opik 2.2.39 → 2.2.41

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.cts CHANGED
@@ -1674,6 +1674,7 @@ interface ProviderApiKeyUpdate {
1674
1674
  headers?: Record<string, string>;
1675
1675
  configuration?: Record<string, string>;
1676
1676
  baseUrl?: string;
1677
+ authConfig?: ProviderAuthConfig;
1677
1678
  }
1678
1679
 
1679
1680
  /**
@@ -1691,6 +1692,17 @@ interface ProviderApiKeyWrite {
1691
1692
  headers?: Record<string, string>;
1692
1693
  configuration?: Record<string, string>;
1693
1694
  baseUrl?: string;
1695
+ authConfig?: ProviderAuthConfigWrite;
1696
+ }
1697
+
1698
+ /**
1699
+ * @example
1700
+ * {}
1701
+ */
1702
+ interface ProviderAuthCheck {
1703
+ /** Test the stored auth config of this provider; also the sentinel-resolution target when auth_config is sent */
1704
+ providerId?: string;
1705
+ authConfig?: ProviderAuthConfig;
1694
1706
  }
1695
1707
 
1696
1708
  declare const ProviderApiKeyWriteProvider: {
@@ -4073,6 +4085,7 @@ declare namespace AutomationRuleEvaluatorObjectObjectPublic {
4073
4085
  /** Projects assigned to this rule (unique, sorted alphabetically by name) */
4074
4086
  projects?: ProjectReferencePublic[];
4075
4087
  name: string;
4088
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4076
4089
  samplingRate?: number;
4077
4090
  enabled?: boolean;
4078
4091
  /** Controls whether the rule fires on production traces, experiment traces, or both. Defaults to 'production' if omitted. */
@@ -4135,6 +4148,7 @@ declare namespace AutomationRuleEvaluatorPublic {
4135
4148
  /** Projects assigned to this rule (unique, sorted alphabetically by name) */
4136
4149
  projects?: ProjectReferencePublic[];
4137
4150
  name: string;
4151
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4138
4152
  samplingRate?: number;
4139
4153
  enabled?: boolean;
4140
4154
  /** Controls whether the rule fires on production traces, experiment traces, or both. Defaults to 'production' if omitted. */
@@ -4222,6 +4236,7 @@ declare namespace AutomationRuleEvaluatorUpdate {
4222
4236
  }
4223
4237
  interface _Base {
4224
4238
  name: string;
4239
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4225
4240
  samplingRate?: number;
4226
4241
  enabled?: boolean;
4227
4242
  triggerScope?: AutomationRuleEvaluatorUpdateTriggerScope;
@@ -4311,6 +4326,7 @@ declare namespace AutomationRuleEvaluatorWrite {
4311
4326
  /** Project IDs for write operations (used when creating/updating rules) */
4312
4327
  projectIds?: string[];
4313
4328
  name: string;
4329
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4314
4330
  samplingRate?: number;
4315
4331
  enabled?: boolean;
4316
4332
  /** Controls whether the rule fires on production traces, experiment traces, or both. Defaults to 'production' if omitted. */
@@ -4711,6 +4727,36 @@ interface CreateSessionResponse {
4711
4727
  runnerId?: string;
4712
4728
  }
4713
4729
 
4730
+ /**
4731
+ * Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
4732
+ */
4733
+ interface Credential {
4734
+ key: string;
4735
+ value?: string;
4736
+ /** Secret values are encrypted at rest and never read back; once true it cannot be unset */
4737
+ secret?: boolean;
4738
+ }
4739
+
4740
+ /**
4741
+ * Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
4742
+ */
4743
+ interface CredentialPublic {
4744
+ key: string;
4745
+ value?: string;
4746
+ /** Secret values are encrypted at rest and never read back; once true it cannot be unset */
4747
+ secret?: boolean;
4748
+ }
4749
+
4750
+ /**
4751
+ * Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
4752
+ */
4753
+ interface CredentialWrite {
4754
+ key: string;
4755
+ value?: string;
4756
+ /** Secret values are encrypted at rest and never read back; once true it cannot be unset */
4757
+ secret?: boolean;
4758
+ }
4759
+
4714
4760
  interface DashboardPagePublic {
4715
4761
  content?: DashboardPublic[];
4716
4762
  page?: number;
@@ -6910,6 +6956,7 @@ interface ProviderApiKeyPublic {
6910
6956
  headers?: Record<string, string>;
6911
6957
  configuration?: Record<string, string>;
6912
6958
  baseUrl?: string;
6959
+ authConfig?: ProviderAuthConfigPublic;
6913
6960
  createdAt?: Date;
6914
6961
  createdBy?: string;
6915
6962
  lastUpdatedAt?: Date;
@@ -6931,6 +6978,84 @@ declare const ProviderApiKeyPublicProvider: {
6931
6978
  };
6932
6979
  type ProviderApiKeyPublicProvider = (typeof ProviderApiKeyPublicProvider)[keyof typeof ProviderApiKeyPublicProvider];
6933
6980
 
6981
+ /**
6982
+ * Dynamic token auth recipe. Send the '__SECRET__' sentinel as a credential value to keep the stored secret; send an empty object to clear the auth config.
6983
+ */
6984
+ interface ProviderAuthConfig {
6985
+ /** Auth service URL the credentials are sent to */
6986
+ tokenUrl?: string;
6987
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
6988
+ sendAs?: ProviderAuthConfigSendAs;
6989
+ /** Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel */
6990
+ credentials?: Credential[];
6991
+ /** Field holding the token in the reply; dot-path for nested replies */
6992
+ tokenField?: string;
6993
+ /** Field holding the token lifetime in seconds in the reply; dot-path for nested replies */
6994
+ expiresField?: string;
6995
+ /** Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins */
6996
+ fallbackTtlSeconds?: number;
6997
+ }
6998
+
6999
+ /**
7000
+ * Dynamic token auth recipe. When set, Opik fetches a short-lived bearer from the configured auth service instead of using a static api_key. Only supported for custom providers. Secret credential values read back masked.
7001
+ */
7002
+ interface ProviderAuthConfigPublic {
7003
+ /** Auth service URL the credentials are sent to */
7004
+ tokenUrl?: string;
7005
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7006
+ sendAs?: ProviderAuthConfigPublicSendAs;
7007
+ /** Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel */
7008
+ credentials?: CredentialPublic[];
7009
+ /** Field holding the token in the reply; dot-path for nested replies */
7010
+ tokenField?: string;
7011
+ /** Field holding the token lifetime in seconds in the reply; dot-path for nested replies */
7012
+ expiresField?: string;
7013
+ /** Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins */
7014
+ fallbackTtlSeconds?: number;
7015
+ }
7016
+
7017
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7018
+ declare const ProviderAuthConfigPublicSendAs: {
7019
+ readonly Form: "form";
7020
+ readonly Json: "json";
7021
+ readonly Basic: "basic";
7022
+ };
7023
+ type ProviderAuthConfigPublicSendAs = (typeof ProviderAuthConfigPublicSendAs)[keyof typeof ProviderAuthConfigPublicSendAs];
7024
+
7025
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7026
+ declare const ProviderAuthConfigSendAs: {
7027
+ readonly Form: "form";
7028
+ readonly Json: "json";
7029
+ readonly Basic: "basic";
7030
+ };
7031
+ type ProviderAuthConfigSendAs = (typeof ProviderAuthConfigSendAs)[keyof typeof ProviderAuthConfigSendAs];
7032
+
7033
+ /**
7034
+ * Dynamic token auth recipe. When set, Opik fetches a short-lived bearer from the configured auth service instead of using a static api_key. Only supported for custom providers. Secret credential values read back masked.
7035
+ */
7036
+ interface ProviderAuthConfigWrite {
7037
+ /** Auth service URL the credentials are sent to */
7038
+ tokenUrl?: string;
7039
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7040
+ sendAs?: ProviderAuthConfigWriteSendAs;
7041
+ /** Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel */
7042
+ credentials?: CredentialWrite[];
7043
+ /** Field holding the token in the reply; dot-path for nested replies */
7044
+ tokenField?: string;
7045
+ /** Field holding the token lifetime in seconds in the reply; dot-path for nested replies */
7046
+ expiresField?: string;
7047
+ /** Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins */
7048
+ fallbackTtlSeconds?: number;
7049
+ }
7050
+
7051
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7052
+ declare const ProviderAuthConfigWriteSendAs: {
7053
+ readonly Form: "form";
7054
+ readonly Json: "json";
7055
+ readonly Basic: "basic";
7056
+ };
7057
+ type ProviderAuthConfigWriteSendAs = (typeof ProviderAuthConfigWriteSendAs)[keyof typeof ProviderAuthConfigWriteSendAs];
7058
+
6934
7059
  interface RecentActivityItemPublic {
6935
7060
  type?: RecentActivityItemPublicType;
6936
7061
  id?: string;
@@ -10609,7 +10734,7 @@ declare class LlmProviderKeyClient {
10609
10734
  getLlmProviderApiKeyById(id: string, request?: GetLlmProviderApiKeyByIdRequest, requestOptions?: LlmProviderKeyClient.RequestOptions): HttpResponsePromise<ProviderApiKeyPublic>;
10610
10735
  private __getLlmProviderApiKeyById;
10611
10736
  /**
10612
- * Update LLM Provider's ApiKey
10737
+ * Update LLM Provider's ApiKey. api_key and auth_config are mutually exclusive: setting a valid auth_config on a provider that holds a static api_key clears the stored key; send auth_config as an empty object to clear the recipe and switch back to a static key
10613
10738
  *
10614
10739
  * @param {string} id
10615
10740
  * @param {OpikApi.ProviderApiKeyUpdate} request
@@ -10624,6 +10749,22 @@ declare class LlmProviderKeyClient {
10624
10749
  */
10625
10750
  updateLlmProviderApiKey(id: string, request?: ProviderApiKeyUpdate, requestOptions?: LlmProviderKeyClient.RequestOptions): HttpResponsePromise<void>;
10626
10751
  private __updateLlmProviderApiKey;
10752
+ /**
10753
+ * Runs the token fetch once, backend-side, and reports the token lifetime. The token itself is never returned. Send provider_id to test the stored config, auth_config to test submitted values, or both to resolve secret sentinels against the stored config.
10754
+ *
10755
+ * @param {OpikApi.ProviderAuthCheck} request
10756
+ * @param {LlmProviderKeyClient.RequestOptions} requestOptions - Request-specific configuration.
10757
+ *
10758
+ * @throws {@link OpikApi.BadRequestError}
10759
+ * @throws {@link OpikApi.ForbiddenError}
10760
+ * @throws {@link OpikApi.NotFoundError}
10761
+ * @throws {@link OpikApi.UnprocessableEntityError}
10762
+ *
10763
+ * @example
10764
+ * await client.llmProviderKey.testLlmProviderAuthConfig()
10765
+ */
10766
+ testLlmProviderAuthConfig(request?: ProviderAuthCheck, requestOptions?: LlmProviderKeyClient.RequestOptions): HttpResponsePromise<Result>;
10767
+ private __testLlmProviderAuthConfig;
10627
10768
  }
10628
10769
 
10629
10770
  declare namespace ManualEvaluationClient {
package/dist/index.d.ts CHANGED
@@ -1674,6 +1674,7 @@ interface ProviderApiKeyUpdate {
1674
1674
  headers?: Record<string, string>;
1675
1675
  configuration?: Record<string, string>;
1676
1676
  baseUrl?: string;
1677
+ authConfig?: ProviderAuthConfig;
1677
1678
  }
1678
1679
 
1679
1680
  /**
@@ -1691,6 +1692,17 @@ interface ProviderApiKeyWrite {
1691
1692
  headers?: Record<string, string>;
1692
1693
  configuration?: Record<string, string>;
1693
1694
  baseUrl?: string;
1695
+ authConfig?: ProviderAuthConfigWrite;
1696
+ }
1697
+
1698
+ /**
1699
+ * @example
1700
+ * {}
1701
+ */
1702
+ interface ProviderAuthCheck {
1703
+ /** Test the stored auth config of this provider; also the sentinel-resolution target when auth_config is sent */
1704
+ providerId?: string;
1705
+ authConfig?: ProviderAuthConfig;
1694
1706
  }
1695
1707
 
1696
1708
  declare const ProviderApiKeyWriteProvider: {
@@ -4073,6 +4085,7 @@ declare namespace AutomationRuleEvaluatorObjectObjectPublic {
4073
4085
  /** Projects assigned to this rule (unique, sorted alphabetically by name) */
4074
4086
  projects?: ProjectReferencePublic[];
4075
4087
  name: string;
4088
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4076
4089
  samplingRate?: number;
4077
4090
  enabled?: boolean;
4078
4091
  /** Controls whether the rule fires on production traces, experiment traces, or both. Defaults to 'production' if omitted. */
@@ -4135,6 +4148,7 @@ declare namespace AutomationRuleEvaluatorPublic {
4135
4148
  /** Projects assigned to this rule (unique, sorted alphabetically by name) */
4136
4149
  projects?: ProjectReferencePublic[];
4137
4150
  name: string;
4151
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4138
4152
  samplingRate?: number;
4139
4153
  enabled?: boolean;
4140
4154
  /** Controls whether the rule fires on production traces, experiment traces, or both. Defaults to 'production' if omitted. */
@@ -4222,6 +4236,7 @@ declare namespace AutomationRuleEvaluatorUpdate {
4222
4236
  }
4223
4237
  interface _Base {
4224
4238
  name: string;
4239
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4225
4240
  samplingRate?: number;
4226
4241
  enabled?: boolean;
4227
4242
  triggerScope?: AutomationRuleEvaluatorUpdateTriggerScope;
@@ -4311,6 +4326,7 @@ declare namespace AutomationRuleEvaluatorWrite {
4311
4326
  /** Project IDs for write operations (used when creating/updating rules) */
4312
4327
  projectIds?: string[];
4313
4328
  name: string;
4329
+ /** Fraction of production (SDK-logged) items this rule scores, from 0 to 1. Trace rules ignore this value for experiment, playground and optimization traces and score them in full; span and thread rules only ever evaluate SDK-logged data. */
4314
4330
  samplingRate?: number;
4315
4331
  enabled?: boolean;
4316
4332
  /** Controls whether the rule fires on production traces, experiment traces, or both. Defaults to 'production' if omitted. */
@@ -4711,6 +4727,36 @@ interface CreateSessionResponse {
4711
4727
  runnerId?: string;
4712
4728
  }
4713
4729
 
4730
+ /**
4731
+ * Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
4732
+ */
4733
+ interface Credential {
4734
+ key: string;
4735
+ value?: string;
4736
+ /** Secret values are encrypted at rest and never read back; once true it cannot be unset */
4737
+ secret?: boolean;
4738
+ }
4739
+
4740
+ /**
4741
+ * Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
4742
+ */
4743
+ interface CredentialPublic {
4744
+ key: string;
4745
+ value?: string;
4746
+ /** Secret values are encrypted at rest and never read back; once true it cannot be unset */
4747
+ secret?: boolean;
4748
+ }
4749
+
4750
+ /**
4751
+ * Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
4752
+ */
4753
+ interface CredentialWrite {
4754
+ key: string;
4755
+ value?: string;
4756
+ /** Secret values are encrypted at rest and never read back; once true it cannot be unset */
4757
+ secret?: boolean;
4758
+ }
4759
+
4714
4760
  interface DashboardPagePublic {
4715
4761
  content?: DashboardPublic[];
4716
4762
  page?: number;
@@ -6910,6 +6956,7 @@ interface ProviderApiKeyPublic {
6910
6956
  headers?: Record<string, string>;
6911
6957
  configuration?: Record<string, string>;
6912
6958
  baseUrl?: string;
6959
+ authConfig?: ProviderAuthConfigPublic;
6913
6960
  createdAt?: Date;
6914
6961
  createdBy?: string;
6915
6962
  lastUpdatedAt?: Date;
@@ -6931,6 +6978,84 @@ declare const ProviderApiKeyPublicProvider: {
6931
6978
  };
6932
6979
  type ProviderApiKeyPublicProvider = (typeof ProviderApiKeyPublicProvider)[keyof typeof ProviderApiKeyPublicProvider];
6933
6980
 
6981
+ /**
6982
+ * Dynamic token auth recipe. Send the '__SECRET__' sentinel as a credential value to keep the stored secret; send an empty object to clear the auth config.
6983
+ */
6984
+ interface ProviderAuthConfig {
6985
+ /** Auth service URL the credentials are sent to */
6986
+ tokenUrl?: string;
6987
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
6988
+ sendAs?: ProviderAuthConfigSendAs;
6989
+ /** Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel */
6990
+ credentials?: Credential[];
6991
+ /** Field holding the token in the reply; dot-path for nested replies */
6992
+ tokenField?: string;
6993
+ /** Field holding the token lifetime in seconds in the reply; dot-path for nested replies */
6994
+ expiresField?: string;
6995
+ /** Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins */
6996
+ fallbackTtlSeconds?: number;
6997
+ }
6998
+
6999
+ /**
7000
+ * Dynamic token auth recipe. When set, Opik fetches a short-lived bearer from the configured auth service instead of using a static api_key. Only supported for custom providers. Secret credential values read back masked.
7001
+ */
7002
+ interface ProviderAuthConfigPublic {
7003
+ /** Auth service URL the credentials are sent to */
7004
+ tokenUrl?: string;
7005
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7006
+ sendAs?: ProviderAuthConfigPublicSendAs;
7007
+ /** Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel */
7008
+ credentials?: CredentialPublic[];
7009
+ /** Field holding the token in the reply; dot-path for nested replies */
7010
+ tokenField?: string;
7011
+ /** Field holding the token lifetime in seconds in the reply; dot-path for nested replies */
7012
+ expiresField?: string;
7013
+ /** Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins */
7014
+ fallbackTtlSeconds?: number;
7015
+ }
7016
+
7017
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7018
+ declare const ProviderAuthConfigPublicSendAs: {
7019
+ readonly Form: "form";
7020
+ readonly Json: "json";
7021
+ readonly Basic: "basic";
7022
+ };
7023
+ type ProviderAuthConfigPublicSendAs = (typeof ProviderAuthConfigPublicSendAs)[keyof typeof ProviderAuthConfigPublicSendAs];
7024
+
7025
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7026
+ declare const ProviderAuthConfigSendAs: {
7027
+ readonly Form: "form";
7028
+ readonly Json: "json";
7029
+ readonly Basic: "basic";
7030
+ };
7031
+ type ProviderAuthConfigSendAs = (typeof ProviderAuthConfigSendAs)[keyof typeof ProviderAuthConfigSendAs];
7032
+
7033
+ /**
7034
+ * Dynamic token auth recipe. When set, Opik fetches a short-lived bearer from the configured auth service instead of using a static api_key. Only supported for custom providers. Secret credential values read back masked.
7035
+ */
7036
+ interface ProviderAuthConfigWrite {
7037
+ /** Auth service URL the credentials are sent to */
7038
+ tokenUrl?: string;
7039
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7040
+ sendAs?: ProviderAuthConfigWriteSendAs;
7041
+ /** Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel */
7042
+ credentials?: CredentialWrite[];
7043
+ /** Field holding the token in the reply; dot-path for nested replies */
7044
+ tokenField?: string;
7045
+ /** Field holding the token lifetime in seconds in the reply; dot-path for nested replies */
7046
+ expiresField?: string;
7047
+ /** Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins */
7048
+ fallbackTtlSeconds?: number;
7049
+ }
7050
+
7051
+ /** How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body) */
7052
+ declare const ProviderAuthConfigWriteSendAs: {
7053
+ readonly Form: "form";
7054
+ readonly Json: "json";
7055
+ readonly Basic: "basic";
7056
+ };
7057
+ type ProviderAuthConfigWriteSendAs = (typeof ProviderAuthConfigWriteSendAs)[keyof typeof ProviderAuthConfigWriteSendAs];
7058
+
6934
7059
  interface RecentActivityItemPublic {
6935
7060
  type?: RecentActivityItemPublicType;
6936
7061
  id?: string;
@@ -10609,7 +10734,7 @@ declare class LlmProviderKeyClient {
10609
10734
  getLlmProviderApiKeyById(id: string, request?: GetLlmProviderApiKeyByIdRequest, requestOptions?: LlmProviderKeyClient.RequestOptions): HttpResponsePromise<ProviderApiKeyPublic>;
10610
10735
  private __getLlmProviderApiKeyById;
10611
10736
  /**
10612
- * Update LLM Provider's ApiKey
10737
+ * Update LLM Provider's ApiKey. api_key and auth_config are mutually exclusive: setting a valid auth_config on a provider that holds a static api_key clears the stored key; send auth_config as an empty object to clear the recipe and switch back to a static key
10613
10738
  *
10614
10739
  * @param {string} id
10615
10740
  * @param {OpikApi.ProviderApiKeyUpdate} request
@@ -10624,6 +10749,22 @@ declare class LlmProviderKeyClient {
10624
10749
  */
10625
10750
  updateLlmProviderApiKey(id: string, request?: ProviderApiKeyUpdate, requestOptions?: LlmProviderKeyClient.RequestOptions): HttpResponsePromise<void>;
10626
10751
  private __updateLlmProviderApiKey;
10752
+ /**
10753
+ * Runs the token fetch once, backend-side, and reports the token lifetime. The token itself is never returned. Send provider_id to test the stored config, auth_config to test submitted values, or both to resolve secret sentinels against the stored config.
10754
+ *
10755
+ * @param {OpikApi.ProviderAuthCheck} request
10756
+ * @param {LlmProviderKeyClient.RequestOptions} requestOptions - Request-specific configuration.
10757
+ *
10758
+ * @throws {@link OpikApi.BadRequestError}
10759
+ * @throws {@link OpikApi.ForbiddenError}
10760
+ * @throws {@link OpikApi.NotFoundError}
10761
+ * @throws {@link OpikApi.UnprocessableEntityError}
10762
+ *
10763
+ * @example
10764
+ * await client.llmProviderKey.testLlmProviderAuthConfig()
10765
+ */
10766
+ testLlmProviderAuthConfig(request?: ProviderAuthCheck, requestOptions?: LlmProviderKeyClient.RequestOptions): HttpResponsePromise<Result>;
10767
+ private __testLlmProviderAuthConfig;
10627
10768
  }
10628
10769
 
10629
10770
  declare namespace ManualEvaluationClient {
package/dist/index.js CHANGED
@@ -1 +1 @@
1
- import {Ia}from'./chunk-5KXDWHV4.js';export{va as AgentTaskCompletionJudge,ua as AgentToolCorrectnessJudge,ia as AnswerRelevance,ea as BaseLLMJudgeMetric,F as BaseMetric,G as BaseSuiteEvaluator,s as ChatPrompt,xa as ComplianceRiskJudge,l as ConfigMismatchError,k as ConfigNotFoundError,ba as Contains,B as DEFAULT_EXECUTION_POLICY,m as Dataset,i as DatasetVersion,j as DatasetVersionNotFoundError,pa as DemographicBiasJudge,na as DialogueHelpfulnessJudge,aa as ExactMatch,ja as GEval,ka as GEvalPreset,ra as GenderBiasJudge,ha as Hallucination,da as IsJson,T as LLMJudge,K as ModelConfigurationError,I as ModelError,J as ModelGenerationError,fa as Moderation,Fa as OPIK_PARENT_SPAN_ID_HEADER,Ea as OPIK_TRACE_ID_HEADER,Da as Opik,H as OpikBaseModel,t as OpikQueryLanguage,g as OpikSpanType,qa as PoliticalBiasJudge,r as Prompt,n as PromptType,wa as PromptUncertaintyJudge,oa as QARelevanceJudge,ca as RegexMatch,ta as RegionalBiasJudge,sa as ReligiousBiasJudge,S as ResponseSchema,Q as SYSTEM_PROMPT,ma as SummarizationCoherenceJudge,la as SummarizationConsistencyJudge,E as TASK_ERROR_SCORE_NAME,Ba as TestSuite,C as TestSuiteResult,v as ThreadsAnnotationQueue,u as TracesAnnotationQueue,R as USER_PROMPT_TEMPLATE,ga as Usefulness,M as VercelAIChatModel,y as activateRunner,w as agentConfigContext,D as buildSuiteResult,N as createModel,O as createModelFromInstance,V as deserializeEvaluators,L as detectProvider,c as disableLogger,_ as evaluate,$ as evaluatePrompt,Y as evaluateTestSuite,x as flushAll,h as generateId,Ga as getDistributedTraceHeaders,o as getGlobalClient,z as getTrackContext,e as isTracingActive,a as logger,q as resetGlobalClient,f as resetTracingToConfigDefault,ya as resolveEvaluators,W as resolveExecutionPolicy,X as resolveItemExecutionPolicy,P as resolveModel,Z as runTests,U as serializeEvaluators,p as setGlobalClient,b as setLoggerLevel,d as setTracingActive,A as track,za as validateEvaluators,Aa as validateExecutionPolicy,Ha as z}from'./chunk-5KXDWHV4.js';Ia();
1
+ import {Ia}from'./chunk-ZGZI64NN.js';export{va as AgentTaskCompletionJudge,ua as AgentToolCorrectnessJudge,ia as AnswerRelevance,ea as BaseLLMJudgeMetric,F as BaseMetric,G as BaseSuiteEvaluator,s as ChatPrompt,xa as ComplianceRiskJudge,l as ConfigMismatchError,k as ConfigNotFoundError,ba as Contains,B as DEFAULT_EXECUTION_POLICY,m as Dataset,i as DatasetVersion,j as DatasetVersionNotFoundError,pa as DemographicBiasJudge,na as DialogueHelpfulnessJudge,aa as ExactMatch,ja as GEval,ka as GEvalPreset,ra as GenderBiasJudge,ha as Hallucination,da as IsJson,T as LLMJudge,K as ModelConfigurationError,I as ModelError,J as ModelGenerationError,fa as Moderation,Fa as OPIK_PARENT_SPAN_ID_HEADER,Ea as OPIK_TRACE_ID_HEADER,Da as Opik,H as OpikBaseModel,t as OpikQueryLanguage,g as OpikSpanType,qa as PoliticalBiasJudge,r as Prompt,n as PromptType,wa as PromptUncertaintyJudge,oa as QARelevanceJudge,ca as RegexMatch,ta as RegionalBiasJudge,sa as ReligiousBiasJudge,S as ResponseSchema,Q as SYSTEM_PROMPT,ma as SummarizationCoherenceJudge,la as SummarizationConsistencyJudge,E as TASK_ERROR_SCORE_NAME,Ba as TestSuite,C as TestSuiteResult,v as ThreadsAnnotationQueue,u as TracesAnnotationQueue,R as USER_PROMPT_TEMPLATE,ga as Usefulness,M as VercelAIChatModel,y as activateRunner,w as agentConfigContext,D as buildSuiteResult,N as createModel,O as createModelFromInstance,V as deserializeEvaluators,L as detectProvider,c as disableLogger,_ as evaluate,$ as evaluatePrompt,Y as evaluateTestSuite,x as flushAll,h as generateId,Ga as getDistributedTraceHeaders,o as getGlobalClient,z as getTrackContext,e as isTracingActive,a as logger,q as resetGlobalClient,f as resetTracingToConfigDefault,ya as resolveEvaluators,W as resolveExecutionPolicy,X as resolveItemExecutionPolicy,P as resolveModel,Z as runTests,U as serializeEvaluators,p as setGlobalClient,b as setLoggerLevel,d as setTracingActive,A as track,za as validateEvaluators,Aa as validateExecutionPolicy,Ha as z}from'./chunk-ZGZI64NN.js';Ia();
@@ -1 +1 @@
1
- import {Ca}from'./chunk-5KXDWHV4.js';export{B as DEFAULT_EXECUTION_POLICY,Ba as TestSuite,C as TestSuiteResult,D as buildSuiteResult,V as deserializeEvaluators,Y as evaluateTestSuite,W as resolveExecutionPolicy,X as resolveItemExecutionPolicy,Z as runTests,U as serializeEvaluators}from'./chunk-5KXDWHV4.js';Ca();
1
+ import {Ca}from'./chunk-ZGZI64NN.js';export{B as DEFAULT_EXECUTION_POLICY,Ba as TestSuite,C as TestSuiteResult,D as buildSuiteResult,V as deserializeEvaluators,Y as evaluateTestSuite,W as resolveExecutionPolicy,X as resolveItemExecutionPolicy,Z as runTests,U as serializeEvaluators}from'./chunk-ZGZI64NN.js';Ca();
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "opik",
3
3
  "description": "Opik TypeScript and JavaScript SDK",
4
- "version": "2.2.39",
4
+ "version": "2.2.41",
5
5
  "repository": {
6
6
  "type": "git",
7
7
  "url": "git+https://github.com/comet-ml/opik.git",