_peak_db`: -3…-0.1 (-1), `format`: `wav` \| `mp3` (`wav`) |
+     *     | `audio.analyze` | 1 audio | none |
+     *     | `music.generate_ace` | 0–1 audio | `prompt` (required, ≤ 1000), `lyrics` (≤ 4000), `duration_seconds`: 10–240 (60), `bpm`: 40–220, `key`, `language`, `seed` |
+     *     | `music.repaint` | 1 audio | `prompt`, `lyrics`, `start_seconds`, `end_seconds` (after start), `seed` |
+     *     | `music.extend` | 1 audio | `prompt`, `lyrics`, `extend_seconds`: 5–120, `seed` |
+     *     | `music.cover` | 1 audio | `prompt`, `lyrics`, `strength`: 0–1 (0.8), `seed` |
+     *     | `sfx.generate` | none | `prompt` (required), `duration_seconds`: 1–30 (5), `seed` |
+     * @example {
+     *       "asset_ids": [
+     *         "3f2b8c1e-0000-4000-8000-000000000001"
+     *       ],
+     *       "params": {
+     *         "stems": 4
+     *       }
+     *     }
+     */
+    readonly MediaOpRequest: {
+      /**
+       * @description Owned, ready Studio asset ids, distinct, in the order the op expects (mask second).
+       * @default []
+       */
+      readonly asset_ids?: readonly string[];
+      /**
+       * @description Per-op parameters (table above).
+       * @default {}
+       */
+      readonly params?: {
+        readonly [key: string]: unknown;
+      };
+    };
+    /** Media op result */
+    readonly MediaOpResult: {
+      /** @description `audio.analyze`: `{ duration_seconds, bpm, key, key_confidence, integrated_lufs, sample_peak_dbfs }`; otherwise `null`. */
+      readonly analysis: {
+        readonly [key: string]: unknown;
+      } | null;
+      /** @description Billed cost, USD micros. */
+      readonly cost_micro_usd: number;
+      /** @enum {string} */
+      readonly object: 'media_op.result';
+      readonly op: components$1['schemas']['MediaOpId'];
+      /** @description Stored outputs, AI-marked, each with lineage to the first input (empty for `audio.analyze`). */
+      readonly outputs: readonly components$1['schemas']['AssetDto'][];
+      /** @enum {string} */
+      readonly status: 'ready';
+    };
     /**
      * Media response format
      * @description `b64_json` (default) returns the bytes inline, base64-encoded — the original shape. `url` stores the result as an asset (kept 90 days) and returns `AssetDto` items with a 1-hour signed `url`; 503 `assets_unavailable` when storage is not configured.
@@ -14684,6 +15332,41 @@ type components$1 = {
        */
       readonly surface: 'share' | 'review';
     };
+    /**
+     * Audio render
+     * @description An audio creative render as returned by `GET /v1/studio/renders/{id}` (`target: audio`).
+     */
+    readonly StudioAudioRender: {
+      readonly cost_micro_usd?: string;
+      /** Format: uuid */
+      readonly creative_id: string;
+      /** @description One stored, AI-marked asset per output (1-hour signed `url`), only when `succeeded`. */
+      readonly data?: readonly (components$1['schemas']['AssetDto'] & {
+        /** @enum {string} */
+        readonly format: 'wav' | 'mp3' | 'flac' | 'lrc';
+        /** @enum {string} */
+        readonly output: 'mix' | 'stem' | 'lrc';
+        readonly track_id: string | null;
+      })[];
+      readonly duration_seconds?: number | null;
+      readonly error: string | null;
+      readonly formats: readonly ('wav' | 'mp3' | 'flac')[];
+      /** Format: uuid */
+      readonly id: string;
+      readonly lrc: boolean;
+      readonly model: string;
+      /** @enum {string} */
+      readonly object: 'studio.render';
+      readonly progress?: number | null;
+      /** @description Measured `lufs`, `true_peak_db`, `clipping`, `warnings` of the master. */
+      readonly qa?: Record<string, never> | null;
+      readonly stage?: string | null;
+      readonly status: components$1['schemas']['StudioRenderStatus'];
+      readonly stems: boolean;
+      /** @enum {string} */
+      readonly target: 'audio';
+      readonly target_lufs: number;
+    };
     /** Studio batch */
     readonly StudioBatch: {
       /** @description The CSV header and the column mapping. */
@@ -15070,6 +15753,119 @@ type components$1 = {
       /** @description Non-fatal problems, e.g. audio assets that were skipped because they are missing or not ready. */
       readonly warnings: readonly string[];
     };
+    /** Written lyrics */
+    readonly StudioLyrics: {
+      /** @description Charge in micro-USD (string, bigint-safe): the token cost of the turns. */
+      readonly cost_micro_usd: string;
+      /** @enum {string} */
+      readonly language: 'ro' | 'en';
+      /** @enum {string} */
+      readonly object: 'studio.lyrics';
+      /** @description True when the second (repair) turn produced the returned lyrics. */
+      readonly repaired: boolean;
+      /** @description Syllable and rhyme check of the returned lyrics. */
+      readonly report: {
+        readonly lines: number;
+        readonly off_lines: number;
+        readonly off_ratio: number;
+        readonly pairs: number;
+        readonly repair_ratio: number;
+        readonly rhymed: number;
+      };
+      /** @enum {string} */
+      readonly rhyme_scheme: 'AABB' | 'ABAB' | 'free';
+      readonly sections: readonly {
+        readonly kind: components$1['schemas']['StudioLyricsSectionKind'];
+        readonly lines: readonly components$1['schemas']['StudioLyricsLine'][];
+      }[];
+      readonly syllables_per_line: number | null;
+      /** @description The whole song as text, one `[kind]` header per section (ready for `lyrics_text` of the align call). */
+      readonly text: string;
+      readonly title: string | null;
+    };
+    /** Lyrics alignment */
+    readonly StudioLyricsAlignment: {
+      readonly applied: boolean;
+      /** @description True when the cached words of the clip were used (no transcription charge). */
+      readonly cached: boolean;
+      readonly clip_id: string;
+      readonly cost_micro_usd: string;
+      /** Format: uuid */
+      readonly creative_id: string;
+      readonly doc_hash?: string;
+      /** @description Timed lines on the document timeline (the `setLyrics` payload). */
+      readonly lines: readonly {
+        readonly endMs: number;
+        readonly sectionId?: string;
+        readonly startMs: number;
+        readonly text: string;
+      }[];
+      /** @description The lines as an LRC file. */
+      readonly lrc: string;
+      /** @description Share of lyric words matched to a transcribed word. */
+      readonly match_ratio: number;
+      /** @enum {string} */
+      readonly object: 'studio.lyrics_alignment';
+      /** @description The new version, when applied. */
+      readonly seq?: number;
+    };
+    /** Lyrics alignment request */
+    readonly StudioLyricsAlignRequest: {
+      /**
+       * @description false returns the timed lines and LRC without editing the creative.
+       * @default true
+       */
+      readonly apply?: boolean;
+      /** @description Version the setLyrics edit is based on (default the head). */
+      readonly base_seq?: number;
+      /** @description The audio clip of the creative to align to (its asset must be a ready speech, music, video or upload asset). */
+      readonly clip_id: string;
+      readonly creative_id: string;
+      /**
+       * @description Transcription language hint (default the document `meta.language`).
+       * @enum {string}
+       */
+      readonly language?: 'ro' | 'en';
+      /** @description The lyrics as text; `[verse]` / `[chorus]` header lines start sections. */
+      readonly lyrics_text: string;
+      /** @description Ignore the cached words of the clip asset and transcribe again (billed). */
+      readonly retranscribe?: boolean;
+    };
+    /** Checked lyric line */
+    readonly StudioLyricsLine: {
+      /** @description Rhyme letter of the line inside its section (A, B, ...). */
+      readonly letter: string;
+      /** @description True when the syllable count is outside the target ±1. */
+      readonly off: boolean;
+      /** @description The rhyme ending used for the scheme check. */
+      readonly rhyme: string;
+      /** @description Counted syllables (Romanian or English rules). */
+      readonly syllables: number;
+      readonly text: string;
+    };
+    /** Lyrics request */
+    readonly StudioLyricsRequest: {
+      /** @description What the song is about (3-4000 chars). Never logged. */
+      readonly brief: string;
+      readonly genre?: string;
+      /** @enum {string} */
+      readonly language: 'ro' | 'en';
+      /** @default 4 */
+      readonly lines_per_section?: number;
+      readonly mood?: string;
+      /**
+       * @default free
+       * @enum {string}
+       */
+      readonly rhyme_scheme?: 'AABB' | 'ABAB' | 'free';
+      /** @description Section order (default verse, chorus, verse, chorus, bridge, chorus). */
+      readonly structure?: readonly components$1['schemas']['StudioLyricsSectionKind'][];
+      /** @description Target syllables per line (checked with a tolerance of 1). */
+      readonly syllables_per_line?: number;
+      readonly title?: string;
+    };
+    /** @enum {string} */
+    readonly StudioLyricsSectionKind: 'intro' | 'verse' | 'pre_chorus' | 'chorus' | 'bridge' | 'outro' | 'instrumental' | 'custom';
     /** Narration defaults */
     readonly StudioNarrationDefaults: {
       /** @description Delivery instructions for expressive voices. */
@@ -16950,6 +17746,17 @@ type components$1 = {
       readonly default_tier: 't1' | 't2' | 't3' | 't4';
       /** @description Public key fingerprint to compare between devices. */
       readonly fingerprint: string;
+      readonly guards?: components$1['schemas']['VaultGuards'];
+      /**
+       * @description Why the vault is locked.
+       * @enum {string|null}
+       */
+      readonly lock_reason?: 'panic' | 'honeytoken' | null;
+      /**
+       * Format: date-time
+       * @description When the vault was locked (panic or honeytoken); null when unlocked. While locked every agent use is denied with reason `vault_locked`.
+       */
+      readonly locked_at?: string | null;
       readonly revision: number;
     };
     /** @description Proven step-up for a decision. `device`: an enrolled device key signs `codai-vault/approve/v2|<approval_id>|<action_hash>|<decision>|<scope>|<device_id>`. `passkey`: a WebAuthn assertion whose challenge is base64url(SHA-256(the same message with device id `passkey`)). With `match_number` the message is v3: `codai-vault/approve/v3|<approval_id>|<action_hash>|<decision>|<scope>|<device_id>|<preview_digest>|<match_number>`, where `preview_digest` = base64url(SHA-256(the canonical text of `request.preview`)). */
@@ -17026,6 +17833,20 @@ type components$1 = {
       /** @enum {string} */
       readonly surface: 'phone' | 'wear' | 'desktop';
     };
+    readonly VaultGuards: {
+      /** @description Agent requests for one item within `burst_window_s` that count as a burst (`anomaly:burst`); 0 = off. */
+      readonly burst_max: number;
+      /** @description Burst window in seconds. */
+      readonly burst_window_s: number;
+      /** @description End of the allowed hours (exclusive) in `tz`; a use outside [hour_start, hour_end) is `anomaly:hour`. */
+      readonly hour_end: number | null;
+      /** @description Start of the allowed hours (inclusive) in `tz`; null together with `hour_end` turns the hours check off. */
+      readonly hour_start: number | null;
+      /** @description Flag a use on a host with no allowed use or grant for that item in the last 30 days (`anomaly:new_host`). */
+      readonly new_host: boolean;
+      /** @description IANA time zone for the hours check, e.g. `Europe/Bucharest`. */
+      readonly tz: string;
+    };
     readonly VaultItemEnvelope: {
       /** @description Public catalogue entry for agents (title, sensitivity, hosts, env var). Never secret values. */
       readonly agent_meta?: {
@@ -17046,6 +17867,35 @@ type components$1 = {
       /** @description Per-item key wrapped under the vault key (`v1.<nonce>.<ciphertext>`). */
       readonly wrapped_key: string;
     };
+    readonly VaultItemLimits: {
+      /** Format: uuid */
+      readonly item_id: string;
+      /** @description Allowed uses per 24 hours; null = no cap. */
+      readonly per_day: number | null;
+      /** @description Allowed uses per minute; null = no cap. */
+      readonly per_minute: number | null;
+      /** @description Units per 24 hours (an `http` use costs 2, other modes 1); null = no cap. */
+      readonly units_per_day: number | null;
+    };
+    readonly VaultLockResult: {
+      /** @description Pending approvals denied by this lock. */
+      readonly approvals_denied: number;
+      /** @description Live grants revoked by this lock. */
+      readonly grants_revoked: number;
+      /** Format: date-time */
+      readonly locked_at: string;
+    };
+    readonly VaultUnlockChallenge: {
+      /** @description 32 random bytes, base64url. Single use. */
+      readonly challenge: string;
+      /**
+       * Format: date-time
+       * @description 5 minutes after issue.
+       */
+      readonly expires_at: string;
+      /** @description `codai-vault/unlock/v1|<challenge>|<device_id or passkey>`: the UTF-8 message the proof covers. */
+      readonly message_template: string;
+    };
     readonly VaultUseDecision: {
       /** @description Hash of the exact request the approver signs. */
       readonly action_hash?: string;
@@ -17055,6 +17905,7 @@ type components$1 = {
       readonly cloud_usable?: boolean;
       /** @description Two digits to show the user with the approval request; they tap the same number on the approving device (number matching). Null when no approval is needed. */
       readonly match_number?: string | null;
+      /** @description Why this tier. Guard reasons: `vault_locked` (the vault is locked, tier `deny`), `anomaly:new_host`, `anomaly:burst`, `anomaly:hour` (tier forced to t4; grants not approved at t4 are ignored). */
       readonly reasons: readonly string[];
       /** @enum {string} */
       readonly tier: 't0' | 't1' | 't2' | 't3' | 't4' | 'deny';
@@ -17176,6 +18027,8 @@ type components$1 = {
     readonly EnvironmentId: string;
     /** @description Replays the stored response of an earlier request with the same key for 24 h instead of running it again. */
     readonly IdempotencyKey: string;
+    /** @description Dotted media-op id, e.g. `image.remove_background` or `audio.separate_stems`. */
+    readonly MediaOpIdPath: components$1['schemas']['MediaOpId'];
     /** @description Project UUID. A malformed value is 400; an unknown or foreign project is 404. */
     readonly ProjectId: string;
     /** @description Client correlation id; echoed back as `x-codai-trace-id` and persisted on the usage row. */
@@ -28120,7 +28973,7 @@ interface operations$1 {
     };
     readonly requestBody?: {
       readonly content: {
-        readonly 'application/json': components$1['schemas']['CreativeRenderRequest'];
+        readonly 'application/json': components$1['schemas']['CreativeRenderRequest'] | components$1['schemas']['CreativeAudioRenderRequest'];
       };
     };
     readonly responses: {
@@ -28139,10 +28992,10 @@ interface operations$1 {
           readonly [name: string]: unknown;
         };
         content: {
-          readonly 'application/json': components$1['schemas']['CreativeRenderAccepted'];
+          readonly 'application/json': components$1['schemas']['CreativeRenderAccepted'] | components$1['schemas']['CreativeAudioRenderAccepted'];
         };
       };
-      /** @description Invalid body, an unsupported format (`unsupported_format`), a missing asset (`asset_not_found`), a non-video creative (`not_supported_for_kind`) or `ai_label: none` on a creative with TTS narration (`ai_label_required`). */
+      /** @description Invalid body, an unsupported format (`unsupported_format`), a missing asset (`asset_not_found`), a kind that cannot render (`not_supported_for_kind`), an audio creative with nothing to render (`empty_audio`) or over 20 minutes (`too_long`), `lrc: true` without timed lyrics (`no_lyrics`) or `ai_label: none` on a creative with TTS narration (`ai_label_required`). */
       readonly 400: {
         headers: {
           readonly [name: string]: unknown;
@@ -29233,6 +30086,281 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
+  readonly writeStudioLyrics: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: {
+        /** @description Replays the stored response of an earlier request with the same key for 24 h instead of running it again. */
+        readonly 'Idempotency-Key'?: components$1['parameters']['IdempotencyKey'];
+        /** @description Client correlation id; echoed back as `x-codai-trace-id` and persisted on the usage row. */
+        readonly 'x-request-id'?: components$1['parameters']['RequestId'];
+      };
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['StudioLyricsRequest'];
+      };
+    };
+    readonly responses: {
+      /** @description The lyrics with a per-line syllable and rhyme report. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['StudioLyrics'];
+        };
+      };
+      /** @description Invalid body (`invalid_request`). */
+      readonly 400: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['CreativeError'];
+        };
+      };
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 402: components$1['responses']['InsufficientFunds'];
+      readonly 403: components$1['responses']['Forbidden'];
+      /** @description The brief could not be turned into lyrics (`no_lyrics`); only the turns that ran are billed. */
+      readonly 422: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['CreativeError'];
+        };
+      };
+      readonly 429: components$1['responses']['RateLimited'];
+      readonly 502: components$1['responses']['UpstreamError'];
+    };
+  };
+  readonly alignStudioLyrics: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: {
+        /** @description Replays the stored response of an earlier request with the same key for 24 h instead of running it again. */
+        readonly 'Idempotency-Key'?: components$1['parameters']['IdempotencyKey'];
+        /** @description Client correlation id; echoed back as `x-codai-trace-id` and persisted on the usage row. */
+        readonly 'x-request-id'?: components$1['parameters']['RequestId'];
+      };
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['StudioLyricsAlignRequest'];
+      };
+    };
+    readonly responses: {
+      /** @description The timed lines, the LRC and the new version when applied. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['StudioLyricsAlignment'];
+        };
+      };
+      /** @description Invalid body, lyrics without lines, or clip audio over 25 MB (`unsupported_media`). */
+      readonly 400: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['CreativeError'];
+        };
+      };
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 402: components$1['responses']['InsufficientFunds'];
+      /** @description EU data-residency account (`residency_unavailable`). */
+      readonly 403: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description The creative moved past `base_seq` and the edit could not be rebased (`stale`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['CreativeError'];
+        };
+      };
+      /** @description Transcription is not configured or not available right now (`transcription_unavailable`). */
+      readonly 503: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+    };
+  };
+  readonly listStudioMediaOps: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description The op catalogue. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['MediaOpList'];
+        };
+      };
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly runStudioMediaOp: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: {
+        /** @description Replays the stored response of an earlier request with the same key for 24 h instead of running it again. */
+        readonly 'Idempotency-Key'?: components$1['parameters']['IdempotencyKey'];
+      };
+      readonly path: {
+        /** @description Dotted media-op id, e.g. `image.remove_background` or `audio.separate_stems`. */
+        readonly op: components$1['parameters']['MediaOpIdPath'];
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['MediaOpRequest'];
+      };
+    };
+    readonly responses: {
+      /** @description Sync op done: the stored, AI-marked outputs (or `analysis` for `audio.analyze`). */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['MediaOpResult'];
+        };
+      };
+      /** @description Async op dispatched: the job (`status: pending`). */
+      readonly 202: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['MediaOpJob'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 402: components$1['responses']['InsufficientFunds'];
+      /** @description Unknown op id, or an asset that does not exist, is not ready or belongs to another account. */
+      readonly 404: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+      readonly 429: components$1['responses']['RateLimited'];
+      readonly 502: components$1['responses']['UpstreamError'];
+      /** @description The op lane is not configured on this gateway (code `media_ops_unavailable`) or asset storage is off (`assets_unavailable`). Nothing was held or billed. */
+      readonly 503: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+    };
+  };
+  readonly quoteStudioMediaOp: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Dotted media-op id, e.g. `image.remove_background` or `audio.separate_stems`. */
+        readonly op: components$1['parameters']['MediaOpIdPath'];
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['MediaOpRequest'];
+      };
+    };
+    readonly responses: {
+      /** @description The quote. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['MediaOpQuote'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      /** @description Unknown op id, or an asset that does not exist, is not ready or belongs to another account. */
+      readonly 404: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+      /** @description The op lane is not configured on this gateway (code `media_ops_unavailable`) or asset storage is off (`assets_unavailable`). */
+      readonly 503: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+    };
+  };
+  readonly getStudioMediaOpJob: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Job UUID (the `id` of the 202 answer). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description The job. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['MediaOpJob'];
+        };
+      };
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
   readonly retrievePreview: {
     readonly parameters: {
       readonly query?: never;
@@ -29475,7 +30603,7 @@ interface operations$1 {
           readonly [name: string]: unknown;
         };
         content: {
-          readonly 'application/json': components$1['schemas']['StudioRender'];
+          readonly 'application/json': components$1['schemas']['StudioRender'] | components$1['schemas']['StudioAudioRender'];
         };
       };
       readonly 401: components$1['responses']['Unauthorized'];
@@ -32265,6 +33393,36 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
+  readonly revokeVaultTaskGrants: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly task: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly revoked: number;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
   readonly vaultHttp: {
     readonly parameters: {
       readonly query?: never;
@@ -32317,7 +33475,312 @@ interface operations$1 {
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
-      /** @description Denied by policy. */
+      /** @description Denied by policy (`vault_denied`; reasons include `vault_locked` while the vault is locked). */
+      readonly 403: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+    };
+  };
+  readonly listVaultItems: {
+    readonly parameters: {
+      readonly query?: {
+        /** @description Only changes after this ISO time. */
+        readonly since?: string;
+      };
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly putVaultItem: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['VaultItemEnvelope'];
+      };
+    };
+    readonly responses: {
+      /** @description Updated. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      /** @description Created. */
+      readonly 201: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Revision conflict. */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly deleteVaultItem: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description Deleted. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly setVaultItemCloud: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly item: {
+            readonly [key: string]: unknown;
+          } | null;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly setVaultItemLimits: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly per_day: number | null;
+          readonly per_minute: number | null;
+          readonly units_per_day: number | null;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK; `limits` is null when removed. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly limits: components$1['schemas']['VaultItemLimits'];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly listVaultLimits: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly limits: readonly components$1['schemas']['VaultItemLimits'][];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly lockVault: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: {
+      readonly content: {
+        readonly 'application/json': {
+          /** @enum {string} */
+          readonly via?: 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Locked. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultLockResult'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly vaultResolve: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly action: string;
+          readonly chain?: readonly string[];
+          readonly handles: readonly string[];
+          /** @enum {string} */
+          readonly provenance?: 'user' | 'agent' | 'untrusted';
+          readonly purpose?: string;
+          readonly task?: string | null;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Decrypted items keyed by handle. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      /** @description Approval required. */
+      readonly 202: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      /** @description Not a broker, or denied by policy. */
       readonly 403: {
         headers: {
           readonly [name: string]: unknown;
@@ -32329,14 +33792,33 @@ interface operations$1 {
         };
       };
       readonly 404: components$1['responses']['NotFound'];
+      /** @description Not cloud-usable: unlock locally. */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
     };
   };
-  readonly listVaultItems: {
+  readonly listVaultRules: {
     readonly parameters: {
-      readonly query?: {
-        /** @description Only changes after this ISO time. */
-        readonly since?: string;
-      };
+      readonly query?: never;
       readonly header?: never;
       readonly path?: never;
       readonly cookie?: never;
@@ -32358,33 +33840,27 @@ interface operations$1 {
       readonly 401: components$1['responses']['Unauthorized'];
     };
   };
-  readonly putVaultItem: {
+  readonly createVaultRule: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
-      readonly path: {
-        /** @description Resource id (uuid). */
-        readonly id: string;
-      };
+      readonly path?: never;
       readonly cookie?: never;
     };
     readonly requestBody: {
       readonly content: {
-        readonly 'application/json': components$1['schemas']['VaultItemEnvelope'];
+        readonly 'application/json': {
+          readonly agent?: string | null;
+          /** Format: uuid */
+          readonly item_id?: string | null;
+          /** @enum {string|null} */
+          readonly mode?: 'env' | 'http' | 'autofill' | 'ssh_sign' | 'reveal' | null;
+          /** @enum {string} */
+          readonly tier: 't0' | 't1' | 't2' | 't3' | 't4' | 'deny';
+        };
       };
     };
     readonly responses: {
-      /** @description Updated. */
-      readonly 200: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
       /** @description Created. */
       readonly 201: {
         headers: {
@@ -32399,20 +33875,9 @@ interface operations$1 {
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
       readonly 404: components$1['responses']['NotFound'];
-      /** @description Revision conflict. */
-      readonly 409: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
     };
   };
-  readonly deleteVaultItem: {
+  readonly deleteVaultRule: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -32440,34 +33905,47 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
-  readonly setVaultItemCloud: {
+  readonly patchVaultSettings: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
-      readonly path: {
-        /** @description Resource id (uuid). */
-        readonly id: string;
-      };
+      readonly path?: never;
       readonly cookie?: never;
     };
     readonly requestBody: {
       readonly content: {
         readonly 'application/json': {
-          readonly item: {
-            readonly [key: string]: unknown;
-          } | null;
+          /** @enum {string} */
+          readonly default_tier?: 't1' | 't2' | 't3' | 't4';
+          /** @description Any subset of `VaultGuards`; `hour_start` and `hour_end` are both null (off) or both set. */
+          readonly guards?: {
+            /** @description Agent requests for one item within `burst_window_s` that count as a burst (`anomaly:burst`); 0 = off. */
+            readonly burst_max?: number;
+            /** @description Burst window in seconds. */
+            readonly burst_window_s?: number;
+            /** @description End of the allowed hours (exclusive) in `tz`; a use outside [hour_start, hour_end) is `anomaly:hour`. */
+            readonly hour_end?: number | null;
+            /** @description Start of the allowed hours (inclusive) in `tz`; null together with `hour_end` turns the hours check off. */
+            readonly hour_start?: number | null;
+            /** @description Flag a use on a host with no allowed use or grant for that item in the last 30 days (`anomaly:new_host`). */
+            readonly new_host?: boolean;
+            /** @description IANA time zone for the hours check, e.g. `Europe/Bucharest`. */
+            readonly tz?: string;
+          };
         };
       };
     };
     readonly responses: {
-      /** @description OK. */
+      /** @description Effective settings. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
+            /** @enum {string} */
+            readonly default_tier: 't1' | 't2' | 't3' | 't4';
+            readonly guards: components$1['schemas']['VaultGuards'];
           };
         };
       };
@@ -32476,7 +33954,7 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
-  readonly vaultResolve: {
+  readonly unlockVault: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -32486,42 +33964,29 @@ interface operations$1 {
     readonly requestBody: {
       readonly content: {
         readonly 'application/json': {
-          readonly action: string;
-          readonly chain?: readonly string[];
-          readonly handles: readonly string[];
+          /** @description Challenge from `POST /v1/vault/unlock/challenge`. */
+          readonly challenge: string;
+          readonly proof: components$1['schemas']['VaultApprovalProof'];
           /** @enum {string} */
-          readonly provenance?: 'user' | 'agent' | 'untrusted';
-          readonly purpose?: string;
-          readonly task?: string | null;
+          readonly via?: 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
         };
       };
     };
     readonly responses: {
-      /** @description Decrypted items keyed by handle. */
+      /** @description Unlocked. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
-      /** @description Approval required. */
-      readonly 202: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
+            readonly unlocked: boolean;
           };
         };
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
-      /** @description Not a broker, or denied by policy. */
+      /** @description `challenge_invalid`, `unknown_device`, `device_revoked`, `wear_t3_only`, `invalid_signature` or `passkey_invalid`. */
       readonly 403: {
         headers: {
           readonly [name: string]: unknown;
@@ -32533,20 +33998,9 @@ interface operations$1 {
         };
       };
       readonly 404: components$1['responses']['NotFound'];
-      /** @description Not cloud-usable: unlock locally. */
-      readonly 409: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
     };
   };
-  readonly listVaultRules: {
+  readonly createVaultUnlockChallenge: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -32561,112 +34015,13 @@ interface operations$1 {
           readonly [name: string]: unknown;
         };
         content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
+          readonly 'application/json': components$1['schemas']['VaultUnlockChallenge'];
         };
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
     };
   };
-  readonly createVaultRule: {
-    readonly parameters: {
-      readonly query?: never;
-      readonly header?: never;
-      readonly path?: never;
-      readonly cookie?: never;
-    };
-    readonly requestBody: {
-      readonly content: {
-        readonly 'application/json': {
-          readonly agent?: string | null;
-          /** Format: uuid */
-          readonly item_id?: string | null;
-          /** @enum {string|null} */
-          readonly mode?: 'env' | 'http' | 'autofill' | 'ssh_sign' | 'reveal' | null;
-          /** @enum {string} */
-          readonly tier: 't0' | 't1' | 't2' | 't3' | 't4' | 'deny';
-        };
-      };
-    };
-    readonly responses: {
-      /** @description Created. */
-      readonly 201: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
-      readonly 400: components$1['responses']['BadRequest'];
-      readonly 401: components$1['responses']['Unauthorized'];
-      readonly 404: components$1['responses']['NotFound'];
-    };
-  };
-  readonly deleteVaultRule: {
-    readonly parameters: {
-      readonly query?: never;
-      readonly header?: never;
-      readonly path: {
-        /** @description Resource id (uuid). */
-        readonly id: string;
-      };
-      readonly cookie?: never;
-    };
-    readonly requestBody?: never;
-    readonly responses: {
-      /** @description Deleted. */
-      readonly 200: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
-      readonly 400: components$1['responses']['BadRequest'];
-      readonly 401: components$1['responses']['Unauthorized'];
-      readonly 404: components$1['responses']['NotFound'];
-    };
-  };
-  readonly patchVaultSettings: {
-    readonly parameters: {
-      readonly query?: never;
-      readonly header?: never;
-      readonly path?: never;
-      readonly cookie?: never;
-    };
-    readonly requestBody: {
-      readonly content: {
-        readonly 'application/json': {
-          /** @enum {string} */
-          readonly default_tier: 't1' | 't2' | 't3' | 't4';
-        };
-      };
-    };
-    readonly responses: {
-      /** @description OK. */
-      readonly 200: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
-      readonly 400: components$1['responses']['BadRequest'];
-      readonly 401: components$1['responses']['Unauthorized'];
-      readonly 404: components$1['responses']['NotFound'];
-    };
-  };
   readonly vaultUse: {
     readonly parameters: {
       readonly query?: never;
@@ -32703,6 +34058,17 @@ interface operations$1 {
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
       readonly 404: components$1['responses']['NotFound'];
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
     };
   };
   readonly listVaults: {
@@ -33203,7 +34569,7 @@ export type Receipt = Reply<'getReceipt'>;
 export type FeedbackRequest = Mutable<Body<'submitFeedback'>>;
 export type FeedbackResponse = Reply<'submitFeedback'>;
 export type PhoneModel = Schema<'AccountPhoneModel'>;
-type CallOpts$37 = {
+type CallOpts$38 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -33211,9 +34577,9 @@ export declare class Account {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/account` — the full account card. */
-  get(opts?: CallOpts$37): Promise<AccountView>;
+  get(opts?: CallOpts$38): Promise<AccountView>;
   /** `PATCH /v1/account` — consents, username, referral (at least one field). */
-  update(body: AccountPatchRequest, opts?: CallOpts$37): Promise<AccountPatchResponse>;
+  update(body: AccountPatchRequest, opts?: CallOpts$38): Promise<AccountPatchResponse>;
 }
 export declare class Receipts {
   private readonly http;
@@ -33225,7 +34591,7 @@ export declare class Receipts {
   get(query?: {
     sessionId?: string;
     since?: string | Date;
-  }, opts?: CallOpts$37): Promise<Receipt>;
+  }, opts?: CallOpts$38): Promise<Receipt>;
 }
 export declare class Feedback {
   private readonly http;
@@ -33234,13 +34600,13 @@ export declare class Feedback {
    * `POST /v1/feedback` — rate one turn. Exactly one of `event_id`,
    * `session_id`, `client_request_id` must be present.
    */
-  submit(body: FeedbackRequest, opts?: CallOpts$37): Promise<FeedbackResponse>;
+  submit(body: FeedbackRequest, opts?: CallOpts$38): Promise<FeedbackResponse>;
 }
 export declare class PhoneModels {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/phone/models` — on-device model catalog with signed URLs. */
-  list(opts?: CallOpts$37): Promise<PhoneModel[]>;
+  list(opts?: CallOpts$38): Promise<PhoneModel[]>;
 }
 //#endregion
 //#region src/resources/agents.d.ts
@@ -33252,7 +34618,7 @@ export type AgentRun = Reply<'getAgentRun'>;
 export type AgentRunStep = Schema<'AgentRunStep'>;
 export type AgentRunStats = Reply<'getAgentRunStats'>;
 export type AgentRunStatus = Schema<'AgentRunStatus'>;
-type CallOpts$36 = {
+type CallOpts$37 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -33289,28 +34655,28 @@ export declare class AgentRuns {
   private readonly http;
   constructor(http: HttpClient);
   /** `POST /v1/agents/runs` — returns 202 with the run id. */
-  create(body: AgentRunCreateRequest, opts?: CallOpts$36): Promise<AgentRunAccepted>;
+  create(body: AgentRunCreateRequest, opts?: CallOpts$37): Promise<AgentRunAccepted>;
   /** `GET /v1/agents/runs/{id}` */
-  get(id: string, opts?: CallOpts$36): Promise<AgentRun>;
+  get(id: string, opts?: CallOpts$37): Promise<AgentRun>;
   /** `GET /v1/agents/runs/{id}/steps` — newest first. */
-  steps(id: string, opts?: CallOpts$36): Promise<AgentRunStep[]>;
+  steps(id: string, opts?: CallOpts$37): Promise<AgentRunStep[]>;
   /** `GET /v1/agents/runs/stats?days=` */
-  stats(days?: number, opts?: CallOpts$36): Promise<AgentRunStats>;
+  stats(days?: number, opts?: CallOpts$37): Promise<AgentRunStats>;
   /** `POST /v1/agents/runs/{id}/cancel` */
-  cancel(id: string, opts?: CallOpts$36): Promise<Reply<'cancelAgentRun'>>;
+  cancel(id: string, opts?: CallOpts$37): Promise<Reply<'cancelAgentRun'>>;
   /**
    * `GET /v1/agents/runs/{id}/stream` — async iterator over `step` / `done` /
    * `timeout` events. The iterator ends after `done`; on `timeout` (30 min)
    * it also ends and you may reconnect (full replay from seq 0).
    */
-  stream(id: string, opts?: CallOpts$36): AsyncGenerator<AgentRunStreamEvent, void, undefined>;
+  stream(id: string, opts?: CallOpts$37): AsyncGenerator<AgentRunStreamEvent, void, undefined>;
 }
 export declare class Agents {
   private readonly http;
   readonly runs: AgentRuns;
   constructor(http: HttpClient);
   /** `POST /v1/agents/run` — blocks until the agent loop finishes. */
-  run(body: AgentRunRequest, opts?: CallOpts$36): Promise<AgentRunResult>;
+  run(body: AgentRunRequest, opts?: CallOpts$37): Promise<AgentRunResult>;
 }
 //#endregion
 //#region src/resources/audio.d.ts
@@ -33475,7 +34841,7 @@ export interface StudioQuoteQuery {
   model?: string;
   n?: number;
 }
-type CallOpts$35 = {
+type CallOpts$36 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -33499,16 +34865,16 @@ export declare class Billing {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/billing` — plan, wallet, auto top-up, cards and pay links (read-only). */
-  get(opts?: CallOpts$35): Promise<BillingOverview>;
+  get(opts?: CallOpts$36): Promise<BillingOverview>;
   /** `GET /v1/billing/invoices` — fiscal invoices and credit notes, newest first. */
   invoices(query?: {
     limit?: number;
-  }, opts?: CallOpts$35): Promise<BillingInvoice[]>;
+  }, opts?: CallOpts$36): Promise<BillingInvoice[]>;
   /**
    * `GET /v1/studio/quote` — what a Studio action costs (USD and wallet EUR micros) and your spendable balance,
    * before you run it. Paid Studio calls answer 402 `insufficient_funds` when `sufficient` is false. Free.
    */
-  studioQuote(query: StudioQuoteQuery, opts?: CallOpts$35): Promise<StudioQuote>;
+  studioQuote(query: StudioQuoteQuery, opts?: CallOpts$36): Promise<StudioQuote>;
   /**
    * Poll `get()` every `intervalMs` and call `onLow` once each time the wallet
    * balance crosses below `thresholdEur`. Read-only: never creates a checkout.
@@ -33553,7 +34919,7 @@ export interface CardsRendered {
   width: number | null;
   height: number | null;
 }
-type CallOpts$34 = {
+type CallOpts$35 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -33562,59 +34928,59 @@ export declare class Cards {
   constructor(http: HttpClient);
   private get;
   /** `GET /v1/cards/weather` — `weather` block from MET Norway (cached 30–60 min per 0.01°, free). */
-  weather(params: CardsWeatherParams, opts?: CallOpts$34): Promise<CardsWeatherResponse>;
+  weather(params: CardsWeatherParams, opts?: CallOpts$35): Promise<CardsWeatherResponse>;
   /**
    * `GET /v1/cards/places` — `places` block from Google Places: Text Search with `q` (biased to `lat`/`lng`/`radius`),
    * Nearby Search without it. Billed per call; `block` is null when nothing matched.
    */
-  places(params: CardsPlacesParams, opts?: CallOpts$34): Promise<CardsPlacesResponse>;
+  places(params: CardsPlacesParams, opts?: CallOpts$35): Promise<CardsPlacesResponse>;
   /** `GET /v1/cards/geocode` — `map` block (≤ 5 markers) plus raw `results` (Google Geocoding, billed). */
-  geocode(params: CardsGeocodeParams, opts?: CallOpts$34): Promise<CardsGeocodeResponse>;
+  geocode(params: CardsGeocodeParams, opts?: CallOpts$35): Promise<CardsGeocodeResponse>;
   /**
    * `GET /v1/cards/static-map` — PNG from Google Maps Static proxied through the gateway (no maps key on the client).
    * Needs `center` or `markers` (`lat,lng[,L]` joined by `|`); ≤ 640×400 points. Billed per call.
    */
-  staticMap(params: CardsStaticMapParams, opts?: CallOpts$34): Promise<CardsStaticMap>;
+  staticMap(params: CardsStaticMapParams, opts?: CallOpts$35): Promise<CardsStaticMap>;
   /**
    * `GET /v1/cards/fx` — BNR (default) or ECB reference rates: a `metric` block with `from`+`to`, otherwise a `table`
    * block against `quote`, optionally limited to `symbols` (comma-separated). Free.
    */
-  fx(params?: CardsFxParams, opts?: CallOpts$34): Promise<CardsFxResponse>;
+  fx(params?: CardsFxParams, opts?: CallOpts$35): Promise<CardsFxResponse>;
   /**
    * `GET /v1/cards/route` — travel time from Google Routes: `route` { mode, durationS, staticDurationS, distanceM,
    * polyline } and a `map` block. `origin`/`destination` as "lat,lng" or `from`/`to` as addresses; `mode` drive
    * (traffic-aware, default), walk, bicycle, transit, two_wheeler. Billed per call; both null when no route exists.
    */
-  route(params: CardsRouteParams, opts?: CallOpts$34): Promise<CardsRouteResponse>;
+  route(params: CardsRouteParams, opts?: CallOpts$35): Promise<CardsRouteResponse>;
   /**
    * `GET /v1/cards/track` — parcel history as a `timeline` block plus `result` (carrier, configured, found,
    * delivered, events, trackingUrl). `carrier` (sameday | fan | cargus | dpd) is guessed from the AWB when omitted;
    * carriers without gateway credentials answer `configured: false` with only the tracking link. Free.
    */
-  track(params: CardsTrackParams, opts?: CallOpts$34): Promise<CardsTrackResponse>;
+  track(params: CardsTrackParams, opts?: CallOpts$35): Promise<CardsTrackResponse>;
   /**
    * `GET /v1/cards/efactura` — your fiscal documents issued through Brivio with their ANAF e-Factura status
    * (`documents[]` + a `table` block, null when there are none). Free.
    */
-  efactura(params?: CardsEfacturaParams, opts?: CallOpts$34): Promise<CardsEfacturaResponse>;
+  efactura(params?: CardsEfacturaParams, opts?: CallOpts$35): Promise<CardsEfacturaResponse>;
   /**
    * `POST /v1/cards/unfurl` — `links` block (variant `preview`) for a public https page; SSRF-guarded, cached 24 h.
    * Private targets throw 400 `unfurl_blocked`, non-https pages 422 `unfurl_not_https`.
    */
-  unfurl(url: string, opts?: CallOpts$34): Promise<CardsUnfurlResponse>;
+  unfurl(url: string, opts?: CallOpts$35): Promise<CardsUnfurlResponse>;
   /**
    * `POST /v1/cards/product` — `products` block with one item from a public https product page's schema.org
    * `Product` JSON-LD (or OpenGraph product tags): name, image, price + currency (lowest offer), old price, rating
    * (0–5), reviews, seller, availability badge in `lang` (en default). Only what the page states; never sponsored.
    * SSRF-guarded like `unfurl`, cached 6 h. No product data throws 422 `product_not_found`.
    */
-  product(url: string, lang?: 'en' | 'ro', opts?: CallOpts$34): Promise<CardsProductResponse>;
+  product(url: string, lang?: 'en' | 'ro', opts?: CallOpts$35): Promise<CardsProductResponse>;
   /**
    * `POST /v1/cards/render` — renders a `chart` or `qr` block to `format` (`png` default, or `svg`) at
    * `width` x `height` CSS px (64–1200, defaults 480 x 300; QR is square) times `scale` (1–3, PNG only).
    * Other block types (Mermaid `diagram`, `math`, …) throw 422 `render_unsupported`. Free; 2000 renders per day.
    */
-  render(body: CardsRenderBody, opts?: CallOpts$34): Promise<CardsRendered>;
+  render(body: CardsRenderBody, opts?: CallOpts$35): Promise<CardsRendered>;
 }
 //#endregion
 //#region src/resources/chat.d.ts
@@ -33730,7 +35096,7 @@ export type Device = Schema<'DeviceListItem'>;
 export type DevicePatch = Mutable<Body<'updateDevice'>>;
 export type DevicePatched = Reply<'updateDevice'>;
 export type DispatchInbox = Reply<'getMyDispatchInbox'>;
-type CallOpts$33 = {
+type CallOpts$34 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -33738,23 +35104,23 @@ export declare class Devices {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/devices` — most recently seen first. */
-  list(opts?: CallOpts$33): Promise<Device[]>;
+  list(opts?: CallOpts$34): Promise<Device[]>;
   /** `PATCH /v1/devices/{id}` — push token and/or capabilities. */
-  update(id: string, body: DevicePatch, opts?: CallOpts$33): Promise<DevicePatched>;
+  update(id: string, body: DevicePatch, opts?: CallOpts$34): Promise<DevicePatched>;
   /** `DELETE /v1/devices/{id}` */
-  delete(id: string, opts?: CallOpts$33): Promise<Reply<'deleteDevice'>>;
+  delete(id: string, opts?: CallOpts$34): Promise<Reply<'deleteDevice'>>;
   /**
    * `POST /v1/keys/self/revoke` — the API key this client uses revokes ITSELF (sign out).
    * Every later call with it fails with 401.
    */
-  revokeSelfKey(opts?: CallOpts$33): Promise<Reply<'revokeSelfKey'>>;
+  revokeSelfKey(opts?: CallOpts$34): Promise<Reply<'revokeSelfKey'>>;
   /**
    * `GET /v1/devices/me/dispatch?limit=` — pending controls dispatched at the
    * calling device (`x-codai-device` required) across all owned sessions.
    */
   dispatchInbox(query?: {
     limit?: number;
-  }, opts?: CallOpts$33): Promise<DispatchInbox>;
+  }, opts?: CallOpts$34): Promise<DispatchInbox>;
 }
 //#endregion
 //#region src/resources/embeddings.d.ts
@@ -33817,7 +35183,7 @@ export type EnvironmentJobStartBody = Mutable<Body<'startEnvironmentJob'>>;
 export type EnvironmentJobStarted = Schema<'EnvironmentJobStarted'>;
 export type EnvironmentJob = Schema<'EnvironmentJob'>;
 export type GetEnvironmentJobQuery = Mutable<QueryOf<'getEnvironmentJob'>>;
-type CallOpts$32 = {
+type CallOpts$33 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -33825,70 +35191,70 @@ export declare class EnvironmentMembers {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/environments/{id}/members` — any role. */
-  list(envId: string, opts?: CallOpts$32): Promise<EnvironmentMember[]>;
+  list(envId: string, opts?: CallOpts$33): Promise<EnvironmentMember[]>;
   /** `POST /v1/environments/{id}/members` — exactly one of `user_id` / `email`. */
-  add(envId: string, body: EnvironmentAddMemberBody, opts?: CallOpts$32): Promise<EnvironmentMemberCreated>;
+  add(envId: string, body: EnvironmentAddMemberBody, opts?: CallOpts$33): Promise<EnvironmentMemberCreated>;
   /** `PUT /v1/environments/{id}/members/me/ssh-key` — one `authorized_keys` line. */
-  setSshKey(envId: string, publicKey: string, opts?: CallOpts$32): Promise<Reply<'setMyEnvironmentSshKey'>>;
+  setSshKey(envId: string, publicKey: string, opts?: CallOpts$33): Promise<Reply<'setMyEnvironmentSshKey'>>;
   /** `PATCH /v1/environments/{id}/members/{userId}` — 409 `last_owner` on demoting the last owner. */
-  setRole(envId: string, userId: string, role: EnvironmentRole, opts?: CallOpts$32): Promise<Reply<'setEnvironmentMemberRole'>['member']>;
+  setRole(envId: string, userId: string, role: EnvironmentRole, opts?: CallOpts$33): Promise<Reply<'setEnvironmentMemberRole'>['member']>;
   /** `DELETE /v1/environments/{id}/members/{userId}` — pass your own id to leave. */
-  remove(envId: string, userId: string, opts?: CallOpts$32): Promise<Reply<'removeEnvironmentMember'>>;
+  remove(envId: string, userId: string, opts?: CallOpts$33): Promise<Reply<'removeEnvironmentMember'>>;
   /** `POST /v1/environments/{id}/members/me/ssh-cert` — 12 h OpenSSH user certificate for your key. */
-  sshCert(envId: string, body: EnvironmentSshCertBody, opts?: CallOpts$32): Promise<EnvironmentSshCert>;
+  sshCert(envId: string, body: EnvironmentSshCertBody, opts?: CallOpts$33): Promise<EnvironmentSshCert>;
 }
 /** `/v1/environments/{id}/tasks` — fire-and-forget agent tasks run in the environment. */
 export declare class EnvironmentTasks {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/environments/{id}/tasks` */
-  list(envId: string, opts?: CallOpts$32): Promise<EnvironmentTaskList>;
+  list(envId: string, opts?: CallOpts$33): Promise<EnvironmentTaskList>;
   /** `POST /v1/environments/{id}/tasks` — queued; you get a notification when it finishes. */
-  create(envId: string, body: EnvironmentTaskCreateBody, opts?: CallOpts$32): Promise<EnvironmentTaskCreated>;
+  create(envId: string, body: EnvironmentTaskCreateBody, opts?: CallOpts$33): Promise<EnvironmentTaskCreated>;
   /** `GET /v1/environments/{id}/tasks/{taskId}` */
-  get(envId: string, taskId: string, opts?: CallOpts$32): Promise<EnvironmentTaskDetail>;
+  get(envId: string, taskId: string, opts?: CallOpts$33): Promise<EnvironmentTaskDetail>;
 }
 /** `/v1/environments/{id}/files` — read/write/list over the relay (developer role or higher). */
 export declare class EnvironmentFiles {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/environments/{id}/files?path=` — directory entries; no path → your workspace. */
-  list(envId: string, path?: string, opts?: CallOpts$32): Promise<EnvironmentFileList>;
+  list(envId: string, path?: string, opts?: CallOpts$33): Promise<EnvironmentFileList>;
   /** `GET /v1/environments/{id}/files/{path}` — UTF-8 text (64 KB default, `maxBytes` ≤ 512 KB). */
   get(envId: string, path: string, options?: {
     maxBytes?: number;
-  } & CallOpts$32): Promise<EnvironmentFile>;
+  } & CallOpts$33): Promise<EnvironmentFile>;
   /** `PUT /v1/environments/{id}/files/{path}` — replace with UTF-8 text (≤ 2 MB). */
-  put(envId: string, path: string, content: string, opts?: CallOpts$32): Promise<EnvironmentFileWritten>;
+  put(envId: string, path: string, content: string, opts?: CallOpts$33): Promise<EnvironmentFileWritten>;
 }
 /** `/v1/environments/{id}/jobs` — background jobs on the environment daemon. */
 export declare class EnvironmentJobs {
   private readonly http;
   constructor(http: HttpClient);
   /** `POST /v1/environments/{id}/jobs` — returns at once with `job_id`. */
-  start(envId: string, body: EnvironmentJobStartBody, opts?: CallOpts$32): Promise<EnvironmentJobStarted>;
+  start(envId: string, body: EnvironmentJobStartBody, opts?: CallOpts$33): Promise<EnvironmentJobStarted>;
   /** `GET /v1/environments/{id}/jobs/{jobId}` — status + output (`since` = previous `next_offset`). */
-  get(envId: string, jobId: string | number, query?: GetEnvironmentJobQuery, opts?: CallOpts$32): Promise<EnvironmentJob>;
+  get(envId: string, jobId: string | number, query?: GetEnvironmentJobQuery, opts?: CallOpts$33): Promise<EnvironmentJob>;
 }
 export declare class EnvironmentPorts {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/environments/{id}/ports` — published (forwarded) ports. */
-  list(envId: string, opts?: CallOpts$32): Promise<EnvironmentPort[]>;
+  list(envId: string, opts?: CallOpts$33): Promise<EnvironmentPort[]>;
   /** `PUT /v1/environments/{id}/ports/{port}` — publish or change visibility (upsert). */
-  set(envId: string, port: number, body: EnvironmentPortBody, opts?: CallOpts$32): Promise<EnvironmentPort>;
+  set(envId: string, port: number, body: EnvironmentPortBody, opts?: CallOpts$33): Promise<EnvironmentPort>;
   /** `DELETE /v1/environments/{id}/ports/{port}` — unpublish. */
-  remove(envId: string, port: number, opts?: CallOpts$32): Promise<Reply<'removeEnvironmentPort'>>;
+  remove(envId: string, port: number, opts?: CallOpts$33): Promise<Reply<'removeEnvironmentPort'>>;
 }
 export declare class EnvironmentSecrets {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/environments/{id}/secrets` — names and timestamps only, never values. */
-  list(envId: string, opts?: CallOpts$32): Promise<EnvironmentSecret[]>;
+  list(envId: string, opts?: CallOpts$33): Promise<EnvironmentSecret[]>;
   /** `PUT /v1/environments/{id}/secrets/{name}` — upsert; `name` is `ENV_STYLE`. */
-  set(envId: string, name: string, value: string, opts?: CallOpts$32): Promise<EnvironmentSecretSet>;
+  set(envId: string, name: string, value: string, opts?: CallOpts$33): Promise<EnvironmentSecretSet>;
   /** `DELETE /v1/environments/{id}/secrets/{name}` */
-  remove(envId: string, name: string, opts?: CallOpts$32): Promise<Reply<'removeEnvironmentSecret'>>;
+  remove(envId: string, name: string, opts?: CallOpts$33): Promise<Reply<'removeEnvironmentSecret'>>;
 }
 export declare class Environments {
   private readonly http;
@@ -33903,41 +35269,41 @@ export declare class Environments {
    * `POST /v1/environments/{id}/exec` — run one relay op and wait (developer+). `op` defaults to
    * `shell` with `command`; 409 `environment_offline`, 504 `host_timeout`.
    */
-  exec(envId: string, body: EnvironmentExecBody, opts?: CallOpts$32): Promise<EnvironmentExecResult>;
+  exec(envId: string, body: EnvironmentExecBody, opts?: CallOpts$33): Promise<EnvironmentExecResult>;
   /** `GET /v1/environments/{id}/ssh-ca` — CA public keys to trust (`@cert-authority` lines). */
-  sshCa(envId: string, opts?: CallOpts$32): Promise<EnvironmentSshCa>;
+  sshCa(envId: string, opts?: CallOpts$33): Promise<EnvironmentSshCa>;
   /** `GET /v1/environments?project_id=&for_user_id=me` — newest first, every state. */
-  list(query?: ListEnvironmentsQuery, opts?: CallOpts$32): Promise<Environment[]>;
+  list(query?: ListEnvironmentsQuery, opts?: CallOpts$33): Promise<Environment[]>;
   /**
    * `POST /v1/environments` — `byo` starts `pending`; managed providers start
    * `creating`. 409 `already_has_env` in a `vm_per_dev` project (the error
    * body carries the `environment_id` to reuse).
    */
-  create(body: EnvironmentCreateBody, opts?: CallOpts$32): Promise<Environment>;
+  create(body: EnvironmentCreateBody, opts?: CallOpts$33): Promise<Environment>;
   /**
    * `POST /v1/environments/enroll` — daemon side. The one-time `codai_env_…`
    * token in the body is the only credential; the client's API key header is
    * ignored by this route. Managed environments additionally receive a
    * freshly minted `api_key`, returned exactly once.
    */
-  enroll(body: EnvironmentEnrollBody, opts?: CallOpts$32): Promise<EnvironmentEnrolled>;
+  enroll(body: EnvironmentEnrollBody, opts?: CallOpts$33): Promise<EnvironmentEnrolled>;
   /** `GET /v1/environments/{id}` — environment, your role, members, ports, recent events. */
-  get(envId: string, opts?: CallOpts$32): Promise<EnvironmentDetail>;
+  get(envId: string, opts?: CallOpts$33): Promise<EnvironmentDetail>;
   /** `PATCH /v1/environments/{id}` — `name` and/or `idle_timeout_minutes` (5..1440). */
-  update(envId: string, body: EnvironmentPatchBody, opts?: CallOpts$32): Promise<Environment>;
+  update(envId: string, body: EnvironmentPatchBody, opts?: CallOpts$33): Promise<Environment>;
   /** `POST /v1/environments/{id}/start` — managed providers only (`stopped` → `starting`). */
-  start(envId: string, opts?: CallOpts$32): Promise<EnvironmentTransition>;
+  start(envId: string, opts?: CallOpts$33): Promise<EnvironmentTransition>;
   /** `POST /v1/environments/{id}/stop` — managed providers only (`running` → `stopping`). */
-  stop(envId: string, opts?: CallOpts$32): Promise<EnvironmentTransition>;
+  stop(envId: string, opts?: CallOpts$33): Promise<EnvironmentTransition>;
   /** `POST /v1/environments/{id}/archive` — keeps history, releases the machine. */
-  archive(envId: string, opts?: CallOpts$32): Promise<EnvironmentTransition>;
+  archive(envId: string, opts?: CallOpts$33): Promise<EnvironmentTransition>;
   /** `POST /v1/environments/{id}/destroy` — owner only; terminal. */
-  destroy(envId: string, opts?: CallOpts$32): Promise<EnvironmentTransition>;
+  destroy(envId: string, opts?: CallOpts$33): Promise<EnvironmentTransition>;
   /**
    * `POST /v1/environments/{id}/enroll-token` — `byo` only; a 30-minute
    * one-time token for `enroll()`. Minting again replaces the previous one.
    */
-  enrollToken(envId: string, opts?: CallOpts$32): Promise<EnvironmentEnrollToken>;
+  enrollToken(envId: string, opts?: CallOpts$33): Promise<EnvironmentEnrollToken>;
   private transition;
 }
 //#endregion
@@ -33974,7 +35340,7 @@ export type HostExecBody = Mutable<Body<'execOnHost'>>;
 export type HostExecResponse = Reply<'execOnHost'>;
 export type HostExecRequest = Schema<'HostExecRequest'>;
 export type HostExecResultBody = Mutable<Body<'postHostExecResult'>>;
-type CallOpts$31 = {
+type CallOpts$32 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -34001,7 +35367,7 @@ export declare class Hosts {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/hosts` — your devices currently connected as hosts. */
-  list(opts?: CallOpts$31): Promise<HostPresence[]>;
+  list(opts?: CallOpts$32): Promise<HostPresence[]>;
   /**
    * `POST /v1/hosts/{deviceId}/exec` — run one op on a connected host and
    * block until it answers (or `timeout_ms`, default 60 s).
@@ -34009,9 +35375,9 @@ export declare class Hosts {
   exec(deviceId: string, op: HostOp, args?: Record<string, unknown>, extra?: {
     timeoutMs?: number;
     label?: string;
-  } & CallOpts$31): Promise<HostExecResponse>;
+  } & CallOpts$32): Promise<HostExecResponse>;
   /** `POST /v1/hosts/exec/{reqId}/result` — host side: deliver an exec result. */
-  postResult(reqId: string, body: HostExecResultBody, opts?: CallOpts$31): Promise<Reply<'postHostExecResult'>>;
+  postResult(reqId: string, body: HostExecResultBody, opts?: CallOpts$32): Promise<Reply<'postHostExecResult'>>;
   /**
    * `GET /v1/hosts/stream?os=&hostname=&roots=` — host side: announce this
    * device and receive `hello` / `ping` / `exec` events. Closed by the server
@@ -34021,7 +35387,7 @@ export declare class Hosts {
     os?: string;
     hostname?: string;
     roots?: string[];
-  }, opts?: CallOpts$31): AsyncGenerator<HostStreamEvent, void, undefined>;
+  }, opts?: CallOpts$32): AsyncGenerator<HostStreamEvent, void, undefined>;
 }
 //#endregion
 //#region src/resources/assets.d.ts
@@ -34033,7 +35399,7 @@ export type AssetDeleted = Reply<'deleteAsset'>;
 export type AssetListQuery = QueryOf<'listAssets'>;
 /** `b64_json` (default, inline bytes) or `url` (stored asset + 1 h signed URL; 503 `assets_unavailable` without storage). */
 export type MediaResponseFormat = Schema<'MediaResponseFormat'>;
-type CallOpts$30 = {
+type CallOpts$31 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -34043,25 +35409,25 @@ export declare class Assets {
   private readonly http;
   constructor(http: HttpClient);
   /** `GET /v1/assets` — newest first, `limit` ≤ 100 (default 30). Paginate by passing `next_before` as `before`. */
-  list(query?: AssetListQuery, opts?: CallOpts$30): Promise<AssetList>;
+  list(query?: AssetListQuery, opts?: CallOpts$31): Promise<AssetList>;
   /** Iterate every asset across pages (`list` with `before` = previous `next_before`). */
-  iterate(query?: Omit<AssetListQuery, 'before'>, opts?: CallOpts$30): AsyncGenerator<AssetDto, void, undefined>;
+  iterate(query?: Omit<AssetListQuery, 'before'>, opts?: CallOpts$31): AsyncGenerator<AssetDto, void, undefined>;
   /** `GET /v1/assets/{id}` — one asset with a fresh 1 h signed `url` (`null` while not `ready`). */
-  retrieve(id: string, opts?: CallOpts$30): Promise<AssetDto>;
+  retrieve(id: string, opts?: CallOpts$31): Promise<AssetDto>;
   /**
    * A fresh signed URL of the asset's bytes (valid 1 h), from `GET /v1/assets/{id}`. Throws when the asset has no
    * content yet. Use it in `<audio>`/`<video>`/`fetch` — it needs no Authorization header.
    */
-  contentUrl(id: string, opts?: CallOpts$30): Promise<string>;
+  contentUrl(id: string, opts?: CallOpts$31): Promise<string>;
   /**
    * The authenticated redirect endpoint `GET /v1/assets/{id}/content` (302 to the signed URL). Useful for tools that
    * follow redirects with the API key (`curl -L -H 'Authorization: Bearer …'`); browsers should use `contentUrl()`.
    */
   contentPath(id: string): string;
   /** Download the asset's bytes (fetches the signed URL, no API key sent to storage). */
-  content(id: string, opts?: CallOpts$30): Promise<Uint8Array>;
+  content(id: string, opts?: CallOpts$31): Promise<Uint8Array>;
   /** `DELETE /v1/assets/{id}` — deletes the object; signed URLs already handed out stop working. */
-  delete(id: string, opts?: CallOpts$30): Promise<AssetDeleted>;
+  delete(id: string, opts?: CallOpts$31): Promise<AssetDeleted>;
 }
 //#endregion
 //#region src/resources/images.d.ts
@@ -34564,11 +35930,11 @@ export type DocumentPreview = Reply<'retrievePreview'>;
 export type DocumentPreviewStatus = DocumentPreview['status'];
 export type DocumentVideoRequest = Mutable<Body<'createDocumentVideo'>>;
 export type DocumentVideoAccepted = Reply<'createDocumentVideo', 202>;
-type CallOpts$29 = {
+type CallOpts$30 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
-export interface DocumentPollOptions extends CallOpts$29 {
+export interface DocumentPollOptions extends CallOpts$30 {
   /** Delay between polls (default 3000 ms for previews, 5000 ms for videos). */
   pollIntervalMs?: number;
   /** Give up after this long (default 300 000 ms for previews, 900 000 ms for videos). */
@@ -34583,21 +35949,21 @@ export declare class Documents {
    * `sheet` -> `SheetSpec`); invalid specs are 400 `invalid_spec`. Files are free. `based_on` creates the next version
    * of one of your documents; `preview: true` also queues a (billed) preview, returned as `preview`.
    */
-  create(body: DocumentCreateRequest, opts?: CallOpts$29): Promise<StudioDocument>;
+  create(body: DocumentCreateRequest, opts?: CallOpts$30): Promise<StudioDocument>;
   /** `GET /v1/studio/documents/{id}` — fresh 1 h signed `file.url`, the stored `spec` and `latest_preview_id`. */
-  retrieve(id: string, opts?: CallOpts$29): Promise<StudioDocument>;
+  retrieve(id: string, opts?: CallOpts$30): Promise<StudioDocument>;
   /**
    * Queue a preview (`POST /v1/studio/documents/{id}/previews`, HTTP 202): tagged PDF, page PNGs (1280 px) and a
    * contact sheet. Billed once on the first poll that sees the result; at most 3 active previews per user (429).
    */
-  preview(id: string, body?: DocumentPreviewRequest, opts?: CallOpts$29): Promise<DocumentPreviewAccepted>;
+  preview(id: string, body?: DocumentPreviewRequest, opts?: CallOpts$30): Promise<DocumentPreviewAccepted>;
   /** Poll a preview (`GET /v1/studio/previews/{id}`): `queued` | `rendering` | `succeeded` | `failed`. */
-  retrievePreview(previewId: string, opts?: CallOpts$29): Promise<DocumentPreview>;
+  retrievePreview(previewId: string, opts?: CallOpts$30): Promise<DocumentPreview>;
   /**
    * Turn a deck into an MP4 (`POST /v1/studio/documents/{id}/video`, HTTP 202). Returns a render: poll it with
    * `renders.retrieve(id)` or use `videoAndWait`. Narration (`narrate`) is synthesized and billed now.
    */
-  video(id: string, body?: DocumentVideoRequest, opts?: CallOpts$29): Promise<DocumentVideoAccepted>;
+  video(id: string, body?: DocumentVideoRequest, opts?: CallOpts$30): Promise<DocumentVideoAccepted>;
   /** Queue a preview and poll until it succeeds. Throws on `failed` or timeout. */
   createPreviewAndWait(id: string, opts?: DocumentPollOptions & {
     body?: DocumentPreviewRequest;
@@ -34619,11 +35985,11 @@ export interface LottieDownload {
   filename: string | null;
   contentType: string | null;
 }
-type CallOpts$28 = {
+type CallOpts$29 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
-export interface ExportWaitOptions extends CallOpts$28 {
+export interface ExportWaitOptions extends CallOpts$29 {
   /** Delay between polls (default 3000 ms). */
   intervalMs?: number;
   /** Give up after this long (default 900 000 ms = 15 min). */
@@ -34633,7 +35999,7 @@ export declare class Exports {
   private readonly http;
   constructor(http: HttpClient);
   /** The export: `queued` / `running`, then `succeeded` (signed `url`, valid 1 h) or `failed` (`error`). Free. */
-  retrieve(id: string, opts?: CallOpts$28): Promise<StudioExport>;
+  retrieve(id: string, opts?: CallOpts$29): Promise<StudioExport>;
   /**
    * Poll `retrieve` every `intervalMs` (default 3 s) until the export is `succeeded` or `failed` and resolve with it
    * (a `failed` export resolves too — check `status` / `error`). Throws when it is not done within `timeoutMs`
@@ -34663,11 +36029,18 @@ export type CreativeRevertResult = Reply<'revertCreative'>;
 export type CreativeForkRequest = Mutable<Body<'forkCreative'>>;
 export type CreativeLintResult = Reply<'lintCreative'>;
 export type CreativeCompiled = Reply<'getCreativeCompiled'>;
-export type CreativeRenderRequest = Mutable<Body<'renderCreative'>>;
-export type CreativeRenderAccepted = Reply<'renderCreative', 202>;
+export type CreativeRenderRequest = Mutable<Schema<'CreativeRenderRequest'>>;
+export type CreativeRenderAccepted = Schema<'CreativeRenderAccepted'>;
 export type CreativeRenderCached = Reply<'renderCreative', 200>;
 /** `render` answer: a new queued render (202, `cached: false`) or the identical existing one (200, `cached: true`). */
 export type CreativeRenderResult = CreativeRenderAccepted | CreativeRenderCached;
+/** `renderAudio` body (MU-05): `formats` (wav | mp3 | flac), `stems`, `lrc`, `loudness` (preset or LUFS), `title`. */
+export type CreativeAudioRenderRequest = Mutable<Schema<'CreativeAudioRenderRequest'>>;
+/** `renderAudio` answer (202): the queued mixdown with its planned `outputs` and `quote_micro_usd`. */
+export type CreativeAudioRenderAccepted = Schema<'CreativeAudioRenderAccepted'>;
+export type CreativeAudioRenderOutput = Schema<'CreativeAudioRenderOutput'>;
+/** `GET /v1/studio/renders/{id}` of an audio render (`target: 'audio'`): one `data[]` asset per output. */
+export type StudioAudioRender = Schema<'StudioAudioRender'>;
 export type CreativeFrameRequest = Mutable<Body<'createCreativeFrame'>>;
 export type CreativeFrame = Schema<'CreativeFrame'>;
 export type CreativeFrames = Reply<'createCreativeFrame', 200>;
@@ -34766,7 +36139,7 @@ export interface CreativeEditRequest {
   /** Bypass locked nodes and variables. */
   force?: boolean;
 }
-type CallOpts$27 = {
+type CallOpts$28 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -34774,49 +36147,49 @@ export declare class Creatives {
   private readonly http;
   constructor(http: HttpClient);
   /** List your creatives, most recently updated first (`next_before` pages). */
-  list(query?: CreativeListQuery, opts?: CallOpts$27): Promise<CreativeList>;
+  list(query?: CreativeListQuery, opts?: CallOpts$28): Promise<CreativeList>;
   /**
    * Create a creative (`kind` + optional `title` / `doc`); without `doc` you get an empty document for the kind.
    * `brand_kit_id` applies one of your brand kits (`brandKits`) to version 1: `brand = { kitId, tokens }` + its logo.
    * `template` (+ `vars`, values by var key) starts from one of your templates (`templates`) instead of `doc`.
    */
-  create(body: CreativeCreateRequest, opts?: CallOpts$27): Promise<Creative>;
+  create(body: CreativeCreateRequest, opts?: CallOpts$28): Promise<Creative>;
   /** The document at the head (or `seq`) with signed `assets` (1 h URLs). */
   retrieve(id: string, query?: {
     seq?: number;
-  }, opts?: CallOpts$27): Promise<CreativeDetail>;
+  }, opts?: CallOpts$28): Promise<CreativeDetail>;
   /** Compact text outline (+ formats and vars) — the cheapest structure for a prompt. */
-  outline(id: string, opts?: CallOpts$27): Promise<CreativeOutline>;
+  outline(id: string, opts?: CallOpts$28): Promise<CreativeOutline>;
   /** Node ids matching `query` (a string = text/name/id substring, or `{ text, type, sceneId, assetId, locked }`). */
-  find(id: string, query: CreativeFindRequest['query'], opts?: CallOpts$27): Promise<CreativeFindResult>;
+  find(id: string, query: CreativeFindRequest['query'], opts?: CallOpts$28): Promise<CreativeFindResult>;
   /** Full JSON of `ids` (scene ids return whole scenes) or of one `sceneId`. */
-  subtree(id: string, body: CreativeSubtreeRequest, opts?: CallOpts$27): Promise<CreativeSubtree>;
+  subtree(id: string, body: CreativeSubtreeRequest, opts?: CallOpts$28): Promise<CreativeSubtree>;
   /**
    * Apply an op batch (all or nothing) authored against `baseSeq`. A stale base is rebased when the touched
    * targets did not change meanwhile; otherwise the call throws `CodaiError` 409 `stale` (reload and retry). Rejected
    * ops throw 400 with `code` (`invalid`, `not_found`, `locked`, `duplicate_id`).
    */
-  edit(id: string, body: CreativeEditRequest, opts?: CallOpts$27): Promise<CreativeOpsResult>;
+  edit(id: string, body: CreativeEditRequest, opts?: CallOpts$28): Promise<CreativeOpsResult>;
   /** Version history, newest first (`beforeSeq` pages). */
   versions(id: string, query?: {
     beforeSeq?: number;
     limit?: number;
-  }, opts?: CallOpts$27): Promise<CreativeVersionList>;
+  }, opts?: CallOpts$28): Promise<CreativeVersionList>;
   /** New head whose document is version `seq`'s (undo / redo). */
-  revert(id: string, seq: number, opts?: CallOpts$27): Promise<CreativeRevertResult>;
+  revert(id: string, seq: number, opts?: CallOpts$28): Promise<CreativeRevertResult>;
   /** New creative from version `seq` (default the head). */
-  fork(id: string, body?: CreativeForkRequest, opts?: CallOpts$27): Promise<Creative>;
+  fork(id: string, body?: CreativeForkRequest, opts?: CallOpts$28): Promise<Creative>;
   /** Soft-delete the creative. */
-  delete(id: string, opts?: CallOpts$27): Promise<CreativeDeleted>;
+  delete(id: string, opts?: CallOpts$28): Promise<CreativeDeleted>;
   /**
    * Contrast, safe area, empty text, missing assets, brand colours, platform safe zones and text floors, alt text,
    * missing captions, reading speed, flashing, missing / stale translations. Issues carry `format` / `fixable` /
    * `locale`; `fixable` counts them (`lintFix`). `locale` lints the translated document (adds
    * `text_overflow_locale`); 404 `Locale not found.` for an unknown locale.
    */
-  lint(id: string, body?: CreativeLintRequest, opts?: CallOpts$27): Promise<CreativeLintResult>;
+  lint(id: string, body?: CreativeLintRequest, opts?: CallOpts$28): Promise<CreativeLintResult>;
   /** Preview HTML (signed asset URLs) for `format` / one `scene` / a translation (`locale`). */
-  compiled(id: string, query?: CreativeCompiledQuery, opts?: CallOpts$27): Promise<CreativeCompiled>;
+  compiled(id: string, query?: CreativeCompiledQuery, opts?: CallOpts$28): Promise<CreativeCompiled>;
   /**
    * Queue an MP4 render of the head (`codai-render`, HTTP 202, `cached: false`); poll `renders.retrieve(render_id)`.
    * When the same render already exists for this version / format / quality / fps you get it back at once
@@ -34825,48 +36198,59 @@ export declare class Creatives {
    * `ai_label` (`none` | `corner` | `end_card`, EU AI Act art. 50(4)) burns a visible AI label into the video; omitted =
    * `corner` when the creative uses TTS narration or AI images, else `none` (`none` with narration: 400 `ai_label_required`).
    */
-  render(id: string, body?: CreativeRenderRequest, opts?: CallOpts$27): Promise<CreativeRenderResult>;
+  render(id: string, body?: CreativeRenderRequest, opts?: CallOpts$28): Promise<CreativeRenderResult>;
+  /**
+   * Mixdown + mastering + exports of an `audio` creative (MU-05; same `POST …/render` route, HTTP 202). `formats`
+   * (default `['wav', 'mp3']`), `stems: true` adds one WAV per audible track (+50 %), `lrc` exports the timed lyrics
+   * (default on when the document has them), `loudness` is `streaming` (−14) | `podcast` (−16) | `broadcast` (−23) or
+   * LUFS (−40…−5). Poll `renders.retrieve(render_id)`: the finished render's `data[]` holds one signed asset per output
+   * (`output: mix | stem | lrc`). $0.001 per output second, minimum $0.01; held up front, billed on the measured length.
+   * 400 `empty_audio` / `too_long` (20 min) / `no_lyrics`; video creatives use `render`.
+   */
+  renderAudio(id: string, body?: CreativeAudioRenderRequest, opts?: CallOpts$28 & {
+    idempotencyKey?: string;
+  }): Promise<CreativeAudioRenderAccepted>;
   /**
    * PNG still frames at up to 6 times (`t_ms`). `exact: false` (default) screenshots the compiled HTML; `exact: true`
    * cuts them from a draft render of the covering scenes. Waits up to ~90 s: frames (`status: 'succeeded'`) or a
    * running job (`status: 'running'`) to poll with `frameJob(id, frame_job_id)`. Cached frames are free; 60 frame
    * jobs per UTC day are free, then billed (`billed_micro_usd`).
    */
-  frame(id: string, body: CreativeFrameRequest, opts?: CallOpts$27): Promise<CreativeFrameResult>;
+  frame(id: string, body: CreativeFrameRequest, opts?: CallOpts$28): Promise<CreativeFrameResult>;
   /**
    * Turn a comment pinned on a frame (`t_ms`, optional `node_id` / `scene_id`) into an edit: one bounded `codai`
    * model turn proposes ops, applied like `edit` against `base_seq` (rebased when possible, 409 `stale` else).
    * 422 `no_edit` when the model made no edit (its answer in `error.text`); `apply: false` only proposes the ops.
    * Token-metered like any `codai` text call.
    */
-  comment(id: string, body: CreativeCommentRequest, opts?: CallOpts$27): Promise<CreativeCommentResult>;
+  comment(id: string, body: CreativeCommentRequest, opts?: CallOpts$28): Promise<CreativeCommentResult>;
   /**
    * Generate A/B variants: one bounded `codai` model turn proposes `count` (default 3) variants changing only
    * `focus` (default hook / title / cta); each becomes a fork of the creative at `base_seq` with the ops applied, plus
    * a queued draft render (`render: false` to skip; poll `renders.retrieve(render_id)`). The original is unchanged
    * until `pickVariant`. 422 `no_edit` when no valid variant came back, 504 `timeout` after 90 s. Token-metered.
    */
-  variants(id: string, body: CreativeVariantsRequest, opts?: CallOpts$27): Promise<CreativeVariantsResult>;
+  variants(id: string, body: CreativeVariantsRequest, opts?: CallOpts$28): Promise<CreativeVariantsResult>;
   /** The latest variant group of a creative (`group_id: null` when none) with statuses and stored render state. */
-  listVariants(id: string, opts?: CallOpts$27): Promise<CreativeVariantList>;
+  listVariants(id: string, opts?: CallOpts$28): Promise<CreativeVariantList>;
   /**
    * Pick the winner: its ops are applied to the original against `base_seq` (rebased when possible, 409 `stale`
    * else); the winner is marked `winner`, the rest of its group `rejected`.
    */
-  pickVariant(id: string, variantId: string, body: CreativeVariantPickRequest, opts?: CallOpts$27): Promise<CreativeVariantPickResult>;
+  pickVariant(id: string, variantId: string, body: CreativeVariantPickRequest, opts?: CallOpts$28): Promise<CreativeVariantPickResult>;
   /**
    * Save the creative (at `seq`, default the head) as a private template: each `vars` entry turns a text node's text
    * (`prop: 'text'`) or an image node's asset (`prop: 'image'`) into a variable whose default is the current value.
    * 400 `node_not_found` / `invalid_pick` / `duplicate_key`. Free.
    */
-  saveTemplate(id: string, body: SaveTemplateRequest, opts?: CallOpts$27): Promise<CreativeTemplate>;
+  saveTemplate(id: string, body: SaveTemplateRequest, opts?: CallOpts$28): Promise<CreativeTemplate>;
   /**
    * Queue an FCPXML export of a video creative (`seq`, default the head; `format`, default the first 1920×1080 /
    * 1080×1920 / 1080×1080 format): a zip with `project.fcpxml` + per-scene MP4 segments + audio, for Final Cut Pro,
    * DaVinci Resolve or Premiere. Resolves to the queued export; poll it with `exports.wait(e.id)`. Only newly
    * rendered seconds are billed (final render price). 400 `unsupported_kind` / `unsupported_format` / `too_long`.
    */
-  exportFcpxml(id: string, query?: ExportFcpxmlQuery, opts?: CallOpts$27): Promise<StudioExport>;
+  exportFcpxml(id: string, query?: ExportFcpxmlQuery, opts?: CallOpts$28): Promise<StudioExport>;
   /**
    * Export a video creative as a Lottie animation (`seq`, default the head; `format`, default the document's default
    * format, or `formats: 'all'`; `container: 'json'` (default, Bodymovin JSON with embedded images) or `'dotlottie'`).
@@ -34874,33 +36258,33 @@ export declare class Creatives {
    * fidelity report in `warnings` (video, chart, HTML block, table, cell grid and audio nodes are not exported).
    * 400 `unsupported_kind` / `invalid_request`, 413 `too_large` (over 20 MB).
    */
-  exportLottie(id: string, query?: ExportLottieQuery, opts?: CallOpts$27): Promise<StudioExport>;
+  exportLottie(id: string, query?: ExportLottieQuery, opts?: CallOpts$28): Promise<StudioExport>;
   /**
    * The Lottie file itself (`download=1`, nothing stored): `application/json` for one Bodymovin JSON, `application/zip`
    * for a dotLottie archive or a zip of JSON files (`formats: 'all'`). Same options and errors as `exportLottie`. Free.
    */
-  downloadLottie(id: string, query?: ExportLottieQuery, opts?: CallOpts$27): Promise<LottieDownload>;
+  downloadLottie(id: string, query?: ExportLottieQuery, opts?: CallOpts$28): Promise<LottieDownload>;
   /**
    * Turn one of your Studio documents (deck, doc, sheet) into an editable creative — slides become scenes with a
    * `layout` and speaker `notes`, doc pages a `flow` group, sheets a `cell_grid`; nodes carry semantic `role`s.
    * Idempotent: a document that already has a creative resolves to it (`existing: true`). Free. 404 unknown document,
    * 409 `document_spec_missing`, 400 `invalid_spec`, 413 `too_large`.
    */
-  fromDocument(documentId: string, opts?: CallOpts$27): Promise<StudioCreativeFromDocument>;
+  fromDocument(documentId: string, opts?: CallOpts$28): Promise<StudioCreativeFromDocument>;
   /**
    * Build a deck / doc / sheet creative (at `seq`, default the head) into a PPTX / DOCX / XLSX — a new version of its
    * Studio document (`document`, exactly the `POST /v1/studio/documents` body). Converter notes come back in
    * `warnings`. The file is free; `preview: true` also queues a billed preview (poll it with
    * `documents.waitForPreview`). 400 `not_supported_for_kind` (video / image) or `invalid_spec`.
    */
-  build(id: string, body?: CreativeBuildRequest, opts?: CallOpts$27): Promise<StudioCreativeBuild>;
+  build(id: string, body?: CreativeBuildRequest, opts?: CallOpts$28): Promise<StudioCreativeBuild>;
   /**
    * Re-apply a brand kit (`brand_kit_id`) or a flat token map (`tokens`) to the creative as one new version: literal
    * colours equal to the old brand become token refs, `snap: true` maps every other colour to the nearest kit colour,
    * `fonts` (default true) sets heading / body font refs by role, locked nodes are skipped unless `force`. The kit
    * logo is registered too. `base_seq` defaults to the head (rebased like `edit`, 409 `stale` else). Free.
    */
-  restyle(id: string, body: CreativeRestyleRequest, opts?: CallOpts$27): Promise<CreativeRestyleResult>;
+  restyle(id: string, body: CreativeRestyleRequest, opts?: CallOpts$28): Promise<CreativeRestyleResult>;
   /**
    * Auto-captions: transcribe a voice clip (`clip_id`, default the first voice clip) word by word and add or update a
    * captions node (`preset`, default `bold-pill`) as one new version. Words are cached on the asset (free next time
@@ -34908,83 +36292,83 @@ export declare class Creatives {
    * transcription is billed at the speech-to-text rate (`cost_micro_usd`). Video creatives only (400
    * `unsupported_kind`); 403 `residency_unavailable`, 503 `transcription_unavailable`.
    */
-  captions(id: string, body?: CreativeCaptionsRequest, opts?: CallOpts$27): Promise<CreativeCaptionsResult>;
+  captions(id: string, body?: CreativeCaptionsRequest, opts?: CallOpts$28): Promise<CreativeCaptionsResult>;
   /** The captions as SubRip text on the document timeline (`node_id`, `seq` optional); 404 without captions. Free. */
-  captionsSrt(id: string, query?: CreativeCaptionsQuery, opts?: CallOpts$27): Promise<string>;
+  captionsSrt(id: string, query?: CreativeCaptionsQuery, opts?: CallOpts$28): Promise<string>;
   /** The captions as WebVTT text on the document timeline (`node_id`, `seq` optional); 404 without captions. Free. */
-  captionsVtt(id: string, query?: CreativeCaptionsQuery, opts?: CallOpts$27): Promise<string>;
+  captionsVtt(id: string, query?: CreativeCaptionsQuery, opts?: CallOpts$28): Promise<string>;
   /**
    * Adapt to platforms (`tiktok`, `reels`, `shorts`, `feed-square`, `feed-portrait`, `youtube`): one format per
    * platform in one new version, text kept inside each platform's safe zone and above its legible size.
    * `focal: 'vision'` (token-metered) finds the focal point of full-bleed images; it fails open. Free otherwise.
    */
-  adapt(id: string, body: CreativeAdaptRequest, opts?: CallOpts$27): Promise<CreativeAdaptResult>;
+  adapt(id: string, body: CreativeAdaptRequest, opts?: CallOpts$28): Promise<CreativeAdaptResult>;
   /**
    * Fix lint issues as one new version: deterministic fixes (free) for `off_brand_color`, `text_too_small`,
    * `outside_platform_safe_zone` and `flashing` (`codes` limits them); `agent: true` (token-metered) gives the rest
    * to one `codai` turn. Nothing to fix: the current `seq`, empty `fixed`, no new version.
    */
-  lintFix(id: string, body?: CreativeLintFixRequest, opts?: CallOpts$27): Promise<CreativeLintFixResult>;
+  lintFix(id: string, body?: CreativeLintFixRequest, opts?: CallOpts$28): Promise<CreativeLintFixResult>;
   /**
    * The tweak panel model: one control per variable (stored `meta.controls` entry or derived from the type). Change
    * values with a `setVar` op and controls with a `setControl` op (`edit`). Free.
    */
-  controls(id: string, opts?: CallOpts$27): Promise<CreativeControls>;
+  controls(id: string, opts?: CallOpts$28): Promise<CreativeControls>;
   /**
    * Localisation state: source locale, glossary, unit count and per locale translated / missing / stale / voice.
    * With `locale` (+ `units`, default 1) also the units of that locale (paged with `offset` / `limit` ≤ 500). Free.
    */
-  locales(id: string, query?: CreativeLocalesQuery, opts?: CallOpts$27): Promise<CreativeLocaleStatus>;
+  locales(id: string, query?: CreativeLocalesQuery, opts?: CallOpts$28): Promise<CreativeLocaleStatus>;
   /**
    * Translate every text into up to 10 BCP-47 `locales` as per-locale overrides (one new version, author `agent`).
    * Token-metered `codai` turns; `glossary` terms and the brand kit name stay verbatim, `tone` picks the address,
    * `only_missing` (default true) skips fresh translations, `voice: true` (video, billed) narrates voice clips again.
    * 400 `nothing_to_translate`; 503 `localize_unavailable` when every locale failed.
    */
-  localize(id: string, body: CreativeLocalizeRequest, opts?: CallOpts$27): Promise<CreativeLocalizeResult>;
+  localize(id: string, body: CreativeLocalizeRequest, opts?: CallOpts$28): Promise<CreativeLocalizeResult>;
   /**
    * Save `locale` as a new standalone creative (translations applied, overrides dropped, `fork_of` recorded; default
    * title `<title> (<locale>)`). 404 `Locale not found.`. Free (HTTP 201).
    */
-  forkLocale(id: string, locale: string, body?: CreativeLocaleForkRequest, opts?: CallOpts$27): Promise<CreativeLocaleForkResult>;
+  forkLocale(id: string, locale: string, body?: CreativeLocaleForkRequest, opts?: CallOpts$28): Promise<CreativeLocaleForkResult>;
   /**
    * Create a public link: `view` (read-only preview of version `seq` or the head; `allow_remix` default false) or
    * `review` (comments by name, no account; `can_approve` lets the holder approve). The `token` and `url` are shown
    * only in this answer (HTTP 201). 400 `unknown_seq`; 409 `too_many_shares` (20 active links). Free.
    */
-  createShare(id: string, body: StudioShareCreateRequest, opts?: CallOpts$27): Promise<StudioShareCreated>;
+  createShare(id: string, body: StudioShareCreateRequest, opts?: CallOpts$28): Promise<StudioShareCreated>;
   /** The active links (not revoked, not expired), newest first; `url` is always null. Free. */
-  listShares(id: string, opts?: CallOpts$27): Promise<StudioShareList>;
+  listShares(id: string, opts?: CallOpts$28): Promise<StudioShareList>;
   /** Revoke a link: it answers 404 from now on. 404 when unknown or already revoked. Free. */
-  revokeShare(id: string, shareId: string, opts?: CallOpts$27): Promise<void>;
+  revokeShare(id: string, shareId: string, opts?: CallOpts$28): Promise<void>;
   /**
    * The review state: `status` (`draft` → `in_review` → `approved` | `changes_requested`), requested / approved
    * version (`approved_is_head` false once the creative changed), decider and thread counts. Free.
    */
-  review(id: string, opts?: CallOpts$27): Promise<StudioReview>;
+  review(id: string, opts?: CallOpts$28): Promise<StudioReview>;
   /** Send the head to review (`in_review`, earlier decision cleared) so approver links can decide. Free. */
-  requestReview(id: string, opts?: CallOpts$27): Promise<StudioReview>;
+  requestReview(id: string, opts?: CallOpts$28): Promise<StudioReview>;
   /** Back to `draft` (decision cleared, comments kept). Free. */
-  resetReview(id: string, opts?: CallOpts$27): Promise<StudioReview>;
+  resetReview(id: string, opts?: CallOpts$28): Promise<StudioReview>;
   /** Comment threads, newest first (≤ 200), replies oldest first; `status` `open` | `resolved` | `all`. Free. */
-  reviewThreads(id: string, query?: StudioReviewThreadsQuery, opts?: CallOpts$27): Promise<StudioReviewThreadList>;
+  reviewThreads(id: string, query?: StudioReviewThreadsQuery, opts?: CallOpts$28): Promise<StudioReviewThreadList>;
   /**
    * Start a thread as the owner, optionally anchored to `node_id` / `scene_id` / `t_ms` (checked against the head:
    * 400 `unknown_node` / `unknown_scene`; HTTP 201). 409 `too_many_comments`. Free.
    */
-  createReviewThread(id: string, body: StudioReviewThreadCreateRequest, opts?: CallOpts$27): Promise<StudioReviewThread>;
+  createReviewThread(id: string, body: StudioReviewThreadCreateRequest, opts?: CallOpts$28): Promise<StudioReviewThread>;
   /** Reply in a thread as the owner (HTTP 201) — returns the whole thread. Free. */
   replyReviewThread(id: string, threadId: string, body: {
     body: string;
-  }, opts?: CallOpts$27): Promise<StudioReviewThread>;
+  }, opts?: CallOpts$28): Promise<StudioReviewThread>;
   /** Resolve a thread. Free. */
-  resolveReviewThread(id: string, threadId: string, opts?: CallOpts$27): Promise<StudioReviewThread>;
+  resolveReviewThread(id: string, threadId: string, opts?: CallOpts$28): Promise<StudioReviewThread>;
   /** Reopen a resolved thread. Free. */
-  reopenReviewThread(id: string, threadId: string, opts?: CallOpts$27): Promise<StudioReviewThread>;
+  reopenReviewThread(id: string, threadId: string, opts?: CallOpts$28): Promise<StudioReviewThread>;
   /** Delete any comment (owner moderation; deleting a root hides the thread). 404 when unknown. Free. */
-  deleteReviewComment(id: string, commentId: string, opts?: CallOpts$27): Promise<void>;
+  deleteReviewComment(id: string, commentId: string, opts?: CallOpts$28): Promise<void>;
   /** Poll a frame job: frames when done (`status: 'succeeded'`), `status: 'running'` meanwhile; 404 unknown job. */
-  frameJob(id: string, jobId: string, opts?: CallOpts$27): Promise<CreativeFrameResult>;
+  frameJob(id: string, jobId: string, opts?: CallOpts$28): Promise<CreativeFrameResult>;
 }
 //#endregion
 //#region src/resources/brand-kits.d.ts
@@ -35000,7 +36384,7 @@ export type BrandKitCreateRequest = Mutable<Body<'createBrandKit'>>;
 export type BrandKitUpdateRequest = Mutable<Body<'updateBrandKit'>>;
 export type BrandKitList = Reply<'listBrandKits'>;
 export type BrandKitDeleted = Reply<'deleteBrandKit'>;
-type CallOpts$26 = {
+type CallOpts$27 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -35012,29 +36396,29 @@ export declare class BrandKits {
    * (import) — exactly one. 400 `invalid_tokens` (with `details.issues`) for an invalid DTCG document, 404 when
    * `logo_asset_id` is not one of your ready image assets. Free.
    */
-  create(body: BrandKitCreateRequest, opts?: CallOpts$26): Promise<BrandKit>;
+  create(body: BrandKitCreateRequest, opts?: CallOpts$27): Promise<BrandKit>;
   /**
    * Edit a kit: `tokens` is merged onto the current kit, `dtcg` replaces the whole document (not both),
    * `logo_asset_id: null` removes the logo. Creatives keep their tokens until `creatives.restyle`. Free.
    */
-  update(id: string, body: BrandKitUpdateRequest, opts?: CallOpts$26): Promise<BrandKit>;
+  update(id: string, body: BrandKitUpdateRequest, opts?: CallOpts$27): Promise<BrandKit>;
   /** The kit as a DTCG 2025.10 JSON document (`$extensions['ro.codai']` = kit id, name, logo asset id). Free. */
-  exportDtcg(id: string, opts?: CallOpts$26): Promise<BrandKitDtcg>;
+  exportDtcg(id: string, opts?: CallOpts$27): Promise<BrandKitDtcg>;
   /**
    * Extract a brand kit from a public `https` page (`{ url }`) or from one of your logo images
    * (`{ logo_asset_id }`, PNG / JPEG / WebP up to 5 MB; it becomes the kit logo): palette (primary, secondary, accent,
    * background, text) and heading / body fonts. One bounded `codai` model call (token-metered); 400 `url_blocked` for
    * private hosts, 400 `unsupported_media` for a bad logo, 422 `fetch_failed` / `extract_failed`, 504 `timeout`.
    */
-  extract(body: BrandKitExtractRequest, opts?: CallOpts$26): Promise<BrandKit>;
+  extract(body: BrandKitExtractRequest, opts?: CallOpts$27): Promise<BrandKit>;
   /** Your brand kits, newest first (`limit` 1–100, default 50). Free. */
   list(query?: {
     limit?: number;
-  }, opts?: CallOpts$26): Promise<BrandKitList>;
+  }, opts?: CallOpts$27): Promise<BrandKitList>;
   /** One kit with a signed logo URL (1 h), its `dtcg` and the WCAG `contrast` pairs. Free. */
-  retrieve(id: string, opts?: CallOpts$26): Promise<BrandKit>;
+  retrieve(id: string, opts?: CallOpts$27): Promise<BrandKit>;
   /** Delete a kit (creatives keep their tokens; the logo asset stays). Free. */
-  delete(id: string, opts?: CallOpts$26): Promise<BrandKitDeleted>;
+  delete(id: string, opts?: CallOpts$27): Promise<BrandKitDeleted>;
 }
 //#endregion
 //#region src/resources/templates.d.ts
@@ -35042,7 +36426,7 @@ export type CreativeTemplateVar = Schema<'CreativeTemplateVar'>;
 export type CreativeTemplateList = Reply<'listCreativeTemplates'>;
 export type CreativeTemplateListQuery = QueryOf<'listCreativeTemplates'>;
 export type CreativeTemplateDeleted = Reply<'deleteCreativeTemplate'>;
-type CallOpts$25 = {
+type CallOpts$26 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
@@ -35055,25 +36439,25 @@ export declare class Templates {
    * (default). `kind` filters both. Without `doc`. Free. A starter id works anywhere a template id does
    * (`retrieve`, `creatives.create({ template })`, batches); starters cannot be deleted.
    */
-  list(query?: CreativeTemplateListQuery, opts?: CallOpts$25): Promise<CreativeTemplateList>;
+  list(query?: CreativeTemplateListQuery, opts?: CallOpts$26): Promise<CreativeTemplateList>;
   /** One template with its variables and `doc`. Free. */
-  retrieve(id: string, opts?: CallOpts$25): Promise<Schema<'CreativeTemplate'>>;
+  retrieve(id: string, opts?: CallOpts$26): Promise<Schema<'CreativeTemplate'>>;
   /** Delete a template (creatives made from it are not affected). Free. */
-  delete(id: string, opts?: CallOpts$25): Promise<CreativeTemplateDeleted>;
+  delete(id: string, opts?: CallOpts$26): Promise<CreativeTemplateDeleted>;
 }
 //#endregion
 //#region src/resources/productions.d.ts
 export type StudioProductionCreate = Mutable<Body<'createStudioProduction'>>;
 export type StudioProduction = Schema<'StudioProduction'>;
-type CallOpts$24 = {
+type CallOpts$25 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
 };
-export interface ProductionCreateOptions extends CallOpts$24 {
+export interface ProductionCreateOptions extends CallOpts$25 {
   /** `Idempotency-Key`: a retry with the same key replays the first production instead of starting another one. */
   idempotencyKey?: string;
 }
-export interface ProductionWaitOptions extends CallOpts$24 {
+export interface ProductionWaitOptions extends CallOpts$25 {
   /** Delay between polls (default 5000 ms). */
   intervalMs?: number;
   /** Give up after this long (default 600 000 ms = 10 min). */
@@ -35086,7 +36470,7 @@ export declare class Productions {
   /** `POST /v1/studio/productions` — brief → storyboard → assets → creative → queued draft render (202). */
   create(body: StudioProductionCreate, opts?: ProductionCreateOptions): Promise<StudioProduction>;
   /** `GET /v1/studio/productions/{id}` — advances the production and returns it (another account's id is a 404). */
-  retrieve(id: string, opts?: CallOpts$24): Promise<StudioProduction>;
+  retrieve(id: string, opts?: CallOpts$25): Promise<StudioProduction>;
   /**
    * Poll `retrieve` every `intervalMs` (default 5 s) until the production `succeeded` or `failed` (a failed one
    * resolves too — check `status` / `error`). Throws after `timeoutMs` (default 10 min) or when `signal` aborts.
@@ -35096,6 +36480,344 @@ export declare class Productions {
   run(body: StudioProductionCreate, opts?: ProductionCreateOptions & ProductionWaitOptions): Promise<StudioProduction>;
 }
 //#endregion
+//#region src/resources/media-ops.d.ts
+export type MediaOpId = Schema<'MediaOpId'>;
+export type MediaOp = Schema<'MediaOp'>;
+export type MediaOpList = Reply<'listStudioMediaOps'>;
+export type MediaOpRequest = Mutable<Schema<'MediaOpRequest'>>;
+export type MediaOpQuote = Schema<'MediaOpQuote'>;
+export type MediaOpResult = Schema<'MediaOpResult'>;
+export type MediaOpJob = Schema<'MediaOpJob'>;
+type CallOpts$24 = {
+  ext?: CodaiRequestExtensions;
+  signal?: AbortSignal;
+};
+export interface MediaOpInput {
+  /** Owned, ready Studio asset ids in the order the op expects (mask second for inpaint / erase). */
+  assetIds?: string[];
+  /** Per-op parameters (validated strictly by the gateway; see the docs table). */
+  params?: Record<string, unknown>;
+}
+export interface MediaOpRunOptions extends CallOpts$24 {
+  /** `Idempotency-Key`: a retry with the same key replays the first answer instead of running (and billing) again. */
+  idempotencyKey?: string;
+}
+export interface MediaOpWaitOptions extends CallOpts$24 {
+  /** Delay between polls (default 3000 ms). */
+  intervalMs?: number;
+  /** Give up after this long (default 1 200 000 ms = 20 min, the server-side job timeout). */
+  timeoutMs?: number;
+}
+/** A run answer is a job (async op, HTTP 202) when `object` is `media_op.job`. */
+export declare const isMediaOpJob: (r: MediaOpResult | MediaOpJob) => r is MediaOpJob;
+export declare const isMediaOpJobFinished: (j: Pick<MediaOpJob, "status">) => boolean;
+export declare class MediaOps {
+  private readonly http;
+  constructor(http: HttpClient);
+  /** `GET /v1/studio/media-ops` — every op with engine, mode, inputs, `available` and a list quote (free). */
+  list(opts?: CallOpts$24): Promise<MediaOpList>;
+  /** `POST /v1/studio/media-ops/{op}/quote` — exact price of this request; nothing is held or billed. */
+  quote(op: MediaOpId | string, input?: MediaOpInput, opts?: CallOpts$24): Promise<MediaOpQuote>;
+  /**
+   * `POST /v1/studio/media-ops/{op}` — sync ops resolve to a `media_op.result` with the outputs, async ops to a
+   * `media_op.job` (`status: pending`; poll with `job` / `wait`). Use `isMediaOpJob` to tell them apart.
+   */
+  run(op: MediaOpId | string, input?: MediaOpInput, opts?: MediaOpRunOptions): Promise<MediaOpResult | MediaOpJob>;
+  /** `GET /v1/studio/media-ops/jobs/{id}` — the job; reading a finished one stores its outputs and bills it once. */
+  job(id: string, opts?: CallOpts$24): Promise<MediaOpJob>;
+  /**
+   * Poll `job` every `intervalMs` (default 3 s) until it is `ready` or `failed` (a failed job resolves too — check
+   * `status` / `error`). Throws after `timeoutMs` (default 20 min) or when `signal` aborts.
+   */
+  wait(id: string, opts?: MediaOpWaitOptions): Promise<MediaOpJob>;
+  /** `run`, then `wait` when the op is async. */
+  runAndWait(op: MediaOpId | string, input?: MediaOpInput, opts?: MediaOpRunOptions & MediaOpWaitOptions): Promise<MediaOpResult | MediaOpJob>;
+}
+//#endregion
+//#region src/resources/lyrics.d.ts
+export type LyricsRequest = Mutable<Schema<'StudioLyricsRequest'>>;
+export type LyricsSectionKind = Schema<'StudioLyricsSectionKind'>;
+export type LyricsLine = Schema<'StudioLyricsLine'>;
+export type Lyrics = Schema<'StudioLyrics'>;
+export type LyricsAlignRequest = Mutable<Schema<'StudioLyricsAlignRequest'>>;
+export type LyricsAlignment = Schema<'StudioLyricsAlignment'>;
+export interface LyricsCallOptions {
+  ext?: CodaiRequestExtensions;
+  signal?: AbortSignal;
+  /** `Idempotency-Key`: a retry with the same key replays the first answer instead of running (and billing) again. */
+  idempotencyKey?: string;
+}
+export declare class LyricsResource {
+  private readonly http;
+  constructor(http: HttpClient);
+  private post;
+  /**
+   * `POST /v1/studio/lyrics` — `{ brief, language: 'ro' | 'en', genre?, mood?, structure?, syllables_per_line?,
+   * rhyme_scheme?, lines_per_section?, title? }` → `studio.lyrics` with every line's syllables and rhyme letter, the
+   * whole song as `text` (`[kind]` headers) and a `report`. `repaired: true` when the repair turn won.
+   */
+  write(body: LyricsRequest, opts?: LyricsCallOptions): Promise<Lyrics>;
+  /**
+   * `POST /v1/studio/lyrics/align` — `{ creative_id, clip_id, lyrics_text, language?, apply?, base_seq?,
+   * retranscribe? }` → `studio.lyrics_alignment`: timed `lines`, `lrc`, `match_ratio`, `cached`, and `seq` /
+   * `doc_hash` of the new version when applied.
+   */
+  align(body: LyricsAlignRequest, opts?: LyricsCallOptions): Promise<LyricsAlignment>;
+}
+//#endregion
+//#region src/resources/realtime.d.ts
+/**
+ * `wss://…/v1/realtime` — dependency-free realtime client (live transcription and the OpenAI
+ * Realtime protocol lanes). Not an OpenAPI operation (OpenAPI cannot describe WebSockets), so it is
+ * outside the `OPERATION_METHODS` parity table.
+ *
+ *   const live = codai.realtime.connect({ model: 'codai-transcribe-live', language: 'ro', token });
+ *   live.appendAudio(pcm16At24kHz);          // Int16Array | ArrayBuffer | Uint8Array
+ *   for await (const ev of live) {
+ *     if (ev.type === 'conversation.item.input_audio_transcription.delta') draw(ev.delta);
+ *   }
+ *
+ * Uses the global `WebSocket` (browsers, Node ≥ 22, Deno, Bun) or an injected constructor.
+ *  - Browser path: pass an ephemeral `token` (scope `realtime` or `live`); it travels as `?key=`.
+ *    Raw `codai_` keys in the query string are refused by the gateway (close 4401).
+ *  - Server path: pass `apiKey` (or a token) with a WebSocket constructor that accepts headers
+ *    (e.g. `ws`); it is sent as `Authorization: Bearer` on the upgrade.
+ */
+/** Minimal WebSocket surface (browser `WebSocket`, Node 22 global, or the `ws` package). */
+export interface RealtimeSocket {
+  readonly readyState: number;
+  binaryType?: string;
+  send(data: string | ArrayBuffer | ArrayBufferView): void;
+  close(code?: number, reason?: string): void;
+  onopen: ((ev: unknown) => void) | null;
+  onmessage: ((ev: {
+    data: unknown;
+  }) => void) | null;
+  onclose: ((ev: {
+    code: number;
+    reason: string;
+  }) => void) | null;
+  onerror: ((ev: unknown) => void) | null;
+}
+/** `new (url, protocols?, options?)` — the third argument is used for headers by `ws`. */
+export type RealtimeSocketCtor = new (url: string, protocols?: string | string[], options?: {
+  headers?: Record<string, string>;
+}) => RealtimeSocket;
+export type RealtimeModel = 'codai-transcribe-live' | 'codai-realtime' | 'codai-voice' | (string & Record<never, never>);
+export interface RealtimeConnectOptions {
+  /** Default `codai-transcribe-live`. */
+  model?: RealtimeModel;
+  /** Language hint (`ro`, `en`, …). `ro` uses the Deepgram Nova-3 lane when the gateway has it. */
+  language?: string;
+  /** Ephemeral token (scope `realtime` or `live`) — sent as `?key=`. Required in browsers. */
+  token?: string;
+  /** Raw API key — sent as `Authorization: Bearer` (needs a ctor that supports headers). */
+  apiKey?: string;
+  /** Conversation id recorded on the usage row (`?session_id=`). */
+  sessionId?: string;
+  /**
+   * First frame sent on open. Default for `codai-transcribe-live`: a transcription
+   * `session.update` (PCM 24 kHz, `language` when set). Pass `null` to send nothing.
+   */
+  sessionUpdate?: Record<string, unknown> | null;
+  /** Injectable WebSocket constructor (tests, `ws` on older Node). Defaults to `globalThis.WebSocket`. */
+  WebSocket?: RealtimeSocketCtor;
+  /** Override the gateway base URL (default: the client's `baseUrl`). */
+  baseUrl?: string;
+}
+/** Typed subset of server events; anything else arrives as `RealtimeUnknownEvent`. */
+export type RealtimeEvent = {
+  type: 'session.created' | 'session.updated';
+  session?: Record<string, unknown>;
+  event_id?: string;
+} | {
+  type: 'conversation.item.input_audio_transcription.delta';
+  item_id: string;
+  content_index?: number;
+  delta: string;
+  event_id?: string;
+} | {
+  type: 'conversation.item.input_audio_transcription.completed';
+  item_id: string;
+  content_index?: number;
+  transcript: string;
+  event_id?: string;
+} | {
+  type: 'input_audio_buffer.committed';
+  item_id?: string;
+  previous_item_id?: string | null;
+} | {
+  type: 'input_audio_buffer.cleared';
+} | {
+  type: 'error';
+  error: {
+    type?: string;
+    code?: string;
+    message?: string;
+  };
+} |
+/** Emitted by the client itself when the socket closes (always the last event). */
+{
+  type: 'close';
+  code: number;
+  reason: string;
+};
+export type RealtimeUnknownEvent = {
+  type: string;
+  [k: string]: unknown;
+};
+export type RealtimeAnyEvent = RealtimeEvent | RealtimeUnknownEvent;
+type Listener$1 = (ev: RealtimeAnyEvent) => void;
+/** A live realtime session: async-iterable of events + `on()` listeners. */
+export declare class RealtimeSession implements AsyncIterable<RealtimeAnyEvent> {
+  readonly socket: RealtimeSocket;
+  private readonly listeners;
+  private readonly queue;
+  private readonly waiters;
+  private readonly outbox;
+  private closed;
+  /** Resolves when the socket is open (rejects if it closes first). */
+  readonly ready: Promise<void>;
+  constructor(socket: RealtimeSocket, firstFrame: Record<string, unknown> | null);
+  /** Listen for one event type (`'*'` = every event). Returns an unsubscribe function. */
+  on(type: string, fn: Listener$1): () => void;
+  /** Send any client event (JSON). Queued until the socket opens. */
+  send(event: Record<string, unknown>): void;
+  /** Append PCM16 little-endian mono audio (24 kHz for `codai-transcribe-live`). */
+  appendAudio(audio: Int16Array | ArrayBuffer | Uint8Array): void;
+  /** Close the current utterance: the server answers with one `...transcription.completed`. */
+  commit(): void;
+  /** Drop audio the server holds for the current utterance. */
+  clear(): void;
+  close(code?: number, reason?: string): void;
+  [Symbol.asyncIterator](): AsyncIterator<RealtimeAnyEvent>;
+  private emit;
+}
+/** Build the `wss://…/v1/realtime?…` URL (exported for tests and custom transports). */
+export declare function realtimeUrl(baseUrl: string, opts: RealtimeConnectOptions): string;
+export declare class Realtime {
+  private readonly defaults;
+  constructor(defaults: {
+    baseUrl: string;
+    apiKey?: string;
+  });
+  /** Open a realtime session. Returns immediately; `await session.ready` to wait for the socket. */
+  connect(opts?: RealtimeConnectOptions): RealtimeSession;
+}
+//#endregion
+//#region src/resources/jam.d.ts
+export declare const JAM_SUBPROTOCOL = "codai-jam";
+/** WebSocket close codes of `/v1/studio/jam`. */
+export declare const JAM_CLOSE_CODES: {
+  readonly invalidMessage: 4400;
+  readonly unauthorized: 4401;
+  readonly insufficientFunds: 4402;
+  readonly forbidden: 4403;
+  readonly maxDuration: 4408;
+  readonly busy: 4409;
+  readonly upstream: 4502;
+  readonly unavailable: 4503;
+};
+export declare const JAM_SCALES: readonly ["SCALE_UNSPECIFIED", "C_MAJOR_A_MINOR", "D_FLAT_MAJOR_B_FLAT_MINOR", "D_MAJOR_B_MINOR", "E_FLAT_MAJOR_C_MINOR", "E_MAJOR_D_FLAT_MINOR", "F_MAJOR_D_MINOR", "G_FLAT_MAJOR_E_FLAT_MINOR", "G_MAJOR_E_MINOR", "A_FLAT_MAJOR_F_MINOR", "A_MAJOR_G_FLAT_MINOR", "B_FLAT_MAJOR_G_MINOR", "B_MAJOR_A_FLAT_MINOR"];
+export type JamScale = (typeof JAM_SCALES)[number];
+/** A weighted prompt: 1..8 per message, `weight` in [-10, 10] and not 0. */
+export interface JamPrompt {
+  text: string;
+  weight: number;
+}
+/** Partial config; the server merges it into the last full config. bpm / scale changes reset the context. */
+export interface JamConfig {
+  bpm?: number;
+  density?: number;
+  brightness?: number;
+  scale?: JamScale;
+}
+export type JamClientMessage = {
+  type: 'prompts';
+  prompts: JamPrompt[];
+} | ({
+  type: 'config';
+} & JamConfig) | {
+  type: 'play' | 'pause' | 'stop' | 'reset';
+};
+export type JamState = 'connecting' | 'ready' | 'playing' | 'paused' | 'stopped' | (string & Record<never, never>);
+export type JamEvent = {
+  type: 'status';
+  state: JamState;
+  remaining_ms: number;
+  sample_rate?: number;
+  channels?: number;
+} | {
+  type: 'filtered';
+  text: string;
+  reason: string;
+} | {
+  type: 'error';
+  code: string;
+  message: string;
+} |
+/** Emitted by the client for every binary frame. */
+{
+  type: 'audio';
+  data: ArrayBuffer;
+} |
+/** Emitted by the client itself when the socket closes (always the last event). */
+{
+  type: 'close';
+  code: number;
+  reason: string;
+};
+export interface JamConnectOptions {
+  /** Ephemeral token (scope `realtime` or `live`) — sent as the `bearer.<token>` subprotocol. Required in browsers. */
+  token?: string;
+  /** API key — sent as `Authorization: Bearer` (needs a ctor that supports headers). */
+  apiKey?: string;
+  /** Conversation id recorded on the usage row (`?session_id=`). */
+  sessionId?: string;
+  /** Injectable WebSocket constructor (tests, `ws` on older Node). Defaults to `globalThis.WebSocket`. */
+  WebSocket?: RealtimeSocketCtor;
+  /** Override the gateway base URL (default: the client's `baseUrl`). */
+  baseUrl?: string;
+}
+type Listener<T extends JamEvent['type']> = (ev: Extract<JamEvent, {
+  type: T;
+}>) => void;
+type AnyListener = (ev: JamEvent) => void;
+/** A live jam session: `on()` listeners for status / audio / errors and typed senders. */
+export declare class JamSession {
+  readonly socket: RealtimeSocket;
+  private readonly listeners;
+  private readonly outbox;
+  private closed;
+  /** Resolves when the socket is open (rejects if it closes first). */
+  readonly ready: Promise<void>;
+  constructor(socket: RealtimeSocket);
+  /** Listen for one event type (`'*'` = every event). Returns an unsubscribe function. */
+  on<T extends JamEvent['type']>(type: T, fn: Listener<T>): () => void;
+  on(type: '*', fn: AnyListener): () => void;
+  /** Send one client message (JSON). Queued until the socket opens. */
+  send(msg: JamClientMessage): void;
+  prompts(prompts: JamPrompt[]): void;
+  config(config: JamConfig): void;
+  play(): void;
+  pause(): void;
+  stop(): void;
+  reset(): void;
+  close(code?: number, reason?: string): void;
+  private emit;
+}
+/** Build the `wss://…/v1/studio/jam` URL (exported for tests and custom transports). */
+export declare function jamUrl(baseUrl: string, opts?: Pick<JamConnectOptions, 'sessionId'>): string;
+export declare class Jam {
+  private readonly defaults;
+  constructor(defaults: {
+    baseUrl: string;
+    apiKey?: string;
+  });
+  /** Open a live jam. Returns immediately; `await session.ready` to wait for the socket. */
+  connect(opts?: JamConnectOptions): JamSession;
+}
+//#endregion
 //#region src/resources/batches.d.ts
 export type StudioBatchStatus = Schema<'StudioBatchStatus'>;
 export type StudioBatchRowStatus = Schema<'StudioBatchRowStatus'>;
@@ -35246,6 +36968,20 @@ export type VaultUseRequest = Mutable<Body<'vaultUse'>>;
 export type VaultHttpRequest = Mutable<Body<'vaultHttp'>>;
 export type VaultResolveRequest = Mutable<Body<'vaultResolve'>>;
 export type VaultTier = VaultAccount['default_tier'];
+/** Anomaly guards (V-32): new host, burst, allowed hours. An anomaly forces t4. */
+export type VaultGuards = Schema<'VaultGuards'>;
+export type VaultSettingsPatch = Mutable<Body<'patchVaultSettings'>>;
+export type VaultSettings = Reply<'patchVaultSettings'>;
+export type VaultLockResult = Schema<'VaultLockResult'>;
+export type VaultUnlockChallenge = Schema<'VaultUnlockChallenge'>;
+export type VaultUnlockRequest = Mutable<Body<'unlockVault'>>;
+/** Per-handle limits (V-21); an `http` use costs 2 units, other modes 1. */
+export type VaultItemLimits = Schema<'VaultItemLimits'>;
+export type VaultItemLimitsInput = Mutable<Body<'setVaultItemLimits'>>;
+/** Where a lock/unlock was triggered from. */
+export type VaultVia = 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
+/** The UTF-8 message an unlock proof covers: `codai-vault/unlock/v1|<challenge>|<device_id or "passkey">`. */
+export declare function vaultUnlockMessage(challenge: string, deviceIdOrPasskey: string): string;
 /** Loose JSON object answers (lists, acks) as documented in the OpenAPI spec. */
 export type VaultObject = Record<string, unknown>;
 type CallOpts$21 = {
@@ -35279,6 +37015,32 @@ export declare class Vault {
   putAccount(body: VaultAccountPut, opts?: CallOpts$21): Promise<VaultObject>;
   /** `PATCH /v1/vault/settings` — default approval tier for items without a matching rule. */
   setDefaultTier(defaultTier: VaultTier, opts?: CallOpts$21): Promise<VaultObject>;
+  /**
+   * `PATCH /v1/vault/settings` — `default_tier` and/or partial anomaly `guards` (merged over the current ones).
+   * Answers the effective `{ default_tier, guards }`.
+   */
+  updateSettings(body: VaultSettingsPatch, opts?: CallOpts$21): Promise<VaultSettings>;
+  /**
+   * `POST /v1/vault/lock` — panic: revoke every live grant, deny every pending approval, lock the vault (agent uses
+   * then answer `vault_locked`). Device keys stay enrolled. Idempotent.
+   */
+  lock(params?: {
+    via?: VaultVia;
+  }, opts?: CallOpts$21): Promise<VaultLockResult>;
+  /** `POST /v1/vault/unlock/challenge` — single-use unlock challenge, valid 5 minutes. */
+  unlockChallenge(opts?: CallOpts$21): Promise<VaultUnlockChallenge>;
+  /**
+   * `POST /v1/vault/unlock` — end a lock with a device-key proof over {@link vaultUnlockMessage} or a passkey whose
+   * challenge is base64url(SHA-256(that message with `passkey`)). 403 `challenge_invalid`, `wear_t3_only`, …
+   */
+  unlock(body: VaultUnlockRequest, opts?: CallOpts$21): Promise<Reply<'unlockVault'>>;
+  /** `GET /v1/vault/limits` — per-handle usage caps on your items. */
+  limits(opts?: CallOpts$21): Promise<VaultItemLimits[]>;
+  /**
+   * `PUT /v1/vault/items/{id}/limits` — all three keys required; `null` removes a cap, all `null` removes the limits
+   * (answers `null`). Over a cap the broker calls answer 429 `vault_rate_limited` with `Retry-After`.
+   */
+  setLimits(id: string, limits: VaultItemLimitsInput, opts?: CallOpts$21): Promise<VaultItemLimits | null>;
   /** `GET /v1/vault/vaults` — vaults you belong to, with your role and sealed vault key. */
   vaults(opts?: CallOpts$21): Promise<VaultObject>;
   /** `POST /v1/vault/vaults` — register a vault created client-side (HTTP 201). */
@@ -35301,6 +37063,8 @@ export declare class Vault {
   grants(opts?: CallOpts$21): Promise<VaultObject>;
   /** `DELETE /v1/vault/grants/{id}` — revoke a grant immediately. */
   revokeGrant(id: string, opts?: CallOpts$21): Promise<VaultObject>;
+  /** `POST /v1/vault/grants/revoke-task` — revoke every live grant of a task / session; answers `{ revoked }`. */
+  revokeTaskGrants(task: string, opts?: CallOpts$21): Promise<Reply<'revokeVaultTaskGrants'>>;
   /** `GET /v1/vault/events` — append-only audit log (never contains secret values). */
   events(params?: QueryOf<'listVaultEvents'>, opts?: CallOpts$21): Promise<VaultObject>;
   /** `GET /v1/vault/approvals` — agent requests waiting for your decision. */
@@ -35475,146 +37239,6 @@ export declare class Projects {
   delete(projectId: string, opts?: CallOpts$19): Promise<Reply<'deleteProject'>>;
 }
 //#endregion
-//#region src/resources/realtime.d.ts
-/**
- * `wss://…/v1/realtime` — dependency-free realtime client (live transcription and the OpenAI
- * Realtime protocol lanes). Not an OpenAPI operation (OpenAPI cannot describe WebSockets), so it is
- * outside the `OPERATION_METHODS` parity table.
- *
- *   const live = codai.realtime.connect({ model: 'codai-transcribe-live', language: 'ro', token });
- *   live.appendAudio(pcm16At24kHz);          // Int16Array | ArrayBuffer | Uint8Array
- *   for await (const ev of live) {
- *     if (ev.type === 'conversation.item.input_audio_transcription.delta') draw(ev.delta);
- *   }
- *
- * Uses the global `WebSocket` (browsers, Node ≥ 22, Deno, Bun) or an injected constructor.
- *  - Browser path: pass an ephemeral `token` (scope `realtime` or `live`); it travels as `?key=`.
- *    Raw `codai_` keys in the query string are refused by the gateway (close 4401).
- *  - Server path: pass `apiKey` (or a token) with a WebSocket constructor that accepts headers
- *    (e.g. `ws`); it is sent as `Authorization: Bearer` on the upgrade.
- */
-/** Minimal WebSocket surface (browser `WebSocket`, Node 22 global, or the `ws` package). */
-export interface RealtimeSocket {
-  readonly readyState: number;
-  binaryType?: string;
-  send(data: string | ArrayBuffer | ArrayBufferView): void;
-  close(code?: number, reason?: string): void;
-  onopen: ((ev: unknown) => void) | null;
-  onmessage: ((ev: {
-    data: unknown;
-  }) => void) | null;
-  onclose: ((ev: {
-    code: number;
-    reason: string;
-  }) => void) | null;
-  onerror: ((ev: unknown) => void) | null;
-}
-/** `new (url, protocols?, options?)` — the third argument is used for headers by `ws`. */
-export type RealtimeSocketCtor = new (url: string, protocols?: string | string[], options?: {
-  headers?: Record<string, string>;
-}) => RealtimeSocket;
-export type RealtimeModel = 'codai-transcribe-live' | 'codai-realtime' | 'codai-voice' | (string & Record<never, never>);
-export interface RealtimeConnectOptions {
-  /** Default `codai-transcribe-live`. */
-  model?: RealtimeModel;
-  /** Language hint (`ro`, `en`, …). `ro` uses the Deepgram Nova-3 lane when the gateway has it. */
-  language?: string;
-  /** Ephemeral token (scope `realtime` or `live`) — sent as `?key=`. Required in browsers. */
-  token?: string;
-  /** Raw API key — sent as `Authorization: Bearer` (needs a ctor that supports headers). */
-  apiKey?: string;
-  /** Conversation id recorded on the usage row (`?session_id=`). */
-  sessionId?: string;
-  /**
-   * First frame sent on open. Default for `codai-transcribe-live`: a transcription
-   * `session.update` (PCM 24 kHz, `language` when set). Pass `null` to send nothing.
-   */
-  sessionUpdate?: Record<string, unknown> | null;
-  /** Injectable WebSocket constructor (tests, `ws` on older Node). Defaults to `globalThis.WebSocket`. */
-  WebSocket?: RealtimeSocketCtor;
-  /** Override the gateway base URL (default: the client's `baseUrl`). */
-  baseUrl?: string;
-}
-/** Typed subset of server events; anything else arrives as `RealtimeUnknownEvent`. */
-export type RealtimeEvent = {
-  type: 'session.created' | 'session.updated';
-  session?: Record<string, unknown>;
-  event_id?: string;
-} | {
-  type: 'conversation.item.input_audio_transcription.delta';
-  item_id: string;
-  content_index?: number;
-  delta: string;
-  event_id?: string;
-} | {
-  type: 'conversation.item.input_audio_transcription.completed';
-  item_id: string;
-  content_index?: number;
-  transcript: string;
-  event_id?: string;
-} | {
-  type: 'input_audio_buffer.committed';
-  item_id?: string;
-  previous_item_id?: string | null;
-} | {
-  type: 'input_audio_buffer.cleared';
-} | {
-  type: 'error';
-  error: {
-    type?: string;
-    code?: string;
-    message?: string;
-  };
-} |
-/** Emitted by the client itself when the socket closes (always the last event). */
-{
-  type: 'close';
-  code: number;
-  reason: string;
-};
-export type RealtimeUnknownEvent = {
-  type: string;
-  [k: string]: unknown;
-};
-export type RealtimeAnyEvent = RealtimeEvent | RealtimeUnknownEvent;
-type Listener = (ev: RealtimeAnyEvent) => void;
-/** A live realtime session: async-iterable of events + `on()` listeners. */
-export declare class RealtimeSession implements AsyncIterable<RealtimeAnyEvent> {
-  readonly socket: RealtimeSocket;
-  private readonly listeners;
-  private readonly queue;
-  private readonly waiters;
-  private readonly outbox;
-  private closed;
-  /** Resolves when the socket is open (rejects if it closes first). */
-  readonly ready: Promise<void>;
-  constructor(socket: RealtimeSocket, firstFrame: Record<string, unknown> | null);
-  /** Listen for one event type (`'*'` = every event). Returns an unsubscribe function. */
-  on(type: string, fn: Listener): () => void;
-  /** Send any client event (JSON). Queued until the socket opens. */
-  send(event: Record<string, unknown>): void;
-  /** Append PCM16 little-endian mono audio (24 kHz for `codai-transcribe-live`). */
-  appendAudio(audio: Int16Array | ArrayBuffer | Uint8Array): void;
-  /** Close the current utterance: the server answers with one `...transcription.completed`. */
-  commit(): void;
-  /** Drop audio the server holds for the current utterance. */
-  clear(): void;
-  close(code?: number, reason?: string): void;
-  [Symbol.asyncIterator](): AsyncIterator<RealtimeAnyEvent>;
-  private emit;
-}
-/** Build the `wss://…/v1/realtime?…` URL (exported for tests and custom transports). */
-export declare function realtimeUrl(baseUrl: string, opts: RealtimeConnectOptions): string;
-export declare class Realtime {
-  private readonly defaults;
-  constructor(defaults: {
-    baseUrl: string;
-    apiKey?: string;
-  });
-  /** Open a realtime session. Returns immediately; `await session.ready` to wait for the socket. */
-  connect(opts?: RealtimeConnectOptions): RealtimeSession;
-}
-//#endregion
 //#region src/resources/referrals.d.ts
 export type ReferralsView = Reply<'getReferrals'>;
 export type ReferralRow = Schema<'ReferralRow'>;
@@ -38004,6 +39628,11 @@ export interface AppKeyMintInput {
   maxOutputTokens?: number;
   /** ISO 8601 with offset, in the future. Omit = never expires. */
   expiresAt?: string;
+  /**
+   * The end user confirmed being 18 or older in your app. Stored on the codai user when it is
+   * CREATED by this call (`users.adult_confirmed_at`, version `host:<app slug>`).
+   */
+  adultConfirmed?: boolean;
 }
 export interface AppKeyMinted {
   id: string;
@@ -38146,6 +39775,8 @@ export interface AppSubscriptionSyncInput {
       object?: unknown;
     };
   };
+  /** The end user confirmed being 18 or older (stored when the codai user is created by this sync). */
+  adultConfirmed?: boolean;
 }
 export interface AppKeyValidation {
   ok: boolean;
@@ -38321,6 +39952,12 @@ export declare class Codai {
   readonly templates: Templates;
   /** codai Studio productions (`productions.run({ brief, language: 'ro' })` → a finished promo video + editable creative). */
   readonly productions: Productions;
+  /** codai Studio media operations (`mediaOps.run('audio.separate_stems', { assetIds })` → job; `mediaOps.wait(id)`). */
+  readonly mediaOps: MediaOps;
+  /** codai Studio lyrics (`lyrics.write({ brief, language: 'ro' })`, `lyrics.align({ creative_id, clip_id, lyrics_text })`). */
+  readonly lyrics: LyricsResource;
+  /** codai Studio live jam over WebSocket (`jam.connect({ token })` → PCM16 48 kHz stereo; `prompts`, `config`, `play`). */
+  readonly jam: Jam;
   /** codai Studio FCPXML exports (`creatives.exportFcpxml(id)` queues one; `exports.wait(id)` polls until the zip is ready). */
   readonly exports: Exports;
   /** codai Studio batches (`batches.create({ source: { template_id }, csv })` → one creative per row; `batches.wait(id)`). */