codai-sdk 0.71.0 → 0.73.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.ts CHANGED
@@ -6099,8 +6099,26 @@ type paths$1 = {
6099
6099
  readonly get?: never;
6100
6100
  readonly put?: never;
6101
6101
  /**
6102
- * Create a production (brief → video)
6103
- * @description One brief becomes a finished promo video, server-side: ONE model turn storyboards it on a built-in video starter
6102
+ * Create a production (brief → finished output)
6103
+ * @description One brief becomes a finished output of one of 8 kinds (`kind`, default `video`), server-side. Every kind runs one
6104
+ * bounded plan turn (`codai::production-storyboard`), generates its images or music under one wallet hold, saves an
6105
+ * editable creative and builds the output with the regular Studio builders:
6106
+ *
6107
+ * | kind | plan | output (`outputs[].role` → format) |
6108
+ * |---|---|---|
6109
+ * | `video` | storyboard on a starter | MP4 render (`render_id`), vision review + one repair |
6110
+ * | `image` | headline, subline, image prompt, format (1:1, 4:5 or 9:16) | `image` → PNG |
6111
+ * | `deck` | title + 4–8 slides | `document` → PPTX (16:9) |
6112
+ * | `doc` | title + 4–8 sections | `document` → DOCX (A4) |
6113
+ * | `sheet` | title + columns + 5–20 rows | `document` → XLSX |
6114
+ * | `carousel` | 4–8 slides (4:5) | `pages` → ZIP of PNGs, `cover` → PNG |
6115
+ * | `print` | poster or flyer, A4 or A5 | `pdf` → PDF |
6116
+ * | `audio` | jingle or song, ≤ 60 s (Lyria 3 Clip, not available on EU data-residency keys) | `audio` → MP3 |
6117
+ *
6118
+ * `starter`, `voice`, `narration` and `aspect_ratio` apply to `video` only (`starter` with another kind is a 400).
6119
+ * Non-video kinds have no review/repair step and return `kind`, `output_asset_id` and `outputs`; video responses are
6120
+ * unchanged. For `video`:
6121
+ * one brief becomes a finished promo video: ONE model turn storyboards it on a built-in video starter
6104
6122
  * (copy vars, one image prompt and one narration line per scene), every scene gets a codai-image still and a
6105
6123
  * narration line (in parallel, billed once each under one wallet hold), the result is saved as an editable creative
6106
6124
  * and a draft render is queued. When the render is ready a vision review of one frame per scene may fix text once
@@ -7865,7 +7883,7 @@ type paths$1 = {
7865
7883
  readonly put?: never;
7866
7884
  /**
7867
7885
  * Resolve values for a local broker
7868
- * @description For codai brokers only (`x-codai-agent: codaid…` or `desktop…`): the cloud fallback of `codaid vault run` when the vault is not unlocked on the machine. Each handle gets an env-mode policy decision; t3/t4 answer 202 with approval ids, items that are not cloud-usable answer 409 `not_cloud_usable`. The broker injects values into a child process and redacts its output; they never reach a model.
7886
+ * @description For codai brokers only (`x-codai-agent: codaid…` or `desktop…`): the cloud fallback of `codaid vault run` when the vault is not unlocked on the machine. Every call carries a `proof`: a fresh challenge from `POST /v1/vault/resolve/challenge` signed by one of your enrolled device keys, checked before any policy decision. Each handle gets an env-mode policy decision; t3/t4 answer 202 with approval ids, items that are not cloud-usable answer 409 `not_cloud_usable`. The broker injects values into a child process and redacts its output; they never reach a model. Errors: 400 `proof_required`, `invalid_challenge` (unknown, used or expired); 403 `invalid_device_proof` (device not yours, revoked, or bad signature), `broker_only`, `vault_denied`.
7869
7887
  */
7870
7888
  readonly post: operations$1['vaultResolve'];
7871
7889
  readonly delete?: never;
@@ -7874,6 +7892,26 @@ type paths$1 = {
7874
7892
  readonly patch?: never;
7875
7893
  readonly trace?: never;
7876
7894
  };
7895
+ readonly '/v1/vault/resolve/challenge': {
7896
+ readonly parameters: {
7897
+ readonly query?: never;
7898
+ readonly header?: never;
7899
+ readonly path?: never;
7900
+ readonly cookie?: never;
7901
+ };
7902
+ readonly get?: never;
7903
+ readonly put?: never;
7904
+ /**
7905
+ * Get a resolve challenge
7906
+ * @description For codai brokers only (`x-codai-agent: codaid…` or `desktop…`; others get 403 `broker_only`). Single-use nonce valid for 120 seconds; the broker signs it with its enrolled device key into the `proof` of the next `POST /v1/vault/resolve`.
7907
+ */
7908
+ readonly post: operations$1['createVaultResolveChallenge'];
7909
+ readonly delete?: never;
7910
+ readonly options?: never;
7911
+ readonly head?: never;
7912
+ readonly patch?: never;
7913
+ readonly trace?: never;
7914
+ };
7877
7915
  readonly '/v1/vault/rules': {
7878
7916
  readonly parameters: {
7879
7917
  readonly query?: never;
@@ -8205,7 +8243,7 @@ type components$1 = {
8205
8243
  * @description Outcome of `referral_code`; `null` when not sent.
8206
8244
  * @enum {string|null}
8207
8245
  */
8208
- readonly referral_result: 'window_closed' | 'none' | 'invalid_code' | 'self' | 'already_referred' | 'flagged' | 'granted' | 'cap_reached' | null;
8246
+ readonly referral_result: 'window_closed' | 'none' | 'invalid_code' | 'self' | 'already_referred' | 'flagged' | 'pending_payment' | 'granted' | 'cap_reached' | null;
8209
8247
  readonly training_opt_out: boolean;
8210
8248
  /** Format: uuid */
8211
8249
  readonly user_id: string;
@@ -16728,14 +16766,22 @@ type components$1 = {
16728
16766
  /** Format: date-time */
16729
16767
  readonly created_at: string;
16730
16768
  readonly creative_id: string | null;
16769
+ /** @description Requested length in seconds (video productions); null when none was requested. */
16770
+ readonly duration_s?: number | null;
16731
16771
  readonly error: string | null;
16732
16772
  readonly first_render_id: string | null;
16733
16773
  /** Format: uuid */
16734
16774
  readonly id: string;
16775
+ /** @description Present only for non-video productions. */
16776
+ readonly kind?: components$1['schemas']['StudioProductionKind'];
16735
16777
  /** @enum {string} */
16736
16778
  readonly language: 'en' | 'ro';
16737
16779
  /** @enum {string} */
16738
16780
  readonly object: 'studio.production';
16781
+ /** @description The primary output (`outputs[0].asset_id`), `null` until `status` is `succeeded`. Present only for non-video productions. */
16782
+ readonly output_asset_id?: string | null;
16783
+ /** @description The built outputs (empty until `status` is `succeeded`). Present only for non-video productions. */
16784
+ readonly outputs?: readonly components$1['schemas']['StudioProductionOutput'][];
16739
16785
  /**
16740
16786
  * @description storyboard → assets → render → qa → repair (at most once) → ready | failed.
16741
16787
  * @enum {string}
@@ -16762,15 +16808,18 @@ type components$1 = {
16762
16808
  /** Studio production request */
16763
16809
  readonly StudioProductionCreate: {
16764
16810
  /**
16765
- * @description Output format.
16811
+ * @description Output format (`video` only; the other kinds pick their own format).
16766
16812
  * @default 16:9
16767
16813
  * @enum {string}
16768
16814
  */
16769
16815
  readonly aspect_ratio?: '16:9' | '9:16' | '1:1';
16770
- /** @description What the video should say: product, audience, tone, call to action (10–2,000 characters). */
16816
+ /** @description What the output should say: product, audience, tone, call to action (10–2,000 characters). */
16771
16817
  readonly brief: string;
16772
16818
  /** @description Spending cap for the whole production in micro-USD (default 3,000,000, max 20,000,000). */
16773
16819
  readonly budget_micro_usd?: number;
16820
+ /** @description Target length in seconds (`video` only). The storyboard and voice-over are planned for it and the scenes stretch to reach it; default: the starter's natural length (about 15–30 s). With another kind it is a 400. */
16821
+ readonly duration_s?: number;
16822
+ readonly kind?: components$1['schemas']['StudioProductionKind'];
16774
16823
  /**
16775
16824
  * @description Language of the copy and the voice-over (and of the starters the model chooses from).
16776
16825
  * @default ro
@@ -16778,17 +16827,35 @@ type components$1 = {
16778
16827
  */
16779
16828
  readonly language?: 'en' | 'ro';
16780
16829
  /**
16781
- * @description Add a voice-over (one line per scene).
16830
+ * @description Add a voice-over (one line per scene). `video` only.
16782
16831
  * @default true
16783
16832
  */
16784
16833
  readonly narration?: boolean;
16785
- /** @description Optional video starter to use (`starter:<slug>:<language>`); default: the model picks one. */
16834
+ /** @description Optional video starter to use (`starter:<slug>:<language>`); default: the model picks one. `video` only. */
16786
16835
  readonly starter?: string;
16787
16836
  /** @description Optional title (default: the storyboard title). */
16788
16837
  readonly title?: string;
16789
16838
  /** @description Optional narration voice (a Cloud TTS voice name or `custom:<uuid>`). */
16790
16839
  readonly voice?: string;
16791
16840
  };
16841
+ /**
16842
+ * Studio production kind
16843
+ * @description What the production builds: `video` (MP4), `image` (PNG), `deck` (PPTX), `doc` (DOCX), `sheet` (XLSX), `audio` (MP3 jingle or song), `carousel` (PNG slides in a ZIP + cover) or `print` (A4/A5 PDF poster or flyer).
16844
+ * @default video
16845
+ * @enum {string}
16846
+ */
16847
+ readonly StudioProductionKind: 'video' | 'image' | 'deck' | 'doc' | 'sheet' | 'audio' | 'carousel' | 'print';
16848
+ /**
16849
+ * Studio production output
16850
+ * @description A built output of a non-video production: the regular Studio asset plus its `role`. `url` is a 1 h signed GET, `null` while not ready.
16851
+ */
16852
+ readonly StudioProductionOutput: components$1['schemas']['AssetDto'] & {
16853
+ /**
16854
+ * @description What the asset is: `image` (PNG), `cover` (carousel cover PNG), `document` (PPTX, DOCX or XLSX), `pages` (ZIP of carousel PNGs), `pdf` or `audio` (MP3).
16855
+ * @enum {string}
16856
+ */
16857
+ readonly role: 'image' | 'cover' | 'document' | 'pages' | 'pdf' | 'audio';
16858
+ };
16792
16859
  /** Review decision */
16793
16860
  readonly StudioPublicDecisionRequest: {
16794
16861
  /** @enum {string} */
@@ -18660,7 +18727,7 @@ type components$1 = {
18660
18727
  readonly nonce: string;
18661
18728
  };
18662
18729
  readonly VaultDeviceEnroll: {
18663
- /** @description Required for `android_keystore` (certificate chain, leaf first, attestation challenge = nonce bytes). Optional for `windows_hello`: a TPM attestation gives `tpm`, none gives `hello-unattested`. */
18730
+ /** @description Required for `android_keystore` (certificate chain, leaf first, attestation challenge = nonce bytes). Optional for `windows_hello`: a TPM attestation gives `tpm`, none gives `hello-unattested`. Must be absent for `cli_ed25519` (surface `cli`, stored as `software`). */
18664
18731
  readonly attestation?: {
18665
18732
  readonly android_chain: readonly string[];
18666
18733
  } | {
@@ -18670,36 +18737,39 @@ type components$1 = {
18670
18737
  };
18671
18738
  };
18672
18739
  readonly device_id: string;
18673
- /** @description The device key over the same message (ECDSA P-256 DER on Android, RSASSA-PKCS1-v1_5 SHA-256 for Windows Hello), base64url. */
18740
+ /** @description The device key over the same message (ECDSA P-256 DER on Android, RSASSA-PKCS1-v1_5 SHA-256 for Windows Hello, raw 64-byte Ed25519 for `cli_ed25519`), base64url. */
18674
18741
  readonly device_signature: string;
18675
18742
  /** @enum {string} */
18676
- readonly kind: 'android_keystore' | 'windows_hello';
18743
+ readonly kind: 'android_keystore' | 'windows_hello' | 'cli_ed25519';
18677
18744
  readonly name: string;
18678
18745
  /** @description Nonce from `POST /v1/vault/devices/challenge`. */
18679
18746
  readonly nonce: string;
18680
18747
  /** @description SubjectPublicKeyInfo DER of the device key, base64url. */
18681
18748
  readonly public_key: string;
18682
18749
  /** @enum {string} */
18683
- readonly surface: 'phone' | 'wear' | 'desktop';
18750
+ readonly surface: 'phone' | 'wear' | 'desktop' | 'cli';
18684
18751
  /** @description Ed25519 signature of your vault key over `codai-vault/device-enroll/v1|<device_id>|<kind>|<spki_sha256>|<nonce>`. */
18685
18752
  readonly vault_signature: string;
18686
18753
  };
18687
18754
  readonly VaultDeviceKey: {
18688
18755
  /**
18689
- * @description What the gateway verified at enrolment: Google key attestation (StrongBox or TEE), a TPM attestation of the Windows Hello key, or an unattested Windows Hello key.
18756
+ * @description What the gateway verified at enrolment: Google key attestation (StrongBox or TEE), a TPM attestation of the Windows Hello key, an unattested Windows Hello key, or `software` for a `cli_ed25519` key (no hardware proof).
18690
18757
  * @enum {string}
18691
18758
  */
18692
- readonly attestation: 'android-strongbox' | 'android-tee' | 'tpm' | 'hello-unattested';
18759
+ readonly attestation: 'android-strongbox' | 'android-tee' | 'tpm' | 'hello-unattested' | 'software';
18693
18760
  /** @description Attestation details (security level, OS patch level, verified boot state…). No secrets. */
18694
18761
  readonly attestation_info: {
18695
18762
  readonly [key: string]: unknown;
18696
18763
  };
18697
18764
  /** Format: date-time */
18698
18765
  readonly created_at: string;
18699
- /** @description Device id (`android-…`, `wear-…` or `desktop-…`), chosen by the client. */
18766
+ /** @description Device id (`android-…`, `wear-…`, `desktop-…` or `cli-…`), chosen by the client. */
18700
18767
  readonly id: string;
18701
- /** @enum {string} */
18702
- readonly kind: 'android_keystore' | 'windows_hello';
18768
+ /**
18769
+ * @description `cli_ed25519` is the software key of `codaid`: it proves `POST /v1/vault/resolve` requests only and can never decide approvals or unlock the vault.
18770
+ * @enum {string}
18771
+ */
18772
+ readonly kind: 'android_keystore' | 'windows_hello' | 'cli_ed25519';
18703
18773
  /** Format: date-time */
18704
18774
  readonly last_used_at: string | null;
18705
18775
  readonly name: string;
@@ -18708,7 +18778,7 @@ type components$1 = {
18708
18778
  /** Format: date-time */
18709
18779
  readonly revoked_at: string | null;
18710
18780
  /** @enum {string} */
18711
- readonly surface: 'phone' | 'wear' | 'desktop';
18781
+ readonly surface: 'phone' | 'wear' | 'desktop' | 'cli';
18712
18782
  };
18713
18783
  readonly VaultGuards: {
18714
18784
  /** @description Agent requests for one item within `burst_window_s` that count as a burst (`anomaly:burst`); 0 = off. */
@@ -18762,6 +18832,23 @@ type components$1 = {
18762
18832
  /** Format: date-time */
18763
18833
  readonly locked_at: string;
18764
18834
  };
18835
+ readonly VaultResolveChallenge: {
18836
+ /** @description 32 random bytes, base64url. Single use; sign it into the next `POST /v1/vault/resolve` proof. */
18837
+ readonly challenge: string;
18838
+ /**
18839
+ * Format: date-time
18840
+ * @description 120 seconds after issue.
18841
+ */
18842
+ readonly expires_at: string;
18843
+ };
18844
+ readonly VaultResolveProof: {
18845
+ /** @description Challenge from `POST /v1/vault/resolve/challenge`. */
18846
+ readonly challenge: string;
18847
+ /** @description An enrolled, unrevoked device key of the caller (desktop: `windows_hello`; codaid: `cli_ed25519`). */
18848
+ readonly device_id: string;
18849
+ /** @description Device-key signature, base64url, over `codai-vault/resolve/v1|<challenge>|<device_id>|<digest>` where `digest` = base64url_nopad(SHA-256(UTF-8(handles joined by `\n` + `\n\n` + action))), with `handles` and `action` exactly as sent. */
18850
+ readonly signature: string;
18851
+ };
18765
18852
  readonly VaultUnlockChallenge: {
18766
18853
  /** @description 32 random bytes, base64url. Single use. */
18767
18854
  readonly challenge: string;
@@ -35087,6 +35174,7 @@ interface operations$1 {
35087
35174
  readonly action: string;
35088
35175
  readonly chain?: readonly string[];
35089
35176
  readonly handles: readonly string[];
35177
+ readonly proof: components$1['schemas']['VaultResolveProof'];
35090
35178
  /** @enum {string} */
35091
35179
  readonly provenance?: 'user' | 'agent' | 'untrusted';
35092
35180
  readonly purpose?: string;
@@ -35119,7 +35207,7 @@ interface operations$1 {
35119
35207
  };
35120
35208
  readonly 400: components$1['responses']['BadRequest'];
35121
35209
  readonly 401: components$1['responses']['Unauthorized'];
35122
- /** @description Not a broker, or denied by policy. */
35210
+ /** @description `invalid_device_proof`, `broker_only` (not a broker) or `vault_denied` (denied by policy). */
35123
35211
  readonly 403: {
35124
35212
  headers: {
35125
35213
  readonly [name: string]: unknown;
@@ -35155,6 +35243,39 @@ interface operations$1 {
35155
35243
  };
35156
35244
  };
35157
35245
  };
35246
+ readonly createVaultResolveChallenge: {
35247
+ readonly parameters: {
35248
+ readonly query?: never;
35249
+ readonly header?: never;
35250
+ readonly path?: never;
35251
+ readonly cookie?: never;
35252
+ };
35253
+ readonly requestBody?: never;
35254
+ readonly responses: {
35255
+ /** @description OK. */
35256
+ readonly 200: {
35257
+ headers: {
35258
+ readonly [name: string]: unknown;
35259
+ };
35260
+ content: {
35261
+ readonly 'application/json': components$1['schemas']['VaultResolveChallenge'];
35262
+ };
35263
+ };
35264
+ readonly 400: components$1['responses']['BadRequest'];
35265
+ readonly 401: components$1['responses']['Unauthorized'];
35266
+ /** @description `broker_only`: not a codai broker. */
35267
+ readonly 403: {
35268
+ headers: {
35269
+ readonly [name: string]: unknown;
35270
+ };
35271
+ content: {
35272
+ readonly 'application/json': {
35273
+ readonly [key: string]: unknown;
35274
+ };
35275
+ };
35276
+ };
35277
+ };
35278
+ };
35158
35279
  readonly listVaultRules: {
35159
35280
  readonly parameters: {
35160
35281
  readonly query?: never;
@@ -37805,6 +37926,8 @@ export declare class Templates {
37805
37926
  }
37806
37927
  export type StudioProductionCreate = Mutable<Body<'createStudioProduction'>>;
37807
37928
  export type StudioProduction = Schema<'StudioProduction'>;
37929
+ export type StudioProductionKind = Schema<'StudioProductionKind'>;
37930
+ export type StudioProductionOutput = Schema<'StudioProductionOutput'>;
37808
37931
  type CallOpts$27 = {
37809
37932
  ext?: CodaiRequestExtensions;
37810
37933
  signal?: AbortSignal;
@@ -38396,7 +38519,10 @@ export type VaultDeviceEnroll = Mutable<Schema<'VaultDeviceEnroll'>>;
38396
38519
  export type VaultDeviceAttestation = VaultDeviceKey['attestation'];
38397
38520
  export type VaultUseRequest = Mutable<Body<'vaultUse'>>;
38398
38521
  export type VaultHttpRequest = Mutable<Body<'vaultHttp'>>;
38522
+ /** Requires `proof`: a fresh {@link Vault.resolveChallenge} signed over {@link vaultResolveMessage} by an enrolled device key. */
38399
38523
  export type VaultResolveRequest = Mutable<Body<'vaultResolve'>>;
38524
+ export type VaultResolveProof = Mutable<Schema<'VaultResolveProof'>>;
38525
+ export type VaultResolveChallenge = Schema<'VaultResolveChallenge'>;
38400
38526
  export type VaultTier = VaultAccount['default_tier'];
38401
38527
  /** Anomaly guards (V-32): new host, burst, allowed hours. An anomaly forces t4. */
38402
38528
  export type VaultGuards = Schema<'VaultGuards'>;
@@ -38412,6 +38538,14 @@ export type VaultItemLimitsInput = Mutable<Body<'setVaultItemLimits'>>;
38412
38538
  export type VaultVia = 'hub' | 'desktop' | 'phone' | 'wear' | 'extension';
38413
38539
  /** The UTF-8 message an unlock proof covers: `codai-vault/unlock/v1|<challenge>|<device_id or "passkey">`. */
38414
38540
  export declare function vaultUnlockMessage(challenge: string, deviceIdOrPasskey: string): string;
38541
+ /**
38542
+ * The UTF-8 message a resolve proof covers: `codai-vault/resolve/v1|<challenge>|<device_id>|<digest>`, where `digest` =
38543
+ * base64url_nopad(SHA-256(handles.join("\n") + "\n\n" + action)) with handles and action exactly as sent.
38544
+ * Compute `digest` with your platform's SHA-256 (the SDK stays crypto-free).
38545
+ */
38546
+ export declare function vaultResolveMessage(challenge: string, deviceId: string, digest: string): string;
38547
+ /** The exact UTF-8 text whose SHA-256 (base64url, no padding) is the resolve proof `digest`. */
38548
+ export declare function vaultResolveDigestInput(handles: readonly string[], action: string): string;
38415
38549
  /** Loose JSON object answers (lists, acks) as documented in the OpenAPI spec. */
38416
38550
  export type VaultObject = Record<string, unknown>;
38417
38551
  type CallOpts$21 = {
@@ -38512,7 +38646,12 @@ export declare class Vault {
38512
38646
  use(body: VaultUseRequest, opts?: CallOpts$21): Promise<VaultUseDecision>;
38513
38647
  /** `POST /v1/vault/http` — brokered HTTPS call with `{{vault:<slug>}}` handles; 202 = approval required. */
38514
38648
  httpCall(body: VaultHttpRequest, opts?: CallOpts$21): Promise<VaultObject>;
38515
- /** `POST /v1/vault/resolve` — codai local brokers only (cloud fallback of `codaid vault run`); 202 = approval. */
38649
+ /** `POST /v1/vault/resolve/challenge` — codai local brokers only; single-use resolve challenge, valid 120 s. */
38650
+ resolveChallenge(opts?: CallOpts$21): Promise<VaultResolveChallenge>;
38651
+ /**
38652
+ * `POST /v1/vault/resolve` — codai local brokers only (cloud fallback of `codaid vault run`); 202 = approval.
38653
+ * `body.proof` is required: 400 `proof_required` / `invalid_challenge`, 403 `invalid_device_proof`.
38654
+ */
38516
38655
  resolve(body: VaultResolveRequest, opts?: CallOpts$21): Promise<VaultObject>;
38517
38656
  }
38518
38657
  /** `share_token`, `surface`, `category`, `explanation`, `reporter_name`, `reporter_email`, `good_faith: true`. */
package/dist/index.js CHANGED
@@ -3523,6 +3523,18 @@ var Voices = class {
3523
3523
  function vaultUnlockMessage(challenge, deviceIdOrPasskey) {
3524
3524
  return `codai-vault/unlock/v1|${challenge}|${deviceIdOrPasskey}`;
3525
3525
  }
3526
+ /**
3527
+ * The UTF-8 message a resolve proof covers: `codai-vault/resolve/v1|<challenge>|<device_id>|<digest>`, where `digest` =
3528
+ * base64url_nopad(SHA-256(handles.join("\n") + "\n\n" + action)) with handles and action exactly as sent.
3529
+ * Compute `digest` with your platform's SHA-256 (the SDK stays crypto-free).
3530
+ */
3531
+ function vaultResolveMessage(challenge, deviceId, digest) {
3532
+ return `codai-vault/resolve/v1|${challenge}|${deviceId}|${digest}`;
3533
+ }
3534
+ /** The exact UTF-8 text whose SHA-256 (base64url, no padding) is the resolve proof `digest`. */
3535
+ function vaultResolveDigestInput(handles, action) {
3536
+ return `${handles.join("\n")}\n\n${action}`;
3537
+ }
3526
3538
  const seg = (base, id, suffix = "") => `${base}/${encodeURIComponent(id)}${suffix}`;
3527
3539
  /** `/v1/vault/devices/*` — hardware-backed device approval keys (public keys only; revocation is instant). */
3528
3540
  var VaultDevices = class {
@@ -3743,7 +3755,14 @@ var Vault = class {
3743
3755
  httpCall(body, opts = {}) {
3744
3756
  return this.send("POST", "/v1/vault/http", opts, body);
3745
3757
  }
3746
- /** `POST /v1/vault/resolve` — codai local brokers only (cloud fallback of `codaid vault run`); 202 = approval. */
3758
+ /** `POST /v1/vault/resolve/challenge` — codai local brokers only; single-use resolve challenge, valid 120 s. */
3759
+ resolveChallenge(opts = {}) {
3760
+ return this.send("POST", "/v1/vault/resolve/challenge", opts, {});
3761
+ }
3762
+ /**
3763
+ * `POST /v1/vault/resolve` — codai local brokers only (cloud fallback of `codaid vault run`); 202 = approval.
3764
+ * `body.proof` is required: 400 `proof_required` / `invalid_challenge`, 403 `invalid_device_proof`.
3765
+ */
3747
3766
  resolve(body, opts = {}) {
3748
3767
  return this.send("POST", "/v1/vault/resolve", opts, body);
3749
3768
  }
@@ -6896,6 +6915,7 @@ const OPERATION_METHODS = {
6896
6915
  vaultUse: "vault.use",
6897
6916
  vaultHttp: "vault.httpCall",
6898
6917
  vaultResolve: "vault.resolve",
6918
+ createVaultResolveChallenge: "vault.resolveChallenge",
6899
6919
  createStudioAbuseReport: "abuseReports.create",
6900
6920
  checkProvenance: "provenance.check",
6901
6921
  createStudioBatch: "batches.create",
@@ -7727,5 +7747,5 @@ function allKeys(obj) {
7727
7747
  return [...keys];
7728
7748
  }
7729
7749
 
7730
- export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, JAM_CLOSE_CODES, JAM_SCALES, JAM_SUBPROTOCOL, Jam, JamSession, Keys, Lists, LyricsResource, MediaOps, Memory, Messages, Models, Music, MusicRoom, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, Voices, extensionHeaders, frameJson, isAssetDto, isMediaOpJob, isMediaOpJobFinished, isMusicRoomFinished, isPagedBuild, isProductionFinished, isResearchFinished, jamUrl, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, vaultUnlockMessage, verifyAttestationWithKeys, verifyResolveWebhook };
7750
+ export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, JAM_CLOSE_CODES, JAM_SCALES, JAM_SUBPROTOCOL, Jam, JamSession, Keys, Lists, LyricsResource, MediaOps, Memory, Messages, Models, Music, MusicRoom, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, Voices, extensionHeaders, frameJson, isAssetDto, isMediaOpJob, isMediaOpJobFinished, isMusicRoomFinished, isPagedBuild, isProductionFinished, isResearchFinished, jamUrl, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, vaultResolveDigestInput, vaultResolveMessage, vaultUnlockMessage, verifyAttestationWithKeys, verifyResolveWebhook };
7731
7751
  //# sourceMappingURL=index.js.map