codai-sdk 0.73.0 → 0.74.1

package/dist/index.js

@@ -3588,12 +3588,147 @@ var VaultDevices = class {
 		});
 	}
 };
+/** `/v1/vault/add-requests/*` — an agent asks the user to add a missing secret (V-17). */
+var VaultAddRequests = class {
+	http;
+	constructor(http) {
+		this.http = http;
+	}
+	/** `POST /v1/vault/add-requests` — answers a hub `url` to show the user (null when a pending request was reused). */
+	create(body, opts = {}) {
+		return this.http.json("/v1/vault/add-requests", {
+			method: "POST",
+			body: stripUndefined({ ...body }),
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+	/** `GET /v1/vault/add-requests/{id}` — poll; once `completed`, `handle` is the new `{{vault:<slug>}}`. */
+	get(id, opts = {}) {
+		return this.http.json(seg("/v1/vault/add-requests", id), {
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+	/** `DELETE /v1/vault/add-requests/{id}` — cancel a pending request. */
+	cancel(id, opts = {}) {
+		return this.http.json(seg("/v1/vault/add-requests", id), {
+			method: "DELETE",
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+	/** `POST /v1/vault/add-requests/lookup` — full request by link token, signed-in owner only (404 otherwise). */
+	lookup(token, opts = {}) {
+		return this.http.json("/v1/vault/add-requests/lookup", {
+			method: "POST",
+			body: { token },
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+	/** `POST /v1/vault/add-requests/{id}/complete` — link the item you added; idempotent for the same item. */
+	complete(id, itemId, opts = {}) {
+		return this.http.json(seg("/v1/vault/add-requests", id, "/complete"), {
+			method: "POST",
+			body: { item_id: itemId },
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+};
+/** `/v1/vault/emergency/*` — emergency access (V-23): invite, seal vault keys, request, wait, release. */
+var VaultEmergency = class {
+	http;
+	constructor(http) {
+		this.http = http;
+	}
+	post(path, opts, body) {
+		return this.http.json(path, {
+			method: "POST",
+			...body ? { body: stripUndefined(body) } : {},
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+	/** `GET /v1/vault/emergency` — `{ outgoing, incoming }` (revoked omitted). */
+	list(opts = {}) {
+		return this.http.json("/v1/vault/emergency", {
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+	/** `POST /v1/vault/emergency` — always 202 `{ id }` (enumeration-safe). */
+	invite(body, opts = {}) {
+		return this.post("/v1/vault/emergency", opts, { ...body });
+	}
+	/** `POST /v1/vault/emergency/accept` — the contact accepts with the emailed token (needs a vault account). */
+	accept(token, opts = {}) {
+		return this.post("/v1/vault/emergency/accept", opts, { token });
+	}
+	/** `PUT /v1/vault/emergency/{id}/seal` — grantor uploads vault keys sealed client-side to the contact. */
+	seal(id, body, opts = {}) {
+		return this.http.json(seg("/v1/vault/emergency", id, "/seal"), {
+			method: "PUT",
+			body: { ...body },
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+	/** `PATCH /v1/vault/emergency/{id}` — change `delay_hours` and/or `vault_ids` (vaults change → re-seal). */
+	update(id, body, opts = {}) {
+		if (body.delay_hours === void 0 && body.vault_ids === void 0) return Promise.reject(/* @__PURE__ */ new TypeError("update needs delay_hours and/or vault_ids"));
+		return this.http.json(seg("/v1/vault/emergency", id), {
+			method: "PATCH",
+			body: stripUndefined({ ...body }),
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+	/** `DELETE /v1/vault/emergency/{id}` — grantor revokes or the contact declines. */
+	revoke(id, opts = {}) {
+		return this.http.json(seg("/v1/vault/emergency", id), {
+			method: "DELETE",
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+	/** `POST /v1/vault/emergency/{id}/request` — contact starts the wait; released at `release_at` unless denied. */
+	request(id, params = {}, opts = {}) {
+		return this.post(seg("/v1/vault/emergency", id, "/request"), opts, { reason: params.reason });
+	}
+	/** `POST /v1/vault/emergency/{id}/deny` — grantor denies a pending request (back to `sealed`). */
+	deny(id, opts = {}) {
+		return this.post(seg("/v1/vault/emergency", id, "/deny"), opts, {});
+	}
+	/** `POST /v1/vault/emergency/{id}/approve` — grantor grants a pending request now. */
+	approve(id, opts = {}) {
+		return this.post(seg("/v1/vault/emergency", id, "/approve"), opts, {});
+	}
+	/** `GET /v1/vault/emergency/{id}/vault-data` — contact, status `granted`: sealed vault keys + item envelopes. */
+	vaultData(id, opts = {}) {
+		return this.http.json(seg("/v1/vault/emergency", id, "/vault-data"), {
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+};
 var Vault = class {
 	http;
 	devices;
+	addRequests;
+	emergency;
 	constructor(http) {
 		this.http = http;
 		this.devices = new VaultDevices(http);
+		this.addRequests = new VaultAddRequests(http);
+		this.emergency = new VaultEmergency(http);
 	}
 	get(path, opts, query) {
 		return this.http.json(path, {
@@ -3766,6 +3901,61 @@ var Vault = class {
 	resolve(body, opts = {}) {
 		return this.send("POST", "/v1/vault/resolve", opts, body);
 	}
+	/**
+	* `GET /v1/vault/hibp/range/{prefix}` — padded HIBP range (`SUFFIX:COUNT` lines, text) for the first 5 hex chars of
+	* a SHA-1; compare locally, the password never leaves the client. 300 calls per user per hour.
+	*/
+	async hibpRange(prefix, opts = {}) {
+		if (!/^[0-9A-Fa-f]{5}$/.test(prefix)) throw new TypeError("hibpRange prefix must be 5 hex characters");
+		return (await this.http.request(`/v1/vault/hibp/range/${prefix.toUpperCase()}`, {
+			ext: opts.ext,
+			signal: opts.signal,
+			headers: { accept: "text/plain" }
+		})).text();
+	}
+	/** `GET /v1/vault/rotation` — rotation queue: breached, overdue, soonest due; unscheduled last. */
+	async rotation(opts = {}) {
+		return [...(await this.get("/v1/vault/rotation", opts)).items];
+	}
+	/** `PUT /v1/vault/items/{id}/rotation` — any of `interval_days`, `provider`, `snoozed_until`; `null` clears one. */
+	setRotation(id, patch, opts = {}) {
+		const body = Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== void 0));
+		if (Object.keys(body).length === 0) return Promise.reject(/* @__PURE__ */ new TypeError("setRotation needs interval_days, provider and/or snoozed_until"));
+		return this.http.json(seg("/v1/vault/items", id, "/rotation"), {
+			method: "PUT",
+			body,
+			ext: opts.ext,
+			signal: opts.signal,
+			noRetry: true
+		});
+	}
+	/** `POST /v1/vault/items/{id}/rotated` — `rotated_at` = now, breach flag cleared. */
+	markRotated(id, opts = {}) {
+		return this.send("POST", seg("/v1/vault/items", id, "/rotated"), opts, {});
+	}
+	/** `POST /v1/vault/rotation/breach-report` — local HIBP results (`count` 0 = clean), up to 500 per call. */
+	reportBreaches(results, opts = {}) {
+		return this.send("POST", "/v1/vault/rotation/breach-report", opts, { results });
+	}
+	/** `GET /v1/vault/derivers` — derivers on items in your vaults (config only, never values). */
+	async derivers(opts = {}) {
+		return [...(await this.get("/v1/vault/derivers", opts)).derivers];
+	}
+	/** `PUT /v1/vault/items/{id}/deriver` — owner only; config validated per provider. */
+	async setDeriver(id, body, opts = {}) {
+		return (await this.send("PUT", seg("/v1/vault/items", id, "/deriver"), opts, { ...body })).deriver;
+	}
+	/** `DELETE /v1/vault/items/{id}/deriver` — owner only; 404 when there is none. */
+	deleteDeriver(id, opts = {}) {
+		return this.send("DELETE", seg("/v1/vault/items", id, "/deriver"), opts);
+	}
+	/**
+	* `POST /v1/vault/derive` — codai local brokers only: a short-lived credential from a root item's deriver. Same
+	* `proof` as {@link resolve} over `handles = [handle]`. A 202 (approval required) is returned, not thrown.
+	*/
+	derive(body, opts = {}) {
+		return this.send("POST", "/v1/vault/derive", opts, body);
+	}
 };
 
 // src/resources/abuse-reports.ts
@@ -6916,6 +7106,30 @@ const OPERATION_METHODS = {
 	vaultHttp: "vault.httpCall",
 	vaultResolve: "vault.resolve",
 	createVaultResolveChallenge: "vault.resolveChallenge",
+	createVaultAddRequest: "vault.addRequests.create",
+	getVaultAddRequest: "vault.addRequests.get",
+	cancelVaultAddRequest: "vault.addRequests.cancel",
+	lookupVaultAddRequest: "vault.addRequests.lookup",
+	completeVaultAddRequest: "vault.addRequests.complete",
+	listVaultEmergency: "vault.emergency.list",
+	inviteVaultEmergency: "vault.emergency.invite",
+	acceptVaultEmergency: "vault.emergency.accept",
+	sealVaultEmergency: "vault.emergency.seal",
+	updateVaultEmergency: "vault.emergency.update",
+	revokeVaultEmergency: "vault.emergency.revoke",
+	requestVaultEmergency: "vault.emergency.request",
+	denyVaultEmergency: "vault.emergency.deny",
+	approveVaultEmergency: "vault.emergency.approve",
+	getVaultEmergencyData: "vault.emergency.vaultData",
+	getVaultHibpRange: "vault.hibpRange",
+	listVaultRotation: "vault.rotation",
+	setVaultItemRotation: "vault.setRotation",
+	markVaultItemRotated: "vault.markRotated",
+	reportVaultBreaches: "vault.reportBreaches",
+	listVaultDerivers: "vault.derivers",
+	setVaultItemDeriver: "vault.setDeriver",
+	deleteVaultItemDeriver: "vault.deleteDeriver",
+	deriveVaultCredential: "vault.derive",
 	createStudioAbuseReport: "abuseReports.create",
 	checkProvenance: "provenance.check",
 	createStudioBatch: "batches.create",
@@ -7431,6 +7645,8 @@ var CodaiApps = class {
 *   client.vault.account / .items / .putItem / .rules / .approvals / .decide / .catalog / .use / .httpCall / .resolve
 *   client.vault.devices.challenge / .enroll / .list / .rename / .revoke (device approval keys, V-27)
 *   client.vault.updateSettings / .lock / .unlockChallenge / .unlock / .limits / .setLimits / .revokeTaskGrants (guards, v4)
+*   client.vault.addRequests.* / .emergency.* / .hibpRange / .rotation / .setRotation / .markRotated / .reportBreaches
+*   client.vault.derivers / .setDeriver / .deleteDeriver / .derive (wave 2: add requests, emergency access, rotation, JIT)
 *     (zero-knowledge credentials vault: ciphertext only; the broker calls never return secret values)
 *   client.abuseReports.create (public DSA notice about a codai Studio share / review link; no key needed)
 *   client.provenance.check (public: which codai AI-provenance marks a file carries; no key needed)
@@ -7747,5 +7963,5 @@ function allKeys(obj) {
 	return [...keys];
 }
 
-export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, JAM_CLOSE_CODES, JAM_SCALES, JAM_SUBPROTOCOL, Jam, JamSession, Keys, Lists, LyricsResource, MediaOps, Memory, Messages, Models, Music, MusicRoom, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, Voices, extensionHeaders, frameJson, isAssetDto, isMediaOpJob, isMediaOpJobFinished, isMusicRoomFinished, isPagedBuild, isProductionFinished, isResearchFinished, jamUrl, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, vaultResolveDigestInput, vaultResolveMessage, vaultUnlockMessage, verifyAttestationWithKeys, verifyResolveWebhook };
+export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, JAM_CLOSE_CODES, JAM_SCALES, JAM_SUBPROTOCOL, Jam, JamSession, Keys, Lists, LyricsResource, MediaOps, Memory, Messages, Models, Music, MusicRoom, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultAddRequests, VaultDevices, VaultEmergency, Verify, Videos, VoiceRevocations, Voices, extensionHeaders, frameJson, isAssetDto, isMediaOpJob, isMediaOpJobFinished, isMusicRoomFinished, isPagedBuild, isProductionFinished, isResearchFinished, jamUrl, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, vaultResolveDigestInput, vaultResolveMessage, vaultUnlockMessage, verifyAttestationWithKeys, verifyResolveWebhook };
 //# sourceMappingURL=index.js.map