codai-sdk 0.72.0 → 0.74.0

package/dist/index.d.ts

@@ -6099,8 +6099,26 @@ type paths$1 = {
     readonly get?: never;
     readonly put?: never;
     /**
-     * Create a production (brief → video)
-     * @description One brief becomes a finished promo video, server-side: ONE model turn storyboards it on a built-in video starter
+     * Create a production (brief → finished output)
+     * @description One brief becomes a finished output of one of 8 kinds (`kind`, default `video`), server-side. Every kind runs one
+     *     bounded plan turn (`codai::production-storyboard`), generates its images or music under one wallet hold, saves an
+     *     editable creative and builds the output with the regular Studio builders:
+     *
+     *     | kind | plan | output (`outputs[].role` → format) |
+     *     |---|---|---|
+     *     | `video` | storyboard on a starter | MP4 render (`render_id`), vision review + one repair |
+     *     | `image` | headline, subline, image prompt, format (1:1, 4:5 or 9:16) | `image` → PNG |
+     *     | `deck` | title + 4–8 slides | `document` → PPTX (16:9) |
+     *     | `doc` | title + 4–8 sections | `document` → DOCX (A4) |
+     *     | `sheet` | title + columns + 5–20 rows | `document` → XLSX |
+     *     | `carousel` | 4–8 slides (4:5) | `pages` → ZIP of PNGs, `cover` → PNG |
+     *     | `print` | poster or flyer, A4 or A5 | `pdf` → PDF |
+     *     | `audio` | jingle or song, ≤ 60 s (Lyria 3 Clip, not available on EU data-residency keys) | `audio` → MP3 |
+     *
+     *     `starter`, `voice`, `narration` and `aspect_ratio` apply to `video` only (`starter` with another kind is a 400).
+     *     Non-video kinds have no review/repair step and return `kind`, `output_asset_id` and `outputs`; video responses are
+     *     unchanged. For `video`:
+     *     one brief becomes a finished promo video: ONE model turn storyboards it on a built-in video starter
      *     (copy vars, one image prompt and one narration line per scene), every scene gets a codai-image still and a
      *     narration line (in parallel, billed once each under one wallet hold), the result is saved as an editable creative
      *     and a draft render is queued. When the render is ready a vision review of one frame per scene may fix text once
@@ -7482,6 +7500,90 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/add-requests': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Ask the user to add a secret
+     * @description An agent asks you to add a missing credential. Answers a hub link (`url`) the agent shows you; you add the item in the hub and the request completes. No secret passes through this route. An equivalent pending request is reused (`url` null). Always 201.
+     */
+    readonly post: operations$1['createVaultAddRequest'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/add-requests/{id}': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Add request status
+     * @description Agents poll this: once `completed`, `handle` is the new `{{vault:<slug>}}`.
+     */
+    readonly get: operations$1['getVaultAddRequest'];
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Cancel an add request
+     * @description Marks a pending request `cancelled`.
+     */
+    readonly delete: operations$1['cancelVaultAddRequest'];
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/add-requests/{id}/complete': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Complete an add request
+     * @description Links the item you added (it must be in one of your vaults). Idempotent for the same item; another item answers 409 `add_request_completed`, a closed request 409 `add_request_closed`.
+     */
+    readonly post: operations$1['completeVaultAddRequest'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/add-requests/lookup': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Look up an add request by link token
+     * @description For the hub deep link: the full request, only for the signed-in owner; anyone else gets 404.
+     */
+    readonly post: operations$1['lookupVaultAddRequest'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/approvals': {
     readonly parameters: {
       readonly query?: never;
@@ -7562,6 +7664,46 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/derive': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Derive a short-lived credential
+     * @description For codai brokers only (`x-codai-agent: codaid…` or `desktop…`). Same device proof (over `handles = [handle]`) and env-mode policy as `POST /v1/vault/resolve`; then mints a credential from the root item through its deriver, valid `min(ttl_s, max_ttl_s)`. 202 = approval required; 409 `not_cloud_usable` or `no_deriver`; 502 `derive_failed` (upstream error, sanitised).
+     */
+    readonly post: operations$1['deriveVaultCredential'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/derivers': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List credential derivers
+     * @description Derivers configured on items in your vaults (provider, config, max TTL). Never secret values.
+     */
+    readonly get: operations$1['listVaultDerivers'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/devices': {
     readonly parameters: {
       readonly query?: never;
@@ -7630,6 +7772,174 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/emergency': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * List emergency contacts
+     * @description Contacts you invited (`outgoing`) and people who named you (`incoming`); revoked ones are omitted.
+     */
+    readonly get: operations$1['listVaultEmergency'];
+    readonly put?: never;
+    /**
+     * Invite an emergency contact
+     * @description Emails an invitation. Always 202 with an id, whether or not the address has a codai account (enumeration-safe); inviting the same address again returns the existing id.
+     */
+    readonly post: operations$1['inviteVaultEmergency'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/{id}': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    readonly post?: never;
+    /**
+     * Revoke or decline
+     * @description The grantor revokes the contact or the contact declines; sealed keys are dropped and any access ends at once.
+     */
+    readonly delete: operations$1['revokeVaultEmergency'];
+    readonly options?: never;
+    readonly head?: never;
+    /**
+     * Change an emergency contact
+     * @description Grantor: change the wait and/or the covered vaults (send at least one). Changing the vaults returns a sealed contact to `accepted`, so the keys must be sealed again.
+     */
+    readonly patch: operations$1['updateVaultEmergency'];
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/{id}/approve': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Approve an access request now
+     * @description Grantor: grants a pending request immediately instead of waiting for `release_at`.
+     */
+    readonly post: operations$1['approveVaultEmergency'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/{id}/deny': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Deny an access request
+     * @description Grantor: denies a pending request; the contact returns to `sealed` and may ask again later.
+     */
+    readonly post: operations$1['denyVaultEmergency'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/{id}/request': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Request emergency access
+     * @description Contact: starts the wait (`delay_hours`); the grantor is notified and can deny. Without a denial access is granted at `release_at`. The body is optional.
+     */
+    readonly post: operations$1['requestVaultEmergency'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/{id}/seal': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    /**
+     * Seal vault keys to the contact
+     * @description Grantor: uploads each covered vault key sealed client-side to the contact public keys, with the fingerprint you compared. The server never sees a vault key.
+     */
+    readonly put: operations$1['sealVaultEmergency'];
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/{id}/vault-data': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Read the granted vaults
+     * @description Contact, status `granted`: the covered vaults (vault keys sealed to you) and their item envelopes. Ciphertext only; decrypt client-side with your vault account.
+     */
+    readonly get: operations$1['getVaultEmergencyData'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/emergency/accept': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Accept an emergency invitation
+     * @description The contact accepts with the token from the email; needs a vault account (404 `vault_not_setup`). The grantor then seals the vault keys to the contact.
+     */
+    readonly post: operations$1['acceptVaultEmergency'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/events': {
     readonly parameters: {
       readonly query?: never;
@@ -7710,6 +8020,26 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/hibp/range/{prefix}': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Breach check range (k-anonymity)
+     * @description Proxies the Have I Been Pwned range API with padding: send the first 5 hex characters of a SHA-1, compare the returned `SUFFIX:COUNT` lines locally. The password and its full hash never leave the client. Cached 24 h; 300 calls per user per hour (429 with `Retry-After`).
+     */
+    readonly get: operations$1['getVaultHibpRange'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/http': {
     readonly parameters: {
       readonly query?: never;
@@ -7794,6 +8124,30 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/items/{id}/deriver': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    /**
+     * Set a credential deriver
+     * @description Owner only. Turns a cloud-usable root item into a source of short-lived credentials (`aws_sts`, `gcp_sa`, `cloudflare`, `github_app`). The config is validated per provider (400 with the first issues).
+     */
+    readonly put: operations$1['setVaultItemDeriver'];
+    readonly post?: never;
+    /**
+     * Remove a credential deriver
+     * @description Owner only. 404 when the item has no deriver.
+     */
+    readonly delete: operations$1['deleteVaultItemDeriver'];
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/items/{id}/limits': {
     readonly parameters: {
       readonly query?: never;
@@ -7814,6 +8168,46 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/items/{id}/rotated': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Mark an item rotated
+     * @description Editor or above: sets `rotated_at` to now and clears the breach flag.
+     */
+    readonly post: operations$1['markVaultItemRotated'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/items/{id}/rotation': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    /**
+     * Set the rotation schedule
+     * @description Editor or above. Send any of `interval_days` (1-730), `provider`, `snoozed_until`; null clears a value.
+     */
+    readonly put: operations$1['setVaultItemRotation'];
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/limits': {
     readonly parameters: {
       readonly query?: never;
@@ -7894,6 +8288,46 @@ type paths$1 = {
     readonly patch?: never;
     readonly trace?: never;
   };
+  readonly '/v1/vault/rotation': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    /**
+     * Rotation queue
+     * @description Items in your vaults with their rotation state: breached first, then overdue, then soonest due; unscheduled last.
+     */
+    readonly get: operations$1['listVaultRotation'];
+    readonly put?: never;
+    readonly post?: never;
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
+  readonly '/v1/vault/rotation/breach-report': {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly get?: never;
+    readonly put?: never;
+    /**
+     * Report breach check results
+     * @description The client reports what its local HIBP check found (count 0 = clean), up to 500 items; items outside your vaults are ignored. Newly breached items notify you.
+     */
+    readonly post: operations$1['reportVaultBreaches'];
+    readonly delete?: never;
+    readonly options?: never;
+    readonly head?: never;
+    readonly patch?: never;
+    readonly trace?: never;
+  };
   readonly '/v1/vault/rules': {
     readonly parameters: {
       readonly query?: never;
@@ -8225,7 +8659,7 @@ type components$1 = {
        * @description Outcome of `referral_code`; `null` when not sent.
        * @enum {string|null}
        */
-      readonly referral_result: 'window_closed' | 'none' | 'invalid_code' | 'self' | 'already_referred' | 'flagged' | 'granted' | 'cap_reached' | null;
+      readonly referral_result: 'window_closed' | 'none' | 'invalid_code' | 'self' | 'already_referred' | 'flagged' | 'pending_payment' | 'granted' | 'cap_reached' | null;
       readonly training_opt_out: boolean;
       /** Format: uuid */
       readonly user_id: string;
@@ -16748,14 +17182,22 @@ type components$1 = {
       /** Format: date-time */
       readonly created_at: string;
       readonly creative_id: string | null;
+      /** @description Requested length in seconds (video productions); null when none was requested. */
+      readonly duration_s?: number | null;
       readonly error: string | null;
       readonly first_render_id: string | null;
       /** Format: uuid */
       readonly id: string;
+      /** @description Present only for non-video productions. */
+      readonly kind?: components$1['schemas']['StudioProductionKind'];
       /** @enum {string} */
       readonly language: 'en' | 'ro';
       /** @enum {string} */
       readonly object: 'studio.production';
+      /** @description The primary output (`outputs[0].asset_id`), `null` until `status` is `succeeded`. Present only for non-video productions. */
+      readonly output_asset_id?: string | null;
+      /** @description The built outputs (empty until `status` is `succeeded`). Present only for non-video productions. */
+      readonly outputs?: readonly components$1['schemas']['StudioProductionOutput'][];
       /**
        * @description storyboard → assets → render → qa → repair (at most once) → ready | failed.
        * @enum {string}
@@ -16782,15 +17224,18 @@ type components$1 = {
     /** Studio production request */
     readonly StudioProductionCreate: {
       /**
-       * @description Output format.
+       * @description Output format (`video` only; the other kinds pick their own format).
        * @default 16:9
        * @enum {string}
        */
       readonly aspect_ratio?: '16:9' | '9:16' | '1:1';
-      /** @description What the video should say: product, audience, tone, call to action (10–2,000 characters). */
+      /** @description What the output should say: product, audience, tone, call to action (10–2,000 characters). */
       readonly brief: string;
       /** @description Spending cap for the whole production in micro-USD (default 3,000,000, max 20,000,000). */
       readonly budget_micro_usd?: number;
+      /** @description Target length in seconds (`video` only). The storyboard and voice-over are planned for it and the scenes stretch to reach it; default: the starter's natural length (about 15–30 s). With another kind it is a 400. */
+      readonly duration_s?: number;
+      readonly kind?: components$1['schemas']['StudioProductionKind'];
       /**
        * @description Language of the copy and the voice-over (and of the starters the model chooses from).
        * @default ro
@@ -16798,17 +17243,35 @@ type components$1 = {
        */
       readonly language?: 'en' | 'ro';
       /**
-       * @description Add a voice-over (one line per scene).
+       * @description Add a voice-over (one line per scene). `video` only.
        * @default true
        */
       readonly narration?: boolean;
-      /** @description Optional video starter to use (`starter:<slug>:<language>`); default: the model picks one. */
+      /** @description Optional video starter to use (`starter:<slug>:<language>`); default: the model picks one. `video` only. */
       readonly starter?: string;
       /** @description Optional title (default: the storyboard title). */
       readonly title?: string;
       /** @description Optional narration voice (a Cloud TTS voice name or `custom:<uuid>`). */
       readonly voice?: string;
     };
+    /**
+     * Studio production kind
+     * @description What the production builds: `video` (MP4), `image` (PNG), `deck` (PPTX), `doc` (DOCX), `sheet` (XLSX), `audio` (MP3 jingle or song), `carousel` (PNG slides in a ZIP + cover) or `print` (A4/A5 PDF poster or flyer).
+     * @default video
+     * @enum {string}
+     */
+    readonly StudioProductionKind: 'video' | 'image' | 'deck' | 'doc' | 'sheet' | 'audio' | 'carousel' | 'print';
+    /**
+     * Studio production output
+     * @description A built output of a non-video production: the regular Studio asset plus its `role`. `url` is a 1 h signed GET, `null` while not ready.
+     */
+    readonly StudioProductionOutput: components$1['schemas']['AssetDto'] & {
+      /**
+       * @description What the asset is: `image` (PNG), `cover` (carousel cover PNG), `document` (PPTX, DOCX or XLSX), `pages` (ZIP of carousel PNGs), `pdf` or `audio` (MP3).
+       * @enum {string}
+       */
+      readonly role: 'image' | 'cover' | 'document' | 'pages' | 'pdf' | 'audio';
+    };
     /** Review decision */
     readonly StudioPublicDecisionRequest: {
       /** @enum {string} */
@@ -18656,6 +19119,78 @@ type components$1 = {
       readonly locked_at?: string | null;
       readonly revision: number;
     };
+    readonly VaultAddRequest: {
+      readonly agent: string;
+      /** Format: date-time */
+      readonly completed_at: string | null;
+      /** Format: date-time */
+      readonly created_at: string;
+      readonly env_var: string | null;
+      /** Format: date-time */
+      readonly expires_at: string;
+      readonly fields: readonly string[];
+      readonly handle: string | null;
+      readonly hosts: readonly string[];
+      /** Format: uuid */
+      readonly id: string;
+      /** Format: uuid */
+      readonly item_id: string | null;
+      /** @enum {string} */
+      readonly kind: 'login' | 'api_key' | 'env' | 'ssh_key' | 'oauth_token' | 'note' | 'card' | 'identity' | 'passkey';
+      readonly purpose: string;
+      readonly slug: string | null;
+      /**
+       * @description A pending request past its expiry reads as `expired`.
+       * @enum {string}
+       */
+      readonly status: 'pending' | 'completed' | 'cancelled' | 'expired';
+      readonly task: string | null;
+      readonly title: string;
+    };
+    readonly VaultAddRequestCreate: {
+      readonly env_var?: string;
+      /** @description Field names the user should fill in. */
+      readonly fields?: readonly string[];
+      /** @description Hosts the secret should be bound to. */
+      readonly hosts?: readonly string[];
+      /** @enum {string} */
+      readonly kind: 'login' | 'api_key' | 'env' | 'ssh_key' | 'oauth_token' | 'note' | 'card' | 'identity' | 'passkey';
+      /** @description Why the agent needs this secret; shown to the user. */
+      readonly purpose: string;
+      /** @description Suggested handle slug (the user may change it). */
+      readonly slug?: string;
+      readonly task?: string;
+      readonly title: string;
+    };
+    readonly VaultAddRequestCreated: {
+      /** Format: date-time */
+      readonly expires_at: string;
+      /** Format: uuid */
+      readonly id: string;
+      /**
+       * @description A pending request past its expiry reads as `expired`.
+       * @enum {string}
+       */
+      readonly status: 'pending' | 'completed' | 'cancelled' | 'expired';
+      /** @description Hub link the user opens to add the secret. Null when an equivalent pending request was reused (the link token is not stored). */
+      readonly url: string | null;
+    };
+    readonly VaultAddRequestStatus: {
+      /** Format: date-time */
+      readonly expires_at: string;
+      /** @description `{{vault:<slug>}}` once completed. */
+      readonly handle: string | null;
+      /** Format: uuid */
+      readonly id: string;
+      /** Format: uuid */
+      readonly item_id: string | null;
+      readonly slug: string | null;
+      /**
+       * @description A pending request past its expiry reads as `expired`.
+       * @enum {string}
+       */
+      readonly status: 'pending' | 'completed' | 'cancelled' | 'expired';
+    };
     /** @description Proven step-up for a decision. `device`: an enrolled device key signs `codai-vault/approve/v2|<approval_id>|<action_hash>|<decision>|<scope>|<device_id>`. `passkey`: a WebAuthn assertion whose challenge is base64url(SHA-256(the same message with device id `passkey`)). With `match_number` the message is v3: `codai-vault/approve/v3|<approval_id>|<action_hash>|<decision>|<scope>|<device_id>|<preview_digest>|<match_number>`, where `preview_digest` = base64url(SHA-256(the canonical text of `request.preview`)). */
     readonly VaultApprovalProof: {
       readonly device_id: string;
@@ -18670,6 +19205,33 @@ type components$1 = {
       /** @enum {string} */
       readonly type: 'passkey';
     };
+    readonly VaultDerived: {
+      /** @description The same values keyed by environment variable name. */
+      readonly env: {
+        readonly [key: string]: string;
+      };
+      /** Format: date-time */
+      readonly expires_at: string;
+      /** @enum {string} */
+      readonly provider: 'aws_sts' | 'gcp_sa' | 'cloudflare' | 'github_app';
+      /** @description Short-lived credential fields. For the broker only: inject and redact, never pass to a model. */
+      readonly values: {
+        readonly [key: string]: string;
+      };
+    };
+    readonly VaultDeriver: {
+      /** @description Provider configuration (role ARN, scopes, permissions…). Never secret values: the root credential stays in the item. */
+      readonly config: {
+        readonly [key: string]: unknown;
+      };
+      /** Format: uuid */
+      readonly item_id: string;
+      readonly max_ttl_s: number;
+      /** @enum {string} */
+      readonly provider: 'aws_sts' | 'gcp_sa' | 'cloudflare' | 'github_app';
+      /** Format: date-time */
+      readonly updated_at: string;
+    };
     readonly VaultDeviceChallenge: {
       /**
        * Format: date-time
@@ -18733,6 +19295,74 @@ type components$1 = {
       /** @enum {string} */
       readonly surface: 'phone' | 'wear' | 'desktop' | 'cli';
     };
+    readonly VaultEmergencyContact: {
+      /** Format: date-time */
+      readonly created_at: string;
+      /**
+       * @description Hours between an access request and automatic release, unless the grantor denies it.
+       * @enum {integer}
+       */
+      readonly delay_hours: 24 | 48 | 72;
+      /** Format: date-time */
+      readonly denied_at: string | null;
+      /** @description The invited email (grantor view). */
+      readonly email: string | null;
+      /** Format: date-time */
+      readonly granted_at: string | null;
+      /** @description Fingerprint of the contact public keys the grantor sealed to. */
+      readonly grantee_fingerprint: string | null;
+      /** @description Contact public keys (grantor view, after acceptance) to seal the vault keys to. */
+      readonly grantee_public_keys: {
+        readonly [key: string]: unknown;
+      } | null;
+      /** Format: uuid */
+      readonly id: string;
+      /** @description Display name of the other party. */
+      readonly other_name: string | null;
+      /**
+       * Format: date-time
+       * @description When a pending request is released automatically.
+       */
+      readonly release_at: string | null;
+      readonly request_reason: string | null;
+      /** Format: date-time */
+      readonly requested_at: string | null;
+      /**
+       * @description Your side of the relationship.
+       * @enum {string}
+       */
+      readonly role: 'grantor' | 'grantee';
+      /**
+       * @description `invited` → `accepted` (the contact has a vault account) → `sealed` (the grantor sealed the vault keys to the contact) → `requested` → `granted` (approved, or the wait elapsed with no denial). A denial returns to `sealed`.
+       * @enum {string}
+       */
+      readonly status: 'invited' | 'accepted' | 'sealed' | 'requested' | 'granted' | 'revoked';
+      readonly vault_ids: readonly string[];
+    };
+    readonly VaultEmergencyData: {
+      readonly items: readonly {
+        /** @description Public catalogue entry, as on the item. */
+        readonly agent_meta: unknown;
+        readonly ciphertext: string;
+        /** Format: uuid */
+        readonly id: string;
+        readonly kind: string;
+        readonly revision: number;
+        readonly slug: string | null;
+        /** Format: uuid */
+        readonly vault_id: string;
+        readonly wrapped_key: string;
+      }[];
+      readonly vaults: readonly {
+        readonly encrypted_meta: string;
+        /** Format: uuid */
+        readonly id: string;
+        /** @description The vault key sealed to the contact (X-Wing). */
+        readonly sealed_key: {
+          readonly [key: string]: unknown;
+        };
+      }[];
+    };
     readonly VaultGuards: {
       /** @description Agent requests for one item within `burst_window_s` that count as a burst (`anomaly:burst`); 0 = off. */
       readonly burst_max: number;
@@ -18802,6 +19432,31 @@ type components$1 = {
       /** @description Device-key signature, base64url, over `codai-vault/resolve/v1|<challenge>|<device_id>|<digest>` where `digest` = base64url_nopad(SHA-256(UTF-8(handles joined by `\n` + `\n\n` + action))), with `handles` and `action` exactly as sent. */
       readonly signature: string;
     };
+    readonly VaultRotationEntry: {
+      /** Format: date-time */
+      readonly breach_checked_at: string | null;
+      readonly breach_count: number;
+      /** @description The last client breach check found the password in a known breach. */
+      readonly breached: boolean;
+      /** @description Where to create a replacement key at the provider. */
+      readonly create_url: string | null;
+      /** Format: date-time */
+      readonly due_at: string | null;
+      /** @description Effective interval: the item setting, else 90 days for `api_key`, `oauth_token` and `env`, else null (unscheduled). */
+      readonly interval_days: number | null;
+      /** Format: uuid */
+      readonly item_id: string;
+      readonly kind: string;
+      readonly overdue: boolean;
+      /** @enum {string|null} */
+      readonly provider: 'stripe' | 'github_pat' | 'openai' | 'google_api_key' | 'other' | null;
+      /** Format: date-time */
+      readonly rotated_at: string | null;
+      readonly slug: string | null;
+      /** Format: date-time */
+      readonly snoozed_until: string | null;
+      readonly title: string | null;
+    };
     readonly VaultUnlockChallenge: {
       /** @description 32 random bytes, base64url. Single use. */
       readonly challenge: string;
@@ -34388,6 +35043,168 @@ interface operations$1 {
       };
     };
   };
+  readonly createVaultAddRequest: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['VaultAddRequestCreate'];
+      };
+    };
+    readonly responses: {
+      /** @description Created or reused. */
+      readonly 201: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultAddRequestCreated'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly getVaultAddRequest: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultAddRequestStatus'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly cancelVaultAddRequest: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description Cancelled. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultAddRequestStatus'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description The request is already closed. */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly completeVaultAddRequest: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          /** Format: uuid */
+          readonly item_id: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Completed. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultAddRequestStatus'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description `add_request_completed` or `add_request_closed`. */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly lookupVaultAddRequest: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly token: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultAddRequest'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
   readonly listVaultApprovals: {
     readonly parameters: {
       readonly query?: never;
@@ -34524,6 +35341,117 @@ interface operations$1 {
       readonly 401: components$1['responses']['Unauthorized'];
     };
   };
+  readonly deriveVaultCredential: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly action: string;
+          readonly chain?: readonly string[];
+          readonly handle: string;
+          readonly proof: components$1['schemas']['VaultResolveProof'];
+          /** @enum {string} */
+          readonly provenance?: 'user' | 'agent' | 'untrusted';
+          readonly purpose?: string;
+          readonly task?: string | null;
+          readonly ttl_s?: number;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Credential. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultDerived'];
+        };
+      };
+      /** @description Approval required. */
+      readonly 202: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            /** Format: uuid */
+            readonly approval_id: string;
+            readonly match_number: string | null;
+            readonly reasons: readonly string[];
+            /** @enum {string} */
+            readonly status: 'approval_required';
+            readonly tier: string;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      /** @description `broker_only`, `invalid_device_proof` or `vault_denied`. */
+      readonly 403: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description `not_cloud_usable` or `no_deriver`. */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      /** @description `derive_failed`. */
+      readonly 502: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly listVaultDerivers: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly derivers: readonly components$1['schemas']['VaultDeriver'][];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
   readonly listVaultDevices: {
     readonly parameters: {
       readonly query?: never;
@@ -34693,6 +35621,397 @@ interface operations$1 {
       readonly 401: components$1['responses']['Unauthorized'];
     };
   };
+  readonly listVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly incoming: readonly components$1['schemas']['VaultEmergencyContact'][];
+            readonly outgoing: readonly components$1['schemas']['VaultEmergencyContact'][];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly inviteVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          /**
+           * @description Hours between an access request and automatic release, unless the grantor denies it.
+           * @enum {integer}
+           */
+          readonly delay_hours: 24 | 48 | 72;
+          /** Format: email */
+          readonly email: string;
+          /** @description Vaults covered; omitted = every vault you own. */
+          readonly vault_ids?: readonly string[];
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Invited. */
+      readonly 202: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            /** Format: uuid */
+            readonly id: string;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly revokeVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description Revoked. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            /** Format: uuid */
+            readonly id: string;
+            /** @enum {string} */
+            readonly status: 'revoked';
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly updateVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          /**
+           * @description Hours between an access request and automatic release, unless the grantor denies it.
+           * @enum {integer}
+           */
+          readonly delay_hours?: 24 | 48 | 72;
+          /** @description Vaults covered; omitted = every vault you own. */
+          readonly vault_ids?: readonly string[];
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Updated. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyContact'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Wrong state for this action (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly approveVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description Granted. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyContact'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Wrong state for this action (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly denyVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description Denied. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyContact'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Wrong state for this action (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly requestVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly reason?: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Requested. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyContact'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Wrong state for this action (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly sealVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly grantee_fingerprint: string;
+          /** @description Vault id → vault key sealed to the contact. */
+          readonly sealed_keys: {
+            readonly [key: string]: {
+              /** @enum {string} */
+              readonly alg: 'xwing-hkdf-xchacha20poly1305';
+              readonly ct: string;
+              readonly wrapped: string;
+            };
+          };
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Sealed. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyContact'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Wrong state for this action (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly getVaultEmergencyData: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyData'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Access not granted (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly acceptVaultEmergency: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly token: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Accepted. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['VaultEmergencyContact'];
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description Wrong state for this action (`emergency_state`). */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
   readonly listVaultEvents: {
     readonly parameters: {
       readonly query?: {
@@ -34744,7 +36063,214 @@ interface operations$1 {
       readonly 401: components$1['responses']['Unauthorized'];
     };
   };
-  readonly revokeVaultGrant: {
+  readonly revokeVaultGrant: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description Revoked. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
+    };
+  };
+  readonly revokeVaultTaskGrants: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly task: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly revoked: number;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly getVaultHibpRange: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path: {
+        /** @description First 5 hex characters of the SHA-1 of the password (k-anonymity). */
+        readonly prefix: string;
+      };
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description `SUFFIX:COUNT` lines (padded). */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'text/plain': string;
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      /** @description Hourly limit reached. */
+      readonly 429: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+      /** @description `hibp_unavailable`; retry later. */
+      readonly 503: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+    };
+  };
+  readonly vaultHttp: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly body?: string | null;
+          readonly chain?: readonly string[];
+          readonly handle: string;
+          readonly headers?: {
+            readonly [key: string]: string;
+          };
+          /** @enum {string} */
+          readonly method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD';
+          /** @enum {string} */
+          readonly provenance?: 'user' | 'agent' | 'untrusted';
+          readonly purpose?: string;
+          readonly task?: string | null;
+          /** Format: uri */
+          readonly url: string;
+        };
+      };
+    };
+    readonly responses: {
+      /** @description Upstream response (redacted). */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      /** @description Approval required. */
+      readonly 202: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+      /** @description Denied by policy (`vault_denied`; reasons include `vault_locked` while the vault is locked). */
+      readonly 403: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 404: components$1['responses']['NotFound'];
+      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
+      readonly 429: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          readonly 'Retry-After'?: number;
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': components$1['schemas']['Error'];
+        };
+      };
+    };
+  };
+  readonly listVaultItems: {
+    readonly parameters: {
+      readonly query?: {
+        /** @description Only changes after this ISO time. */
+        readonly since?: string;
+      };
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly putVaultItem: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -34754,9 +36280,13 @@ interface operations$1 {
       };
       readonly cookie?: never;
     };
-    readonly requestBody?: never;
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': components$1['schemas']['VaultItemEnvelope'];
+      };
+    };
     readonly responses: {
-      /** @description Revoked. */
+      /** @description Updated. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
@@ -34767,70 +36297,82 @@ interface operations$1 {
           };
         };
       };
+      /** @description Created. */
+      readonly 201: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
       readonly 404: components$1['responses']['NotFound'];
+      /** @description Revision conflict. */
+      readonly 409: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly [key: string]: unknown;
+          };
+        };
+      };
     };
   };
-  readonly revokeVaultTaskGrants: {
+  readonly deleteVaultItem: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
-      readonly path?: never;
-      readonly cookie?: never;
-    };
-    readonly requestBody: {
-      readonly content: {
-        readonly 'application/json': {
-          readonly task: string;
-        };
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
       };
+      readonly cookie?: never;
     };
+    readonly requestBody?: never;
     readonly responses: {
-      /** @description OK. */
+      /** @description Deleted. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly revoked: number;
+            readonly [key: string]: unknown;
           };
         };
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
     };
   };
-  readonly vaultHttp: {
+  readonly setVaultItemCloud: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
-      readonly path?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
       readonly cookie?: never;
     };
     readonly requestBody: {
       readonly content: {
         readonly 'application/json': {
-          readonly body?: string | null;
-          readonly chain?: readonly string[];
-          readonly handle: string;
-          readonly headers?: {
-            readonly [key: string]: string;
-          };
-          /** @enum {string} */
-          readonly method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD';
-          /** @enum {string} */
-          readonly provenance?: 'user' | 'agent' | 'untrusted';
-          readonly purpose?: string;
-          readonly task?: string | null;
-          /** Format: uri */
-          readonly url: string;
+          readonly item: {
+            readonly [key: string]: unknown;
+          } | null;
         };
       };
     };
     readonly responses: {
-      /** @description Upstream response (redacted). */
+      /** @description OK. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
@@ -34841,55 +36383,33 @@ interface operations$1 {
           };
         };
       };
-      /** @description Approval required. */
-      readonly 202: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
-      /** @description Denied by policy (`vault_denied`; reasons include `vault_locked` while the vault is locked). */
-      readonly 403: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
       readonly 404: components$1['responses']['NotFound'];
-      /** @description `vault_rate_limited`: a per-handle limit is reached (`PUT /v1/vault/items/{id}/limits`). Read `Retry-After` (60 s for the per-minute cap, 3600 s for the daily caps). */
-      readonly 429: {
-        headers: {
-          /** @description Seconds to wait before retrying. */
-          readonly 'Retry-After'?: number;
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': components$1['schemas']['Error'];
-        };
-      };
     };
   };
-  readonly listVaultItems: {
+  readonly setVaultItemDeriver: {
     readonly parameters: {
-      readonly query?: {
-        /** @description Only changes after this ISO time. */
-        readonly since?: string;
-      };
+      readonly query?: never;
       readonly header?: never;
-      readonly path?: never;
+      readonly path: {
+        /** @description Resource id (uuid). */
+        readonly id: string;
+      };
       readonly cookie?: never;
     };
-    readonly requestBody?: never;
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly config: {
+            readonly [key: string]: unknown;
+          };
+          readonly max_ttl_s: number;
+          /** @enum {string} */
+          readonly provider: 'aws_sts' | 'gcp_sa' | 'cloudflare' | 'github_app';
+        };
+      };
+    };
     readonly responses: {
       /** @description OK. */
       readonly 200: {
@@ -34898,15 +36418,16 @@ interface operations$1 {
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
+            readonly deriver: components$1['schemas']['VaultDeriver'];
           };
         };
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
+      readonly 404: components$1['responses']['NotFound'];
     };
   };
-  readonly putVaultItem: {
+  readonly deleteVaultItemDeriver: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -34916,51 +36437,25 @@ interface operations$1 {
       };
       readonly cookie?: never;
     };
-    readonly requestBody: {
-      readonly content: {
-        readonly 'application/json': components$1['schemas']['VaultItemEnvelope'];
-      };
-    };
+    readonly requestBody?: never;
     readonly responses: {
-      /** @description Updated. */
+      /** @description Deleted. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
-      /** @description Created. */
-      readonly 201: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
+            readonly deleted: boolean;
           };
         };
       };
       readonly 400: components$1['responses']['BadRequest'];
       readonly 401: components$1['responses']['Unauthorized'];
       readonly 404: components$1['responses']['NotFound'];
-      /** @description Revision conflict. */
-      readonly 409: {
-        headers: {
-          readonly [name: string]: unknown;
-        };
-        content: {
-          readonly 'application/json': {
-            readonly [key: string]: unknown;
-          };
-        };
-      };
     };
   };
-  readonly deleteVaultItem: {
+  readonly setVaultItemLimits: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -34970,16 +36465,24 @@ interface operations$1 {
       };
       readonly cookie?: never;
     };
-    readonly requestBody?: never;
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly per_day: number | null;
+          readonly per_minute: number | null;
+          readonly units_per_day: number | null;
+        };
+      };
+    };
     readonly responses: {
-      /** @description Deleted. */
+      /** @description OK; `limits` is null when removed. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
+            readonly limits: components$1['schemas']['VaultItemLimits'];
           };
         };
       };
@@ -34988,7 +36491,7 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
-  readonly setVaultItemCloud: {
+  readonly markVaultItemRotated: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -34998,15 +36501,7 @@ interface operations$1 {
       };
       readonly cookie?: never;
     };
-    readonly requestBody: {
-      readonly content: {
-        readonly 'application/json': {
-          readonly item: {
-            readonly [key: string]: unknown;
-          } | null;
-        };
-      };
-    };
+    readonly requestBody?: never;
     readonly responses: {
       /** @description OK. */
       readonly 200: {
@@ -35015,7 +36510,10 @@ interface operations$1 {
         };
         content: {
           readonly 'application/json': {
-            readonly [key: string]: unknown;
+            /** Format: uuid */
+            readonly item_id: string;
+            /** Format: date-time */
+            readonly rotated_at: string | null;
           };
         };
       };
@@ -35024,7 +36522,7 @@ interface operations$1 {
       readonly 404: components$1['responses']['NotFound'];
     };
   };
-  readonly setVaultItemLimits: {
+  readonly setVaultItemRotation: {
     readonly parameters: {
       readonly query?: never;
       readonly header?: never;
@@ -35037,21 +36535,29 @@ interface operations$1 {
     readonly requestBody: {
       readonly content: {
         readonly 'application/json': {
-          readonly per_day: number | null;
-          readonly per_minute: number | null;
-          readonly units_per_day: number | null;
+          readonly interval_days?: number | null;
+          /** @enum {string|null} */
+          readonly provider?: 'stripe' | 'github_pat' | 'openai' | 'google_api_key' | 'other' | null;
+          /** Format: date-time */
+          readonly snoozed_until?: string | null;
         };
       };
     };
     readonly responses: {
-      /** @description OK; `limits` is null when removed. */
+      /** @description OK. */
       readonly 200: {
         headers: {
           readonly [name: string]: unknown;
         };
         content: {
           readonly 'application/json': {
-            readonly limits: components$1['schemas']['VaultItemLimits'];
+            readonly interval_days: number | null;
+            /** Format: uuid */
+            readonly item_id: string;
+            /** @enum {string|null} */
+            readonly provider: 'stripe' | 'github_pat' | 'openai' | 'google_api_key' | 'other' | null;
+            /** Format: date-time */
+            readonly snoozed_until: string | null;
           };
         };
       };
@@ -35229,6 +36735,65 @@ interface operations$1 {
       };
     };
   };
+  readonly listVaultRotation: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody?: never;
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly items: readonly components$1['schemas']['VaultRotationEntry'][];
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
+  readonly reportVaultBreaches: {
+    readonly parameters: {
+      readonly query?: never;
+      readonly header?: never;
+      readonly path?: never;
+      readonly cookie?: never;
+    };
+    readonly requestBody: {
+      readonly content: {
+        readonly 'application/json': {
+          readonly results: readonly {
+            readonly count: number;
+            /** Format: uuid */
+            readonly item_id: string;
+          }[];
+        };
+      };
+    };
+    readonly responses: {
+      /** @description OK. */
+      readonly 200: {
+        headers: {
+          readonly [name: string]: unknown;
+        };
+        content: {
+          readonly 'application/json': {
+            readonly newly_breached: number;
+            readonly recorded: number;
+          };
+        };
+      };
+      readonly 400: components$1['responses']['BadRequest'];
+      readonly 401: components$1['responses']['Unauthorized'];
+    };
+  };
   readonly listVaultRules: {
     readonly parameters: {
       readonly query?: never;
@@ -37879,6 +39444,8 @@ export declare class Templates {
 }
 export type StudioProductionCreate = Mutable<Body<'createStudioProduction'>>;
 export type StudioProduction = Schema<'StudioProduction'>;
+export type StudioProductionKind = Schema<'StudioProductionKind'>;
+export type StudioProductionOutput = Schema<'StudioProductionOutput'>;
 type CallOpts$27 = {
   ext?: CodaiRequestExtensions;
   signal?: AbortSignal;
@@ -38487,6 +40054,31 @@ export type VaultItemLimits = Schema<'VaultItemLimits'>;
 export type VaultItemLimitsInput = Mutable<Body<'setVaultItemLimits'>>;
 /** Where a lock/unlock was triggered from. */
 export type VaultVia = 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
+/** V-17: an agent asks the user to add a missing secret (no secret ever passes through these calls). */
+export type VaultAddRequestCreate = Mutable<Schema<'VaultAddRequestCreate'>>;
+export type VaultAddRequestCreated = Schema<'VaultAddRequestCreated'>;
+export type VaultAddRequestStatus = Schema<'VaultAddRequestStatus'>;
+export type VaultAddRequest = Schema<'VaultAddRequest'>;
+/** V-23 emergency access: contacts, sealed vault keys, wait-then-release. */
+export type VaultEmergencyContact = Schema<'VaultEmergencyContact'>;
+export type VaultEmergencyList = Reply<'listVaultEmergency'>;
+export type VaultEmergencyInvite = Mutable<Body<'inviteVaultEmergency'>>;
+export type VaultEmergencySeal = Mutable<Body<'sealVaultEmergency'>>;
+export type VaultEmergencyUpdate = Mutable<Body<'updateVaultEmergency'>>;
+export type VaultEmergencyData = Schema<'VaultEmergencyData'>;
+/** V-15 rotation queue entry (breach state is client-reported via HIBP k-anonymity). */
+export type VaultRotationEntry = Schema<'VaultRotationEntry'>;
+export type VaultRotationPatch = Mutable<Body<'setVaultItemRotation'>>;
+export type VaultRotationSetting = Reply<'setVaultItemRotation'>;
+export type VaultBreachResult = Mutable<Body<'reportVaultBreaches'>>['results'][number];
+/** V-20 JIT derivers: short-lived credentials minted from a cloud-usable root item. */
+export type VaultDeriver = Schema<'VaultDeriver'>;
+export type VaultDeriverInput = Mutable<Body<'setVaultItemDeriver'>>;
+/** Requires `proof` over `handles = [handle]` (same as {@link VaultResolveRequest}). */
+export type VaultDeriveRequest = Mutable<Body<'deriveVaultCredential'>>;
+export type VaultDerived = Schema<'VaultDerived'>;
+/** 202 from `derive`: approval needed first. */
+export type VaultDeriveApproval = Reply<'deriveVaultCredential', 202>;
 /** The UTF-8 message an unlock proof covers: `codai-vault/unlock/v1|<challenge>|<device_id or "passkey">`. */
 export declare function vaultUnlockMessage(challenge: string, deviceIdOrPasskey: string): string;
 /**
@@ -38518,9 +40110,54 @@ export declare class VaultDevices {
   /** `DELETE /v1/vault/devices/{id}` — revoke at once; later proofs answer 403 `device_revoked`. */
   revoke(id: string, opts?: CallOpts$21): Promise<Reply<'revokeVaultDevice'>>;
 }
+/** `/v1/vault/add-requests/*` — an agent asks the user to add a missing secret (V-17). */
+export declare class VaultAddRequests {
+  private readonly http;
+  constructor(http: HttpClient);
+  /** `POST /v1/vault/add-requests` — answers a hub `url` to show the user (null when a pending request was reused). */
+  create(body: VaultAddRequestCreate, opts?: CallOpts$21): Promise<VaultAddRequestCreated>;
+  /** `GET /v1/vault/add-requests/{id}` — poll; once `completed`, `handle` is the new `{{vault:<slug>}}`. */
+  get(id: string, opts?: CallOpts$21): Promise<VaultAddRequestStatus>;
+  /** `DELETE /v1/vault/add-requests/{id}` — cancel a pending request. */
+  cancel(id: string, opts?: CallOpts$21): Promise<VaultAddRequestStatus>;
+  /** `POST /v1/vault/add-requests/lookup` — full request by link token, signed-in owner only (404 otherwise). */
+  lookup(token: string, opts?: CallOpts$21): Promise<VaultAddRequest>;
+  /** `POST /v1/vault/add-requests/{id}/complete` — link the item you added; idempotent for the same item. */
+  complete(id: string, itemId: string, opts?: CallOpts$21): Promise<VaultAddRequestStatus>;
+}
+/** `/v1/vault/emergency/*` — emergency access (V-23): invite, seal vault keys, request, wait, release. */
+export declare class VaultEmergency {
+  private readonly http;
+  constructor(http: HttpClient);
+  private post;
+  /** `GET /v1/vault/emergency` — `{ outgoing, incoming }` (revoked omitted). */
+  list(opts?: CallOpts$21): Promise<VaultEmergencyList>;
+  /** `POST /v1/vault/emergency` — always 202 `{ id }` (enumeration-safe). */
+  invite(body: VaultEmergencyInvite, opts?: CallOpts$21): Promise<Reply<'inviteVaultEmergency', 202>>;
+  /** `POST /v1/vault/emergency/accept` — the contact accepts with the emailed token (needs a vault account). */
+  accept(token: string, opts?: CallOpts$21): Promise<VaultEmergencyContact>;
+  /** `PUT /v1/vault/emergency/{id}/seal` — grantor uploads vault keys sealed client-side to the contact. */
+  seal(id: string, body: VaultEmergencySeal, opts?: CallOpts$21): Promise<VaultEmergencyContact>;
+  /** `PATCH /v1/vault/emergency/{id}` — change `delay_hours` and/or `vault_ids` (vaults change → re-seal). */
+  update(id: string, body: VaultEmergencyUpdate, opts?: CallOpts$21): Promise<VaultEmergencyContact>;
+  /** `DELETE /v1/vault/emergency/{id}` — grantor revokes or the contact declines. */
+  revoke(id: string, opts?: CallOpts$21): Promise<Reply<'revokeVaultEmergency'>>;
+  /** `POST /v1/vault/emergency/{id}/request` — contact starts the wait; released at `release_at` unless denied. */
+  request(id: string, params?: {
+    reason?: string;
+  }, opts?: CallOpts$21): Promise<VaultEmergencyContact>;
+  /** `POST /v1/vault/emergency/{id}/deny` — grantor denies a pending request (back to `sealed`). */
+  deny(id: string, opts?: CallOpts$21): Promise<VaultEmergencyContact>;
+  /** `POST /v1/vault/emergency/{id}/approve` — grantor grants a pending request now. */
+  approve(id: string, opts?: CallOpts$21): Promise<VaultEmergencyContact>;
+  /** `GET /v1/vault/emergency/{id}/vault-data` — contact, status `granted`: sealed vault keys + item envelopes. */
+  vaultData(id: string, opts?: CallOpts$21): Promise<VaultEmergencyData>;
+}
 export declare class Vault {
   private readonly http;
   readonly devices: VaultDevices;
+  readonly addRequests: VaultAddRequests;
+  readonly emergency: VaultEmergency;
   constructor(http: HttpClient);
   private get;
   private send;
@@ -38604,6 +40241,30 @@ export declare class Vault {
    * `body.proof` is required: 400 `proof_required` / `invalid_challenge`, 403 `invalid_device_proof`.
    */
   resolve(body: VaultResolveRequest, opts?: CallOpts$21): Promise<VaultObject>;
+  /**
+   * `GET /v1/vault/hibp/range/{prefix}` — padded HIBP range (`SUFFIX:COUNT` lines, text) for the first 5 hex chars of
+   * a SHA-1; compare locally, the password never leaves the client. 300 calls per user per hour.
+   */
+  hibpRange(prefix: string, opts?: CallOpts$21): Promise<string>;
+  /** `GET /v1/vault/rotation` — rotation queue: breached, overdue, soonest due; unscheduled last. */
+  rotation(opts?: CallOpts$21): Promise<VaultRotationEntry[]>;
+  /** `PUT /v1/vault/items/{id}/rotation` — any of `interval_days`, `provider`, `snoozed_until`; `null` clears one. */
+  setRotation(id: string, patch: VaultRotationPatch, opts?: CallOpts$21): Promise<VaultRotationSetting>;
+  /** `POST /v1/vault/items/{id}/rotated` — `rotated_at` = now, breach flag cleared. */
+  markRotated(id: string, opts?: CallOpts$21): Promise<Reply<'markVaultItemRotated'>>;
+  /** `POST /v1/vault/rotation/breach-report` — local HIBP results (`count` 0 = clean), up to 500 per call. */
+  reportBreaches(results: VaultBreachResult[], opts?: CallOpts$21): Promise<Reply<'reportVaultBreaches'>>;
+  /** `GET /v1/vault/derivers` — derivers on items in your vaults (config only, never values). */
+  derivers(opts?: CallOpts$21): Promise<VaultDeriver[]>;
+  /** `PUT /v1/vault/items/{id}/deriver` — owner only; config validated per provider. */
+  setDeriver(id: string, body: VaultDeriverInput, opts?: CallOpts$21): Promise<VaultDeriver>;
+  /** `DELETE /v1/vault/items/{id}/deriver` — owner only; 404 when there is none. */
+  deleteDeriver(id: string, opts?: CallOpts$21): Promise<Reply<'deleteVaultItemDeriver'>>;
+  /**
+   * `POST /v1/vault/derive` — codai local brokers only: a short-lived credential from a root item's deriver. Same
+   * `proof` as {@link resolve} over `handles = [handle]`. A 202 (approval required) is returned, not thrown.
+   */
+  derive(body: VaultDeriveRequest, opts?: CallOpts$21): Promise<VaultDerived | VaultDeriveApproval>;
 }
 /** `share_token`, `surface`, `category`, `explanation`, `reporter_name`, `reporter_email`, `good_faith: true`. */
 export type StudioAbuseReportRequest = Mutable<Schema<'StudioAbuseReportRequest'>>;