openmates 0.15.0-alpha.12 → 0.15.0-alpha.13

package/dist/{chunk-DYHLNAUG.js → chunk-Z4CRE3LS.js}

@@ -13618,6 +13618,7 @@ var OpenMates = class {
   embeds;
   feedback;
   inspirations;
+  apiKeys;
   learningMode;
   memories;
   newChatSuggestions;
@@ -13648,6 +13649,7 @@ var OpenMates = class {
     this.embeds = new OpenMatesEmbeds(this);
     this.feedback = new OpenMatesFeedback(this);
     this.inspirations = new OpenMatesInspirations(this);
+    this.apiKeys = new OpenMatesApiKeys(this);
     this.learningMode = new OpenMatesLearningMode(this);
     this.memories = new OpenMatesMemories(this);
     this.newChatSuggestions = new OpenMatesNewChatSuggestions(this);
@@ -14131,6 +14133,7 @@ var OpenMatesChats = class {
           remainingMs2
         );
       } catch (error) {
+        if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) break;
         if (!(error instanceof OpenMatesApiError) || error.status !== 404) throw error;
       }
       const remainingMs = deadline - Date.now();
@@ -14333,6 +14336,63 @@ var OpenMatesSettings = class {
     return unsupportedSdkFeature("Debug-log sharing");
   }
 };
+var OpenMatesApiKeys = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    const data = await this.client.get("/v1/sdk/settings/api-keys");
+    const masterKey = await this.client.masterKey();
+    const apiKeys = [];
+    for (const key of data.api_keys ?? []) {
+      apiKeys.push(await this.decryptRecord(key, masterKey));
+    }
+    return { apiKeys };
+  }
+  async create(options) {
+    const name = options.name.trim();
+    if (!name) throw new OpenMatesConfigError("API key name is required");
+    const masterKey = await this.client.masterKey();
+    const material = await createApiKeyCryptoMaterial(name, bytesToBase64(masterKey));
+    const key = await this.client.request("/v1/sdk/settings/api-keys", {
+      encrypted_name: material.encryptedName,
+      api_key_hash: material.apiKeyHash,
+      encrypted_key_prefix: material.encryptedKeyPrefix,
+      encrypted_master_key: material.encryptedMasterKey,
+      salt: material.saltB64,
+      key_iv: material.keyIv,
+      full_access: options.fullAccess ?? true,
+      scopes: options.scopes ?? {},
+      credit_limit: options.creditLimit ?? null,
+      expires_at: options.expiresAt ?? null
+    });
+    return { apiKey: material.apiKey, key: await this.decryptRecord(key, masterKey) };
+  }
+  async revoke(id) {
+    return this.client.delete(`/v1/sdk/settings/api-keys/${encodeURIComponent(id)}`);
+  }
+  async decryptRecord(record, masterKey) {
+    const encryptedName = typeof record.encrypted_name === "string" ? record.encrypted_name : "";
+    const encryptedPrefix = typeof record.encrypted_key_prefix === "string" ? record.encrypted_key_prefix : "";
+    const name = encryptedName ? await decryptWithAesGcmCombined(encryptedName, masterKey) : null;
+    const keyPrefix = encryptedPrefix ? await decryptWithAesGcmCombined(encryptedPrefix, masterKey) : null;
+    const lastUsedAt = typeof record.last_used_at === "string" ? record.last_used_at : null;
+    return {
+      id: String(record.id ?? ""),
+      name: name || encryptedName || "Unnamed API key",
+      keyPrefix: keyPrefix || encryptedPrefix || "sk-api-...",
+      createdAt: typeof record.created_at === "string" ? record.created_at : null,
+      expiresAt: typeof record.expires_at === "string" ? record.expires_at : null,
+      lastUsedAt,
+      lastUsedLabel: lastUsedAt ? new Date(lastUsedAt).toLocaleString() : "Never used",
+      fullAccess: typeof record.full_access === "boolean" ? record.full_access : true,
+      scopes: record.scopes && typeof record.scopes === "object" ? record.scopes : {},
+      creditLimit: record.credit_limit && typeof record.credit_limit === "object" ? record.credit_limit : null,
+      pendingDeviceCount: typeof record.pending_device_count === "number" ? record.pending_device_count : 0
+    };
+  }
+};
 var OpenMatesMemories = class {
   client;
   constructor(client) {
@@ -46073,6 +46133,110 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
           text: "OpenMates is designed so that most of your data is encrypted on your device before it reaches our servers. This is **not** end-to-end encryption: our servers briefly decrypt your content in memory to run AI responses, render invoices, and deliver reminders. But we never write decrypted content to disk, logs, or traces, and when you delete your account we destroy the encryption key that protects your data \u2014 cryptographically shredding every encrypted field we still hold."
         }
       },
+      quick_answers: {
+        heading: {
+          text: "Quick answers about your privacy"
+        },
+        intro: {
+          text: "These answers summarize the most important privacy points in plain language. The detailed policy and provider tables below explain the same topics in more depth."
+        },
+        employee_access: {
+          question: {
+            text: "Can OpenMates employees read my private chats?"
+          },
+          answer: {
+            text: "Private chats are not routinely reviewed by OpenMates employees, and we do not provide a normal admin screen for browsing private chat content. However, OpenMates is not a strict end-to-end encrypted or zero-knowledge system: relevant content can be processed temporarily in server memory when you ask for an AI response or use a feature that needs server processing."
+          }
+        },
+        device_only_encryption: {
+          question: {
+            text: "Are my chats encrypted so only my devices can read them?"
+          },
+          answer: {
+            text: "No. OpenMates uses client-side encryption for durable storage and sync, not device-only access. Permanent chat history is encrypted before it is stored, so database and backup records should be ciphertext. But OpenMates servers can process relevant plaintext in memory when needed to answer your request."
+          }
+        },
+        recent_context_cache: {
+          question: {
+            text: "What is the recent AI context cache?"
+          },
+          answer: {
+            text: "To make follow-up responses fast, OpenMates may keep a short-lived, server-readable AI context cache for recent chats, currently designed around the last 3 chats. This cache is encrypted with server-side Vault encryption, but OpenMates servers can decrypt it while processing your request. If the cache is missing, the server may ask your active client to resend the needed decrypted context and cache it temporarily again."
+          }
+        },
+        storage_protection: {
+          question: {
+            text: "Where are my chats stored, and how are they protected?"
+          },
+          answer: {
+            text: "Saved chats are stored on OpenMates infrastructure as encrypted data. Chat content, titles, summaries, tags, app settings, memories, reminders, and sensitive profile fields are designed to be encrypted before durable storage. Persistent storage, backups, and sync caches should not contain readable chat text."
+          }
+        },
+        third_party_providers: {
+          question: {
+            text: "Do third-party AI providers see my messages?"
+          },
+          answer: {
+            text: "Yes, when you choose a model or use a feature powered by a third-party provider, the content needed to process that request may be sent to that provider. OpenMates tries to reduce exposure by replacing recognized personal details and secrets with placeholders before sending, but anything not detected may be sent as typed."
+          }
+        },
+        model_training: {
+          question: {
+            text: "Are my chats used to train AI models?"
+          },
+          answer: {
+            text: "OpenMates does not use your private chats to train OpenMates-owned AI models. For third-party providers, the answer depends on the provider. Most audited chat-model providers state that they do not train on API customer data, or only train if the customer opts in. Some image or 3D generation providers have broader or limited-use policies. The provider-by-provider training table below lists the status, source document, and last verification date."
+          }
+        },
+        placeholder_protection: {
+          question: {
+            text: "Does placeholder protection make sensitive data safe to send?"
+          },
+          answer: {
+            text: "No. Placeholder protection reduces risk, but it is not a guarantee. It works best for recognized personal data, saved privacy-profile values, and common secret patterns. It may miss typos, unusual formats, context-only sensitive information, other people's personal data, or sensitive topics that are not technically identifiable as personal data."
+          }
+        },
+        logs_diagnostics: {
+          question: {
+            text: "What data appears in logs or diagnostics?"
+          },
+          answer: {
+            text: "OpenMates is designed so chat content is not written to logs or traces. Application logs and telemetry include redaction and filtering for authentication headers, cookies, tokens, passwords, emails, IP addresses, and chat content. Browser stability logs are sanitized, use temporary session identifiers, and can be disabled in privacy settings."
+          }
+        },
+        deletion: {
+          question: {
+            text: "What happens when I delete my account or chats?"
+          },
+          answer: {
+            text: "When you delete chats or your account, OpenMates deletes the corresponding data according to the retention rules below. For account deletion, OpenMates also destroys encryption keys so any remaining encrypted data in backups or caches becomes unreadable ciphertext. Some records may remain for legal or operational reasons, such as invoices, payment records, audit logs, third-party provider logs, or short-lived encrypted backups."
+          }
+        },
+        open_source: {
+          question: {
+            text: "What does open source mean for my privacy?"
+          },
+          answer: {
+            text: "Open source means the OpenMates software code is public and can be inspected by others. It does not mean your private data is public. Your chats, account data, settings, memories, uploads, and billing data are not published on GitHub. The code is public; your personal data is not."
+          }
+        },
+        sensitive_topics: {
+          question: {
+            text: "Is OpenMates suitable for sensitive topics?"
+          },
+          answer: {
+            text: "OpenMates is privacy-conscious, but it is not a zero-knowledge or device-only system. It is reasonable for everyday private AI use when you avoid unnecessary personal details. For highly sensitive legal, medical, financial, business-confidential, or safety-critical topics, be careful about what you enter and which model or provider you use."
+          }
+        },
+        highest_privacy: {
+          question: {
+            text: "What if I have the highest privacy requirements?"
+          },
+          answer: {
+            text: "If you have very high privacy requirements, consider self-hosting OpenMates and using local or offline AI models instead of third-party AI providers. This gives you more control over infrastructure, model choice, logs, backups, and provider exposure. It requires technical experience, ongoing maintenance, secure server administration, and enough hardware for useful local AI inference. Self-hosting does not automatically make everything private: you still need to secure the server, backups, secrets, network access, logs, and any external providers you enable."
+          }
+        }
+      },
       protection: {
         heading: {
           text: "How we protect your data"
@@ -50584,6 +50748,18 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
     developers_devices_revoke: {
       text: "Revoke"
     },
+    developers_devices_reject: {
+      text: "Reject"
+    },
+    developers_devices_ip_address: {
+      text: "IP address"
+    },
+    developers_devices_access_type: {
+      text: "Access type"
+    },
+    developers_devices_api_key: {
+      text: "API key"
+    },
     developers_devices_confirm_revoke: {
       text: "Are you sure you want to revoke access for this device?"
     },
@@ -52490,6 +52666,9 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       copied_done: {
         text: "I've copied the key"
       },
+      confirm_device: {
+        text: "Confirm device"
+      },
       loading: {
         text: "Loading API keys..."
       },

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-DYHLNAUG.js";
+} from "./chunk-Z4CRE3LS.js";
 import "./chunk-AXNRPVLE.js";
 export {
   getExtForLang,

package/dist/index.d.ts

@@ -1096,7 +1096,7 @@ interface BankTransferStatus {
 interface GiftCardBankTransferStatus extends BankTransferStatus {
     gift_card_code?: string | null;
 }
-interface ApiKeyCreateOptions {
+interface ApiKeyCreateOptions$1 {
     name: string;
     fullAccess?: boolean;
     scopes?: Record<string, unknown>;
@@ -1108,7 +1108,7 @@ interface CreatedApiKeyResult {
     key: unknown;
     crypto: ApiKeyCryptoMaterial;
 }
-interface ApiKeyRecord {
+interface ApiKeyRecord$1 {
     id: string;
     name: string;
     key_prefix: string;
@@ -1123,7 +1123,7 @@ interface ApiKeyRecord {
     encrypted_key_prefix?: string | null;
 }
 interface ApiKeyListResult {
-    api_keys: ApiKeyRecord[];
+    api_keys: ApiKeyRecord$1[];
 }
 interface AuthMethodsStatus {
     has_passkey?: boolean;
@@ -1616,7 +1616,7 @@ declare class OpenMatesClient {
     createPlanVerification(planId: string, input: UserPlanVerificationRecord & Record<string, unknown>): Promise<UserPlanVerificationRecord>;
     addPlanVerificationEvidence(planId: string, verificationId: string, input: Partial<UserPlanVerificationRecord>): Promise<UserPlanVerificationRecord>;
     settingsGet(path: string, apiKey?: string): Promise<unknown>;
-    createApiKey(options: ApiKeyCreateOptions): Promise<CreatedApiKeyResult>;
+    createApiKey(options: ApiKeyCreateOptions$1): Promise<CreatedApiKeyResult>;
     listApiKeys(): Promise<ApiKeyListResult>;
     revokeApiKey(id: string): Promise<unknown>;
     private decryptApiKeyList;
@@ -4830,6 +4830,30 @@ interface ConfirmedMutationOptions {
 interface RequestOptions {
     query?: Record<string, string | number | boolean | undefined | null>;
 }
+interface ApiKeyCreateOptions {
+    name: string;
+    fullAccess?: boolean;
+    scopes?: Record<string, unknown>;
+    creditLimit?: Record<string, unknown> | null;
+    expiresAt?: string | null;
+}
+interface ApiKeyRecord {
+    id: string;
+    name: string;
+    keyPrefix: string;
+    createdAt?: string | null;
+    expiresAt?: string | null;
+    lastUsedAt?: string | null;
+    lastUsedLabel: string;
+    fullAccess: boolean;
+    scopes: Record<string, unknown>;
+    creditLimit?: Record<string, unknown> | null;
+    pendingDeviceCount: number;
+}
+interface ApiKeyCreateResult {
+    apiKey: string;
+    key: ApiKeyRecord;
+}
 interface ApplicationPreviewStartOptions {
     chatId: string;
     sharedContext?: string;
@@ -4933,6 +4957,7 @@ declare class OpenMates {
     readonly embeds: OpenMatesEmbeds;
     readonly feedback: OpenMatesFeedback;
     readonly inspirations: OpenMatesInspirations;
+    readonly apiKeys: OpenMatesApiKeys;
     readonly learningMode: OpenMatesLearningMode;
     readonly memories: OpenMatesMemories;
     readonly newChatSuggestions: OpenMatesNewChatSuggestions;
@@ -5039,6 +5064,16 @@ declare class OpenMatesSettings {
         confirmed: true;
     }): Promise<Record<string, unknown>>;
 }
+declare class OpenMatesApiKeys {
+    private readonly client;
+    constructor(client: OpenMates);
+    list(): Promise<{
+        apiKeys: ApiKeyRecord[];
+    }>;
+    create(options: ApiKeyCreateOptions): Promise<ApiKeyCreateResult>;
+    revoke(id: string): Promise<Record<string, unknown>>;
+    private decryptRecord;
+}
 declare class OpenMatesMemories {
     private readonly client;
     constructor(client: OpenMates);
@@ -5288,4 +5323,4 @@ type AssistantFeedbackDecision = {
 };
 declare function buildAssistantFeedbackDecision(rating: number): AssistantFeedbackDecision;
 
-export { APP_SKILL_METADATA, ASSISTANT_FEEDBACK_REPORT_TITLE, ASSISTANT_FEEDBACK_THANKS, type AssistantFeedbackDecision, type AuthMethodsStatus, type AuthoritativeChatReconciliation, type BackupCodesResult, type BankTransferOrderDetails, type BankTransferStatus, type CachedChat, type CachedNewChatSuggestion, type ChatCreateOptions, type ChatListOptions, type ChatListPage, type ChatResponse, type CliSignupResult, type DecryptedDraft, type DecryptedEmbed, type DecryptedMemoryEntry, type DecryptedMessage, type DecryptedNewChatSuggestion, type DocsFile, type DocsFolder, type DocsSearchResult, type DocsTree, type DraftRecord, type EncryptedChatMetadata, type EncryptedDraft, type EncryptedDraftRecord, type FocusModeSelection, type GiftCardBankTransferStatus, INTEREST_TAG_IDS, type InterestTagId, MATE_NAMES, MEMORY_TYPE_REGISTRY, type MemoryFieldDef, type MemoryTypeDef, OpenMates, OpenMatesApiError, OpenMatesClient, type OpenMatesClientOptions, OpenMatesConfigError, type OpenMatesOptions, type OpenMatesSession, type ProjectSourceCapability, type ProjectSourceCreateInput, type ProjectSourceRecord, type ProjectSourceStatus, type ProjectSourceType, SUPPORT_URL, type SyncCache, type TopicPreferencesPayload, type TotpSetupStartResult, type WorkflowCapability, type WorkflowDetail, type WorkflowEdge, type WorkflowGraph, type WorkflowNode, type WorkflowNodeRun, type WorkflowNodeType, type WorkflowRunContentRetention, type WorkflowRunContentStorage, type WorkflowRunDetail, type WorkflowSummary, buildAssistantFeedbackDecision, defaultCloneBranchForVersion, deriveAppUrl, normalizeInterestTagIds, reconcileAuthoritativeChats, renderSupportInfo };
+export { APP_SKILL_METADATA, ASSISTANT_FEEDBACK_REPORT_TITLE, ASSISTANT_FEEDBACK_THANKS, type ApiKeyCreateOptions, type ApiKeyCreateResult, type ApiKeyRecord, type AssistantFeedbackDecision, type AuthMethodsStatus, type AuthoritativeChatReconciliation, type BackupCodesResult, type BankTransferOrderDetails, type BankTransferStatus, type CachedChat, type CachedNewChatSuggestion, type ChatCreateOptions, type ChatListOptions, type ChatListPage, type ChatResponse, type CliSignupResult, type DecryptedDraft, type DecryptedEmbed, type DecryptedMemoryEntry, type DecryptedMessage, type DecryptedNewChatSuggestion, type DocsFile, type DocsFolder, type DocsSearchResult, type DocsTree, type DraftRecord, type EncryptedChatMetadata, type EncryptedDraft, type EncryptedDraftRecord, type FocusModeSelection, type GiftCardBankTransferStatus, INTEREST_TAG_IDS, type InterestTagId, MATE_NAMES, MEMORY_TYPE_REGISTRY, type MemoryFieldDef, type MemoryTypeDef, OpenMates, OpenMatesApiError, OpenMatesClient, type OpenMatesClientOptions, OpenMatesConfigError, type OpenMatesOptions, type OpenMatesSession, type ProjectSourceCapability, type ProjectSourceCreateInput, type ProjectSourceRecord, type ProjectSourceStatus, type ProjectSourceType, SUPPORT_URL, type SyncCache, type TopicPreferencesPayload, type TotpSetupStartResult, type WorkflowCapability, type WorkflowDetail, type WorkflowEdge, type WorkflowGraph, type WorkflowNode, type WorkflowNodeRun, type WorkflowNodeType, type WorkflowRunContentRetention, type WorkflowRunContentStorage, type WorkflowRunDetail, type WorkflowSummary, buildAssistantFeedbackDecision, defaultCloneBranchForVersion, deriveAppUrl, normalizeInterestTagIds, reconcileAuthoritativeChats, renderSupportInfo };

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   reconcileAuthoritativeChats,
   renderSupportInfo,
   serializeToYaml
-} from "./chunk-DYHLNAUG.js";
+} from "./chunk-Z4CRE3LS.js";
 import "./chunk-AXNRPVLE.js";
 export {
   APP_SKILL_METADATA,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.15.0-alpha.12",
+  "version": "0.15.0-alpha.13",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",