@openrouter/sdk 1.2.49 → 1.2.51

package/esm/funcs/byokCreate.d.ts

@@ -13,7 +13,7 @@ import { Result } from "../types/fp.js";
  * Create a BYOK provider credential
  *
  * @remarks
- * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+ * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.
  */
 export declare function byokCreate(client: OpenRouterCore, request: operations.CreateBYOKKeyRequest, options?: RequestOptions): APIPromise<Result<models.CreateBYOKKeyResponse, errors.BadRequestResponseError | errors.UnauthorizedResponseError | errors.ForbiddenResponseError | errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=byokCreate.d.ts.map

package/esm/funcs/byokCreate.js

@@ -17,7 +17,7 @@ import { APIPromise } from "../types/async.js";
  * Create a BYOK provider credential
  *
  * @remarks
- * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+ * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.
  */
 export function byokCreate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/esm/funcs/byokUpdate.d.ts

@@ -13,7 +13,7 @@ import { Result } from "../types/fp.js";
  * Update a BYOK provider credential
  *
  * @remarks
- * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.
+ * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.
  */
 export declare function byokUpdate(client: OpenRouterCore, request: operations.UpdateBYOKKeyRequest, options?: RequestOptions): APIPromise<Result<models.UpdateBYOKKeyResponse, errors.BadRequestResponseError | errors.UnauthorizedResponseError | errors.NotFoundResponseError | errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=byokUpdate.d.ts.map

package/esm/funcs/byokUpdate.js

@@ -17,7 +17,7 @@ import { APIPromise } from "../types/async.js";
  * Update a BYOK provider credential
  *
  * @remarks
- * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.
+ * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.
  */
 export function byokUpdate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/esm/funcs/guardrailsCreate.d.ts

@@ -13,7 +13,7 @@ import { Result } from "../types/fp.js";
  * Create a guardrail
  *
  * @remarks
- * Create a new guardrail for the authenticated user. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+ * Create a new guardrail for the authenticated user. A newly created guardrail enforces nothing until it is assigned to API keys or organization members; `workspace_id` places the guardrail in a workspace but does not apply it to that workspace's traffic. To restrict all traffic in a workspace, update the workspace's default guardrail instead. [Management key](/docs/guides/overview/auth/management-api-keys) required.
  */
 export declare function guardrailsCreate(client: OpenRouterCore, request: operations.CreateGuardrailRequest, options?: RequestOptions): APIPromise<Result<models.CreateGuardrailResponse, errors.BadRequestResponseError | errors.UnauthorizedResponseError | errors.ForbiddenResponseError | errors.InternalServerResponseError | OpenRouterError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=guardrailsCreate.d.ts.map

package/esm/funcs/guardrailsCreate.js

@@ -17,7 +17,7 @@ import { APIPromise } from "../types/async.js";
  * Create a guardrail
  *
  * @remarks
- * Create a new guardrail for the authenticated user. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+ * Create a new guardrail for the authenticated user. A newly created guardrail enforces nothing until it is assigned to API keys or organization members; `workspace_id` places the guardrail in a workspace but does not apply it to that workspace's traffic. To restrict all traffic in a workspace, update the workspace's default guardrail instead. [Management key](/docs/guides/overview/auth/management-api-keys) required.
  */
 export function guardrailsCreate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/esm/lib/config.d.ts

@@ -50,8 +50,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "1.0.0";
-    readonly sdkVersion: "1.2.49";
+    readonly sdkVersion: "1.2.51";
     readonly genVersion: "2.914.0";
-    readonly userAgent: "speakeasy-sdk/typescript 1.2.49 2.914.0 1.0.0 @openrouter/sdk";
+    readonly userAgent: "speakeasy-sdk/typescript 1.2.51 2.914.0 1.0.0 @openrouter/sdk";
 };
 //# sourceMappingURL=config.d.ts.map

package/esm/lib/config.js

@@ -29,8 +29,8 @@ export function serverURLFromOptions(options) {
 export const SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1.0.0",
-    sdkVersion: "1.2.49",
+    sdkVersion: "1.2.51",
     genVersion: "2.914.0",
-    userAgent: "speakeasy-sdk/typescript 1.2.49 2.914.0 1.0.0 @openrouter/sdk",
+    userAgent: "speakeasy-sdk/typescript 1.2.51 2.914.0 1.0.0 @openrouter/sdk",
 };
 //# sourceMappingURL=config.js.map

package/esm/models/createbyokkeyrequest.d.ts

@@ -1,6 +1,10 @@
 import * as z from "zod/v4";
 import { BYOKProviderSlug } from "./byokproviderslug.js";
 export type CreateBYOKKeyRequest = {
+    /**
+     * Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.
+     */
+    allowedApiKeyHashes?: Array<string> | null | undefined;
     /**
      * Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
      */
@@ -36,6 +40,7 @@ export type CreateBYOKKeyRequest = {
 };
 /** @internal */
 export type CreateBYOKKeyRequest$Outbound = {
+    allowed_api_key_hashes?: Array<string> | null | undefined;
     allowed_models?: Array<string> | null | undefined;
     allowed_user_ids?: Array<string> | null | undefined;
     disabled?: boolean | undefined;

package/esm/models/createbyokkeyrequest.js

@@ -7,6 +7,7 @@ import { remap as remap$ } from "../lib/primitives.js";
 import { BYOKProviderSlug$outboundSchema, } from "./byokproviderslug.js";
 /** @internal */
 export const CreateBYOKKeyRequest$outboundSchema = z.object({
+    allowedApiKeyHashes: z.nullable(z.array(z.string())).optional(),
     allowedModels: z.nullable(z.array(z.string())).optional(),
     allowedUserIds: z.nullable(z.array(z.string())).optional(),
     disabled: z.boolean().optional(),
@@ -17,6 +18,7 @@ export const CreateBYOKKeyRequest$outboundSchema = z.object({
     workspaceId: z.string().optional(),
 }).transform((v) => {
     return remap$(v, {
+        allowedApiKeyHashes: "allowed_api_key_hashes",
         allowedModels: "allowed_models",
         allowedUserIds: "allowed_user_ids",
         isFallback: "is_fallback",

package/esm/models/createguardrailrequest.d.ts

@@ -86,7 +86,7 @@ export type CreateGuardrailRequest = {
      */
     resetInterval?: GuardrailInterval | null | undefined;
     /**
-     * The workspace to create the guardrail in. When omitted, the guardrail is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly.
+     * The workspace to create the guardrail in. When omitted, the guardrail is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. This only places the guardrail in the workspace; the created guardrail enforces nothing for that workspace's traffic until it is assigned to API keys or members. To restrict all traffic in a workspace, update the workspace's default guardrail instead.
      */
     workspaceId?: string | undefined;
 };

package/esm/models/guardrail.d.ts

@@ -100,7 +100,7 @@ export type Guardrail = {
      */
     updatedAt?: string | null | undefined;
     /**
-     * The workspace this guardrail is scoped to, or `null` for an unscoped legacy guardrail predating workspaces. A `null` value does not mean the default workspace, and does not apply the guardrail across every workspace.
+     * The workspace this guardrail belongs to, or `null` for an unscoped legacy guardrail predating workspaces. Workspace membership organizes the guardrail; it does not apply the guardrail to the workspace's traffic. A `null` value does not mean the default workspace, and does not apply the guardrail across every workspace.
      */
     workspaceId: string | null;
 };

package/esm/models/updatebyokkeyrequest.d.ts

@@ -1,5 +1,9 @@
 import * as z from "zod/v4";
 export type UpdateBYOKKeyRequest = {
+    /**
+     * Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` clears the restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.
+     */
+    allowedApiKeyHashes?: Array<string> | null | undefined;
     /**
      * Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
      */
@@ -27,6 +31,7 @@ export type UpdateBYOKKeyRequest = {
 };
 /** @internal */
 export type UpdateBYOKKeyRequest$Outbound = {
+    allowed_api_key_hashes?: Array<string> | null | undefined;
     allowed_models?: Array<string> | null | undefined;
     allowed_user_ids?: Array<string> | null | undefined;
     disabled?: boolean | undefined;

package/esm/models/updatebyokkeyrequest.js

@@ -6,6 +6,7 @@ import * as z from "zod/v4";
 import { remap as remap$ } from "../lib/primitives.js";
 /** @internal */
 export const UpdateBYOKKeyRequest$outboundSchema = z.object({
+    allowedApiKeyHashes: z.nullable(z.array(z.string())).optional(),
     allowedModels: z.nullable(z.array(z.string())).optional(),
     allowedUserIds: z.nullable(z.array(z.string())).optional(),
     disabled: z.boolean().optional(),
@@ -14,6 +15,7 @@ export const UpdateBYOKKeyRequest$outboundSchema = z.object({
     name: z.nullable(z.string()).optional(),
 }).transform((v) => {
     return remap$(v, {
+        allowedApiKeyHashes: "allowed_api_key_hashes",
         allowedModels: "allowed_models",
         allowedUserIds: "allowed_user_ids",
         isFallback: "is_fallback",

package/esm/sdk/byok.d.ts

@@ -16,7 +16,7 @@ export declare class BYOK extends ClientSDK {
      * Create a BYOK provider credential
      *
      * @remarks
-     * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     create(request: operations.CreateBYOKKeyRequest, options?: RequestOptions): Promise<models.CreateBYOKKeyResponse>;
     /**
@@ -37,7 +37,7 @@ export declare class BYOK extends ClientSDK {
      * Update a BYOK provider credential
      *
      * @remarks
-     * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     update(request: operations.UpdateBYOKKeyRequest, options?: RequestOptions): Promise<models.UpdateBYOKKeyResponse>;
 }

package/esm/sdk/byok.js

@@ -24,7 +24,7 @@ export class BYOK extends ClientSDK {
      * Create a BYOK provider credential
      *
      * @remarks
-     * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async create(request, options) {
         return unwrapAsync(byokCreate(this, request, options));
@@ -51,7 +51,7 @@ export class BYOK extends ClientSDK {
      * Update a BYOK provider credential
      *
      * @remarks
-     * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async update(request, options) {
         return unwrapAsync(byokUpdate(this, request, options));

package/esm/sdk/guardrails.d.ts

@@ -16,7 +16,7 @@ export declare class Guardrails extends ClientSDK {
      * Create a guardrail
      *
      * @remarks
-     * Create a new guardrail for the authenticated user. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Create a new guardrail for the authenticated user. A newly created guardrail enforces nothing until it is assigned to API keys or organization members; `workspace_id` places the guardrail in a workspace but does not apply it to that workspace's traffic. To restrict all traffic in a workspace, update the workspace's default guardrail instead. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     create(request: operations.CreateGuardrailRequest, options?: RequestOptions): Promise<models.CreateGuardrailResponse>;
     /**

package/esm/sdk/guardrails.js

@@ -32,7 +32,7 @@ export class Guardrails extends ClientSDK {
      * Create a guardrail
      *
      * @remarks
-     * Create a new guardrail for the authenticated user. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Create a new guardrail for the authenticated user. A newly created guardrail enforces nothing until it is assigned to API keys or organization members; `workspace_id` places the guardrail in a workspace but does not apply it to that workspace's traffic. To restrict all traffic in a workspace, update the workspace's default guardrail instead. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async create(request, options) {
         return unwrapAsync(guardrailsCreate(this, request, options));

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@openrouter/sdk",
-  "version": "1.2.49",
+  "version": "1.2.51",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrouter/sdk",
-  "version": "1.2.49",
+  "version": "1.2.51",
   "author": "OpenRouter",
   "description": "The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.",
   "keywords": [
@@ -73,15 +73,15 @@
     "lint": "eslint --cache --max-warnings=0 src",
     "build": "tsc",
     "prepublishOnly": "npm run build",
-    "test:e2e": "vitest --run --project e2e",
-    "typecheck": "tsc --noEmit",
     "typecheck:transit": "exit 0",
     "postinstall": "node scripts/check-types.js || true",
+    "test": "vitest --run --project unit",
+    "compile": "tsc",
     "prepare": "npm run build",
+    "test:e2e": "vitest --run --project e2e",
     "test:transit": "exit 0",
     "test:watch": "vitest --watch --project unit",
-    "compile": "tsc",
-    "test": "vitest --run --project unit"
+    "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {},
   "devDependencies": {