@openrouter/sdk 1.4.25 → 1.5.0

package/esm/sdk/apikeys.js

@@ -62,8 +62,10 @@ export class APIKeys extends ClientSDK {
      * @remarks
      * Update an existing API key. Authenticate with a [management key](/docs/guides/overview/auth/management-api-keys).
      *
+     * Set `workspace_id` to move the key to another workspace.
+     *
      * <Warning>
-     * You can't change `workspace_id` through the API. The request body accepts only the fields listed below, and unrecognized fields are ignored. To move a key to another workspace, use the OpenRouter dashboard. If the body contains none of the accepted fields, the request fails with `400` and the message `No update fields provided`.
+     * The request body accepts only the fields listed below, and unrecognized fields are ignored. If the body contains none of the accepted fields, the request fails with `400` and the message `No update fields provided`.
      * </Warning>
      */
     async update(request, options) {

package/esm/sdk/betaresponses.d.ts

@@ -1,4 +1,6 @@
+import { EventStream } from "../lib/event-streams.js";
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class BetaResponses extends ClientSDK {
     /**
@@ -11,12 +13,12 @@ export declare class BetaResponses extends ClientSDK {
         responsesRequest: {
             stream?: false | undefined;
         };
-    }, options?: RequestOptions): Promise<operations.CreateResponsesResponse>;
+    }, options?: RequestOptions): Promise<models.OpenResponsesResult>;
     send(request: operations.CreateResponsesRequest & {
         responsesRequest: {
             stream: true;
         };
-    }, options?: RequestOptions): Promise<operations.CreateResponsesResponse>;
+    }, options?: RequestOptions): Promise<EventStream<models.StreamEvents>>;
     send(request: operations.CreateResponsesRequest, options?: RequestOptions): Promise<operations.CreateResponsesResponse>;
 }
 //# sourceMappingURL=betaresponses.d.ts.map

package/esm/sdk/chat.d.ts

@@ -1,4 +1,6 @@
+import { EventStream } from "../lib/event-streams.js";
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class Chat extends ClientSDK {
     /**
@@ -11,12 +13,12 @@ export declare class Chat extends ClientSDK {
         chatRequest: {
             stream?: false | undefined;
         };
-    }, options?: RequestOptions): Promise<operations.SendChatCompletionRequestResponse>;
+    }, options?: RequestOptions): Promise<models.ChatResult>;
     send(request: operations.SendChatCompletionRequestRequest & {
         chatRequest: {
             stream: true;
         };
-    }, options?: RequestOptions): Promise<operations.SendChatCompletionRequestResponse>;
+    }, options?: RequestOptions): Promise<EventStream<models.ChatStreamChunk>>;
     send(request: operations.SendChatCompletionRequestRequest, options?: RequestOptions): Promise<operations.SendChatCompletionRequestResponse>;
 }
 //# sourceMappingURL=chat.d.ts.map

package/esm/sdk/endusers.d.ts

@@ -4,41 +4,41 @@ import * as operations from "../models/operations/index.js";
 import { PageIterator } from "../types/operations.js";
 export declare class EndUsers extends ClientSDK {
     /**
-     * List registered end users
+     * List registered external users
      *
      * @remarks
      * List registrations belonging to the authenticated organization. Inactive registrations are excluded by default. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
-    list(request?: operations.ListEndUsersRequest | undefined, options?: RequestOptions): Promise<PageIterator<operations.ListEndUsersResponse, {
+    list(request?: operations.ListExternalUsersRequest | undefined, options?: RequestOptions): Promise<PageIterator<operations.ListExternalUsersResponse, {
         offset: number;
     }>>;
     /**
-     * Register an end user
+     * Register an external user
      *
      * @remarks
      * Register a caller-supplied tracking ID under the authenticated organization. No login account, policy, or credentials are created. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
-    create(request: operations.CreateEndUserRequest, options?: RequestOptions): Promise<models.EndUserResponse>;
+    create(request: operations.CreateExternalUserRequest, options?: RequestOptions): Promise<models.ExternalUserResponse>;
     /**
-     * Deactivate a registered end user
+     * Deactivate a registered external user
      *
      * @remarks
      * Soft-deactivate a registration while retaining its tracking ID. Repeat deactivation succeeds. This does not block inference; reactivate through PATCH. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
-    delete(request: operations.DeleteEndUserRequest, options?: RequestOptions): Promise<void>;
+    delete(request: operations.DeleteExternalUserRequest, options?: RequestOptions): Promise<void>;
     /**
-     * Get a registered end user
+     * Get a registered external user
      *
      * @remarks
      * Retrieve an active or inactive registration by its URL-encoded, caller-supplied tracking ID. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
-    get(request: operations.GetEndUserRequest, options?: RequestOptions): Promise<models.EndUserResponse>;
+    get(request: operations.GetExternalUserRequest, options?: RequestOptions): Promise<models.ExternalUserResponse>;
     /**
-     * Update a registered end user
+     * Update a registered external user
      *
      * @remarks
      * Update registration state without changing identity. State changes do not enforce inference access. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
-    update(request: operations.UpdateEndUserRequest, options?: RequestOptions): Promise<models.EndUserResponse>;
+    update(request: operations.UpdateExternalUserRequest, options?: RequestOptions): Promise<models.ExternalUserResponse>;
 }
 //# sourceMappingURL=endusers.d.ts.map

package/esm/sdk/endusers.js

@@ -2,59 +2,59 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  * @generated-id: 8e12697ee658
  */
-import { endUsersCreate } from "../funcs/endUsersCreate.js";
-import { endUsersDelete } from "../funcs/endUsersDelete.js";
-import { endUsersGet } from "../funcs/endUsersGet.js";
-import { endUsersList } from "../funcs/endUsersList.js";
-import { endUsersUpdate } from "../funcs/endUsersUpdate.js";
+import { externalUsersCreate } from "../funcs/externalUsersCreate.js";
+import { externalUsersDelete } from "../funcs/externalUsersDelete.js";
+import { externalUsersGet } from "../funcs/externalUsersGet.js";
+import { externalUsersList } from "../funcs/externalUsersList.js";
+import { externalUsersUpdate } from "../funcs/externalUsersUpdate.js";
 import { ClientSDK } from "../lib/sdks.js";
 import { unwrapAsync } from "../types/fp.js";
 import { unwrapResultIterator } from "../types/operations.js";
 export class EndUsers extends ClientSDK {
     /**
-     * List registered end users
+     * List registered external users
      *
      * @remarks
      * List registrations belonging to the authenticated organization. Inactive registrations are excluded by default. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async list(request, options) {
-        return unwrapResultIterator(endUsersList(this, request, options));
+        return unwrapResultIterator(externalUsersList(this, request, options));
     }
     /**
-     * Register an end user
+     * Register an external user
      *
      * @remarks
      * Register a caller-supplied tracking ID under the authenticated organization. No login account, policy, or credentials are created. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async create(request, options) {
-        return unwrapAsync(endUsersCreate(this, request, options));
+        return unwrapAsync(externalUsersCreate(this, request, options));
     }
     /**
-     * Deactivate a registered end user
+     * Deactivate a registered external user
      *
      * @remarks
      * Soft-deactivate a registration while retaining its tracking ID. Repeat deactivation succeeds. This does not block inference; reactivate through PATCH. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async delete(request, options) {
-        return unwrapAsync(endUsersDelete(this, request, options));
+        return unwrapAsync(externalUsersDelete(this, request, options));
     }
     /**
-     * Get a registered end user
+     * Get a registered external user
      *
      * @remarks
      * Retrieve an active or inactive registration by its URL-encoded, caller-supplied tracking ID. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async get(request, options) {
-        return unwrapAsync(endUsersGet(this, request, options));
+        return unwrapAsync(externalUsersGet(this, request, options));
     }
     /**
-     * Update a registered end user
+     * Update a registered external user
      *
      * @remarks
      * Update registration state without changing identity. State changes do not enforce inference access. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async update(request, options) {
-        return unwrapAsync(endUsersUpdate(this, request, options));
+        return unwrapAsync(externalUsersUpdate(this, request, options));
     }
 }
 //# sourceMappingURL=endusers.js.map

package/esm/sdk/externalusers.d.ts

@@ -0,0 +1,44 @@
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { PageIterator } from "../types/operations.js";
+export declare class ExternalUsers extends ClientSDK {
+    /**
+     * List registered external users
+     *
+     * @remarks
+     * List registrations belonging to the authenticated organization. Inactive registrations are excluded by default. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    list(request?: operations.ListExternalUsersRequest | undefined, options?: RequestOptions): Promise<PageIterator<operations.ListExternalUsersResponse, {
+        offset: number;
+    }>>;
+    /**
+     * Register an external user
+     *
+     * @remarks
+     * Register a caller-supplied tracking ID under the authenticated organization. No login account, policy, or credentials are created. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    create(request: operations.CreateExternalUserRequest, options?: RequestOptions): Promise<models.ExternalUserResponse>;
+    /**
+     * Deactivate a registered external user
+     *
+     * @remarks
+     * Soft-deactivate a registration while retaining its tracking ID. Repeat deactivation succeeds. This does not block inference; reactivate through PATCH. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    delete(request: operations.DeleteExternalUserRequest, options?: RequestOptions): Promise<void>;
+    /**
+     * Get a registered external user
+     *
+     * @remarks
+     * Retrieve an active or inactive registration by its URL-encoded, caller-supplied tracking ID. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    get(request: operations.GetExternalUserRequest, options?: RequestOptions): Promise<models.ExternalUserResponse>;
+    /**
+     * Update a registered external user
+     *
+     * @remarks
+     * Update registration state without changing identity. State changes do not enforce inference access. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    update(request: operations.UpdateExternalUserRequest, options?: RequestOptions): Promise<models.ExternalUserResponse>;
+}
+//# sourceMappingURL=externalusers.d.ts.map

package/esm/sdk/externalusers.js

@@ -0,0 +1,60 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 8b2b4b6306c5
+ */
+import { externalUsersCreate } from "../funcs/externalUsersCreate.js";
+import { externalUsersDelete } from "../funcs/externalUsersDelete.js";
+import { externalUsersGet } from "../funcs/externalUsersGet.js";
+import { externalUsersList } from "../funcs/externalUsersList.js";
+import { externalUsersUpdate } from "../funcs/externalUsersUpdate.js";
+import { ClientSDK } from "../lib/sdks.js";
+import { unwrapAsync } from "../types/fp.js";
+import { unwrapResultIterator } from "../types/operations.js";
+export class ExternalUsers extends ClientSDK {
+    /**
+     * List registered external users
+     *
+     * @remarks
+     * List registrations belonging to the authenticated organization. Inactive registrations are excluded by default. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async list(request, options) {
+        return unwrapResultIterator(externalUsersList(this, request, options));
+    }
+    /**
+     * Register an external user
+     *
+     * @remarks
+     * Register a caller-supplied tracking ID under the authenticated organization. No login account, policy, or credentials are created. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async create(request, options) {
+        return unwrapAsync(externalUsersCreate(this, request, options));
+    }
+    /**
+     * Deactivate a registered external user
+     *
+     * @remarks
+     * Soft-deactivate a registration while retaining its tracking ID. Repeat deactivation succeeds. This does not block inference; reactivate through PATCH. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async delete(request, options) {
+        return unwrapAsync(externalUsersDelete(this, request, options));
+    }
+    /**
+     * Get a registered external user
+     *
+     * @remarks
+     * Retrieve an active or inactive registration by its URL-encoded, caller-supplied tracking ID. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async get(request, options) {
+        return unwrapAsync(externalUsersGet(this, request, options));
+    }
+    /**
+     * Update a registered external user
+     *
+     * @remarks
+     * Update registration state without changing identity. State changes do not enforce inference access. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     */
+    async update(request, options) {
+        return unwrapAsync(externalUsersUpdate(this, request, options));
+    }
+}
+//# sourceMappingURL=externalusers.js.map

package/esm/sdk/images.d.ts

@@ -1,3 +1,4 @@
+import { EventStream } from "../lib/event-streams.js";
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
 import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
@@ -12,12 +13,12 @@ export declare class Images extends ClientSDK {
         imageGenerationRequest: {
             stream?: false | undefined;
         };
-    }, options?: RequestOptions): Promise<operations.CreateImagesResponse>;
+    }, options?: RequestOptions): Promise<models.ImageGenerationResponse>;
     generate(request: operations.CreateImagesRequest & {
         imageGenerationRequest: {
             stream: true;
         };
-    }, options?: RequestOptions): Promise<operations.CreateImagesResponse>;
+    }, options?: RequestOptions): Promise<EventStream<models.ImageStreamingResponseData>>;
     generate(request: operations.CreateImagesRequest, options?: RequestOptions): Promise<operations.CreateImagesResponse>;
     /**
      * List image generation models

package/esm/sdk/interns.d.ts

@@ -37,11 +37,18 @@ export declare class Interns extends ClientSDK {
      * Changes the intern name, description, instructions or model. Omitted fields stay unchanged. The request body is capped at 1048576 bytes and a larger body is refused with 413. A non-empty body must declare `Content-Type: application/json` or it is refused with 415. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     updateIntern(request: operations.UpdateInternRequest, options?: RequestOptions): Promise<models.Intern>;
+    /**
+     * List an intern's connections
+     *
+     * @remarks
+     * Returns the Slack, GitHub, Google Workspace and MCP connections one visible intern can reach, and the shared ones switched off for it or disabled for the workspace. An OAuth grant needs `vault:read`, because the list names members' personal accounts; without it the route answers 403 `insufficient_scope`. The response is sent with `Cache-Control: no-store`. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    getInternConnections(request: operations.GetInternConnectionsRequest, options?: RequestOptions): Promise<models.InternConnectionList>;
     /**
      * Get an intern's daemon access
      *
      * @remarks
-     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: only an OAuth-token caller (`ori login --oidc`) may read it, the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. API keys get 403 `personal_identity_required`. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     getInternDaemon(request: operations.GetInternDaemonRequest, options?: RequestOptions): Promise<models.InternDaemonAccess>;
     /**
@@ -53,6 +60,29 @@ export declare class Interns extends ClientSDK {
      * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
      */
     getInternDaemonAccess(request: operations.GetInternDaemonAccessRequest, options?: RequestOptions): Promise<models.InternDaemonAccess>;
+    /**
+     * Sign a daemon request with the caller's identity (deprecated alias)
+     *
+     * @remarks
+     * Deprecated alias of `POST /interns/{internId}/daemon/sign` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     *
+     * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
+     */
+    signInternDaemonAccessRequest(request: operations.SignInternDaemonAccessRequestRequest, options?: RequestOptions): Promise<operations.SignInternDaemonAccessRequestResponse>;
+    /**
+     * Sign a daemon request with the caller's identity
+     *
+     * @remarks
+     * Signs the SHA-256 digest of one request the CLI is about to send to the intern daemon, binding it to the intern and to the signed-in member so personal connections resolve. Only an OAuth session from `ori login --oidc` whose grant carries `vault:read` can sign: an API key is refused with 403 because it names no person, and an `interns`-only grant is refused with 403 because a proof releases that user's personal connections. The route is behind the same gate as chat and counts against the chat turn limiter. The response is sent with `Cache-Control: no-store`. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    signInternDaemonRequest(request: operations.SignInternDaemonRequestRequest, options?: RequestOptions): Promise<operations.SignInternDaemonRequestResponse>;
+    /**
+     * Get an intern's icon
+     *
+     * @remarks
+     * Returns the icon image of one visible intern. Pass the intern's `icon_sha256` as `v` to receive a response that can be cached indefinitely. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    getInternIcon(request: operations.GetInternIconRequest, options?: RequestOptions): Promise<ReadableStream<Uint8Array>>;
     /**
      * Provision an intern
      *

package/esm/sdk/interns.js

@@ -6,11 +6,15 @@ import { internsChat } from "../funcs/internsChat.js";
 import { internsCreateIntern } from "../funcs/internsCreateIntern.js";
 import { internsDeleteIntern } from "../funcs/internsDeleteIntern.js";
 import { internsGetIntern } from "../funcs/internsGetIntern.js";
+import { internsGetInternConnections } from "../funcs/internsGetInternConnections.js";
 import { internsGetInternDaemon } from "../funcs/internsGetInternDaemon.js";
 import { internsGetInternDaemonAccess } from "../funcs/internsGetInternDaemonAccess.js";
+import { internsGetInternIcon } from "../funcs/internsGetInternIcon.js";
 import { internsInvoke } from "../funcs/internsInvoke.js";
 import { internsListInterns } from "../funcs/internsListInterns.js";
 import { internsProvisionIntern } from "../funcs/internsProvisionIntern.js";
+import { internsSignInternDaemonAccessRequest } from "../funcs/internsSignInternDaemonAccessRequest.js";
+import { internsSignInternDaemonRequest } from "../funcs/internsSignInternDaemonRequest.js";
 import { internsSuspendIntern } from "../funcs/internsSuspendIntern.js";
 import { internsUpdateIntern } from "../funcs/internsUpdateIntern.js";
 import { ClientSDK } from "../lib/sdks.js";
@@ -61,11 +65,20 @@ export class Interns extends ClientSDK {
     async updateIntern(request, options) {
         return unwrapAsync(internsUpdateIntern(this, request, options));
     }
+    /**
+     * List an intern's connections
+     *
+     * @remarks
+     * Returns the Slack, GitHub, Google Workspace and MCP connections one visible intern can reach, and the shared ones switched off for it or disabled for the workspace. An OAuth grant needs `vault:read`, because the list names members' personal accounts; without it the route answers 403 `insufficient_scope`. The response is sent with `Cache-Control: no-store`. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async getInternConnections(request, options) {
+        return unwrapAsync(internsGetInternConnections(this, request, options));
+    }
     /**
      * Get an intern's daemon access
      *
      * @remarks
-     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     * Returns the origin and daemon token that attach `ori tui --host` to one visible, running intern. The token is a credential: only an OAuth-token caller (`ori login --oidc`) may read it, the response is sent with `Cache-Control: no-store`, and each reveal is logged by caller and intern. API keys get 403 `personal_identity_required`. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
      */
     async getInternDaemon(request, options) {
         return unwrapAsync(internsGetInternDaemon(this, request, options));
@@ -81,6 +94,35 @@ export class Interns extends ClientSDK {
     async getInternDaemonAccess(request, options) {
         return unwrapAsync(internsGetInternDaemonAccess(this, request, options));
     }
+    /**
+     * Sign a daemon request with the caller's identity (deprecated alias)
+     *
+     * @remarks
+     * Deprecated alias of `POST /interns/{internId}/daemon/sign` with the same request, response, and errors. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     *
+     * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
+     */
+    async signInternDaemonAccessRequest(request, options) {
+        return unwrapAsync(internsSignInternDaemonAccessRequest(this, request, options));
+    }
+    /**
+     * Sign a daemon request with the caller's identity
+     *
+     * @remarks
+     * Signs the SHA-256 digest of one request the CLI is about to send to the intern daemon, binding it to the intern and to the signed-in member so personal connections resolve. Only an OAuth session from `ori login --oidc` whose grant carries `vault:read` can sign: an API key is refused with 403 because it names no person, and an `interns`-only grant is refused with 403 because a proof releases that user's personal connections. The route is behind the same gate as chat and counts against the chat turn limiter. The response is sent with `Cache-Control: no-store`. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async signInternDaemonRequest(request, options) {
+        return unwrapAsync(internsSignInternDaemonRequest(this, request, options));
+    }
+    /**
+     * Get an intern's icon
+     *
+     * @remarks
+     * Returns the icon image of one visible intern. Pass the intern's `icon_sha256` as `v` to receive a response that can be cached indefinitely. The API key selects the caller, workspace and visible interns. An intern's own API key sees only that intern: the collection and every other intern answer 404 to it. There is no default workspace fallback. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async getInternIcon(request, options) {
+        return unwrapAsync(internsGetInternIcon(this, request, options));
+    }
     /**
      * Provision an intern
      *

package/esm/sdk/privateendpoints.d.ts

@@ -62,7 +62,7 @@ export declare class PrivateEndpoints extends ClientSDK {
      * Set private endpoint pricing
      *
      * @remarks
-     * Set the negotiated per-token rates reported for requests routed to this endpoint. Applies to drafts and active endpoints; new rates take effect for subsequent requests. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Set the negotiated per-token rates reported for requests routed to this endpoint. Applies to drafts and active endpoints; new rates take effect for subsequent requests. The body replaces the whole pricing object: omitting `cache_read` or `cache_write` reverts that rate to the provider pricing strategy's default, even if it was set before. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     updatePricing(request: operations.UpdatePrivateEndpointPricingRequest, options?: RequestOptions): Promise<models.PrivateEndpointResponse>;
     /**

package/esm/sdk/privateendpoints.js

@@ -91,7 +91,7 @@ export class PrivateEndpoints extends ClientSDK {
      * Set private endpoint pricing
      *
      * @remarks
-     * Set the negotiated per-token rates reported for requests routed to this endpoint. Applies to drafts and active endpoints; new rates take effect for subsequent requests. [Management key](/docs/guides/overview/auth/management-api-keys) required.
+     * Set the negotiated per-token rates reported for requests routed to this endpoint. Applies to drafts and active endpoints; new rates take effect for subsequent requests. The body replaces the whole pricing object: omitting `cache_read` or `cache_write` reverts that rate to the provider pricing strategy's default, even if it was set before. [Management key](/docs/guides/overview/auth/management-api-keys) required.
      */
     async updatePricing(request, options) {
         return unwrapAsync(privateEndpointsUpdatePricing(this, request, options));

package/esm/sdk/responses.d.ts

@@ -1,4 +1,6 @@
+import { EventStream } from "../lib/event-streams.js";
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class Responses extends ClientSDK {
     /**
@@ -11,12 +13,12 @@ export declare class Responses extends ClientSDK {
         responsesRequest: {
             stream?: false | undefined;
         };
-    }, options?: RequestOptions): Promise<operations.CreateResponsesResponse>;
+    }, options?: RequestOptions): Promise<models.OpenResponsesResult>;
     send(request: operations.CreateResponsesRequest & {
         responsesRequest: {
             stream: true;
         };
-    }, options?: RequestOptions): Promise<operations.CreateResponsesResponse>;
+    }, options?: RequestOptions): Promise<EventStream<models.StreamEvents>>;
     send(request: operations.CreateResponsesRequest, options?: RequestOptions): Promise<operations.CreateResponsesResponse>;
 }
 //# sourceMappingURL=responses.d.ts.map

package/esm/sdk/sdk.d.ts

@@ -14,6 +14,7 @@ import { Datasets } from "./datasets.js";
 import { Embeddings } from "./embeddings.js";
 import { Endpoints } from "./endpoints.js";
 import { EndUsers } from "./endusers.js";
+import { ExternalUsers } from "./externalusers.js";
 import { Files } from "./files.js";
 import { Generations } from "./generations.js";
 import { Guardrails } from "./guardrails.js";
@@ -71,10 +72,12 @@ export declare class OpenRouter extends ClientSDK {
     get datasets(): Datasets;
     private _embeddings?;
     get embeddings(): Embeddings;
-    private _endUsers?;
-    get endUsers(): EndUsers;
     private _endpoints?;
     get endpoints(): Endpoints;
+    private _externalUsers?;
+    get externalUsers(): ExternalUsers;
+    private _endUsers?;
+    get endUsers(): EndUsers;
     private _files?;
     get files(): Files;
     private _generations?;

package/esm/sdk/sdk.js

@@ -18,6 +18,7 @@ import { Datasets } from "./datasets.js";
 import { Embeddings } from "./embeddings.js";
 import { Endpoints } from "./endpoints.js";
 import { EndUsers } from "./endusers.js";
+import { ExternalUsers } from "./externalusers.js";
 import { Files } from "./files.js";
 import { Generations } from "./generations.js";
 import { Guardrails } from "./guardrails.js";
@@ -87,12 +88,15 @@ export class OpenRouter extends ClientSDK {
     get embeddings() {
         return (this._embeddings ?? (this._embeddings = new Embeddings(this._options)));
     }
-    get endUsers() {
-        return (this._endUsers ?? (this._endUsers = new EndUsers(this._options)));
-    }
     get endpoints() {
         return (this._endpoints ?? (this._endpoints = new Endpoints(this._options)));
     }
+    get externalUsers() {
+        return (this._externalUsers ?? (this._externalUsers = new ExternalUsers(this._options)));
+    }
+    get endUsers() {
+        return (this._endUsers ?? (this._endUsers = new EndUsers(this._options)));
+    }
     get files() {
         return (this._files ?? (this._files = new Files(this._options)));
     }

package/esm/sdk/vault.d.ts

@@ -2,6 +2,13 @@ import { ClientSDK, RequestOptions } from "../lib/sdks.js";
 import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class Vault extends ClientSDK {
+    /**
+     * List the connections an intern can use
+     *
+     * @remarks
+     * Lists the connections in scope for the intern, by the key of their card on the dashboard's Connections tab: `github`, `slack`, `google`, a catalog MCP server such as `linear` or `notion`, or `mcp:<host>` for a custom MCP server. A connection is listed when it is stored, enabled, and not turned off or hidden for this intern, as the Connections tab lists it; whether its last test passed is not part of the rule. `ori features add` checks a feature's `ori.requires.connections` against this list. Keys only, never credentials. Returns 404 for an intern the key cannot see. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    listInternConnections(request: operations.ListInternConnectionsRequest, options?: RequestOptions): Promise<operations.ListInternConnectionsResponse>;
     /**
      * List the secrets an intern receives
      *

package/esm/sdk/vault.js

@@ -5,6 +5,7 @@
 import { vaultCopyVaultSecretsToIntern } from "../funcs/vaultCopyVaultSecretsToIntern.js";
 import { vaultDeleteInternVaultSecret } from "../funcs/vaultDeleteInternVaultSecret.js";
 import { vaultDeleteVaultSecret } from "../funcs/vaultDeleteVaultSecret.js";
+import { vaultListInternConnections } from "../funcs/vaultListInternConnections.js";
 import { vaultListInternEffectiveVaultSecrets } from "../funcs/vaultListInternEffectiveVaultSecrets.js";
 import { vaultListInternVaultSecrets } from "../funcs/vaultListInternVaultSecrets.js";
 import { vaultListVaultSecrets } from "../funcs/vaultListVaultSecrets.js";
@@ -13,6 +14,15 @@ import { vaultStoreVaultSecret } from "../funcs/vaultStoreVaultSecret.js";
 import { ClientSDK } from "../lib/sdks.js";
 import { unwrapAsync } from "../types/fp.js";
 export class Vault extends ClientSDK {
+    /**
+     * List the connections an intern can use
+     *
+     * @remarks
+     * Lists the connections in scope for the intern, by the key of their card on the dashboard's Connections tab: `github`, `slack`, `google`, a catalog MCP server such as `linear` or `notion`, or `mcp:<host>` for a custom MCP server. A connection is listed when it is stored, enabled, and not turned off or hidden for this intern, as the Connections tab lists it; whether its last test passed is not part of the rule. `ori features add` checks a feature's `ori.requires.connections` against this list. Keys only, never credentials. Returns 404 for an intern the key cannot see. The scope is selected by the API key: workspace routes act on the key's active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. An intern's own API key is confined to that intern: it can always read the intern's secrets and effective secrets, writes to them follow the rules above, and every other intern and every workspace route answers 404. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.
+     */
+    async listInternConnections(request, options) {
+        return unwrapAsync(vaultListInternConnections(this, request, options));
+    }
     /**
      * List the secrets an intern receives
      *

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@openrouter/sdk",
-  "version": "1.4.25",
+  "version": "1.5.0",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrouter/sdk",
-  "version": "1.4.25",
+  "version": "1.5.0",
   "author": "OpenRouter",
   "description": "The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.",
   "keywords": [
@@ -73,15 +73,15 @@
     "lint": "eslint --cache --max-warnings=0 src",
     "build": "tsc && node scripts/unbarrel-imports.js",
     "prepublishOnly": "npm run build",
-    "compile": "tsc && node scripts/unbarrel-imports.js",
-    "test": "vitest --run --project unit",
-    "test:watch": "vitest --watch --project unit",
     "typecheck": "tsc --noEmit",
     "typecheck:transit": "exit 0",
-    "postinstall": "node scripts/check-types.js || true",
     "prepare": "npm run build",
+    "test": "vitest --run --project unit",
     "test:e2e": "vitest --run --project e2e",
-    "test:transit": "exit 0"
+    "test:transit": "exit 0",
+    "test:watch": "vitest --watch --project unit",
+    "compile": "tsc && node scripts/unbarrel-imports.js",
+    "postinstall": "node scripts/check-types.js || true"
   },
   "peerDependencies": {