codai-sdk 0.71.0__tar.gz → 0.72.0__tar.gz

{codai_sdk-0.71.0 → codai_sdk-0.72.0}/CHANGELOG.md

@@ -6,6 +6,18 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.72.0] - 2026-10-24
+
+- Vault wave 2 (ADR `docs/decisions/2026-10-24-vault-wave2.md`), mirroring `codai-sdk` 0.73.0:
+  - `vault.add_requests.create / get / cancel / lookup / complete` (`/v1/vault/add-requests*`): an agent asks the
+    user to add a missing secret and polls until `handle` is set. No secret passes through these calls.
+  - `vault.emergency.list / invite / accept / seal / update / revoke / request / deny / approve / vault_data`
+    (`/v1/vault/emergency*`): emergency contacts with vault keys sealed client-side and a 24/48/72 h wait.
+  - `vault.hibp_range(prefix)` (text, k-anonymity), `vault.rotation()`, `vault.set_rotation(item_id, ...)`,
+    `vault.mark_rotated(item_id)`, `vault.report_breaches(results)`: rotation queue and client-side breach checks.
+  - `vault.derivers()`, `vault.set_deriver(...)`, `vault.delete_deriver(item_id)`, `vault.derive(body)`: short-lived
+    credentials for codai brokers; HTTP 202 (approval required) is returned, not raised.
+
 ## [0.71.0] - 2026-10-24
 
 - `productions.create(kind=..., duration_s=...)`: 8 production kinds (video, image, deck, doc, sheet, audio,

{codai_sdk-0.71.0 → codai_sdk-0.72.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codai-sdk
-Version: 0.71.0
+Version: 0.72.0
 Summary: Official Python SDK for the codai AI gateway — chat, messages, responses, streaming, agents, sessions, hosts, tasks, account.
 Project-URL: Homepage, https://codai.ro
 Project-URL: Repository, https://github.com/codai-ro/codai-sdk-python

{codai_sdk-0.71.0 → codai_sdk-0.72.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "codai-sdk"
-version = "0.71.0"
+version = "0.72.0"
 description = "Official Python SDK for the codai AI gateway — chat, messages, responses, streaming, agents, sessions, hosts, tasks, account."
 readme = "README.md"
 

{codai_sdk-0.71.0 → codai_sdk-0.72.0}/src/codai/__init__.py

@@ -172,7 +172,7 @@ __all__ = [
     "vault_resolve_message",
     "vault_unlock_message",
 ]
-__version__ = "0.71.0"
+__version__ = "0.72.0"
 class _CallableGroup:
     """A resource group that is also callable — keeps ``client.chat(...)``,
     ``client.embeddings(...)``, ``client.models()`` and ``client.feedback(...)``

{codai_sdk-0.71.0 → codai_sdk-0.72.0}/src/codai/_operations.py

@@ -140,6 +140,30 @@ OPERATION_METHODS: Dict[str, str] = {
     "vaultHttp": "vault.http_call",
     "vaultResolve": "vault.resolve",
     "createVaultResolveChallenge": "vault.resolve_challenge",
+    "createVaultAddRequest": "vault.add_requests.create",
+    "getVaultAddRequest": "vault.add_requests.get",
+    "cancelVaultAddRequest": "vault.add_requests.cancel",
+    "lookupVaultAddRequest": "vault.add_requests.lookup",
+    "completeVaultAddRequest": "vault.add_requests.complete",
+    "listVaultEmergency": "vault.emergency.list",
+    "inviteVaultEmergency": "vault.emergency.invite",
+    "acceptVaultEmergency": "vault.emergency.accept",
+    "sealVaultEmergency": "vault.emergency.seal",
+    "updateVaultEmergency": "vault.emergency.update",
+    "revokeVaultEmergency": "vault.emergency.revoke",
+    "requestVaultEmergency": "vault.emergency.request",
+    "denyVaultEmergency": "vault.emergency.deny",
+    "approveVaultEmergency": "vault.emergency.approve",
+    "getVaultEmergencyData": "vault.emergency.vault_data",
+    "getVaultHibpRange": "vault.hibp_range",
+    "listVaultRotation": "vault.rotation",
+    "setVaultItemRotation": "vault.set_rotation",
+    "markVaultItemRotated": "vault.mark_rotated",
+    "reportVaultBreaches": "vault.report_breaches",
+    "listVaultDerivers": "vault.derivers",
+    "setVaultItemDeriver": "vault.set_deriver",
+    "deleteVaultItemDeriver": "vault.delete_deriver",
+    "deriveVaultCredential": "vault.derive",
     "createStudioAbuseReport": "abuse_reports.create",
     "checkProvenance": "provenance.check",
     "createStudioBatch": "batches.create",

{codai_sdk-0.71.0 → codai_sdk-0.72.0}/src/codai/_types.py

@@ -7190,6 +7190,127 @@ class VaultApprovalProofOption2(TypedDict):
 VaultApprovalProof = Union[VaultApprovalProofOption1, VaultApprovalProofOption2]
 
 
+class _VaultAddRequestCreateRequired(TypedDict):
+    kind: Literal['login', 'api_key', 'env', 'ssh_key', 'oauth_token', 'note', 'card', 'identity', 'passkey']
+    title: str
+    purpose: str
+
+
+class VaultAddRequestCreate(_VaultAddRequestCreateRequired, total=False):
+    slug: str
+    hosts: List[str]
+    env_var: str
+    fields: List[str]
+    task: str
+
+
+class VaultAddRequestCreated(TypedDict):
+    id: str
+    url: Optional[str]
+    status: Literal['pending', 'completed', 'cancelled', 'expired']
+    expires_at: str
+
+
+class VaultAddRequestStatus(TypedDict):
+    id: str
+    status: Literal['pending', 'completed', 'cancelled', 'expired']
+    slug: Optional[str]
+    handle: Optional[str]
+    item_id: Optional[str]
+    expires_at: str
+
+
+class VaultAddRequest(TypedDict):
+    id: str
+    status: Literal['pending', 'completed', 'cancelled', 'expired']
+    agent: str
+    kind: Literal['login', 'api_key', 'env', 'ssh_key', 'oauth_token', 'note', 'card', 'identity', 'passkey']
+    title: str
+    slug: Optional[str]
+    hosts: List[str]
+    env_var: Optional[str]
+    fields: List[str]
+    purpose: str
+    task: Optional[str]
+    handle: Optional[str]
+    item_id: Optional[str]
+    expires_at: str
+    completed_at: Optional[str]
+    created_at: str
+
+
+class VaultEmergencyContact(TypedDict):
+    id: str
+    role: Literal['grantor', 'grantee']
+    email: Optional[str]
+    other_name: Optional[str]
+    status: Literal['invited', 'accepted', 'sealed', 'requested', 'granted', 'revoked']
+    delay_hours: Literal[24, 48, 72]
+    vault_ids: List[str]
+    grantee_fingerprint: Optional[str]
+    grantee_public_keys: Optional[Dict[str, Any]]
+    request_reason: Optional[str]
+    requested_at: Optional[str]
+    release_at: Optional[str]
+    granted_at: Optional[str]
+    denied_at: Optional[str]
+    created_at: str
+
+
+class VaultEmergencyDataVaultsItem(TypedDict):
+    id: str
+    encrypted_meta: str
+    sealed_key: Dict[str, Any]
+
+
+class VaultEmergencyDataItemsItem(TypedDict):
+    id: str
+    vault_id: str
+    revision: int
+    wrapped_key: str
+    ciphertext: str
+    kind: str
+    slug: Optional[str]
+    agent_meta: Any
+
+
+class VaultEmergencyData(TypedDict):
+    vaults: List[VaultEmergencyDataVaultsItem]
+    items: List[VaultEmergencyDataItemsItem]
+
+
+class VaultRotationEntry(TypedDict):
+    item_id: str
+    slug: Optional[str]
+    title: Optional[str]
+    kind: str
+    interval_days: Optional[int]
+    rotated_at: Optional[str]
+    due_at: Optional[str]
+    overdue: bool
+    breached: bool
+    breach_count: int
+    breach_checked_at: Optional[str]
+    snoozed_until: Optional[str]
+    provider: Optional[Literal['stripe', 'github_pat', 'openai', 'google_api_key', 'other']]
+    create_url: Optional[str]
+
+
+class VaultDeriver(TypedDict):
+    item_id: str
+    provider: Literal['aws_sts', 'gcp_sa', 'cloudflare', 'github_app']
+    config: Dict[str, Any]
+    max_ttl_s: int
+    updated_at: str
+
+
+class VaultDerived(TypedDict):
+    provider: Literal['aws_sts', 'gcp_sa', 'cloudflare', 'github_app']
+    values: Dict[str, str]
+    env: Dict[str, str]
+    expires_at: str
+
+
 # POST /v1/chat/completions — request body
 CreateChatCompletionBody = ChatCompletionRequest
 
@@ -9770,8 +9891,197 @@ class VaultResolveBody(_VaultResolveBodyRequired, total=False):
 VaultResolveResponse = Dict[str, Any]
 
 
+# POST /v1/vault/add-requests — request body
+CreateVaultAddRequestBody = VaultAddRequestCreate
+
+
+# POST /v1/vault/add-requests — 201 response
+CreateVaultAddRequestResponse = VaultAddRequestCreated
+
+
+class LookupVaultAddRequestBody(TypedDict):
+    token: str
+
+
+# POST /v1/vault/add-requests/lookup — 200 response
+LookupVaultAddRequestResponse = VaultAddRequest
+
+
+# GET /v1/vault/add-requests/{id} — 200 response
+GetVaultAddRequestResponse = VaultAddRequestStatus
+
+
+# DELETE /v1/vault/add-requests/{id} — 200 response
+CancelVaultAddRequestResponse = VaultAddRequestStatus
+
+
+class CompleteVaultAddRequestBody(TypedDict):
+    item_id: str
+
+
+# POST /v1/vault/add-requests/{id}/complete — 200 response
+CompleteVaultAddRequestResponse = VaultAddRequestStatus
+
+
+class ListVaultEmergencyResponse(TypedDict):
+    outgoing: List[VaultEmergencyContact]
+    incoming: List[VaultEmergencyContact]
+
+
+class _InviteVaultEmergencyBodyRequired(TypedDict):
+    email: str
+    delay_hours: Literal[24, 48, 72]
+
+
+class InviteVaultEmergencyBody(_InviteVaultEmergencyBodyRequired, total=False):
+    vault_ids: List[str]
+
+
+class InviteVaultEmergencyResponse(TypedDict):
+    id: str
+
+
+class AcceptVaultEmergencyBody(TypedDict):
+    token: str
+
+
+# POST /v1/vault/emergency/accept — 200 response
+AcceptVaultEmergencyResponse = VaultEmergencyContact
+
+
+class SealVaultEmergencyBodySealedKeysValue(TypedDict):
+    alg: Literal['xwing-hkdf-xchacha20poly1305']
+    ct: str
+    wrapped: str
+
+
+class SealVaultEmergencyBody(TypedDict):
+    grantee_fingerprint: str
+    sealed_keys: Dict[str, SealVaultEmergencyBodySealedKeysValue]
+
+
+# PUT /v1/vault/emergency/{id}/seal — 200 response
+SealVaultEmergencyResponse = VaultEmergencyContact
+
+
+class UpdateVaultEmergencyBody(TypedDict, total=False):
+    delay_hours: Literal[24, 48, 72]
+    vault_ids: List[str]
+
+
+# PATCH /v1/vault/emergency/{id} — 200 response
+UpdateVaultEmergencyResponse = VaultEmergencyContact
+
+
+class RevokeVaultEmergencyResponse(TypedDict):
+    id: str
+    status: Literal['revoked']
+
+
+class RequestVaultEmergencyBody(TypedDict, total=False):
+    reason: str
+
+
+# POST /v1/vault/emergency/{id}/request — 200 response
+RequestVaultEmergencyResponse = VaultEmergencyContact
+
+
+# POST /v1/vault/emergency/{id}/deny — 200 response
+DenyVaultEmergencyResponse = VaultEmergencyContact
+
+
+# POST /v1/vault/emergency/{id}/approve — 200 response
+ApproveVaultEmergencyResponse = VaultEmergencyContact
+
+
+# GET /v1/vault/emergency/{id}/vault-data — 200 response
+GetVaultEmergencyDataResponse = VaultEmergencyData
+
+
+class ListVaultRotationResponse(TypedDict):
+    items: List[VaultRotationEntry]
+
+
+class SetVaultItemRotationBody(TypedDict, total=False):
+    interval_days: Optional[int]
+    provider: Optional[Literal['stripe', 'github_pat', 'openai', 'google_api_key', 'other']]
+    snoozed_until: Optional[str]
+
+
+class SetVaultItemRotationResponse(TypedDict):
+    item_id: str
+    interval_days: Optional[int]
+    provider: Optional[Literal['stripe', 'github_pat', 'openai', 'google_api_key', 'other']]
+    snoozed_until: Optional[str]
+
+
+class MarkVaultItemRotatedResponse(TypedDict):
+    item_id: str
+    rotated_at: Optional[str]
+
+
+class ReportVaultBreachesBodyResultsItem(TypedDict):
+    item_id: str
+    count: int
+
+
+class ReportVaultBreachesBody(TypedDict):
+    results: List[ReportVaultBreachesBodyResultsItem]
+
+
+class ReportVaultBreachesResponse(TypedDict):
+    recorded: int
+    newly_breached: int
+
+
+class ListVaultDeriversResponse(TypedDict):
+    derivers: List[VaultDeriver]
+
+
+class SetVaultItemDeriverBody(TypedDict):
+    provider: Literal['aws_sts', 'gcp_sa', 'cloudflare', 'github_app']
+    config: Dict[str, Any]
+    max_ttl_s: int
+
+
+class SetVaultItemDeriverResponse(TypedDict):
+    deriver: VaultDeriver
+
+
+class DeleteVaultItemDeriverResponse(TypedDict):
+    deleted: bool
+
+
+class _DeriveVaultCredentialBodyRequired(TypedDict):
+    handle: str
+    action: str
+    proof: VaultResolveProof
+
+
+class DeriveVaultCredentialBody(_DeriveVaultCredentialBodyRequired, total=False):
+    purpose: str
+    provenance: Literal['user', 'agent', 'untrusted']
+    chain: List[str]
+    task: Optional[str]
+    ttl_s: int
+
+
+# POST /v1/vault/derive — 200 response
+DeriveVaultCredentialResponse = VaultDerived
+
+
+class DeriveVaultCredentialResponse202(TypedDict):
+    status: Literal['approval_required']
+    tier: str
+    approval_id: str
+    match_number: Optional[str]
+    reasons: List[str]
+
+
 __all__ = [
     'AcceptTranscriptPromptResponse',
+    'AcceptVaultEmergencyBody',
+    'AcceptVaultEmergencyResponse',
     'AccountConsent',
     'AccountFeedbackRequest',
     'AccountGrowth',
@@ -9827,6 +10137,7 @@ __all__ = [
     'ApplyCreativeOpsResponse',
     'ApproveScheduleCommandBody',
     'ApproveScheduleCommandResponse',
+    'ApproveVaultEmergencyResponse',
     'ArchiveEnvironmentResponse',
     'AskTranscriptsBody',
     'AskTranscriptsResponse',
@@ -9866,6 +10177,7 @@ __all__ = [
     'BulkPromptsResponse',
     'CancelAgentRunResponse',
     'CancelStudioBatchResponse',
+    'CancelVaultAddRequestResponse',
     'CaptionCreativeBody',
     'CaptionCreativeResponse',
     'CaptionPresetId',
@@ -9922,6 +10234,8 @@ __all__ = [
     'ClaimSessionLeaseResponse',
     'CommentCreativeBody',
     'CommentCreativeResponse',
+    'CompleteVaultAddRequestBody',
+    'CompleteVaultAddRequestResponse',
     'ConfirmTaskBody',
     'ConfirmTaskResponse',
     'Control',
@@ -10050,6 +10364,8 @@ __all__ = [
     'CreateTranscriptionResponse',
     'CreateTriggerBody',
     'CreateTriggerResponse',
+    'CreateVaultAddRequestBody',
+    'CreateVaultAddRequestResponse',
     'CreateVaultBody',
     'CreateVaultDeviceChallengeResponse',
     'CreateVaultResolveChallengeResponse',
@@ -10203,8 +10519,13 @@ __all__ = [
     'DeleteSessionResponse',
     'DeleteSessionShareResponse',
     'DeleteTriggerResponse',
+    'DeleteVaultItemDeriverResponse',
     'DeleteVaultItemResponse',
     'DeleteVaultRuleResponse',
+    'DenyVaultEmergencyResponse',
+    'DeriveVaultCredentialBody',
+    'DeriveVaultCredentialResponse',
+    'DeriveVaultCredentialResponse202',
     'DestroyEnvironmentResponse',
     'DeviceListItem',
     'DevicePatch',
@@ -10370,7 +10691,9 @@ __all__ = [
     'GetTranscriptVocabularyResponse',
     'GetUsageResponse',
     'GetVaultAccountResponse',
+    'GetVaultAddRequestResponse',
     'GetVaultApprovalResponse',
+    'GetVaultEmergencyDataResponse',
     'GetVideoResponse',
     'GetVideoResponseDataItemOption1',
     'HeartbeatMonitor',
@@ -10388,6 +10711,8 @@ __all__ = [
     'InsufficientBalanceErrorError',
     'InsufficientFundsError',
     'InsufficientFundsErrorError',
+    'InviteVaultEmergencyBody',
+    'InviteVaultEmergencyResponse',
     'IssueMyEnvironmentSshCertBody',
     'IssueMyEnvironmentSshCertResponse',
     'LaunchPromptBody',
@@ -10462,20 +10787,26 @@ __all__ = [
     'ListTriggerEventsResponse',
     'ListTriggersResponse',
     'ListVaultApprovalsResponse',
+    'ListVaultDeriversResponse',
     'ListVaultDevicesResponse',
+    'ListVaultEmergencyResponse',
     'ListVaultEventsResponse',
     'ListVaultGrantsResponse',
     'ListVaultItemsResponse',
     'ListVaultLimitsResponse',
+    'ListVaultRotationResponse',
     'ListVaultRulesResponse',
     'ListVaultsResponse',
     'LocalizeCreativeBody',
     'LocalizeCreativeResponse',
     'LockVaultBody',
     'LockVaultResponse',
+    'LookupVaultAddRequestBody',
+    'LookupVaultAddRequestResponse',
     'MarkNotificationsReadBody',
     'MarkNotificationsReadResponse',
     'MarkSessionControlAppliedResponse',
+    'MarkVaultItemRotatedResponse',
     'MatchPromptBody',
     'MatchPromptResponse',
     'MediaOp',
@@ -10655,6 +10986,11 @@ __all__ = [
     'ReplyPublicReviewThreadResponse',
     'ReportScheduleRunResultBody',
     'ReportScheduleRunResultResponse',
+    'ReportVaultBreachesBody',
+    'ReportVaultBreachesBodyResultsItem',
+    'ReportVaultBreachesResponse',
+    'RequestVaultEmergencyBody',
+    'RequestVaultEmergencyResponse',
     'ResearchJob',
     'ResearchJobError',
     'ResearchRequest',
@@ -10676,6 +11012,7 @@ __all__ = [
     'RevertCreativeResponse',
     'RevokeSelfKeyResponse',
     'RevokeVaultDeviceResponse',
+    'RevokeVaultEmergencyResponse',
     'RevokeVaultGrantResponse',
     'RevokeVaultTaskGrantsBody',
     'RevokeVaultTaskGrantsResponse',
@@ -10737,6 +11074,9 @@ __all__ = [
     'ScheduleInput',
     'ScheduleRun',
     'SchedulerHost',
+    'SealVaultEmergencyBody',
+    'SealVaultEmergencyBodySealedKeysValue',
+    'SealVaultEmergencyResponse',
     'SearchMemoriesResponse',
     'SearchSfxResponse',
     'SearchTranscriptsResponse',
@@ -10783,8 +11123,12 @@ __all__ = [
     'SetTriggerSecretResponse',
     'SetVaultItemCloudBody',
     'SetVaultItemCloudResponse',
+    'SetVaultItemDeriverBody',
+    'SetVaultItemDeriverResponse',
     'SetVaultItemLimitsBody',
     'SetVaultItemLimitsResponse',
+    'SetVaultItemRotationBody',
+    'SetVaultItemRotationResponse',
     'SettingsConflict',
     'SettingsConflictError',
     'SettingsPatchRequest',
@@ -11044,22 +11388,34 @@ __all__ = [
     'UpdateTranscriptUtteranceResponse',
     'UpdateTriggerBody',
     'UpdateTriggerResponse',
+    'UpdateVaultEmergencyBody',
+    'UpdateVaultEmergencyResponse',
     'UsageReport',
     'UsageRow',
     'UserSettings',
     'Utterance',
     'UtteranceWordsItem',
     'VaultAccount',
+    'VaultAddRequest',
+    'VaultAddRequestCreate',
+    'VaultAddRequestCreated',
+    'VaultAddRequestStatus',
     'VaultApprovalProof',
     'VaultApprovalProofOption1',
     'VaultApprovalProofOption2',
     'VaultCatalogResponse',
+    'VaultDerived',
+    'VaultDeriver',
     'VaultDeviceChallenge',
     'VaultDeviceEnroll',
     'VaultDeviceEnrollAttestationOption1',
     'VaultDeviceEnrollAttestationOption2',
     'VaultDeviceEnrollAttestationOption2Tpm',
     'VaultDeviceKey',
+    'VaultEmergencyContact',
+    'VaultEmergencyData',
+    'VaultEmergencyDataItemsItem',
+    'VaultEmergencyDataVaultsItem',
     'VaultGuards',
     'VaultHttpBody',
     'VaultHttpResponse',
@@ -11070,6 +11426,7 @@ __all__ = [
     'VaultResolveChallenge',
     'VaultResolveProof',
     'VaultResolveResponse',
+    'VaultRotationEntry',
     'VaultUnlockChallenge',
     'VaultUseBody',
     'VaultUseDecision',