diff --git a/.speakeasy/gen.lock b/.speakeasy/gen.lock index a87f338f4..38bd17de5 100644 --- a/.speakeasy/gen.lock +++ b/.speakeasy/gen.lock @@ -1,19 +1,19 @@ lockVersion: "" id: "" management: - docChecksum: 77a5b0dd8ab45001d15e1b5a27808278 + docChecksum: abd7f52b7429f0a020f709b0dcca0625 docVersion: 1.0.0 speakeasyVersion: 1.787.0 generationVersion: 2.914.0 - releaseVersion: 1.4.0 - configChecksum: c6f97602909da6a554bd1756310947c6 + releaseVersion: 1.4.1 + configChecksum: 9f6e8601f83dbe83fca3af20c3c48dd8 repoURL: https://github.com/OpenRouterTeam/typescript-sdk.git installationURL: https://github.com/OpenRouterTeam/typescript-sdk published: true persistentEdits: - generation_id: 71da85c9-72b8-47cb-9523-9051538ff5df - pristine_commit_hash: 36a234faeeb6cc824bcf043f2df18aef1069300f - pristine_tree_hash: d90da52046add890cce0571519434c361f61e719 + generation_id: 74733277-66b9-4d04-a5b6-9b34bd0c76e0 + pristine_commit_hash: e6cdef4812f4f55039b6f73397802ea641101d48 + pristine_tree_hash: b8f036befdebe377af840152f0bc6cfea3730008 features: typescript: acceptHeaders: 2.81.2 @@ -9725,6 +9725,14 @@ trackedFiles: id: 9ad03ead3ab8 last_write_checksum: sha1:3cdf9854e1ef01f10a4723b19cb042dec8c269b1 pristine_git_object: 6880d9d81935f6fa48b6d87bab9fbe78803534f6 + docs/models/operations/listinterneffectivevaultsecretsglobals.mdx: + id: 755d10265dbb + last_write_checksum: sha1:f3ce7cbed31f2a8d0aeab6834a329564d5cff226 + pristine_git_object: 3e627a5b3de2ad62bb119abd6692f7e3201479cf + docs/models/operations/listinterneffectivevaultsecretsrequest.mdx: + id: 903c64583cbf + last_write_checksum: sha1:3460bef46ccd501a9cf48ea2ba9f394a9f46c44b + pristine_git_object: 8f8748a2b627719b1b967d7c4689f96fab9e42c6 docs/models/operations/listinternsglobals.mdx: id: f62b829b195b last_write_checksum: sha1:02ff172832aa7c664ac878c2801fecfc2dc7fc90 @@ -12673,10 +12681,6 @@ trackedFiles: id: 2c7ac4015da5 last_write_checksum: sha1:494e2054437406ff149c4a9749e1c80714bc765d pristine_git_object: ee8ecb43ffd4b07579511e9c29717a78caa9fef2 - docs/models/scope.mdx: - id: 53060439ddc4 - last_write_checksum: sha1:3bde46df57dee7681df97045b31432ea6452b6eb - pristine_git_object: 0d989e65007420d73a145d5eee5da7822610b0f3 docs/models/searchcontextsizeenum.md: id: 4de34693233a last_write_checksum: sha1:efc7659126209876e2b83b5fd67b1dc379796ad0 @@ -13517,8 +13521,12 @@ trackedFiles: deleted: true docs/models/tokenexchangerequest.mdx: id: 20223978500d - last_write_checksum: sha1:e6de0f3e1084ffa011464a3b2cb54c9b9ba6124b - pristine_git_object: 4f5a6c113ce78b17bf8e91563e8c9593e489eb2f + last_write_checksum: sha1:eb82c51c5807f56577eeae1386835e019de414f1 + pristine_git_object: 4fd88c444695d890270622ed12a9a5b31b27dc4b + docs/models/tokenexchangerequestscope.mdx: + id: e19f72333221 + last_write_checksum: sha1:f1645539b1fd483cab39c77a24d3c8d70f49e8e1 + pristine_git_object: cc3c4dd07a8889b40790e433acfb08c337abb6d2 docs/models/tokenexchangeresponse.mdx: id: 29ffda782ee3 last_write_checksum: sha1:4f5b18c6072ab5dd16e1de671f8773e1cab83383 @@ -14203,6 +14211,18 @@ trackedFiles: id: a898d6bbef33 last_write_checksum: sha1:02aa8646079d62293338ef295481809bfe413ece pristine_git_object: 50ceaea11a7c0a924c93ccce5b1aa57b5ad7f6a7 + docs/models/vaulteffectivesecret.mdx: + id: 692f3ab2cea9 + last_write_checksum: sha1:069ce3bc10f0fb747d56aa7c55977ae5a1cbc3a1 + pristine_git_object: 4430f34570acd28bb746aa42c1870d94ee983855 + docs/models/vaulteffectivesecretlistresponse.mdx: + id: 88ab2dfa3a17 + last_write_checksum: sha1:290e4ed44394e926bbfcf89945fbe1bd1aa2c014 + pristine_git_object: afade5fcfb67115be67a6b265d94ab2e7cc594ef + docs/models/vaulteffectivesecretscope.mdx: + id: 4244d990fa78 + last_write_checksum: sha1:6f66ece5b96de2aae764cf286932b4b528cd5578 + pristine_git_object: 257dd2675b039455e90334f3122ee0c46e1aa276 docs/models/vaultsecret.mdx: id: 2043e343062a last_write_checksum: sha1:09e26a0a774a4b5b0e51d0c9ec19c0ec139b0cba @@ -14739,8 +14759,8 @@ trackedFiles: pristine_git_object: 15b7b4c80d50dd3aa0f7adc3ab4d9fb03a8efaa7 docs/sdks/interns/README.mdx: id: 2f8a053ffe78 - last_write_checksum: sha1:854e8be236339d0a7def72a56e9f4f79a37fb017 - pristine_git_object: 229d03a6798b5efb0487bd98f2b86824ee212f03 + last_write_checksum: sha1:a1a2aa6f2885ece37ca4fa89a171f053b947864a + pristine_git_object: 58668ffc9a9d59e3f2755650ec6ad7b7e221b228 docs/sdks/models/README.mdx: id: 58f1ca464e0b last_write_checksum: sha1:dbae6f74244ab3e9fe38e075ab67f926f33ef87d @@ -14825,8 +14845,8 @@ trackedFiles: pristine_git_object: f268a989002642a92428fedba701bf5ddf4ed3e3 docs/sdks/vault/README.mdx: id: 3738c6722acd - last_write_checksum: sha1:b643a4e3d8a8946ad887ef8b916bb88c1794e491 - pristine_git_object: 30a5e8e15229fad1d2493e482a0057dc1021fe50 + last_write_checksum: sha1:060c7999f93108fb9d779646f187013f35aee9b9 + pristine_git_object: f537caf25d55a2c7806318b2ea76947182abbea1 docs/sdks/videogeneration/README.md: id: b6dbf7b0729c last_write_checksum: sha1:71205a37afffed445af770082c3f50f6bcbfadfa @@ -14871,12 +14891,12 @@ trackedFiles: pristine_git_object: 410efafd6a7f50d91ccb87131fedbe0c3d47e15a jsr.json: id: 7f6ab7767282 - last_write_checksum: sha1:539d1627d0e4c38387c6f62ae3a4abc5826d1b51 - pristine_git_object: 76f67d38de69f459a000d8878d10d12b57d1b47b + last_write_checksum: sha1:cd7fd0b0693c7f0f53ce65833490e5f06f3cff92 + pristine_git_object: 6e684a8436ce5811d0a4350025edc3ddd20f2f1e package.json: id: 7030d0b2f71b - last_write_checksum: sha1:e45707a9c63986788ff1265b227dbcedbf26e67f - pristine_git_object: 8841b3ac795df26b937e875feae1848830dbfc65 + last_write_checksum: sha1:c9accc9d671f99e39e8765104543e1e4bd4cbf87 + pristine_git_object: 3505a46bcd6668d17628348fedc3bf6e94a3d94e src/core.ts: id: f431fdbcd144 last_write_checksum: sha1:5aa66b0b6a5964f3eea7f3098c2eb3c0ee9c0131 @@ -15119,44 +15139,44 @@ trackedFiles: pristine_git_object: b73e7606a33f6e568e0e0f0f6edc6a2cf683b295 src/funcs/internsCreateIntern.ts: id: 74ff6cd8e4b0 - last_write_checksum: sha1:552a9f984d38571d742dead0f6a3834cbfb85959 - pristine_git_object: 8081c1a61184489df9b770ba4381831301a0063f + last_write_checksum: sha1:e14cdb0c5c98f918f869b55aa8182f2179bb048b + pristine_git_object: 7bf7c9123f51cf2d488d3c3f2a7fa9385344982c src/funcs/internsDeleteIntern.ts: id: 7eb35f20da18 - last_write_checksum: sha1:4659c2c43af730669c2e4163d142c0275c6b9ce8 - pristine_git_object: ffda40ba9072eb0aa1bea616b31f212617e404ce + last_write_checksum: sha1:59305c57df6deee411feed4b59260afd87347394 + pristine_git_object: 76ca8ecadfc9d0f0b6c0ac0645802bf24106b3f1 src/funcs/internsGetIntern.ts: id: 484b04c35876 - last_write_checksum: sha1:95616ff94e6ef4fe3248885d25aa71a6b01f5186 - pristine_git_object: 84985cfee5e79c648083370d42e07563d54f8fd2 + last_write_checksum: sha1:eb25ad753db871626ce9e204fe72c18dc6263ab0 + pristine_git_object: c63d853cce364f3ca7fe036e521b95b66062d667 src/funcs/internsGetInternDaemon.ts: id: 727cbeff5468 - last_write_checksum: sha1:8d8de1ac422ef03425af979f67c464b08364a8fc - pristine_git_object: 00c6a4c15409bac36e463ced4131b301716b52ac + last_write_checksum: sha1:597ebdf44726ef1d0907068f99947032f23f5933 + pristine_git_object: 8ddfabc318a1f61b2a9835745a7d01b9fb4128de src/funcs/internsGetInternDaemonAccess.ts: id: 464f7f69e2f0 - last_write_checksum: sha1:ceb2ab2eef61e74c12b82dd7095ef1118909af81 - pristine_git_object: a60cc07695a9e26fd271e2d52dd877ab517b8f85 + last_write_checksum: sha1:7c1abbc5d3d112b11e8e744dc8b91e18a82018b5 + pristine_git_object: 7d1a84bfbf78854398ec7fb9ef868a984551f6fd src/funcs/internsInvoke.ts: id: d0be40cd89cf last_write_checksum: sha1:e7e5db94633812351a50eca92befa7aa032e49a7 pristine_git_object: 60325197f9d904257d8a5cfb86c1ebd1a10586d1 src/funcs/internsListInterns.ts: id: eceaf7dad653 - last_write_checksum: sha1:e5dd060b7ff96038d687efc0a5495064efc84621 - pristine_git_object: 48cd8682b2086de133ae3bb3c85c9b42a87a8b23 + last_write_checksum: sha1:4765be7bd7c69b5b1458abef7180ac280d883a96 + pristine_git_object: 0e97597846738288bdf287cdaf8dec78bad7f60a src/funcs/internsProvisionIntern.ts: id: 38001699f102 - last_write_checksum: sha1:b2cf753b37585b3e9b29f565d86b3eb348fd2ef7 - pristine_git_object: 6d022614a1853377a0d2534f07d2d311a70cc221 + last_write_checksum: sha1:eea2e3e2024851c619d6ae2e5b1b8d265f7b94e3 + pristine_git_object: 84f3dddbf8bb57856bf9297f7e2f26e5d8a04ed9 src/funcs/internsSuspendIntern.ts: id: 5928ef254c09 - last_write_checksum: sha1:5c8412c56b26feee1a898aa34252ffcaa3cb46b4 - pristine_git_object: e1668e0fb434a4b48d824f10e384050c4803ed44 + last_write_checksum: sha1:cda18c1920e1538e7313ff1ec2e8f907618bf81a + pristine_git_object: 5c20a90b19ec1815bea71d28471b540378caac90 src/funcs/internsUpdateIntern.ts: id: 1d493469e489 - last_write_checksum: sha1:b6662f9745d583855df6f1cc37d91894f021ba0a - pristine_git_object: 23c9a21b02d88278d1fdc8316e813aeedb25009e + last_write_checksum: sha1:3d31621ac5975fa26fd6671b77cb8dc1a21c744a + pristine_git_object: 8f5a82f87ec4ff137716429fc0ee1364e2abc80c src/funcs/modelsCount.ts: id: 371adfc67b48 last_write_checksum: sha1:b5207eb21e0d08e0f1384059f5507fdb2eb16fe0 @@ -15343,32 +15363,36 @@ trackedFiles: pristine_git_object: 4cea6cce545cae422b69b0bab5ecd02faa79a840 src/funcs/vaultCopyVaultSecretsToIntern.ts: id: 5f2c033bee20 - last_write_checksum: sha1:e9ef734e6e9ba4dfcd32ddf5fbf1a842d4033b94 - pristine_git_object: 526fbaee4f131b4254ef1044d957e8f67d72fe43 + last_write_checksum: sha1:a8c3f695bd8d91e9dda10ded4bebd6cb8eb5b78f + pristine_git_object: 9d243e38cddcb44dc7fc7d2de80b77c715bd8579 src/funcs/vaultDeleteInternVaultSecret.ts: id: b714b9bd8f2a - last_write_checksum: sha1:bfdf71a96f0ee7ab592bd4a005a9374c35f16ecb - pristine_git_object: 25af9eaeaa655c1803046a0e1469c98136317fed + last_write_checksum: sha1:ea9a172199f83c66c61db7bd669bec4a93c694b0 + pristine_git_object: d090681b037762b179c0e8b3353ed088c92c7bc3 src/funcs/vaultDeleteVaultSecret.ts: id: 9af36010c726 - last_write_checksum: sha1:d5796eefdd2badd0f386cd2da459034068fd3e3d - pristine_git_object: 403d962a989a7d4c4c16306fddc4e2d9b3279642 + last_write_checksum: sha1:c507f78b438a289f8a8f1b2b62a6b9a852384900 + pristine_git_object: 545d976d7a49294740f0062390f08aa7c24d5294 + src/funcs/vaultListInternEffectiveVaultSecrets.ts: + id: f8d9b6f715e3 + last_write_checksum: sha1:0cb71702dae5dcb48db8a5f53e368c09306f5814 + pristine_git_object: 7168ce2b5c1a2953fdeccea41969cad4d04cb9e6 src/funcs/vaultListInternVaultSecrets.ts: id: 2b49f136fb3f - last_write_checksum: sha1:ef690c4173904f174e6b4abb58c1dc5f1baf130b - pristine_git_object: 84c05cb1436808a17cb1a0b86fb6d6d1ed6f5edc + last_write_checksum: sha1:cbf9126a832da6587e4f006debe6e371f7dc0705 + pristine_git_object: 7c3ed63c842a4e28288603ef011542825f3d7e39 src/funcs/vaultListVaultSecrets.ts: id: f701a28ac32e - last_write_checksum: sha1:4a424e78fda2bf513d1a90c30d55a1d77fd14958 - pristine_git_object: bada0a942371fbf44e804261911847da8580fb05 + last_write_checksum: sha1:40ccfbac60c31b354cd3832edae2163e37bdb8b4 + pristine_git_object: 96980dcfb889948901ffe8bf44f886e6fc91a147 src/funcs/vaultStoreInternVaultSecret.ts: id: 8216704a5d50 - last_write_checksum: sha1:16215dbed1b74337e0d203c5bd34e0cd4a7f4592 - pristine_git_object: 6cfaad97ca094f08888fc497aada8fa58a2905de + last_write_checksum: sha1:6041a86e6b360657bb36aa566b6dae2b07c53dbc + pristine_git_object: 8deb2e158fcbb2596bf1b517385e7493d371d128 src/funcs/vaultStoreVaultSecret.ts: id: 2a58f9053954 - last_write_checksum: sha1:71d29dc9ef7c9d05c992d713000593e9396fa226 - pristine_git_object: 7fba356aa94e5008a87955c77efceac14848bce6 + last_write_checksum: sha1:ac94d2eda5d1b5d670884336d90fb3a331d8341c + pristine_git_object: e2f549547b29784b11dc9b25709f88c3113d1a1c src/funcs/videoGenerationGenerate.ts: id: 6f3650ac9f5e last_write_checksum: sha1:d39927b5c5226aa530b5dbc779db7a5a3ba4aaeb @@ -15455,8 +15479,8 @@ trackedFiles: pristine_git_object: a187e58707bdb726ca2aff74941efe7493422d4e src/lib/config.ts: id: 320761608fb3 - last_write_checksum: sha1:52873324419700d41a96e7876fe1267297381f3a - pristine_git_object: 807876cf7be2cab1595c72e416b11010db710106 + last_write_checksum: sha1:21051571a2accf7f25d72e5b7a46529f87ddaf88 + pristine_git_object: a4b8fda54c8362fe9e6ee930015ae9926af8f05e src/lib/dlv.ts: id: b1988214835a last_write_checksum: sha1:eaac763b22717206a6199104e0403ed17a4e2711 @@ -17161,8 +17185,8 @@ trackedFiles: pristine_git_object: 7abdfe096d3adff317db6837dc689c69db92e127 src/models/index.ts: id: f93644b0f37e - last_write_checksum: sha1:c629a47b67329439856b5e22c4191d7e320e617f - pristine_git_object: a0d021c48903b01a2fbcf1ff8e2db8f10cf3613e + last_write_checksum: sha1:539fcd021455b5fee975bd9761e5f02c98a54b99 + pristine_git_object: c8e320117a048dee3cfc5c242f0718a7fe59c573 src/models/inputaudio.ts: id: 9bdc14c7565f last_write_checksum: sha1:2f8dc4c1d6a9c2927d9eb186e0ecedf7b81838e6 @@ -18077,8 +18101,8 @@ trackedFiles: pristine_git_object: a052ed42bd123e79be1f05dc823c808f8c32b383 src/models/operations/index.ts: id: 0d9ffaf774d2 - last_write_checksum: sha1:7084571e42a12b1c2fb564bb91c346f068b1653c - pristine_git_object: 700a9ee1da516f6586693b0238382e6d6721ca60 + last_write_checksum: sha1:cd2d2fc3f3339a115b795fa1e85e0a3056c0a45e + pristine_git_object: dffc4fdceb8ca7ff1da7d5b4731439d5953dddc6 src/models/operations/invokeintern.ts: id: f2b19fbd8a96 last_write_checksum: sha1:55f0d7c3a2020919fbf3e92c2c7524a75a412504 @@ -18139,6 +18163,10 @@ trackedFiles: id: 439d3eed4cf3 last_write_checksum: sha1:8c63a2f39b210f1cd71ffa89f58e42168ccde4b8 pristine_git_object: 53af57ce4fbd45ca669919b1e55d41052b43bb74 + src/models/operations/listinterneffectivevaultsecrets.ts: + id: 8162d29b4032 + last_write_checksum: sha1:9ee1bc688169aa52e40fac2cb5049318d5dc49b3 + pristine_git_object: 50bfa2a6310e7534e6d3c848574b71785e0bec4b src/models/operations/listinterns.ts: id: 3fe8f2b8da99 last_write_checksum: sha1:9b698c834a6e3f647f566ea445980e3e28378ebd @@ -19077,8 +19105,8 @@ trackedFiles: pristine_git_object: 3896234004dafb4ef489fc1127b3fbcc5c78132d src/models/tokenexchangerequest.ts: id: 27152e05f952 - last_write_checksum: sha1:6a7d58272a24deb3724312724d4af051c2d6750e - pristine_git_object: 66dc2d82cece08f48fa0b8387a58a91fb2fba47c + last_write_checksum: sha1:f951ef0a92f250123fd0b55761462d86da629f3d + pristine_git_object: 7b425caaf82169dbb24e0f586b56c0995455be5d src/models/tokenexchangeresponse.ts: id: e2774cad9e5e last_write_checksum: sha1:b6df8a206e572d6058783b0d04d45726cae1d598 @@ -19227,6 +19255,14 @@ trackedFiles: id: f7909806f4e1 last_write_checksum: sha1:fbdbc3aa6a79633c1d12c1f4eb28f820964804f7 pristine_git_object: ebf610c9efacd08a3d9c5960465e9708564f7458 + src/models/vaulteffectivesecret.ts: + id: 0e9a217f3be7 + last_write_checksum: sha1:0ba03e286e92b3d730b18d4182bd4e466f6e0fdf + pristine_git_object: 0b2b0a631e921540bf00edfc393150ea592ce809 + src/models/vaulteffectivesecretlistresponse.ts: + id: 053f6551d3f4 + last_write_checksum: sha1:7bce76517f06d1568b577c88e138521430a6395d + pristine_git_object: bbd427e458ce5311b003816cf31d232815040e4a src/models/vaultsecret.ts: id: daa0ae6ffc96 last_write_checksum: sha1:2ef7624a977d16ce5546dba23aed15dbba49eb1c @@ -19457,8 +19493,8 @@ trackedFiles: pristine_git_object: 5c82fe389f888827f98aa52788b850ef43422e07 src/sdk/interns.ts: id: fc3b4e6c5008 - last_write_checksum: sha1:44ad31c08bc5f25f3048c0e7a3a5fd5e7dec677f - pristine_git_object: f55ab379944f24af8e8db60fd4b13e93965d5e11 + last_write_checksum: sha1:b9f1bdbf5343b7c9da3b949b0d3246c7a7e4c2ed + pristine_git_object: 5a881b1ded0ed6cc57609d61d11eaff0fa458fa3 src/sdk/models.ts: id: 8c761ab180fd last_write_checksum: sha1:0c5e5cefb7079fc69eb11ef157af6d2cb5255933 @@ -19517,8 +19553,8 @@ trackedFiles: pristine_git_object: 4d885b023e6aac47f225d63bfe3161b919681f88 src/sdk/vault.ts: id: adbb922fff4a - last_write_checksum: sha1:de2320505db5b9e852aa1a8797d5fbfbeeb78b27 - pristine_git_object: 418352481b3a27d27d56ab3d63dc8d61e1dde522 + last_write_checksum: sha1:74c9dee006dbe549f4e21abe5ad2dc988b64ee5a + pristine_git_object: 65c32ea3f43fb27a0072e4e59f50d994e3aafdf0 src/sdk/videogeneration.ts: id: db34eab5bd5b last_write_checksum: sha1:0e8a13f8ca379037c57417f0ebe9a9fe35dc3bea @@ -23190,16 +23226,178 @@ examples: application/json: {"error": {"code": 500, "message": "Internal Server Error"}} "502": application/json: {"error": {"code": 502, "message": "Provider returned error"}} + listInternEffectiveVaultSecrets: + speakeasy-default-list-intern-effective-vault-secrets: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "200": + application/json: {"data": [{"created_at": "2026-09-15T17:44:00.000Z", "fingerprint": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "hosts": ["api.github.com"], "name": "github_token", "scope": "intern"}, {"created_at": "2026-09-15T17:44:00.000Z", "fingerprint": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "hosts": ["api.linear.app"], "name": "linear_api_key", "scope": "workspace"}, {"created_at": "2026-08-01T09:30:00.000Z", "fingerprint": null, "hosts": null, "name": "legacy_token", "scope": "workspace"}], "has_more": false} + "400": + application/json: {"error": {"code": 400, "message": "Invalid request parameters"}} + "401": + application/json: {"error": {"code": 401, "message": "Missing Authentication header"}} + "403": + application/json: {"error": {"code": 403, "message": "Only management keys can perform this operation"}} + "404": + application/json: {"error": {"code": 404, "message": "Resource not found"}} + "408": + application/json: {"error": {"code": 408, "message": "Operation timed out. Please try again later."}} + "429": + application/json: {"error": {"code": 429, "message": "Rate limit exceeded"}} + "500": + application/json: {"error": {"code": 500, "message": "Internal Server Error"}} + "502": + application/json: {"error": {"code": 502, "message": "Provider returned error"}} + "503": + application/json: {"error": {"code": 503, "message": "Service temporarily unavailable"}} + "504": + application/json: {"error": {"code": 504, "message": "The operation was aborted due to timeout"}} + invalid-vault-request: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "400": + application/json: {"error": {"code": 400, "message": "Invalid vault request"}} + invalid-or-missing-api-key: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "401": + application/json: {"error": {"code": 401, "message": "Invalid or missing API key"}} + regional-hostname: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "403": + application/json: {"error": {"code": 403, "message": "The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai."}} + workspace-scope-unavailable: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "403": + application/json: {"error": {"code": 403, "message": "Vault scope is unavailable"}} + not-found: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "404": + application/json: {"error": {"code": 404, "message": "Not found"}} + body-timed-out: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "408": + application/json: {"error": {"code": 408, "message": "Request body timed out"}} + route-deadline: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "408": + application/json: {"error": {"code": 408, "message": "Vault request timed out"}} + rate-limited: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "429": + application/json: {"error": {"code": 429, "message": "Too many vault requests"}} + internal-error: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "500": + application/json: {"error": {"code": 500, "message": "Internal Server Error"}} + invalid-vault-response: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "502": + application/json: {"error": {"code": 502, "message": "Invalid vault response"}} + vault-request-failed: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "502": + application/json: {"error": {"code": 502, "message": "Vault request failed"}} + vault-unavailable: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "503": + application/json: {"error": {"code": 503, "message": "Vault service is unavailable"}} + writes-disabled: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "503": + application/json: {"error": {"code": 503, "message": "Vault writes are not enabled"}} + vault-timed-out: + parameters: + path: + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7" + query: + limit: 50 + offset: 0 + responses: + "504": + application/json: {"error": {"code": 504, "message": "Vault request timed out"}} examplesVersion: 1.0.2 releaseNotes: | ## Typescript SDK Changes: - * `openrouter.privateEndpoints.list()`: **Added** - * `openrouter.privateEndpoints.create()`: **Added** - * `openrouter.privateEndpoints.delete()`: **Added** - * `openrouter.privateEndpoints.get()`: **Added** - * `openrouter.privateEndpoints.update()`: **Added** - * `openrouter.privateEndpoints.activate()`: **Added** - * `openrouter.privateEndpoints.disable()`: **Added** - * `openrouter.privateEndpoints.enable()`: **Added** - * `openrouter.privateEndpoints.updatePricing()`: **Added** - * `openrouter.privateEndpoints.validate()`: **Added** + * `openrouter.vault.listInternEffectiveVaultSecrets()`: **Added** diff --git a/.speakeasy/gen.yaml b/.speakeasy/gen.yaml index c98ed14e1..702f7ddd8 100644 --- a/.speakeasy/gen.yaml +++ b/.speakeasy/gen.yaml @@ -37,7 +37,7 @@ generation: documentation: mintlify preApplyUnionDiscriminators: true typescript: - version: 1.4.0 + version: 1.4.1 acceptHeaderEnum: false additionalDependencies: dependencies: diff --git a/.speakeasy/out.openapi.yaml b/.speakeasy/out.openapi.yaml index 5fc93b523..66e2261f3 100644 --- a/.speakeasy/out.openapi.yaml +++ b/.speakeasy/out.openapi.yaml @@ -30774,6 +30774,90 @@ components: required: - 'workspace_id' type: 'object' + VaultEffectiveSecret: + additionalProperties: false + description: 'Metadata for the one secret the intern''s outbound requests receive under this name. The secret value is never returned. The intern receives it only on requests to a hostname in `hosts`, or on any request when `hosts` is `null`; a request to any other hostname receives no secret under this name, even when another vault holds one. `fingerprint` is comparable only within one vault.' + example: + created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + scope: 'intern' + properties: + created_at: + format: 'date-time' + type: 'string' + fingerprint: + pattern: '^sha256:[a-f0-9]{64}$' + type: + - 'string' + - 'null' + hosts: + items: + maxLength: 254 + type: 'string' + maxItems: 100 + minItems: 1 + type: + - 'array' + - 'null' + name: + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + scope: + description: 'Where the delivered secret is stored: `intern` for the intern''s own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault.' + enum: + - 'intern' + - 'attached' + - 'workspace' + type: 'string' + x-speakeasy-unknown-values: allow + required: + - 'name' + - 'hosts' + - 'fingerprint' + - 'created_at' + - 'scope' + type: 'object' + VaultEffectiveSecretListResponse: + additionalProperties: false + description: 'One page of the secrets an intern receives, one entry per name.' + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + scope: 'intern' + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' + hosts: + - 'api.linear.app' + name: 'linear_api_key' + scope: 'workspace' + - created_at: '2026-08-01T09:30:00.000Z' + fingerprint: null + hosts: null + name: 'legacy_token' + scope: 'workspace' + has_more: false + properties: + data: + items: + $ref: '#/components/schemas/VaultEffectiveSecret' + maxItems: 100 + type: 'array' + has_more: + description: 'True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries.' + type: 'boolean' + required: + - 'data' + - 'has_more' + type: 'object' VaultSecret: additionalProperties: false description: 'Metadata for one stored secret. The secret value is never returned. `fingerprint` is an HMAC-SHA-256 of the value keyed with that vault''s own data key, so it is comparable only within one vault: equal fingerprints in one vault mean equal values, and rewriting the same value keeps its fingerprint. The same value stored in two vaults (for example a workspace secret and its intern copy) carries different fingerprints, so comparing fingerprints across vaults cannot show that a copy matches or that a rotation propagated. `hosts` and `fingerprint` are `null` only for legacy rows written before host binding was required; storing the secret again assigns hosts.' @@ -39304,7 +39388,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /interns: get: - description: 'Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'listInterns' parameters: - description: 'Maximum number of interns to return, from 1 through 500.' @@ -39461,7 +39545,7 @@ paths: tags: - 'Interns' post: - description: 'Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'createIntern' parameters: - description: 'Key that makes retries resume the same create operation, from 1 through 255 characters. An empty or longer key is refused with 400. Without the header, the server derives a stable key from the request body.' @@ -39675,7 +39759,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /interns/{internId}: delete: - description: 'Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'deleteIntern' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -39834,7 +39918,7 @@ paths: tags: - 'Interns' get: - description: 'Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'getIntern' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -39933,7 +40017,7 @@ paths: tags: - 'Interns' patch: - description: 'Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'updateIntern' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -40339,7 +40423,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /interns/{internId}/daemon: get: - description: 'Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'getInternDaemon' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -40442,7 +40526,7 @@ paths: /interns/{internId}/daemon-access: get: deprecated: true - description: 'Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'getInternDaemonAccess' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -40755,7 +40839,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /interns/{internId}/provision: post: - description: 'Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'provisionIntern' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -40911,7 +40995,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /interns/{internId}/suspend: post: - description: 'Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern''s own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'suspendIntern' parameters: - description: 'ID of an intern visible to the authenticated API key.' @@ -48299,9 +48383,235 @@ paths: - $ref: "#/components/parameters/AppIdentifier" - $ref: "#/components/parameters/AppDisplayName" - $ref: "#/components/parameters/AppCategories" + /vault/interns/{internId}/effective-secrets: + get: + description: 'Lists, one entry per name, the secret the intern''s outbound requests receive: its own secrets, secrets from an attached vault, and workspace secrets, including ones stored before workspace-scoped storage. Where several vaults hold a name, the entry is the one that wins, in the order intern, attached, workspace. The same resolution decides what outbound requests receive, so this list and the intern''s requests agree. `scope` says which vault the entry comes from. Responses carry metadata only, never values. Results are ordered by name and paginated with `limit` and `offset`. Returns 404 when the intern''s attached vault is no longer available, since the intern then receives no secrets. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'listInternEffectiveVaultSecrets' + parameters: + - description: 'UUID of an intern in the workspace selected by the API key.' + in: 'path' + name: 'internId' + required: true + schema: + description: 'UUID of an intern in the workspace selected by the API key.' + example: '7c9e6679-7425-40de-944b-e07fc1f90ae7' + format: 'uuid' + type: 'string' + - description: 'Page size, 1 to 100. Defaults to 100.' + in: 'query' + name: 'limit' + required: false + schema: + default: 100 + description: 'Page size, 1 to 100. Defaults to 100.' + example: 50 + maximum: 100 + minimum: 1 + type: 'integer' + - description: 'Number of secrets to skip, 0 to 10000. Defaults to 0.' + in: 'query' + name: 'offset' + required: false + schema: + default: 0 + description: 'Number of secrets to skip, 0 to 10000. Defaults to 0.' + example: 0 + maximum: 10000 + minimum: 0 + type: 'integer' + responses: + '200': + content: + application/json: + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + scope: 'intern' + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' + hosts: + - 'api.linear.app' + name: 'linear_api_key' + scope: 'workspace' + - created_at: '2026-08-01T09:30:00.000Z' + fingerprint: null + hosts: null + name: 'legacy_token' + scope: 'workspace' + has_more: false + schema: + $ref: '#/components/schemas/VaultEffectiveSecretListResponse' + description: 'One page of the secrets the intern receives.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'List the secrets an intern receives' + tags: + - 'Vault' + parameters: + - $ref: "#/components/parameters/AppIdentifier" + - $ref: "#/components/parameters/AppDisplayName" + - $ref: "#/components/parameters/AppCategories" /vault/interns/{internId}/secrets: get: - description: 'Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Lists secret metadata stored for one intern. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'listInternVaultSecrets' parameters: - description: 'UUID of an intern in the workspace selected by the API key.' @@ -48411,7 +48721,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: @@ -48519,7 +48829,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /vault/interns/{internId}/secrets/{name}: delete: - description: 'Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'deleteInternVaultSecret' parameters: - description: 'UUID of an intern in the workspace selected by the API key.' @@ -48602,7 +48912,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: @@ -48705,7 +49015,7 @@ paths: tags: - 'Vault' put: - description: 'Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'storeInternVaultSecret' parameters: - description: 'UUID of an intern in the workspace selected by the API key.' @@ -48809,7 +49119,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: @@ -48943,7 +49253,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /vault/interns/{internId}/secrets/copy: post: - description: 'Copies the named workspace secrets into one intern''s scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Copies the named workspace secrets into one intern''s scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'copyVaultSecretsToIntern' parameters: - description: 'UUID of an intern in the workspace selected by the API key.' @@ -49035,7 +49345,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: @@ -49169,7 +49479,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /vault/secrets: get: - description: 'Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Lists secret metadata for the workspace of the authenticated API key. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'listVaultSecrets' parameters: - description: 'Page size, 1 to 100. Defaults to 100.' @@ -49270,7 +49580,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: @@ -49378,7 +49688,7 @@ paths: - $ref: "#/components/parameters/AppCategories" /vault/secrets/{name}: delete: - description: 'Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'deleteVaultSecret' parameters: - description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' @@ -49452,7 +49762,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: @@ -49555,7 +49865,7 @@ paths: tags: - 'Vault' put: - description: 'Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + description: 'Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern''s own API key is confined to that intern: it can always read the intern''s secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' operationId: 'storeVaultSecret' parameters: - description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' @@ -49650,7 +49960,7 @@ paths: message: 'Not found' schema: $ref: '#/components/schemas/NotFoundResponse' - description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + description: 'Not Found - The intern is not in the selected workspace or is not visible to the key (a member key without an admin role sees only interns its member created or interns in workspaces they administer), the secret does not exist in the selected scope, or the caller is outside the intern programme.' '408': content: application/json: diff --git a/.speakeasy/workflow.lock b/.speakeasy/workflow.lock index 7460953de..e0acea8f5 100644 --- a/.speakeasy/workflow.lock +++ b/.speakeasy/workflow.lock @@ -2,8 +2,8 @@ speakeasyVersion: 1.787.0 sources: OpenRouter API: sourceNamespace: open-router-chat-completions-api - sourceRevisionDigest: sha256:a529cc2d3941bec2ea744863bc08f7a239d30b7e72033a2cccaf01e94b9d4bb3 - sourceBlobDigest: sha256:fb9ecf2cce9df3d4e0c78943515eacfb28c95f13a12306535e7cf632290d61ff + sourceRevisionDigest: sha256:4a276d79b0f0aad6a714e25c3f8f7fe7e812f8dc4791653ee148242a283ca5f4 + sourceBlobDigest: sha256:5ffe733d2a2d2d28e357d4687a6be62eca30fe9a1d24490c01416145ee0a23b9 tags: - latest - 1.0.0 @@ -11,10 +11,10 @@ targets: openrouter: source: OpenRouter API sourceNamespace: open-router-chat-completions-api - sourceRevisionDigest: sha256:a529cc2d3941bec2ea744863bc08f7a239d30b7e72033a2cccaf01e94b9d4bb3 - sourceBlobDigest: sha256:fb9ecf2cce9df3d4e0c78943515eacfb28c95f13a12306535e7cf632290d61ff + sourceRevisionDigest: sha256:4a276d79b0f0aad6a714e25c3f8f7fe7e812f8dc4791653ee148242a283ca5f4 + sourceBlobDigest: sha256:5ffe733d2a2d2d28e357d4687a6be62eca30fe9a1d24490c01416145ee0a23b9 codeSamplesNamespace: open-router-chat-completions-api-typescript-code-samples - codeSamplesRevisionDigest: sha256:c5ec6edd5c4e93efdfc4143f121237e51f7b340f48434bfdcaa2107672446867 + codeSamplesRevisionDigest: sha256:605403f5ec8c8833f004c2ed0224231f60501b6ea647f09a8e8d8e3099222cf7 workflow: workflowVersion: 1.0.0 speakeasyVersion: 1.787.0 diff --git a/RELEASES.md b/RELEASES.md index 6579961be..bc11125e6 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -4156,4 +4156,14 @@ Based on: ### Generated - [typescript v1.4.0] . ### Releases -- [NPM v1.4.0] https://www.npmjs.com/package/@openrouter/sdk/v/1.4.0 - . \ No newline at end of file +- [NPM v1.4.0] https://www.npmjs.com/package/@openrouter/sdk/v/1.4.0 - . + +## 2026-09-29 02:08:19 +### Changes +Based on: +- OpenAPI Doc +- Speakeasy CLI 1.787.0 (2.914.0) https://github.com/speakeasy-api/speakeasy +### Generated +- [typescript v1.4.1] . +### Releases +- [NPM v1.4.1] https://www.npmjs.com/package/@openrouter/sdk/v/1.4.1 - . \ No newline at end of file diff --git a/docs/models/operations/listinterneffectivevaultsecretsglobals.mdx b/docs/models/operations/listinterneffectivevaultsecretsglobals.mdx new file mode 100644 index 000000000..3e627a5b3 --- /dev/null +++ b/docs/models/operations/listinterneffectivevaultsecretsglobals.mdx @@ -0,0 +1,19 @@ +--- +title: "ListInternEffectiveVaultSecretsGlobals" +--- + +## Example Usage + +```typescript +import { ListInternEffectiveVaultSecretsGlobals } from "@openrouter/sdk/models/operations"; + +let value: ListInternEffectiveVaultSecretsGlobals = {}; +``` + +## Fields + +| Field | Type | Required | Description | +| ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | +| `httpReferer` | *string* | :heavy_minus_sign: | The app identifier should be your app's URL and is used as the primary identifier for rankings.
This is used to track API usage per application.
| +| `appTitle` | *string* | :heavy_minus_sign: | The app display name allows you to customize how your app appears in OpenRouter's dashboard.
| +| `appCategories` | *string* | :heavy_minus_sign: | Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings.
| \ No newline at end of file diff --git a/docs/models/operations/listinterneffectivevaultsecretsrequest.mdx b/docs/models/operations/listinterneffectivevaultsecretsrequest.mdx new file mode 100644 index 000000000..8f8748a2b --- /dev/null +++ b/docs/models/operations/listinterneffectivevaultsecretsrequest.mdx @@ -0,0 +1,25 @@ +--- +title: "ListInternEffectiveVaultSecretsRequest" +--- + +## Example Usage + +```typescript +import { ListInternEffectiveVaultSecretsRequest } from "@openrouter/sdk/models/operations"; + +let value: ListInternEffectiveVaultSecretsRequest = { + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7", + limit: 50, +}; +``` + +## Fields + +| Field | Type | Required | Description | Example | +| ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | +| `httpReferer` | *string* | :heavy_minus_sign: | The app identifier should be your app's URL and is used as the primary identifier for rankings.
This is used to track API usage per application.
| | +| `appTitle` | *string* | :heavy_minus_sign: | The app display name allows you to customize how your app appears in OpenRouter's dashboard.
| | +| `appCategories` | *string* | :heavy_minus_sign: | Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings.
| | +| `internId` | *string* | :heavy_check_mark: | UUID of an intern in the workspace selected by the API key. | 7c9e6679-7425-40de-944b-e07fc1f90ae7 | +| `limit` | *number* | :heavy_minus_sign: | Page size, 1 to 100. Defaults to 100. | 50 | +| `offset` | *number* | :heavy_minus_sign: | Number of secrets to skip, 0 to 10000. Defaults to 0. | 0 | \ No newline at end of file diff --git a/docs/models/scope.mdx b/docs/models/scope.mdx deleted file mode 100644 index 0d989e650..000000000 --- a/docs/models/scope.mdx +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: "Scope" ---- - -Optional; only `inference` is available. - -## Example Usage - -```typescript -import { Scope } from "@openrouter/sdk/models"; - -let value: Scope = "inference"; -``` - -## Values - -```typescript -"inference" -``` \ No newline at end of file diff --git a/docs/models/tokenexchangerequest.mdx b/docs/models/tokenexchangerequest.mdx index 4f5a6c113..4fd88c444 100644 --- a/docs/models/tokenexchangerequest.mdx +++ b/docs/models/tokenexchangerequest.mdx @@ -24,6 +24,6 @@ let value: TokenExchangeRequest = { | `federationPolicyId` | *string* | :heavy_check_mark: | The federation policy to evaluate, from Settings → Workload identity. Binds the exchange to one organization. | 4b2f7d1e-8c3a-4e5f-9a6b-1c2d3e4f5a6b | | `grantType` | [models.GrantType](../models/granttype.mdx) | :heavy_check_mark: | Must be `urn:ietf:params:oauth:grant-type:token-exchange`. | urn:ietf:params:oauth:grant-type:token-exchange | | `requestedTokenType` | [models.RequestedTokenType](../models/requestedtokentype.mdx) | :heavy_minus_sign: | Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`. | urn:ietf:params:oauth:token-type:access_token | -| `scope` | [models.Scope](../models/scope.mdx) | :heavy_minus_sign: | Optional; only `inference` is available. | inference | +| `scope` | [models.TokenExchangeRequestScope](../models/tokenexchangerequestscope.mdx) | :heavy_minus_sign: | Optional; only `inference` is available. | inference | | `subjectToken` | *string* | :heavy_check_mark: | The JWT issued by your identity provider. | \ | | `subjectTokenType` | [models.SubjectTokenType](../models/subjecttokentype.mdx) | :heavy_check_mark: | Must be `urn:ietf:params:oauth:token-type:jwt`. | urn:ietf:params:oauth:token-type:jwt | \ No newline at end of file diff --git a/docs/models/tokenexchangerequestscope.mdx b/docs/models/tokenexchangerequestscope.mdx new file mode 100644 index 000000000..cc3c4dd07 --- /dev/null +++ b/docs/models/tokenexchangerequestscope.mdx @@ -0,0 +1,19 @@ +--- +title: "TokenExchangeRequestScope" +--- + +Optional; only `inference` is available. + +## Example Usage + +```typescript +import { TokenExchangeRequestScope } from "@openrouter/sdk/models"; + +let value: TokenExchangeRequestScope = "inference"; +``` + +## Values + +```typescript +"inference" +``` \ No newline at end of file diff --git a/docs/models/vaulteffectivesecret.mdx b/docs/models/vaulteffectivesecret.mdx new file mode 100644 index 000000000..4430f3457 --- /dev/null +++ b/docs/models/vaulteffectivesecret.mdx @@ -0,0 +1,32 @@ +--- +title: "VaultEffectiveSecret" +--- + +Metadata for the one secret the intern's outbound requests receive under this name. The secret value is never returned. The intern receives it only on requests to a hostname in `hosts`, or on any request when `hosts` is `null`; a request to any other hostname receives no secret under this name, even when another vault holds one. `fingerprint` is comparable only within one vault. + +## Example Usage + +```typescript +import { VaultEffectiveSecret } from "@openrouter/sdk/models"; + +let value: VaultEffectiveSecret = { + createdAt: new Date("2026-09-15T17:44:00.000Z"), + fingerprint: + "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", + hosts: [ + "api.github.com", + ], + name: "github_token", + scope: "intern", +}; +``` + +## Fields + +| Field | Type | Required | Description | +| -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `createdAt` | [Date](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date) | :heavy_check_mark: | N/A | +| `fingerprint` | *string* | :heavy_check_mark: | N/A | +| `hosts` | *string*[] | :heavy_check_mark: | N/A | +| `name` | *string* | :heavy_check_mark: | N/A | +| `scope` | [models.VaultEffectiveSecretScope](../models/vaulteffectivesecretscope.mdx) | :heavy_check_mark: | Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault. | \ No newline at end of file diff --git a/docs/models/vaulteffectivesecretlistresponse.mdx b/docs/models/vaulteffectivesecretlistresponse.mdx new file mode 100644 index 000000000..afade5fcf --- /dev/null +++ b/docs/models/vaulteffectivesecretlistresponse.mdx @@ -0,0 +1,51 @@ +--- +title: "VaultEffectiveSecretListResponse" +--- + +One page of the secrets an intern receives, one entry per name. + +## Example Usage + +```typescript +import { VaultEffectiveSecretListResponse } from "@openrouter/sdk/models"; + +let value: VaultEffectiveSecretListResponse = { + data: [ + { + createdAt: new Date("2026-09-15T17:44:00.000Z"), + fingerprint: + "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", + hosts: [ + "api.github.com", + ], + name: "github_token", + scope: "intern", + }, + { + createdAt: new Date("2026-09-15T17:44:00.000Z"), + fingerprint: + "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + hosts: [ + "api.linear.app", + ], + name: "linear_api_key", + scope: "workspace", + }, + { + createdAt: new Date("2026-08-01T09:30:00.000Z"), + fingerprint: null, + hosts: null, + name: "legacy_token", + scope: "workspace", + }, + ], + hasMore: false, +}; +``` + +## Fields + +| Field | Type | Required | Description | +| ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | +| `data` | [models.VaultEffectiveSecret](../models/vaulteffectivesecret.mdx)[] | :heavy_check_mark: | N/A | +| `hasMore` | *boolean* | :heavy_check_mark: | True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries. | \ No newline at end of file diff --git a/docs/models/vaulteffectivesecretscope.mdx b/docs/models/vaulteffectivesecretscope.mdx new file mode 100644 index 000000000..257dd2675 --- /dev/null +++ b/docs/models/vaulteffectivesecretscope.mdx @@ -0,0 +1,21 @@ +--- +title: "VaultEffectiveSecretScope" +--- + +Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault. + +## Example Usage + +```typescript +import { VaultEffectiveSecretScope } from "@openrouter/sdk/models"; + +let value: VaultEffectiveSecretScope = "attached"; + +// Open enum: unrecognized values are captured as Unrecognized +``` + +## Values + +```typescript +"intern" | "attached" | "workspace" | Unrecognized +``` \ No newline at end of file diff --git a/docs/sdks/interns/README.mdx b/docs/sdks/interns/README.mdx index 229d03a67..58668ffc9 100644 --- a/docs/sdks/interns/README.mdx +++ b/docs/sdks/interns/README.mdx @@ -23,7 +23,7 @@ Create, inspect, update, provision, suspend and delete OpenRouter interns throug ## listInterns -Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -99,7 +99,7 @@ run(); ## createIntern -Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -187,7 +187,7 @@ run(); ## deleteIntern -Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -273,7 +273,7 @@ run(); ## getIntern -Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -353,7 +353,7 @@ run(); ## updateIntern -Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -441,7 +441,7 @@ run(); ## getInternDaemon -Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -521,7 +521,7 @@ run(); ## ~~getInternDaemonAccess~~ -Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. > :warning: **DEPRECATED**: This will be removed in a future release, please migrate away from it as soon as possible. @@ -603,7 +603,7 @@ run(); ## provisionIntern -Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -683,7 +683,7 @@ run(); ## suspendIntern -Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage diff --git a/docs/sdks/vault/README.mdx b/docs/sdks/vault/README.mdx index 30a5e8e15..f537caf25 100644 --- a/docs/sdks/vault/README.mdx +++ b/docs/sdks/vault/README.mdx @@ -9,6 +9,7 @@ Store host-bound secrets for a workspace or for one intern. Scope is selected by ### Available Operations +* [listInternEffectiveVaultSecrets](#listinterneffectivevaultsecrets) - List the secrets an intern receives * [listInternVaultSecrets](#listinternvaultsecrets) - List intern secrets * [deleteInternVaultSecret](#deleteinternvaultsecret) - Delete an intern secret * [storeInternVaultSecret](#storeinternvaultsecret) - Store an intern secret @@ -17,9 +18,99 @@ Store host-bound secrets for a workspace or for one intern. Scope is selected by * [deleteVaultSecret](#deletevaultsecret) - Delete a workspace secret * [storeVaultSecret](#storevaultsecret) - Store a workspace secret +## listInternEffectiveVaultSecrets + +Lists, one entry per name, the secret the intern's outbound requests receive: its own secrets, secrets from an attached vault, and workspace secrets, including ones stored before workspace-scoped storage. Where several vaults hold a name, the entry is the one that wins, in the order intern, attached, workspace. The same resolution decides what outbound requests receive, so this list and the intern's requests agree. `scope` says which vault the entry comes from. Responses carry metadata only, never values. Results are ordered by name and paginated with `limit` and `offset`. Returns 404 when the intern's attached vault is no longer available, since the intern then receives no secrets. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + +### Example Usage + +```typescript +import { OpenRouter } from "@openrouter/sdk"; + +const openRouter = new OpenRouter({ + httpReferer: "", + appTitle: "", + appCategories: "", + apiKey: process.env["OPENROUTER_API_KEY"] ?? "", +}); + +async function run() { + const result = await openRouter.vault.listInternEffectiveVaultSecrets({ + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7", + limit: 50, + }); + + console.log(result); +} + +run(); +``` + +### Standalone function + +The standalone function version of this method: + +```typescript +import { OpenRouterCore } from "@openrouter/sdk/core.js"; +import { vaultListInternEffectiveVaultSecrets } from "@openrouter/sdk/funcs/vaultListInternEffectiveVaultSecrets.js"; + +// Use `OpenRouterCore` for best tree-shaking performance. +// You can create one instance of it to use across an application. +const openRouter = new OpenRouterCore({ + httpReferer: "", + appTitle: "", + appCategories: "", + apiKey: process.env["OPENROUTER_API_KEY"] ?? "", +}); + +async function run() { + const res = await vaultListInternEffectiveVaultSecrets(openRouter, { + internId: "7c9e6679-7425-40de-944b-e07fc1f90ae7", + limit: 50, + }); + if (res.ok) { + const { value: result } = res; + console.log(result); + } else { + console.log("vaultListInternEffectiveVaultSecrets failed:", res.error); + } +} + +run(); +``` + +### Parameters + +| Parameter | Type | Required | Description | +| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `request` | [operations.ListInternEffectiveVaultSecretsRequest](../../models/operations/listinterneffectivevaultsecretsrequest.mdx) | :heavy_check_mark: | The request object to use for the request. | +| `options` | RequestOptions | :heavy_minus_sign: | Used to set various options for making HTTP requests. | +| `options.fetchOptions` | [RequestInit](https://developer.mozilla.org/en-US/docs/Web/API/Request/Request#options) | :heavy_minus_sign: | Options that are passed to the underlying HTTP request. This can be used to inject extra headers for examples. All `Request` options, except `method` and `body`, are allowed. | +| `options.retries` | [RetryConfig](../../lib/utils/retryconfig.mdx) | :heavy_minus_sign: | Enables retrying HTTP requests under certain failure conditions. | + +### Response + +**Promise\<[models.VaultEffectiveSecretListResponse](../../models/vaulteffectivesecretlistresponse.mdx)\>** + +### Errors + +| Error Type | Status Code | Content Type | +| -------------------------------------- | -------------------------------------- | -------------------------------------- | +| errors.BadRequestResponseError | 400 | application/json | +| errors.UnauthorizedResponseError | 401 | application/json | +| errors.ForbiddenResponseError | 403 | application/json | +| errors.NotFoundResponseError | 404 | application/json | +| errors.RequestTimeoutResponseError | 408 | application/json | +| errors.TooManyRequestsResponseError | 429 | application/json | +| errors.InternalServerResponseError | 500 | application/json | +| errors.BadGatewayResponseError | 502 | application/json | +| errors.ServiceUnavailableResponseError | 503 | application/json | +| errors.GatewayTimeoutResponseError | 504 | application/json | +| errors.OpenRouterDefaultError | 4XX, 5XX | \*/\* | + ## listInternVaultSecrets -Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Lists secret metadata stored for one intern. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -109,7 +200,7 @@ run(); ## deleteInternVaultSecret -Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -199,7 +290,7 @@ run(); ## storeInternVaultSecret -Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage: body-timed-out @@ -1323,7 +1414,7 @@ run(); ## copyVaultSecretsToIntern -Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage: body-timed-out @@ -2383,7 +2474,7 @@ run(); ## listVaultSecrets -Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Lists secret metadata for the workspace of the authenticated API key. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -2467,7 +2558,7 @@ run(); ## deleteVaultSecret -Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage @@ -2555,7 +2646,7 @@ run(); ## storeVaultSecret -Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. +Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. ### Example Usage: body-timed-out diff --git a/jsr.json b/jsr.json index 76f67d38d..6e684a843 100644 --- a/jsr.json +++ b/jsr.json @@ -2,7 +2,7 @@ { "name": "@openrouter/sdk", - "version": "1.4.0", + "version": "1.4.1", "exports": { ".": "./src/index.ts", "./models/errors": "./src/models/errors/index.ts", diff --git a/package.json b/package.json index 8841b3ac7..3505a46bc 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@openrouter/sdk", - "version": "1.4.0", + "version": "1.4.1", "author": "OpenRouter", "description": "The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.", "keywords": [ @@ -21,8 +21,8 @@ "license": "Apache-2.0", "packageManager": "pnpm@10.22.0", "publishConfig": { - "access": "public", - "provenance": true + "provenance": true, + "access": "public" }, "type": "module", "main": "./esm/index.js", @@ -73,15 +73,15 @@ "lint": "eslint --cache --max-warnings=0 src", "build": "tsc && node scripts/unbarrel-imports.js", "prepublishOnly": "npm run build", - "typecheck": "tsc --noEmit", - "compile": "tsc && node scripts/unbarrel-imports.js", - "postinstall": "node scripts/check-types.js || true", "prepare": "npm run build", - "test:watch": "vitest --watch --project unit", - "typecheck:transit": "exit 0", "test": "vitest --run --project unit", "test:e2e": "vitest --run --project e2e", - "test:transit": "exit 0" + "test:transit": "exit 0", + "test:watch": "vitest --watch --project unit", + "typecheck": "tsc --noEmit", + "compile": "tsc && node scripts/unbarrel-imports.js", + "postinstall": "node scripts/check-types.js || true", + "typecheck:transit": "exit 0" }, "peerDependencies": { diff --git a/src/funcs/internsCreateIntern.ts b/src/funcs/internsCreateIntern.ts index 8081c1a61..7bf7c9123 100644 --- a/src/funcs/internsCreateIntern.ts +++ b/src/funcs/internsCreateIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Create an intern * * @remarks - * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsDeleteIntern.ts b/src/funcs/internsDeleteIntern.ts index ffda40ba9..76ca8ecad 100644 --- a/src/funcs/internsDeleteIntern.ts +++ b/src/funcs/internsDeleteIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Delete an intern * * @remarks - * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsGetIntern.ts b/src/funcs/internsGetIntern.ts index 84985cfee..c63d853cc 100644 --- a/src/funcs/internsGetIntern.ts +++ b/src/funcs/internsGetIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Get an intern * * @remarks - * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsGetInternDaemon.ts b/src/funcs/internsGetInternDaemon.ts index 00c6a4c15..8ddfabc31 100644 --- a/src/funcs/internsGetInternDaemon.ts +++ b/src/funcs/internsGetInternDaemon.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Get an intern's daemon access * * @remarks - * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsGetInternDaemonAccess.ts b/src/funcs/internsGetInternDaemonAccess.ts index a60cc0769..7d1a84bfb 100644 --- a/src/funcs/internsGetInternDaemonAccess.ts +++ b/src/funcs/internsGetInternDaemonAccess.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Get an intern's daemon access (deprecated alias) * * @remarks - * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. * diff --git a/src/funcs/internsListInterns.ts b/src/funcs/internsListInterns.ts index 48cd8682b..0e9759784 100644 --- a/src/funcs/internsListInterns.ts +++ b/src/funcs/internsListInterns.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * List interns * * @remarks - * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsProvisionIntern.ts b/src/funcs/internsProvisionIntern.ts index 6d022614a..84f3dddbf 100644 --- a/src/funcs/internsProvisionIntern.ts +++ b/src/funcs/internsProvisionIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Provision an intern * * @remarks - * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsSuspendIntern.ts b/src/funcs/internsSuspendIntern.ts index e1668e0fb..5c20a90b1 100644 --- a/src/funcs/internsSuspendIntern.ts +++ b/src/funcs/internsSuspendIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Suspend an intern * * @remarks - * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/internsUpdateIntern.ts b/src/funcs/internsUpdateIntern.ts index 23c9a21b0..8f5a82f87 100644 --- a/src/funcs/internsUpdateIntern.ts +++ b/src/funcs/internsUpdateIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Update an intern * * @remarks - * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultCopyVaultSecretsToIntern.ts b/src/funcs/vaultCopyVaultSecretsToIntern.ts index 526fbaee4..9d243e38c 100644 --- a/src/funcs/vaultCopyVaultSecretsToIntern.ts +++ b/src/funcs/vaultCopyVaultSecretsToIntern.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Copy workspace secrets to an intern * * @remarks - * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultDeleteInternVaultSecret.ts b/src/funcs/vaultDeleteInternVaultSecret.ts index 25af9eaea..d090681b0 100644 --- a/src/funcs/vaultDeleteInternVaultSecret.ts +++ b/src/funcs/vaultDeleteInternVaultSecret.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Delete an intern secret * * @remarks - * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultDeleteVaultSecret.ts b/src/funcs/vaultDeleteVaultSecret.ts index 403d962a9..545d976d7 100644 --- a/src/funcs/vaultDeleteVaultSecret.ts +++ b/src/funcs/vaultDeleteVaultSecret.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Delete a workspace secret * * @remarks - * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultListInternEffectiveVaultSecrets.ts b/src/funcs/vaultListInternEffectiveVaultSecrets.ts new file mode 100644 index 000000000..7168ce2b5 --- /dev/null +++ b/src/funcs/vaultListInternEffectiveVaultSecrets.ts @@ -0,0 +1,252 @@ +/* + * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT. + * @generated-id: f8d9b6f715e3 + */ + +import { OpenRouterCore } from "../core.js"; +import { encodeFormQuery, encodeSimple } from "../lib/encodings.js"; +import { matchStatusCode } from "../lib/http.js"; +import * as M from "../lib/matchers.js"; +import { compactMap } from "../lib/primitives.js"; +import { safeParse } from "../lib/schemas.js"; +import { RequestOptions } from "../lib/sdks.js"; +import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js"; +import { pathToFunc } from "../lib/url.js"; +import { + ConnectionError, + InvalidRequestError, + RequestAbortedError, + RequestTimeoutError, + UnexpectedClientError, +} from "../models/errors/httpclienterrors.js"; +import * as errors from "../models/errors/index.js"; +import { OpenRouterError } from "../models/errors/openroutererror.js"; +import { ResponseValidationError } from "../models/errors/responsevalidationerror.js"; +import { SDKValidationError } from "../models/errors/sdkvalidationerror.js"; +import * as models from "../models/index.js"; +import * as operations from "../models/operations/index.js"; +import { APICall, APIPromise } from "../types/async.js"; +import { Result } from "../types/fp.js"; + +/** + * List the secrets an intern receives + * + * @remarks + * Lists, one entry per name, the secret the intern's outbound requests receive: its own secrets, secrets from an attached vault, and workspace secrets, including ones stored before workspace-scoped storage. Where several vaults hold a name, the entry is the one that wins, in the order intern, attached, workspace. The same resolution decides what outbound requests receive, so this list and the intern's requests agree. `scope` says which vault the entry comes from. Responses carry metadata only, never values. Results are ordered by name and paginated with `limit` and `offset`. Returns 404 when the intern's attached vault is no longer available, since the intern then receives no secrets. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * + * If set, this operation will use {@link Security.apiKey} from the global security. + */ +export function vaultListInternEffectiveVaultSecrets( + client: OpenRouterCore, + request: operations.ListInternEffectiveVaultSecretsRequest, + options?: RequestOptions, +): APIPromise< + Result< + models.VaultEffectiveSecretListResponse, + | errors.BadRequestResponseError + | errors.UnauthorizedResponseError + | errors.ForbiddenResponseError + | errors.NotFoundResponseError + | errors.RequestTimeoutResponseError + | errors.TooManyRequestsResponseError + | errors.InternalServerResponseError + | errors.BadGatewayResponseError + | errors.ServiceUnavailableResponseError + | errors.GatewayTimeoutResponseError + | OpenRouterError + | ResponseValidationError + | ConnectionError + | RequestAbortedError + | RequestTimeoutError + | InvalidRequestError + | UnexpectedClientError + | SDKValidationError + > +> { + return new APIPromise($do( + client, + request, + options, + )); +} + +async function $do( + client: OpenRouterCore, + request: operations.ListInternEffectiveVaultSecretsRequest, + options?: RequestOptions, +): Promise< + [ + Result< + models.VaultEffectiveSecretListResponse, + | errors.BadRequestResponseError + | errors.UnauthorizedResponseError + | errors.ForbiddenResponseError + | errors.NotFoundResponseError + | errors.RequestTimeoutResponseError + | errors.TooManyRequestsResponseError + | errors.InternalServerResponseError + | errors.BadGatewayResponseError + | errors.ServiceUnavailableResponseError + | errors.GatewayTimeoutResponseError + | OpenRouterError + | ResponseValidationError + | ConnectionError + | RequestAbortedError + | RequestTimeoutError + | InvalidRequestError + | UnexpectedClientError + | SDKValidationError + >, + APICall, + ] +> { + const parsed = safeParse( + request, + (value) => + operations.ListInternEffectiveVaultSecretsRequest$outboundSchema.parse( + value, + ), + "Input validation failed", + ); + if (!parsed.ok) { + return [parsed, { status: "invalid" }]; + } + const payload = parsed.value; + const body = null; + + const pathParams = { + internId: encodeSimple("internId", payload.internId, { + explode: false, + charEncoding: "percent", + }), + }; + const path = pathToFunc("/vault/interns/{internId}/effective-secrets")( + pathParams, + ); + + const query = encodeFormQuery({ + "limit": payload.limit, + "offset": payload.offset, + }); + + const headers = new Headers(compactMap({ + Accept: "application/json", + "HTTP-Referer": encodeSimple( + "HTTP-Referer", + payload["HTTP-Referer"] ?? client._options.httpReferer, + { explode: false, charEncoding: "none" }, + ), + "X-OpenRouter-Categories": encodeSimple( + "X-OpenRouter-Categories", + payload.appCategories ?? client._options.appCategories, + { explode: false, charEncoding: "none" }, + ), + "X-OpenRouter-Title": encodeSimple( + "X-OpenRouter-Title", + payload.appTitle ?? client._options.appTitle, + { explode: false, charEncoding: "none" }, + ), + })); + + const secConfig = await extractSecurity(client._options.apiKey); + const securityInput = secConfig == null ? {} : { apiKey: secConfig }; + const requestSecurity = resolveGlobalSecurity(securityInput, [0]); + + const context = { + options: client._options, + baseURL: options?.serverURL ?? client._baseURL ?? "", + operationID: "listInternEffectiveVaultSecrets", + oAuth2Scopes: null, + + resolvedSecurity: requestSecurity, + + securitySource: client._options.apiKey, + retryConfig: options?.retries + || client._options.retryConfig + || { + strategy: "backoff", + backoff: { + initialInterval: 500, + maxInterval: 60000, + exponent: 1.5, + maxElapsedTime: 3600000, + }, + retryConnectionErrors: true, + } + || { strategy: "none" }, + retryCodes: options?.retryCodes || ["5XX"], + }; + + const requestRes = client._createRequest(context, { + security: requestSecurity, + method: "GET", + baseURL: options?.serverURL, + path: path, + headers: headers, + query: query, + body: body, + userAgent: client._options.userAgent, + timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1, + }, options); + if (!requestRes.ok) { + return [requestRes, { status: "invalid" }]; + } + const req = requestRes.value; + + const doResult = await client._do(req, { + context, + isErrorStatusCode: (statusCode: number) => + matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]), + retryConfig: context.retryConfig, + retryCodes: context.retryCodes, + }); + if (!doResult.ok) { + return [doResult, { status: "request-error", request: req }]; + } + const response = doResult.value; + + const responseFields = { + HttpMeta: { Response: response, Request: req }, + }; + + const [result] = await M.match< + models.VaultEffectiveSecretListResponse, + | errors.BadRequestResponseError + | errors.UnauthorizedResponseError + | errors.ForbiddenResponseError + | errors.NotFoundResponseError + | errors.RequestTimeoutResponseError + | errors.TooManyRequestsResponseError + | errors.InternalServerResponseError + | errors.BadGatewayResponseError + | errors.ServiceUnavailableResponseError + | errors.GatewayTimeoutResponseError + | OpenRouterError + | ResponseValidationError + | ConnectionError + | RequestAbortedError + | RequestTimeoutError + | InvalidRequestError + | UnexpectedClientError + | SDKValidationError + >( + M.json(200, models.VaultEffectiveSecretListResponse$inboundSchema), + M.jsonErr(400, errors.BadRequestResponseError$inboundSchema), + M.jsonErr(401, errors.UnauthorizedResponseError$inboundSchema), + M.jsonErr(403, errors.ForbiddenResponseError$inboundSchema), + M.jsonErr(404, errors.NotFoundResponseError$inboundSchema), + M.jsonErr(408, errors.RequestTimeoutResponseError$inboundSchema), + M.jsonErr(429, errors.TooManyRequestsResponseError$inboundSchema), + M.jsonErr(500, errors.InternalServerResponseError$inboundSchema), + M.jsonErr(502, errors.BadGatewayResponseError$inboundSchema), + M.jsonErr(503, errors.ServiceUnavailableResponseError$inboundSchema), + M.jsonErr(504, errors.GatewayTimeoutResponseError$inboundSchema), + M.fail("4XX"), + M.fail("5XX"), + )(response, req, { extraFields: responseFields }); + if (!result.ok) { + return [result, { status: "complete", request: req, response }]; + } + + return [result, { status: "complete", request: req, response }]; +} diff --git a/src/funcs/vaultListInternVaultSecrets.ts b/src/funcs/vaultListInternVaultSecrets.ts index 84c05cb14..7c3ed63c8 100644 --- a/src/funcs/vaultListInternVaultSecrets.ts +++ b/src/funcs/vaultListInternVaultSecrets.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * List intern secrets * * @remarks - * Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Lists secret metadata stored for one intern. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultListVaultSecrets.ts b/src/funcs/vaultListVaultSecrets.ts index bada0a942..96980dcfb 100644 --- a/src/funcs/vaultListVaultSecrets.ts +++ b/src/funcs/vaultListVaultSecrets.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * List workspace secrets * * @remarks - * Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Lists secret metadata for the workspace of the authenticated API key. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultStoreInternVaultSecret.ts b/src/funcs/vaultStoreInternVaultSecret.ts index 6cfaad97c..8deb2e158 100644 --- a/src/funcs/vaultStoreInternVaultSecret.ts +++ b/src/funcs/vaultStoreInternVaultSecret.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Store an intern secret * * @remarks - * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/funcs/vaultStoreVaultSecret.ts b/src/funcs/vaultStoreVaultSecret.ts index 7fba356aa..e2f549547 100644 --- a/src/funcs/vaultStoreVaultSecret.ts +++ b/src/funcs/vaultStoreVaultSecret.ts @@ -32,7 +32,7 @@ import { Result } from "../types/fp.js"; * Store a workspace secret * * @remarks - * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * If set, this operation will use {@link Security.apiKey} from the global security. */ diff --git a/src/lib/config.ts b/src/lib/config.ts index 7eaf25450..065d7338b 100644 --- a/src/lib/config.ts +++ b/src/lib/config.ts @@ -79,7 +79,7 @@ export function serverURLFromOptions(options: SDKOptions): URL | null { export const SDK_METADATA = { language: "typescript", openapiDocVersion: "1.0.0", - sdkVersion: "1.4.0", + sdkVersion: "1.4.1", genVersion: "2.914.0", - userAgent: "speakeasy-sdk/typescript 1.4.0 2.914.0 1.0.0 @openrouter/sdk", + userAgent: "speakeasy-sdk/typescript 1.4.1 2.914.0 1.0.0 @openrouter/sdk", } as const; diff --git a/src/models/index.ts b/src/models/index.ts index a0d021c48..c8e320117 100644 --- a/src/models/index.ts +++ b/src/models/index.ts @@ -760,6 +760,8 @@ export * from "./upsertworkspacebudgetrequest.js"; export * from "./upsertworkspacebudgetresponse.js"; export * from "./urlcitation.js"; export * from "./validateprivateendpointrequest.js"; +export * from "./vaulteffectivesecret.js"; +export * from "./vaulteffectivesecretlistresponse.js"; export * from "./vaultsecret.js"; export * from "./vaultsecretcopyrequest.js"; export * from "./vaultsecretcopyresponse.js"; diff --git a/src/models/operations/index.ts b/src/models/operations/index.ts index 700a9ee1d..dffc4fdce 100644 --- a/src/models/operations/index.ts +++ b/src/models/operations/index.ts @@ -100,6 +100,7 @@ export * from "./listguardrailmemberassignments.js"; export * from "./listguardrails.js"; export * from "./listimagemodelendpoints.js"; export * from "./listimagemodels.js"; +export * from "./listinterneffectivevaultsecrets.js"; export * from "./listinterns.js"; export * from "./listinternvaultsecrets.js"; export * from "./listkeyassignments.js"; diff --git a/src/models/operations/listinterneffectivevaultsecrets.ts b/src/models/operations/listinterneffectivevaultsecrets.ts new file mode 100644 index 000000000..50bfa2a63 --- /dev/null +++ b/src/models/operations/listinterneffectivevaultsecrets.ts @@ -0,0 +1,101 @@ +/* + * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT. + * @generated-id: 8162d29b4032 + */ + +import * as z from "zod/v4"; +import { remap as remap$ } from "../../lib/primitives.js"; + +export type ListInternEffectiveVaultSecretsGlobals = { + /** + * The app identifier should be your app's URL and is used as the primary identifier for rankings. + * + * @remarks + * This is used to track API usage per application. + */ + httpReferer?: string | undefined; + /** + * The app display name allows you to customize how your app appears in OpenRouter's dashboard. + * + * @remarks + */ + appTitle?: string | undefined; + /** + * Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings. + * + * @remarks + */ + appCategories?: string | undefined; +}; + +export type ListInternEffectiveVaultSecretsRequest = { + /** + * The app identifier should be your app's URL and is used as the primary identifier for rankings. + * + * @remarks + * This is used to track API usage per application. + */ + httpReferer?: string | undefined; + /** + * The app display name allows you to customize how your app appears in OpenRouter's dashboard. + * + * @remarks + */ + appTitle?: string | undefined; + /** + * Comma-separated list of app categories (e.g. "cli-agent,cloud-agent"). Used for marketplace rankings. + * + * @remarks + */ + appCategories?: string | undefined; + /** + * UUID of an intern in the workspace selected by the API key. + */ + internId: string; + /** + * Page size, 1 to 100. Defaults to 100. + */ + limit?: number | undefined; + /** + * Number of secrets to skip, 0 to 10000. Defaults to 0. + */ + offset?: number | undefined; +}; + +/** @internal */ +export type ListInternEffectiveVaultSecretsRequest$Outbound = { + "HTTP-Referer"?: string | undefined; + appTitle?: string | undefined; + appCategories?: string | undefined; + internId: string; + limit: number; + offset: number; +}; + +/** @internal */ +export const ListInternEffectiveVaultSecretsRequest$outboundSchema: z.ZodType< + ListInternEffectiveVaultSecretsRequest$Outbound, + ListInternEffectiveVaultSecretsRequest +> = z.object({ + httpReferer: z.string().optional(), + appTitle: z.string().optional(), + appCategories: z.string().optional(), + internId: z.string(), + limit: z.int().default(100), + offset: z.int().default(0), +}).transform((v) => { + return remap$(v, { + httpReferer: "HTTP-Referer", + }); +}); + +export function listInternEffectiveVaultSecretsRequestToJSON( + listInternEffectiveVaultSecretsRequest: + ListInternEffectiveVaultSecretsRequest, +): string { + return JSON.stringify( + ListInternEffectiveVaultSecretsRequest$outboundSchema.parse( + listInternEffectiveVaultSecretsRequest, + ), + ); +} diff --git a/src/models/tokenexchangerequest.ts b/src/models/tokenexchangerequest.ts index 66dc2d82c..7b425caaf 100644 --- a/src/models/tokenexchangerequest.ts +++ b/src/models/tokenexchangerequest.ts @@ -34,13 +34,15 @@ export type RequestedTokenType = ClosedEnum; /** * Optional; only `inference` is available. */ -export const Scope = { +export const TokenExchangeRequestScope = { Inference: "inference", } as const; /** * Optional; only `inference` is available. */ -export type Scope = ClosedEnum; +export type TokenExchangeRequestScope = ClosedEnum< + typeof TokenExchangeRequestScope +>; /** * Must be `urn:ietf:params:oauth:token-type:jwt`. @@ -72,7 +74,7 @@ export type TokenExchangeRequest = { /** * Optional; only `inference` is available. */ - scope?: Scope | undefined; + scope?: TokenExchangeRequestScope | undefined; /** * The JWT issued by your identity provider. */ @@ -94,7 +96,9 @@ export const RequestedTokenType$outboundSchema: z.ZodEnum< > = z.enum(RequestedTokenType); /** @internal */ -export const Scope$outboundSchema: z.ZodEnum = z.enum(Scope); +export const TokenExchangeRequestScope$outboundSchema: z.ZodEnum< + typeof TokenExchangeRequestScope +> = z.enum(TokenExchangeRequestScope); /** @internal */ export const SubjectTokenType$outboundSchema: z.ZodEnum< @@ -119,7 +123,7 @@ export const TokenExchangeRequest$outboundSchema: z.ZodType< federationPolicyId: z.string(), grantType: GrantType$outboundSchema, requestedTokenType: RequestedTokenType$outboundSchema.optional(), - scope: Scope$outboundSchema.optional(), + scope: TokenExchangeRequestScope$outboundSchema.optional(), subjectToken: z.string(), subjectTokenType: SubjectTokenType$outboundSchema, }).transform((v) => { diff --git a/src/models/vaulteffectivesecret.ts b/src/models/vaulteffectivesecret.ts new file mode 100644 index 000000000..0b2b0a631 --- /dev/null +++ b/src/models/vaulteffectivesecret.ts @@ -0,0 +1,73 @@ +/* + * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT. + * @generated-id: 0e9a217f3be7 + */ + +import * as z from "zod/v4"; +import { remap as remap$ } from "../lib/primitives.js"; +import { safeParse } from "../lib/schemas.js"; +import * as openEnums from "../types/enums.js"; +import { OpenEnum } from "../types/enums.js"; +import { Result as SafeParseResult } from "../types/fp.js"; +import { SDKValidationError } from "./errors/sdkvalidationerror.js"; + +/** + * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault. + */ +export const VaultEffectiveSecretScope = { + Intern: "intern", + Attached: "attached", + Workspace: "workspace", +} as const; +/** + * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault. + */ +export type VaultEffectiveSecretScope = OpenEnum< + typeof VaultEffectiveSecretScope +>; + +/** + * Metadata for the one secret the intern's outbound requests receive under this name. The secret value is never returned. The intern receives it only on requests to a hostname in `hosts`, or on any request when `hosts` is `null`; a request to any other hostname receives no secret under this name, even when another vault holds one. `fingerprint` is comparable only within one vault. + */ +export type VaultEffectiveSecret = { + createdAt: Date; + fingerprint: string | null; + hosts: Array | null; + name: string; + /** + * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault. + */ + scope: VaultEffectiveSecretScope; +}; + +/** @internal */ +export const VaultEffectiveSecretScope$inboundSchema: z.ZodType< + VaultEffectiveSecretScope, + unknown +> = openEnums.inboundSchema(VaultEffectiveSecretScope); + +/** @internal */ +export const VaultEffectiveSecret$inboundSchema: z.ZodType< + VaultEffectiveSecret, + unknown +> = z.object({ + created_at: z.iso.datetime({ offset: true }).transform(v => new Date(v)), + fingerprint: z.nullable(z.string()), + hosts: z.nullable(z.array(z.string())), + name: z.string(), + scope: VaultEffectiveSecretScope$inboundSchema, +}).transform((v) => { + return remap$(v, { + "created_at": "createdAt", + }); +}); + +export function vaultEffectiveSecretFromJSON( + jsonString: string, +): SafeParseResult { + return safeParse( + jsonString, + (x) => VaultEffectiveSecret$inboundSchema.parse(JSON.parse(x)), + `Failed to parse 'VaultEffectiveSecret' from JSON`, + ); +} diff --git a/src/models/vaulteffectivesecretlistresponse.ts b/src/models/vaulteffectivesecretlistresponse.ts new file mode 100644 index 000000000..bbd427e45 --- /dev/null +++ b/src/models/vaulteffectivesecretlistresponse.ts @@ -0,0 +1,48 @@ +/* + * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT. + * @generated-id: 053f6551d3f4 + */ + +import * as z from "zod/v4"; +import { remap as remap$ } from "../lib/primitives.js"; +import { safeParse } from "../lib/schemas.js"; +import { Result as SafeParseResult } from "../types/fp.js"; +import { SDKValidationError } from "./errors/sdkvalidationerror.js"; +import { + VaultEffectiveSecret, + VaultEffectiveSecret$inboundSchema, +} from "./vaulteffectivesecret.js"; + +/** + * One page of the secrets an intern receives, one entry per name. + */ +export type VaultEffectiveSecretListResponse = { + data: Array; + /** + * True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries. + */ + hasMore: boolean; +}; + +/** @internal */ +export const VaultEffectiveSecretListResponse$inboundSchema: z.ZodType< + VaultEffectiveSecretListResponse, + unknown +> = z.object({ + data: z.array(VaultEffectiveSecret$inboundSchema), + has_more: z.boolean(), +}).transform((v) => { + return remap$(v, { + "has_more": "hasMore", + }); +}); + +export function vaultEffectiveSecretListResponseFromJSON( + jsonString: string, +): SafeParseResult { + return safeParse( + jsonString, + (x) => VaultEffectiveSecretListResponse$inboundSchema.parse(JSON.parse(x)), + `Failed to parse 'VaultEffectiveSecretListResponse' from JSON`, + ); +} diff --git a/src/sdk/interns.ts b/src/sdk/interns.ts index f55ab3799..5a881b1de 100644 --- a/src/sdk/interns.ts +++ b/src/sdk/interns.ts @@ -24,7 +24,7 @@ export class Interns extends ClientSDK { * List interns * * @remarks - * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async listInterns( request?: operations.ListInternsRequest | undefined, @@ -41,7 +41,7 @@ export class Interns extends ClientSDK { * Create an intern * * @remarks - * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async createIntern( request: operations.CreateInternRequest, @@ -58,7 +58,7 @@ export class Interns extends ClientSDK { * Delete an intern * * @remarks - * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async deleteIntern( request: operations.DeleteInternRequest, @@ -75,7 +75,7 @@ export class Interns extends ClientSDK { * Get an intern * * @remarks - * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async getIntern( request: operations.GetInternRequest, @@ -92,7 +92,7 @@ export class Interns extends ClientSDK { * Update an intern * * @remarks - * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async updateIntern( request: operations.UpdateInternRequest, @@ -109,7 +109,7 @@ export class Interns extends ClientSDK { * Get an intern's daemon access * * @remarks - * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async getInternDaemon( request: operations.GetInternDaemonRequest, @@ -126,7 +126,7 @@ export class Interns extends ClientSDK { * Get an intern's daemon access (deprecated alias) * * @remarks - * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. * * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible. */ @@ -145,7 +145,7 @@ export class Interns extends ClientSDK { * Provision an intern * * @remarks - * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async provisionIntern( request: operations.ProvisionInternRequest, @@ -162,7 +162,7 @@ export class Interns extends ClientSDK { * Suspend an intern * * @remarks - * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async suspendIntern( request: operations.SuspendInternRequest, diff --git a/src/sdk/vault.ts b/src/sdk/vault.ts index 418352481..65c32ea3f 100644 --- a/src/sdk/vault.ts +++ b/src/sdk/vault.ts @@ -6,6 +6,7 @@ import { vaultCopyVaultSecretsToIntern } from "../funcs/vaultCopyVaultSecretsToIntern.js"; import { vaultDeleteInternVaultSecret } from "../funcs/vaultDeleteInternVaultSecret.js"; import { vaultDeleteVaultSecret } from "../funcs/vaultDeleteVaultSecret.js"; +import { vaultListInternEffectiveVaultSecrets } from "../funcs/vaultListInternEffectiveVaultSecrets.js"; import { vaultListInternVaultSecrets } from "../funcs/vaultListInternVaultSecrets.js"; import { vaultListVaultSecrets } from "../funcs/vaultListVaultSecrets.js"; import { vaultStoreInternVaultSecret } from "../funcs/vaultStoreInternVaultSecret.js"; @@ -16,11 +17,28 @@ import * as operations from "../models/operations/index.js"; import { unwrapAsync } from "../types/fp.js"; export class Vault extends ClientSDK { + /** + * List the secrets an intern receives + * + * @remarks + * Lists, one entry per name, the secret the intern's outbound requests receive: its own secrets, secrets from an attached vault, and workspace secrets, including ones stored before workspace-scoped storage. Where several vaults hold a name, the entry is the one that wins, in the order intern, attached, workspace. The same resolution decides what outbound requests receive, so this list and the intern's requests agree. `scope` says which vault the entry comes from. Responses carry metadata only, never values. Results are ordered by name and paginated with `limit` and `offset`. Returns 404 when the intern's attached vault is no longer available, since the intern then receives no secrets. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + */ + async listInternEffectiveVaultSecrets( + request: operations.ListInternEffectiveVaultSecretsRequest, + options?: RequestOptions, + ): Promise { + return unwrapAsync(vaultListInternEffectiveVaultSecrets( + this, + request, + options, + )); + } + /** * List intern secrets * * @remarks - * Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Lists secret metadata stored for one intern. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async listInternVaultSecrets( request: operations.ListInternVaultSecretsRequest, @@ -37,7 +55,7 @@ export class Vault extends ClientSDK { * Delete an intern secret * * @remarks - * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async deleteInternVaultSecret( request: operations.DeleteInternVaultSecretRequest, @@ -54,7 +72,7 @@ export class Vault extends ClientSDK { * Store an intern secret * * @remarks - * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async storeInternVaultSecret( request: operations.StoreInternVaultSecretRequest, @@ -71,7 +89,7 @@ export class Vault extends ClientSDK { * Copy workspace secrets to an intern * * @remarks - * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async copyVaultSecretsToIntern( request: operations.CopyVaultSecretsToInternRequest, @@ -88,7 +106,7 @@ export class Vault extends ClientSDK { * List workspace secrets * * @remarks - * Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Lists secret metadata for the workspace of the authenticated API key. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async listVaultSecrets( request?: operations.ListVaultSecretsRequest | undefined, @@ -105,7 +123,7 @@ export class Vault extends ClientSDK { * Delete a workspace secret * * @remarks - * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async deleteVaultSecret( request: operations.DeleteVaultSecretRequest, @@ -122,7 +140,7 @@ export class Vault extends ClientSDK { * Store a workspace secret * * @remarks - * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. + * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required. */ async storeVaultSecret( request: operations.StoreVaultSecretRequest,