codai-sdk 0.66.0 → 0.67.0

package/dist/index.js

@@ -3036,6 +3036,10 @@ var VoiceRevocations = class {
 
 //#endregion
 //#region src/resources/vault.ts
+/** The UTF-8 message an unlock proof covers: `codai-vault/unlock/v1|<challenge>|<device_id or "passkey">`. */
+function vaultUnlockMessage(challenge, deviceIdOrPasskey) {
+	return `codai-vault/unlock/v1|${challenge}|${deviceIdOrPasskey}`;
+}
 const seg = (base, id, suffix = "") => `${base}/${encodeURIComponent(id)}${suffix}`;
 /** `/v1/vault/devices/*` — hardware-backed device approval keys (public keys only; revocation is instant). */
 var VaultDevices = class {
@@ -3124,6 +3128,53 @@ var Vault = class {
 	setDefaultTier(defaultTier, opts = {}) {
 		return this.send("PATCH", "/v1/vault/settings", opts, { default_tier: defaultTier });
 	}
+	/**
+	* `PATCH /v1/vault/settings` — `default_tier` and/or partial anomaly `guards` (merged over the current ones).
+	* Answers the effective `{ default_tier, guards }`.
+	*/
+	updateSettings(body, opts = {}) {
+		if (body.default_tier === void 0 && body.guards === void 0) return Promise.reject(/* @__PURE__ */ new TypeError("updateSettings needs default_tier and/or guards"));
+		return this.send("PATCH", "/v1/vault/settings", opts, { ...body });
+	}
+	/**
+	* `POST /v1/vault/lock` — panic: revoke every live grant, deny every pending approval, lock the vault (agent uses
+	* then answer `vault_locked`). Device keys stay enrolled. Idempotent.
+	*/
+	lock(params = {}, opts = {}) {
+		return this.send("POST", "/v1/vault/lock", opts, { via: params.via });
+	}
+	/** `POST /v1/vault/unlock/challenge` — single-use unlock challenge, valid 5 minutes. */
+	unlockChallenge(opts = {}) {
+		return this.send("POST", "/v1/vault/unlock/challenge", opts, {});
+	}
+	/**
+	* `POST /v1/vault/unlock` — end a lock with a device-key proof over {@link vaultUnlockMessage} or a passkey whose
+	* challenge is base64url(SHA-256(that message with `passkey`)). 403 `challenge_invalid`, `wear_t3_only`, …
+	*/
+	unlock(body, opts = {}) {
+		return this.send("POST", "/v1/vault/unlock", opts, { ...body });
+	}
+	/** `GET /v1/vault/limits` — per-handle usage caps on your items. */
+	async limits(opts = {}) {
+		return [...(await this.get("/v1/vault/limits", opts)).limits];
+	}
+	/**
+	* `PUT /v1/vault/items/{id}/limits` — all three keys required; `null` removes a cap, all `null` removes the limits
+	* (answers `null`). Over a cap the broker calls answer 429 `vault_rate_limited` with `Retry-After`.
+	*/
+	async setLimits(id, limits, opts = {}) {
+		return (await this.http.json(seg("/v1/vault/items", id, "/limits"), {
+			method: "PUT",
+			body: {
+				per_minute: limits.per_minute,
+				per_day: limits.per_day,
+				units_per_day: limits.units_per_day
+			},
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		})).limits ?? null;
+	}
 	/** `GET /v1/vault/vaults` — vaults you belong to, with your role and sealed vault key. */
 	vaults(opts = {}) {
 		return this.get("/v1/vault/vaults", opts);
@@ -3174,6 +3225,10 @@ var Vault = class {
 	revokeGrant(id, opts = {}) {
 		return this.send("DELETE", seg("/v1/vault/grants", id), opts);
 	}
+	/** `POST /v1/vault/grants/revoke-task` — revoke every live grant of a task / session; answers `{ revoked }`. */
+	revokeTaskGrants(task, opts = {}) {
+		return this.send("POST", "/v1/vault/grants/revoke-task", opts, { task });
+	}
 	/** `GET /v1/vault/events` — append-only audit log (never contains secret values). */
 	events(params = {}, opts = {}) {
 		return this.get("/v1/vault/events", opts, { limit: params.limit });
@@ -6354,7 +6409,13 @@ const OPERATION_METHODS = {
 	createVoiceRevocation: "voiceRevocations.create",
 	getVaultAccount: "vault.account",
 	putVaultAccount: "vault.putAccount",
-	patchVaultSettings: "vault.setDefaultTier",
+	patchVaultSettings: "vault.updateSettings",
+	lockVault: "vault.lock",
+	createVaultUnlockChallenge: "vault.unlockChallenge",
+	unlockVault: "vault.unlock",
+	listVaultLimits: "vault.limits",
+	setVaultItemLimits: "vault.setLimits",
+	revokeVaultTaskGrants: "vault.revokeTaskGrants",
 	listVaults: "vault.vaults",
 	createVault: "vault.createVault",
 	listVaultItems: "vault.items",
@@ -6869,6 +6930,7 @@ var CodaiApps = class {
 *   client.voiceRevocations.create (public takedown ticket for a voice cloned in codai Studio; no key needed)
 *   client.vault.account / .items / .putItem / .rules / .approvals / .decide / .catalog / .use / .httpCall / .resolve
 *   client.vault.devices.challenge / .enroll / .list / .rename / .revoke (device approval keys, V-27)
+*   client.vault.updateSettings / .lock / .unlockChallenge / .unlock / .limits / .setLimits / .revokeTaskGrants (guards, v4)
 *     (zero-knowledge credentials vault: ciphertext only; the broker calls never return secret values)
 *   client.abuseReports.create (public DSA notice about a codai Studio share / review link; no key needed)
 *   client.provenance.check (public: which codai AI-provenance marks a file carries; no key needed)
@@ -7165,5 +7227,5 @@ function allKeys(obj) {
 }
 
 //#endregion
-export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, Keys, Lists, Memory, Messages, Models, Music, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, extensionHeaders, frameJson, isAssetDto, isProductionFinished, isResearchFinished, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, verifyAttestationWithKeys, verifyResolveWebhook };
+export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, Keys, Lists, Memory, Messages, Models, Music, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, extensionHeaders, frameJson, isAssetDto, isProductionFinished, isResearchFinished, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, vaultUnlockMessage, verifyAttestationWithKeys, verifyResolveWebhook };
 //# sourceMappingURL=index.js.map