@openrouter/sdk 1.2.130 → 1.2.132

package/esm/models/sttrequest.js

@@ -32,6 +32,7 @@ export const STTRequest$outboundSchema = z.object({
     model: z.string(),
     provider: z.lazy(() => STTRequestProvider$outboundSchema).optional(),
     responseFormat: STTRequestResponseFormat$outboundSchema.optional(),
+    sessionId: z.string().optional(),
     temperature: z.number().optional(),
     timestampGranularities: z.array(STTTimestampGranularity$outboundSchema)
         .optional(),
@@ -41,6 +42,7 @@ export const STTRequest$outboundSchema = z.object({
     return remap$(v, {
         inputAudio: "input_audio",
         responseFormat: "response_format",
+        sessionId: "session_id",
         timestampGranularities: "timestamp_granularities",
     });
 });

package/esm/models/vaultsecret.d.ts

@@ -0,0 +1,16 @@
+import * as z from "zod/v4";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+/**
+ * Metadata for one stored secret. The secret value is never returned. `fingerprint` is a keyed SHA-256 digest of the value: equal fingerprints within one scope mean equal values, but a workspace secret and its intern copy carry different fingerprints. `hosts` and `fingerprint` are `null` only for legacy rows written before host binding was required; storing the secret again assigns hosts.
+ */
+export type VaultSecret = {
+    createdAt: Date;
+    fingerprint: string | null;
+    hosts: Array<string> | null;
+    name: string;
+};
+/** @internal */
+export declare const VaultSecret$inboundSchema: z.ZodType<VaultSecret, unknown>;
+export declare function vaultSecretFromJSON(jsonString: string): SafeParseResult<VaultSecret, SDKValidationError>;
+//# sourceMappingURL=vaultsecret.d.ts.map

package/esm/models/vaultsecret.js

@@ -0,0 +1,23 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: daa0ae6ffc96
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+/** @internal */
+export const VaultSecret$inboundSchema = z
+    .object({
+    created_at: z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+    fingerprint: z.nullable(z.string()),
+    hosts: z.nullable(z.array(z.string())),
+    name: z.string(),
+}).transform((v) => {
+    return remap$(v, {
+        "created_at": "createdAt",
+    });
+});
+export function vaultSecretFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => VaultSecret$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'VaultSecret' from JSON`);
+}
+//# sourceMappingURL=vaultsecret.js.map

package/esm/models/vaultsecretcopyrequest.d.ts

@@ -0,0 +1,18 @@
+import * as z from "zod/v4";
+/**
+ * Workspace secrets to copy into the intern scope.
+ */
+export type VaultSecretCopyRequest = {
+    /**
+     * Names of workspace secrets to copy, 1 to 100 unique entries. Every name must exist in the workspace scope.
+     */
+    names: Array<string>;
+};
+/** @internal */
+export type VaultSecretCopyRequest$Outbound = {
+    names: Array<string>;
+};
+/** @internal */
+export declare const VaultSecretCopyRequest$outboundSchema: z.ZodType<VaultSecretCopyRequest$Outbound, VaultSecretCopyRequest>;
+export declare function vaultSecretCopyRequestToJSON(vaultSecretCopyRequest: VaultSecretCopyRequest): string;
+//# sourceMappingURL=vaultsecretcopyrequest.d.ts.map

package/esm/models/vaultsecretcopyrequest.js

@@ -0,0 +1,13 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: ed56afa8cfc5
+ */
+import * as z from "zod/v4";
+/** @internal */
+export const VaultSecretCopyRequest$outboundSchema = z.object({
+    names: z.array(z.string()),
+});
+export function vaultSecretCopyRequestToJSON(vaultSecretCopyRequest) {
+    return JSON.stringify(VaultSecretCopyRequest$outboundSchema.parse(vaultSecretCopyRequest));
+}
+//# sourceMappingURL=vaultsecretcopyrequest.js.map

package/esm/models/vaultsecretcopyresponse.d.ts

@@ -0,0 +1,14 @@
+import * as z from "zod/v4";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+import { VaultSecret } from "./vaultsecret.js";
+/**
+ * Metadata for the copies now stored in the intern scope, one entry per requested name.
+ */
+export type VaultSecretCopyResponse = {
+    data: Array<VaultSecret>;
+};
+/** @internal */
+export declare const VaultSecretCopyResponse$inboundSchema: z.ZodType<VaultSecretCopyResponse, unknown>;
+export declare function vaultSecretCopyResponseFromJSON(jsonString: string): SafeParseResult<VaultSecretCopyResponse, SDKValidationError>;
+//# sourceMappingURL=vaultsecretcopyresponse.d.ts.map

package/esm/models/vaultsecretcopyresponse.js

@@ -0,0 +1,15 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: acc6c964e820
+ */
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+import { VaultSecret$inboundSchema } from "./vaultsecret.js";
+/** @internal */
+export const VaultSecretCopyResponse$inboundSchema = z.object({
+    data: z.array(VaultSecret$inboundSchema),
+});
+export function vaultSecretCopyResponseFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => VaultSecretCopyResponse$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'VaultSecretCopyResponse' from JSON`);
+}
+//# sourceMappingURL=vaultsecretcopyresponse.js.map

package/esm/models/vaultsecretlistresponse.d.ts

@@ -0,0 +1,18 @@
+import * as z from "zod/v4";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+import { VaultSecret } from "./vaultsecret.js";
+/**
+ * One page of secret metadata for the selected scope.
+ */
+export type VaultSecretListResponse = {
+    data: Array<VaultSecret>;
+    /**
+     * True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries.
+     */
+    hasMore: boolean;
+};
+/** @internal */
+export declare const VaultSecretListResponse$inboundSchema: z.ZodType<VaultSecretListResponse, unknown>;
+export declare function vaultSecretListResponseFromJSON(jsonString: string): SafeParseResult<VaultSecretListResponse, SDKValidationError>;
+//# sourceMappingURL=vaultsecretlistresponse.d.ts.map

package/esm/models/vaultsecretlistresponse.js

@@ -0,0 +1,21 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 18eb8bc829ef
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { VaultSecret$inboundSchema } from "./vaultsecret.js";
+/** @internal */
+export const VaultSecretListResponse$inboundSchema = z.object({
+    data: z.array(VaultSecret$inboundSchema),
+    has_more: z.boolean(),
+}).transform((v) => {
+    return remap$(v, {
+        "has_more": "hasMore",
+    });
+});
+export function vaultSecretListResponseFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => VaultSecretListResponse$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'VaultSecretListResponse' from JSON`);
+}
+//# sourceMappingURL=vaultsecretlistresponse.js.map

package/esm/models/vaultsecretresponse.d.ts

@@ -0,0 +1,17 @@
+import * as z from "zod/v4";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+import { VaultSecret } from "./vaultsecret.js";
+/**
+ * Metadata for the stored secret.
+ */
+export type VaultSecretResponse = {
+    /**
+     * Metadata for one stored secret. The secret value is never returned. `fingerprint` is a keyed SHA-256 digest of the value: equal fingerprints within one scope mean equal values, but a workspace secret and its intern copy carry different fingerprints. `hosts` and `fingerprint` are `null` only for legacy rows written before host binding was required; storing the secret again assigns hosts.
+     */
+    data: VaultSecret;
+};
+/** @internal */
+export declare const VaultSecretResponse$inboundSchema: z.ZodType<VaultSecretResponse, unknown>;
+export declare function vaultSecretResponseFromJSON(jsonString: string): SafeParseResult<VaultSecretResponse, SDKValidationError>;
+//# sourceMappingURL=vaultsecretresponse.d.ts.map

package/esm/models/vaultsecretresponse.js

@@ -0,0 +1,15 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: c801ca16aec4
+ */
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+import { VaultSecret$inboundSchema } from "./vaultsecret.js";
+/** @internal */
+export const VaultSecretResponse$inboundSchema = z.object({
+    data: VaultSecret$inboundSchema,
+});
+export function vaultSecretResponseFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => VaultSecretResponse$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'VaultSecretResponse' from JSON`);
+}
+//# sourceMappingURL=vaultsecretresponse.js.map

package/esm/models/vaultsecretwriterequest.d.ts

@@ -0,0 +1,23 @@
+import * as z from "zod/v4";
+/**
+ * Secret value and the exact hostnames it may be released to.
+ */
+export type VaultSecretWriteRequest = {
+    /**
+     * Exact DNS hostnames the secret may be sent to, 1 to 100 entries. Each entry is lowercased and a trailing dot is removed, so `API.Example.com.` is stored as `api.example.com`. Schemes, ports, paths, wildcards and empty values are rejected. Duplicates after normalization are collapsed. Matching is exact: a secret bound to `api.example.com` is never released to `example.com` or any other hostname.
+     */
+    hosts: Array<string>;
+    /**
+     * Secret value, 1 to 65536 characters. It is encrypted at rest and never returned.
+     */
+    value: string;
+};
+/** @internal */
+export type VaultSecretWriteRequest$Outbound = {
+    hosts: Array<string>;
+    value: string;
+};
+/** @internal */
+export declare const VaultSecretWriteRequest$outboundSchema: z.ZodType<VaultSecretWriteRequest$Outbound, VaultSecretWriteRequest>;
+export declare function vaultSecretWriteRequestToJSON(vaultSecretWriteRequest: VaultSecretWriteRequest): string;
+//# sourceMappingURL=vaultsecretwriterequest.d.ts.map

package/esm/models/vaultsecretwriterequest.js

@@ -0,0 +1,14 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: fa3836b8b8e1
+ */
+import * as z from "zod/v4";
+/** @internal */
+export const VaultSecretWriteRequest$outboundSchema = z.object({
+    hosts: z.array(z.string()),
+    value: z.string(),
+});
+export function vaultSecretWriteRequestToJSON(vaultSecretWriteRequest) {
+    return JSON.stringify(VaultSecretWriteRequest$outboundSchema.parse(vaultSecretWriteRequest));
+}
+//# sourceMappingURL=vaultsecretwriterequest.js.map

package/esm/models/videogenerationrequest.d.ts

@@ -517,6 +517,10 @@ export type VideoGenerationRequest = {
      * If specified, the generation will sample deterministically, such that repeated requests with the same seed and parameters should return the same result. Determinism is not guaranteed for all providers.
      */
     seed?: number | undefined;
+    /**
+     * A unique identifier for grouping related requests (e.g., a conversation or agent workflow). Used for observability grouping in Broadcast and private logging; never sent to the provider. If provided in both the request body and the x-session-id header, the body value takes precedence. Maximum of 256 characters.
+     */
+    sessionId?: string | undefined;
     /**
      * Exact pixel dimensions of the generated video in "WIDTHxHEIGHT" format (e.g. "1280x720"). Interchangeable with resolution + aspect_ratio.
      */
@@ -988,6 +992,7 @@ export type VideoGenerationRequest$Outbound = {
     provider?: VideoGenerationRequestProvider$Outbound | undefined;
     resolution?: string | undefined;
     seed?: number | undefined;
+    session_id?: string | undefined;
     size?: string | undefined;
     trace?: TraceConfig$Outbound | undefined;
     upscale_factor?: number | undefined;

package/esm/models/videogenerationrequest.js

@@ -241,6 +241,7 @@ export const VideoGenerationRequest$outboundSchema = z.object({
         .optional(),
     resolution: VideoGenerationRequestResolution$outboundSchema.optional(),
     seed: z.int().optional(),
+    sessionId: z.string().optional(),
     size: z.string().optional(),
     trace: TraceConfig$outboundSchema.optional(),
     upscaleFactor: z.number().optional(),
@@ -252,6 +253,7 @@ export const VideoGenerationRequest$outboundSchema = z.object({
         frameImages: "frame_images",
         generateAudio: "generate_audio",
         inputReferences: "input_references",
+        sessionId: "session_id",
         upscaleFactor: "upscale_factor",
     });
 });

package/esm/sdk/sdk.d.ts

@@ -26,6 +26,7 @@ import { Responses } from "./responses.js";
 import { Scim } from "./scim.js";
 import { STT } from "./stt.js";
 import { TTS } from "./tts.js";
+import { Vault } from "./vault.js";
 import { VideoGeneration } from "./videogeneration.js";
 import { Workspaces } from "./workspaces.js";
 import type { $ZodObject, $ZodShape, infer as zodInfer } from "zod/v4/core";
@@ -89,6 +90,8 @@ export declare class OpenRouter extends ClientSDK {
     get beta(): Beta;
     private _scim?;
     get scim(): Scim;
+    private _vault?;
+    get vault(): Vault;
     private _videoGeneration?;
     get videoGeneration(): VideoGeneration;
     private _workspaces?;

package/esm/sdk/sdk.js

@@ -30,6 +30,7 @@ import { Responses } from "./responses.js";
 import { Scim } from "./scim.js";
 import { STT } from "./stt.js";
 import { TTS } from "./tts.js";
+import { Vault } from "./vault.js";
 import { VideoGeneration } from "./videogeneration.js";
 import { Workspaces } from "./workspaces.js";
 import { callModel as callModelFunc, } from "../funcs/call-model.js";
@@ -118,6 +119,9 @@ export class OpenRouter extends ClientSDK {
     get scim() {
         return (this._scim ?? (this._scim = new Scim(this._options)));
     }
+    get vault() {
+        return (this._vault ?? (this._vault = new Vault(this._options)));
+    }
     get videoGeneration() {
         return (this._videoGeneration ?? (this._videoGeneration = new VideoGeneration(this._options)));
     }

package/esm/sdk/vault.d.ts

@@ -0,0 +1,55 @@
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+export declare class Vault extends ClientSDK {
+    /**
+     * List intern secrets
+     *
+     * @remarks
+     * Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    listInternVaultSecrets(request: operations.ListInternVaultSecretsRequest, options?: RequestOptions): Promise<models.VaultSecretListResponse>;
+    /**
+     * Delete an intern secret
+     *
+     * @remarks
+     * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    deleteInternVaultSecret(request: operations.DeleteInternVaultSecretRequest, options?: RequestOptions): Promise<void>;
+    /**
+     * Store an intern secret
+     *
+     * @remarks
+     * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    storeInternVaultSecret(request: operations.StoreInternVaultSecretRequest, options?: RequestOptions): Promise<models.VaultSecretResponse>;
+    /**
+     * Copy workspace secrets to an intern
+     *
+     * @remarks
+     * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    copyVaultSecretsToIntern(request: operations.CopyVaultSecretsToInternRequest, options?: RequestOptions): Promise<models.VaultSecretCopyResponse>;
+    /**
+     * List workspace secrets
+     *
+     * @remarks
+     * Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    listVaultSecrets(request?: operations.ListVaultSecretsRequest | undefined, options?: RequestOptions): Promise<models.VaultSecretListResponse>;
+    /**
+     * Delete a workspace secret
+     *
+     * @remarks
+     * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    deleteVaultSecret(request: operations.DeleteVaultSecretRequest, options?: RequestOptions): Promise<void>;
+    /**
+     * Store a workspace secret
+     *
+     * @remarks
+     * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    storeVaultSecret(request: operations.StoreVaultSecretRequest, options?: RequestOptions): Promise<models.VaultSecretResponse>;
+}
+//# sourceMappingURL=vault.d.ts.map

package/esm/sdk/vault.js

@@ -0,0 +1,79 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: adbb922fff4a
+ */
+import { vaultCopyVaultSecretsToIntern } from "../funcs/vaultCopyVaultSecretsToIntern.js";
+import { vaultDeleteInternVaultSecret } from "../funcs/vaultDeleteInternVaultSecret.js";
+import { vaultDeleteVaultSecret } from "../funcs/vaultDeleteVaultSecret.js";
+import { vaultListInternVaultSecrets } from "../funcs/vaultListInternVaultSecrets.js";
+import { vaultListVaultSecrets } from "../funcs/vaultListVaultSecrets.js";
+import { vaultStoreInternVaultSecret } from "../funcs/vaultStoreInternVaultSecret.js";
+import { vaultStoreVaultSecret } from "../funcs/vaultStoreVaultSecret.js";
+import { ClientSDK } from "../lib/sdks.js";
+import { unwrapAsync } from "../types/fp.js";
+export class Vault extends ClientSDK {
+    /**
+     * List intern secrets
+     *
+     * @remarks
+     * Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async listInternVaultSecrets(request, options) {
+        return unwrapAsync(vaultListInternVaultSecrets(this, request, options));
+    }
+    /**
+     * Delete an intern secret
+     *
+     * @remarks
+     * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async deleteInternVaultSecret(request, options) {
+        return unwrapAsync(vaultDeleteInternVaultSecret(this, request, options));
+    }
+    /**
+     * Store an intern secret
+     *
+     * @remarks
+     * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async storeInternVaultSecret(request, options) {
+        return unwrapAsync(vaultStoreInternVaultSecret(this, request, options));
+    }
+    /**
+     * Copy workspace secrets to an intern
+     *
+     * @remarks
+     * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async copyVaultSecretsToIntern(request, options) {
+        return unwrapAsync(vaultCopyVaultSecretsToIntern(this, request, options));
+    }
+    /**
+     * List workspace secrets
+     *
+     * @remarks
+     * Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async listVaultSecrets(request, options) {
+        return unwrapAsync(vaultListVaultSecrets(this, request, options));
+    }
+    /**
+     * Delete a workspace secret
+     *
+     * @remarks
+     * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async deleteVaultSecret(request, options) {
+        return unwrapAsync(vaultDeleteVaultSecret(this, request, options));
+    }
+    /**
+     * Store a workspace secret
+     *
+     * @remarks
+     * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async storeVaultSecret(request, options) {
+        return unwrapAsync(vaultStoreVaultSecret(this, request, options));
+    }
+}
+//# sourceMappingURL=vault.js.map

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@openrouter/sdk",
-  "version": "1.2.130",
+  "version": "1.2.132",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrouter/sdk",
-  "version": "1.2.130",
+  "version": "1.2.132",
   "author": "OpenRouter",
   "description": "The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.",
   "keywords": [
@@ -21,8 +21,8 @@
   "license": "Apache-2.0",
   "packageManager": "pnpm@10.22.0",
   "publishConfig": {
-    "provenance": true,
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "type": "module",
   "main": "./esm/index.js",
@@ -73,15 +73,15 @@
     "lint": "eslint --cache --max-warnings=0 src",
     "build": "tsc",
     "prepublishOnly": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "test:e2e": "vitest --run --project e2e",
+    "test:transit": "exit 0",
+    "typecheck:transit": "exit 0",
     "compile": "tsc",
     "postinstall": "node scripts/check-types.js || true",
     "prepare": "npm run build",
-    "test:transit": "exit 0",
-    "test:watch": "vitest --watch --project unit",
-    "typecheck": "tsc --noEmit",
-    "typecheck:transit": "exit 0",
     "test": "vitest --run --project unit",
-    "test:e2e": "vitest --run --project e2e"
+    "test:watch": "vitest --watch --project unit"
   },
   "peerDependencies": {},
   "devDependencies": {