@openrouter/sdk 1.3.36 → 1.4.1

package/esm/models/vaulteffectivesecret.d.ts

@@ -0,0 +1,35 @@
+import * as z from "zod/v4";
+import { OpenEnum } from "../types/enums.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+/**
+ * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault.
+ */
+export declare const VaultEffectiveSecretScope: {
+    readonly Intern: "intern";
+    readonly Attached: "attached";
+    readonly Workspace: "workspace";
+};
+/**
+ * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault.
+ */
+export type VaultEffectiveSecretScope = OpenEnum<typeof VaultEffectiveSecretScope>;
+/**
+ * Metadata for the one secret the intern's outbound requests receive under this name. The secret value is never returned. The intern receives it only on requests to a hostname in `hosts`, or on any request when `hosts` is `null`; a request to any other hostname receives no secret under this name, even when another vault holds one. `fingerprint` is comparable only within one vault.
+ */
+export type VaultEffectiveSecret = {
+    createdAt: Date;
+    fingerprint: string | null;
+    hosts: Array<string> | null;
+    name: string;
+    /**
+     * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault.
+     */
+    scope: VaultEffectiveSecretScope;
+};
+/** @internal */
+export declare const VaultEffectiveSecretScope$inboundSchema: z.ZodType<VaultEffectiveSecretScope, unknown>;
+/** @internal */
+export declare const VaultEffectiveSecret$inboundSchema: z.ZodType<VaultEffectiveSecret, unknown>;
+export declare function vaultEffectiveSecretFromJSON(jsonString: string): SafeParseResult<VaultEffectiveSecret, SDKValidationError>;
+//# sourceMappingURL=vaulteffectivesecret.d.ts.map

package/esm/models/vaulteffectivesecret.js

@@ -0,0 +1,34 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 0e9a217f3be7
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import * as openEnums from "../types/enums.js";
+/**
+ * Where the delivered secret is stored: `intern` for the intern's own vault, `attached` for a vault attached to the intern, `workspace` for the workspace vault.
+ */
+export const VaultEffectiveSecretScope = {
+    Intern: "intern",
+    Attached: "attached",
+    Workspace: "workspace",
+};
+/** @internal */
+export const VaultEffectiveSecretScope$inboundSchema = openEnums.inboundSchema(VaultEffectiveSecretScope);
+/** @internal */
+export const VaultEffectiveSecret$inboundSchema = z.object({
+    created_at: z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+    fingerprint: z.nullable(z.string()),
+    hosts: z.nullable(z.array(z.string())),
+    name: z.string(),
+    scope: VaultEffectiveSecretScope$inboundSchema,
+}).transform((v) => {
+    return remap$(v, {
+        "created_at": "createdAt",
+    });
+});
+export function vaultEffectiveSecretFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => VaultEffectiveSecret$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'VaultEffectiveSecret' from JSON`);
+}
+//# sourceMappingURL=vaulteffectivesecret.js.map

package/esm/models/vaulteffectivesecretlistresponse.d.ts

@@ -0,0 +1,18 @@
+import * as z from "zod/v4";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+import { VaultEffectiveSecret } from "./vaulteffectivesecret.js";
+/**
+ * One page of the secrets an intern receives, one entry per name.
+ */
+export type VaultEffectiveSecretListResponse = {
+    data: Array<VaultEffectiveSecret>;
+    /**
+     * True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries.
+     */
+    hasMore: boolean;
+};
+/** @internal */
+export declare const VaultEffectiveSecretListResponse$inboundSchema: z.ZodType<VaultEffectiveSecretListResponse, unknown>;
+export declare function vaultEffectiveSecretListResponseFromJSON(jsonString: string): SafeParseResult<VaultEffectiveSecretListResponse, SDKValidationError>;
+//# sourceMappingURL=vaulteffectivesecretlistresponse.d.ts.map

package/esm/models/vaulteffectivesecretlistresponse.js

@@ -0,0 +1,21 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 053f6551d3f4
+ */
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { VaultEffectiveSecret$inboundSchema, } from "./vaulteffectivesecret.js";
+/** @internal */
+export const VaultEffectiveSecretListResponse$inboundSchema = z.object({
+    data: z.array(VaultEffectiveSecret$inboundSchema),
+    has_more: z.boolean(),
+}).transform((v) => {
+    return remap$(v, {
+        "has_more": "hasMore",
+    });
+});
+export function vaultEffectiveSecretListResponseFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => VaultEffectiveSecretListResponse$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'VaultEffectiveSecretListResponse' from JSON`);
+}
+//# sourceMappingURL=vaulteffectivesecretlistresponse.js.map

package/esm/sdk/interns.d.ts

@@ -6,49 +6,49 @@ export declare class Interns extends ClientSDK {
      * List interns
      *
      * @remarks
-     * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     listInterns(request?: operations.ListInternsRequest | undefined, options?: RequestOptions): Promise<models.InternListResponse>;
     /**
      * Create an intern
      *
      * @remarks
-     * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     createIntern(request: operations.CreateInternRequest, options?: RequestOptions): Promise<models.Intern>;
     /**
      * Delete an intern
      *
      * @remarks
-     * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     deleteIntern(request: operations.DeleteInternRequest, options?: RequestOptions): Promise<models.DeleteInternResponse>;
     /**
      * Get an intern
      *
      * @remarks
-     * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     getIntern(request: operations.GetInternRequest, options?: RequestOptions): Promise<models.Intern>;
     /**
      * Update an intern
      *
      * @remarks
-     * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     updateIntern(request: operations.UpdateInternRequest, options?: RequestOptions): Promise<models.Intern>;
     /**
      * Get an intern's daemon access
      *
      * @remarks
-     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     getInternDaemon(request: operations.GetInternDaemonRequest, options?: RequestOptions): Promise<models.InternDaemonAccess>;
     /**
      * Get an intern's daemon access (deprecated alias)
      *
      * @remarks
-     * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      *
      * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
      */
@@ -57,14 +57,14 @@ export declare class Interns extends ClientSDK {
      * Provision an intern
      *
      * @remarks
-     * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     provisionIntern(request: operations.ProvisionInternRequest, options?: RequestOptions): Promise<models.ProvisionInternResponse>;
     /**
      * Suspend an intern
      *
      * @remarks
-     * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     suspendIntern(request: operations.SuspendInternRequest, options?: RequestOptions): Promise<models.SuspendInternResponse>;
     /**

package/esm/sdk/interns.js

@@ -20,7 +20,7 @@ export class Interns extends ClientSDK {
      * List interns
      *
      * @remarks
-     * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Lists interns visible to the authenticated key, newest first. Filter by workspace and one or more lifecycle statuses. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async listInterns(request, options) {
         return unwrapAsync(internsListInterns(this, request, options));
@@ -29,7 +29,7 @@ export class Interns extends ClientSDK {
      * Create an intern
      *
      * @remarks
-     * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Creates an intern in an explicit workspace. The operation also creates its private vault. It can start provisioning immediately or wait for a later provision call. A retry with the same idempotency key and body resumes unfinished work. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async createIntern(request, options) {
         return unwrapAsync(internsCreateIntern(this, request, options));
@@ -38,7 +38,7 @@ export class Interns extends ClientSDK {
      * Delete an intern
      *
      * @remarks
-     * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Starts safe teardown of the intern, its runtime and its private vault. The body is optional. Send `{"acknowledge_workspace_loss": true}` to delete a `destroy_failed` intern whose `last_failure_message` names `workspace_archive_failed`, accepting that its workspace is not backed up. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async deleteIntern(request, options) {
         return unwrapAsync(internsDeleteIntern(this, request, options));
@@ -47,7 +47,7 @@ export class Interns extends ClientSDK {
      * Get an intern
      *
      * @remarks
-     * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Returns the public lifecycle state and settings for one visible intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async getIntern(request, options) {
         return unwrapAsync(internsGetIntern(this, request, options));
@@ -56,7 +56,7 @@ export class Interns extends ClientSDK {
      * Update an intern
      *
      * @remarks
-     * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async updateIntern(request, options) {
         return unwrapAsync(internsUpdateIntern(this, request, options));
@@ -65,7 +65,7 @@ export class Interns extends ClientSDK {
      * Get an intern's daemon access
      *
      * @remarks
-     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async getInternDaemon(request, options) {
         return unwrapAsync(internsGetInternDaemon(this, request, options));
@@ -74,7 +74,7 @@ export class Interns extends ClientSDK {
      * Get an intern's daemon access (deprecated alias)
      *
      * @remarks
-     * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Deprecated alias of `GET /interns/{internId}/daemon` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      *
      * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
      */
@@ -85,7 +85,7 @@ export class Interns extends ClientSDK {
      * Provision an intern
      *
      * @remarks
-     * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Starts the first boot, or resumes an intern after suspension. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async provisionIntern(request, options) {
         return unwrapAsync(internsProvisionIntern(this, request, options));
@@ -94,7 +94,7 @@ export class Interns extends ClientSDK {
      * Suspend an intern
      *
      * @remarks
-     * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Stops the intern runtime while keeping its disk and configuration for a later provision call. This operation takes no request body. A body carrying any field is refused with 400 rather than ignored. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async suspendIntern(request, options) {
         return unwrapAsync(internsSuspendIntern(this, request, options));

package/esm/sdk/privateendpoints.d.ts

@@ -0,0 +1,76 @@
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+export declare class PrivateEndpoints extends ClientSDK {
+    /**
+     * List private endpoints
+     *
+     * @remarks
+     * List the organization's private endpoints, including drafts. Requires the private endpoints entitlement. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    list(request?: operations.ListPrivateEndpointsRequest | undefined, options?: RequestOptions): Promise<models.ListPrivateEndpointsResponse>;
+    /**
+     * Create a private endpoint
+     *
+     * @remarks
+     * Create a private endpoint as a draft. Drafts are not routable: validate one with `POST /private-endpoints/{id}/validate`, then activate it with `POST /private-endpoints/{id}/activate`. Pass `activate` to do all three in one call; if validation fails the draft is kept and returned with the failed checks. Send an `Idempotency-Key` header to make retries safe: a repeated key with the same request returns the endpoint the first request created; reusing it with different fields returns 422 `idempotency_key_reused`. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    create(request: operations.CreatePrivateEndpointRequest, options?: RequestOptions): Promise<models.ManagedPrivateEndpointResponse>;
+    /**
+     * Delete a private endpoint
+     *
+     * @remarks
+     * Delete a private endpoint and stop routing to it. Pass `draft_only=true` to refuse (409) when the endpoint has been activated. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    delete(request: operations.DeletePrivateEndpointRequest, options?: RequestOptions): Promise<models.DeletePrivateEndpointResponse>;
+    /**
+     * Get a private endpoint
+     *
+     * @remarks
+     * Get one private endpoint with its upstream configuration and current pricing. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    get(request: operations.GetPrivateEndpointRequest, options?: RequestOptions): Promise<models.PrivateEndpointResponse>;
+    /**
+     * Update a draft private endpoint
+     *
+     * @remarks
+     * Replace a draft endpoint's upstream configuration: send `upstream_model_id`, and `base_url` to change it (an omitted `base_url` keeps the stored one). Omitted data-policy declarations are kept while the upstream is unchanged and cleared when it changes. Any change clears earlier validation. Active endpoints return 409; delete and re-create them instead. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    update(request: operations.UpdatePrivateEndpointRequest, options?: RequestOptions): Promise<models.PrivateEndpointResponse>;
+    /**
+     * Activate a validated private endpoint
+     *
+     * @remarks
+     * Make a validated draft routable. Returns 409 when the endpoint was never validated, the validation is stale, or it is already active. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    activate(request: operations.ActivatePrivateEndpointRequest, options?: RequestOptions): Promise<models.ManagedPrivateEndpointResponse>;
+    /**
+     * Disable a private endpoint
+     *
+     * @remarks
+     * Stop routing to an active endpoint without deleting it. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    disable(request: operations.DisablePrivateEndpointRequest, options?: RequestOptions): Promise<models.ManagedPrivateEndpointResponse>;
+    /**
+     * Enable a private endpoint
+     *
+     * @remarks
+     * Resume routing to a disabled endpoint. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    enable(request: operations.EnablePrivateEndpointRequest, options?: RequestOptions): Promise<models.ManagedPrivateEndpointResponse>;
+    /**
+     * Set private endpoint pricing
+     *
+     * @remarks
+     * Set the negotiated per-token rates reported for requests routed to this endpoint. Applies to drafts and active endpoints; new rates take effect for subsequent requests. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    updatePricing(request: operations.UpdatePrivateEndpointPricingRequest, options?: RequestOptions): Promise<models.PrivateEndpointResponse>;
+    /**
+     * Validate a draft private endpoint
+     *
+     * @remarks
+     * Send a live test request to the draft endpoint using the given workspace's BYOK credential for its provider. A passing validation is required before activation. Failed checks return 200 with `passed: false`. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    validate(request: operations.ValidatePrivateEndpointRequest, options?: RequestOptions): Promise<models.PrivateEndpointValidationResponse>;
+}
+//# sourceMappingURL=privateendpoints.d.ts.map

package/esm/sdk/privateendpoints.js

@@ -0,0 +1,109 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: ed31ec182fa7
+ */
+import { privateEndpointsActivate } from "../funcs/privateEndpointsActivate.js";
+import { privateEndpointsCreate } from "../funcs/privateEndpointsCreate.js";
+import { privateEndpointsDelete } from "../funcs/privateEndpointsDelete.js";
+import { privateEndpointsDisable } from "../funcs/privateEndpointsDisable.js";
+import { privateEndpointsEnable } from "../funcs/privateEndpointsEnable.js";
+import { privateEndpointsGet } from "../funcs/privateEndpointsGet.js";
+import { privateEndpointsList } from "../funcs/privateEndpointsList.js";
+import { privateEndpointsUpdate } from "../funcs/privateEndpointsUpdate.js";
+import { privateEndpointsUpdatePricing } from "../funcs/privateEndpointsUpdatePricing.js";
+import { privateEndpointsValidate } from "../funcs/privateEndpointsValidate.js";
+import { ClientSDK } from "../lib/sdks.js";
+import { unwrapAsync } from "../types/fp.js";
+export class PrivateEndpoints extends ClientSDK {
+    /**
+     * List private endpoints
+     *
+     * @remarks
+     * List the organization's private endpoints, including drafts. Requires the private endpoints entitlement. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async list(request, options) {
+        return unwrapAsync(privateEndpointsList(this, request, options));
+    }
+    /**
+     * Create a private endpoint
+     *
+     * @remarks
+     * Create a private endpoint as a draft. Drafts are not routable: validate one with `POST /private-endpoints/{id}/validate`, then activate it with `POST /private-endpoints/{id}/activate`. Pass `activate` to do all three in one call; if validation fails the draft is kept and returned with the failed checks. Send an `Idempotency-Key` header to make retries safe: a repeated key with the same request returns the endpoint the first request created; reusing it with different fields returns 422 `idempotency_key_reused`. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async create(request, options) {
+        return unwrapAsync(privateEndpointsCreate(this, request, options));
+    }
+    /**
+     * Delete a private endpoint
+     *
+     * @remarks
+     * Delete a private endpoint and stop routing to it. Pass `draft_only=true` to refuse (409) when the endpoint has been activated. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async delete(request, options) {
+        return unwrapAsync(privateEndpointsDelete(this, request, options));
+    }
+    /**
+     * Get a private endpoint
+     *
+     * @remarks
+     * Get one private endpoint with its upstream configuration and current pricing. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async get(request, options) {
+        return unwrapAsync(privateEndpointsGet(this, request, options));
+    }
+    /**
+     * Update a draft private endpoint
+     *
+     * @remarks
+     * Replace a draft endpoint's upstream configuration: send `upstream_model_id`, and `base_url` to change it (an omitted `base_url` keeps the stored one). Omitted data-policy declarations are kept while the upstream is unchanged and cleared when it changes. Any change clears earlier validation. Active endpoints return 409; delete and re-create them instead. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async update(request, options) {
+        return unwrapAsync(privateEndpointsUpdate(this, request, options));
+    }
+    /**
+     * Activate a validated private endpoint
+     *
+     * @remarks
+     * Make a validated draft routable. Returns 409 when the endpoint was never validated, the validation is stale, or it is already active. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async activate(request, options) {
+        return unwrapAsync(privateEndpointsActivate(this, request, options));
+    }
+    /**
+     * Disable a private endpoint
+     *
+     * @remarks
+     * Stop routing to an active endpoint without deleting it. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async disable(request, options) {
+        return unwrapAsync(privateEndpointsDisable(this, request, options));
+    }
+    /**
+     * Enable a private endpoint
+     *
+     * @remarks
+     * Resume routing to a disabled endpoint. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async enable(request, options) {
+        return unwrapAsync(privateEndpointsEnable(this, request, options));
+    }
+    /**
+     * Set private endpoint pricing
+     *
+     * @remarks
+     * Set the negotiated per-token rates reported for requests routed to this endpoint. Applies to drafts and active endpoints; new rates take effect for subsequent requests. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async updatePricing(request, options) {
+        return unwrapAsync(privateEndpointsUpdatePricing(this, request, options));
+    }
+    /**
+     * Validate a draft private endpoint
+     *
+     * @remarks
+     * Send a live test request to the draft endpoint using the given workspace's BYOK credential for its provider. A passing validation is required before activation. Failed checks return 200 with `passed: false`. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async validate(request, options) {
+        return unwrapAsync(privateEndpointsValidate(this, request, options));
+    }
+}
+//# sourceMappingURL=privateendpoints.js.map

package/esm/sdk/sdk.d.ts

@@ -23,6 +23,7 @@ import { OAuth } from "./oauth.js";
 import { Observability } from "./observability.js";
 import { Organization } from "./organization.js";
 import { Presets } from "./presets.js";
+import { PrivateEndpoints } from "./privateendpoints.js";
 import { Providers } from "./providers.js";
 import { Rerank } from "./rerank.js";
 import { Responses } from "./responses.js";
@@ -90,6 +91,8 @@ export declare class OpenRouter extends ClientSDK {
     get organization(): Organization;
     private _presets?;
     get presets(): Presets;
+    private _privateEndpoints?;
+    get privateEndpoints(): PrivateEndpoints;
     private _providers?;
     get providers(): Providers;
     private _rerank?;

package/esm/sdk/sdk.js

@@ -27,6 +27,7 @@ import { OAuth } from "./oauth.js";
 import { Observability } from "./observability.js";
 import { Organization } from "./organization.js";
 import { Presets } from "./presets.js";
+import { PrivateEndpoints } from "./privateendpoints.js";
 import { Providers } from "./providers.js";
 import { Rerank } from "./rerank.js";
 import { Responses } from "./responses.js";
@@ -117,6 +118,9 @@ export class OpenRouter extends ClientSDK {
     get presets() {
         return (this._presets ?? (this._presets = new Presets(this._options)));
     }
+    get privateEndpoints() {
+        return (this._privateEndpoints ?? (this._privateEndpoints = new PrivateEndpoints(this._options)));
+    }
     get providers() {
         return (this._providers ?? (this._providers = new Providers(this._options)));
     }

package/esm/sdk/vault.d.ts

@@ -2,53 +2,60 @@ import { ClientSDK, RequestOptions } from "../lib/sdks.js";
 import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class Vault extends ClientSDK {
+    /**
+     * List the secrets an intern receives
+     *
+     * @remarks
+     * Lists, one entry per name, the secret the intern's outbound requests receive: its own secrets, secrets from an attached vault, and workspace secrets, including ones stored before workspace-scoped storage. Where several vaults hold a name, the entry is the one that wins, in the order intern, attached, workspace. The same resolution decides what outbound requests receive, so this list and the intern's requests agree. `scope` says which vault the entry comes from. Responses carry metadata only, never values. Results are ordered by name and paginated with `limit` and `offset`. Returns 404 when the intern's attached vault is no longer available, since the intern then receives no secrets. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    listInternEffectiveVaultSecrets(request: operations.ListInternEffectiveVaultSecretsRequest, options?: RequestOptions): Promise<models.VaultEffectiveSecretListResponse>;
     /**
      * List intern secrets
      *
      * @remarks
-     * Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Lists secret metadata stored for one intern. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     listInternVaultSecrets(request: operations.ListInternVaultSecretsRequest, options?: RequestOptions): Promise<models.VaultSecretListResponse>;
     /**
      * Delete an intern secret
      *
      * @remarks
-     * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     deleteInternVaultSecret(request: operations.DeleteInternVaultSecretRequest, options?: RequestOptions): Promise<void>;
     /**
      * Store an intern secret
      *
      * @remarks
-     * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     storeInternVaultSecret(request: operations.StoreInternVaultSecretRequest, options?: RequestOptions): Promise<models.VaultSecretResponse>;
     /**
      * Copy workspace secrets to an intern
      *
      * @remarks
-     * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Copies the named workspace secrets into one intern's scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     copyVaultSecretsToIntern(request: operations.CopyVaultSecretsToInternRequest, options?: RequestOptions): Promise<models.VaultSecretCopyResponse>;
     /**
      * List workspace secrets
      *
      * @remarks
-     * Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Lists secret metadata for the workspace of the authenticated API key. The list includes secrets stored from the dashboard or at provisioning before workspace-scoped storage; where both exist under one name, the one stored through this API is listed. Those older secrets cannot be deleted or copied through this API, and storing the same name through this API replaces them. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     listVaultSecrets(request?: operations.ListVaultSecretsRequest | undefined, options?: RequestOptions): Promise<models.VaultSecretListResponse>;
     /**
      * Delete a workspace secret
      *
      * @remarks
-     * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     deleteVaultSecret(request: operations.DeleteVaultSecretRequest, options?: RequestOptions): Promise<void>;
     /**
      * Store a workspace secret
      *
      * @remarks
-     * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     storeVaultSecret(request: operations.StoreVaultSecretRequest, options?: RequestOptions): Promise<models.VaultSecretResponse>;
 }