diff --git a/.speakeasy/gen.lock b/.speakeasy/gen.lock index dd4d08fa0..111393f8c 100644 --- a/.speakeasy/gen.lock +++ b/.speakeasy/gen.lock @@ -1,19 +1,19 @@ lockVersion: "" id: "" management: - docChecksum: 8228a16de78adebfe022d172b75cccb9 + docChecksum: ec14fdf8e1b5c0ddd2afc07761bc639d docVersion: 1.0.0 speakeasyVersion: 1.802.0 generationVersion: 2.948.4 - releaseVersion: 1.5.9 - configChecksum: fba964f8afb0438747ed1966b374262e + releaseVersion: 1.5.10 + configChecksum: cf64e39c991bc9e18a72c5cc15b31b8f repoURL: https://github.com/OpenRouterTeam/typescript-sdk.git installationURL: https://github.com/OpenRouterTeam/typescript-sdk published: true persistentEdits: - generation_id: 5c0de7c8-47bc-4440-9ac7-5ab42ddac838 - pristine_commit_hash: 72f1dbd763c2eef55590679dd21f9ff8068c8cc1 - pristine_tree_hash: 6139716e017b2129c1b70638f5229a8a6366a14e + generation_id: df1cd9e0-5650-42de-a189-74647cc335ad + pristine_commit_hash: bcf9e0738b852f6027482ac8d8cffb21f469fbad + pristine_tree_hash: 8b3bb2c048d0ac830d6ec7c379ad53f8f3f83699 features: typescript: acceptHeaders: 2.81.2 @@ -1569,6 +1569,10 @@ trackedFiles: id: af1321c2e60a last_write_checksum: sha1:f67574edf6d81008f8ed06ad16da4a0e3fa1988b pristine_git_object: 631d769d68f71bfc5568ab02bf9c47c3d641ceb5 + docs/models/authmode.mdx: + id: 8b441a3a15a1 + last_write_checksum: sha1:8352a44fe36da96c3432bda57ab3b9ed87420cea + pristine_git_object: 2b55b6aef3d88b03be3341ba457bdcf16184a932 docs/models/autobetarouterplugin.mdx: id: ecc97e45ac41 last_write_checksum: sha1:29f3663fb35057ca4e897a762644daf0592e2127 @@ -7455,8 +7459,8 @@ trackedFiles: deleted: true docs/models/observabilitydestination.mdx: id: 0d91bf16e1ec - last_write_checksum: sha1:b972b71b59471cc221d3495578bb74efe8c671a6 - pristine_git_object: c9bf64bed2457c234560f8d3a4cb42b8737e0c0d + last_write_checksum: sha1:78d7e9dc69e0af580bc7e6d65da0a064ddd3b3bc + pristine_git_object: 537707557a9b78d6bb123b7be6195b0c4209345e docs/models/observabilityfilterrulegroup.mdx: id: b40be32620bd last_write_checksum: sha1:4ae96077440d5f31fe11c99654f3321299f8ad97 @@ -7634,8 +7638,8 @@ trackedFiles: deleted: true docs/models/observabilitys3destination.mdx: id: afba0fabeaeb - last_write_checksum: sha1:c147c20e3c466c3e9fcd070f0cdf1ddcfe6ed2f8 - pristine_git_object: 148c06bff8518a29185afe2b6c6b944d6aeffaa4 + last_write_checksum: sha1:a9860a43ccdf473eb640cf9fb48c22f4e111e78c + pristine_git_object: 1c46f95f612b27f51efe3a1b97bcc49a7114274a docs/models/observabilitys3destinationconfig.md: id: 4c930bc55a1a last_write_checksum: sha1:aa373d5cbce0067ea8991ff5fb5798401d9a37df @@ -7643,8 +7647,8 @@ trackedFiles: deleted: true docs/models/observabilitys3destinationconfig.mdx: id: 93a768ff7501 - last_write_checksum: sha1:8abb090a8d8f9fda5869d898428fc06867582125 - pristine_git_object: 522c7ce8d09a674f3a975b737e1e8132b7bae50c + last_write_checksum: sha1:d851bf82e5d7aaf18b565f7b4d0f1a77f052e07c + pristine_git_object: 473353912494de4d728e67b4d973b3228db8e01a docs/models/observabilitysentrydestination.md: id: d4cb048bd043 last_write_checksum: sha1:7a0aa4b54cffcf9caab562717703d874585b25b2 @@ -12268,6 +12272,10 @@ trackedFiles: last_write_checksum: sha1:25e4cea3b61a585df4086b56ab75ef61285ba942 pristine_git_object: 1aed4592b081784d850dd7e95efb8562a3adce14 deleted: true + docs/models/providerenum.mdx: + id: 040ee4a43220 + last_write_checksum: sha1:b204e6c9b583aab309045c462227369d80e5bf3a + pristine_git_object: fbeccb448d757089283a6064ee44f22c50f11965 docs/models/providername.mdx: id: 69a9efe649dc last_write_checksum: sha1:2ffade9b9df45d099eb0da6d3b9948a95c7e7e52 @@ -15387,12 +15395,12 @@ trackedFiles: pristine_git_object: 410efafd6a7f50d91ccb87131fedbe0c3d47e15a jsr.json: id: 7f6ab7767282 - last_write_checksum: sha1:7770ce157e9e9c729c2550dd132dde9cefb18568 - pristine_git_object: 3a6bb460b58d15315c8e66bda3812bd8d59c639f + last_write_checksum: sha1:570832c76560ffe61ae5838b600d9c0c9265efb6 + pristine_git_object: a03cbf08401fe6323c0371f65710745e75148d73 package.json: id: 7030d0b2f71b - last_write_checksum: sha1:3d9a1e8c9c9a1d6ea6302fb20578bb60155abe94 - pristine_git_object: b94bbd7fe0224ba4cb77c1615971c2a380960b7e + last_write_checksum: sha1:6460469d2919c1b184de8f1ec65d60ad8b8fe512 + pristine_git_object: b33166d0cbaf7b77743d0241555c2718914c6a9d src/core.ts: id: f431fdbcd144 last_write_checksum: sha1:5aa66b0b6a5964f3eea7f3098c2eb3c0ee9c0131 @@ -15971,8 +15979,8 @@ trackedFiles: pristine_git_object: a187e58707bdb726ca2aff74941efe7493422d4e src/lib/config.ts: id: 320761608fb3 - last_write_checksum: sha1:7cbe3348afcd128119bead28c38d9557321cee93 - pristine_git_object: da146bfa32b625c81deb18d0045f2ca710758b1f + last_write_checksum: sha1:251f3a7237bc200ac60c883f3b7745874fa8649a + pristine_git_object: 26572f93667db723441c253ad4bc71eb1447031f src/lib/dlv.ts: id: b1988214835a last_write_checksum: sha1:eaac763b22717206a6199104e0403ed17a4e2711 @@ -18173,8 +18181,8 @@ trackedFiles: pristine_git_object: a76acc96008fd05e8b5565f11592ab298cb9dfcc src/models/observabilitys3destination.ts: id: a9e50c2b3d64 - last_write_checksum: sha1:de28ed288b0428803ab8e6d8879d2b43f38fb427 - pristine_git_object: 57fd3f43e0ed4ed89376a939bc0e948741ec272a + last_write_checksum: sha1:0ad28ef0896e62d697035d20048af1b582e141b5 + pristine_git_object: 38c0ff53999fce6be18fe36491836c3b3822d615 src/models/observabilitysentrydestination.ts: id: 05cd77bde6a0 last_write_checksum: sha1:c080a3a112c3a2eea53060048bb78cc67f2a9a42 @@ -24601,4 +24609,9 @@ examples: "500": application/json: {"error": {"code": 404, "message": "Intern not found"}} examplesVersion: 1.0.2 -releaseNotes: "## Typescript SDK Changes:\n* `openrouter.presets.createPresetsMessages()`: \n * `request.messagesRequest.messages[].content.union(Array<>)[].union(tool_addition).tool.union(tool_definition)` **Added**\n" +releaseNotes: | + ## Typescript SDK Changes: + * `openrouter.observability.list()`: `response.data[].union(s3).config` **Changed** + * `openrouter.observability.create()`: `response.data.union(s3).config` **Changed** + * `openrouter.observability.get()`: `response.data.union(s3).config` **Changed** + * `openrouter.observability.update()`: `response.data.union(s3).config` **Changed** diff --git a/.speakeasy/gen.yaml b/.speakeasy/gen.yaml index 84e5cb02c..043fa8ff6 100644 --- a/.speakeasy/gen.yaml +++ b/.speakeasy/gen.yaml @@ -37,7 +37,7 @@ generation: documentation: mintlify preApplyUnionDiscriminators: true typescript: - version: 1.5.9 + version: 1.5.10 acceptHeaderEnum: false additionalDependencies: dependencies: diff --git a/.speakeasy/out.openapi.yaml b/.speakeasy/out.openapi.yaml index af9270c69..ebcda6a27 100644 --- a/.speakeasy/out.openapi.yaml +++ b/.speakeasy/out.openapi.yaml @@ -20858,6 +20858,26 @@ components: accessKeyId: minLength: 1 type: 'string' + visibleWhen: + - field: 'authMode' + in: + - 'access_keys' + - '' + authMode: + default: 'access_keys' + description: 'IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don''t share long-lived keys.' + enum: + - 'access_keys' + - 'iam_role' + optionLabels: + access_keys: 'Access keys' + iam_role: 'IAM role' + type: 'string' + visibleWhen: + - field: 'provider' + in: + - 'aws' + x-speakeasy-unknown-values: allow bucketName: minLength: 1 type: 'string' @@ -20865,6 +20885,24 @@ components: description: 'Only for S3-compatible services like Cloudflare R2 (https://account-id.r2.cloudflarestorage.com) or MinIO. Leave blank for standard AWS S3.' format: 'uri' type: 'string' + visibleWhen: + - field: 'provider' + in: + - 'cloudflare_r2' + - 'gcs' + - 'other' + - '' + externalId: + description: 'Generated by OpenRouter when you save. Require it as sts:ExternalId in your role''s trust policy.' + readOnly: true + type: 'string' + visibleWhen: + - field: 'provider' + in: + - 'aws' + - field: 'authMode' + in: + - 'iam_role' headers: additionalProperties: type: 'string' @@ -20877,17 +20915,51 @@ components: prefix: default: 'openrouter-traces' type: 'string' + provider: + description: 'The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys.' + enum: + - 'aws' + - 'cloudflare_r2' + - 'gcs' + - 'other' + optionLabels: + aws: 'AWS S3' + cloudflare_r2: 'Cloudflare R2' + gcs: 'Google Cloud Storage' + other: 'Other S3-compatible' + type: 'string' + x-speakeasy-unknown-values: allow region: + description: 'Required for IAM role authentication. With access keys, AWS S3 detects the bucket region when you leave this blank.' + type: 'string' + roleArn: + description: 'The IAM role in your account that OpenRouter assumes. Its trust policy must allow sts:AssumeRole from arn:aws:iam::536697249728:role/openrouter-broadcast-exporter and require the external ID below, and its permissions must allow s3:PutObject on the bucket and prefix (plus kms:GenerateDataKey for SSE-KMS buckets).' + pattern: '^arn:aws(?:-[a-z]+)*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$' type: 'string' + visibleWhen: + - field: 'provider' + in: + - 'aws' + - field: 'authMode' + in: + - 'iam_role' secretAccessKey: minLength: 1 type: 'string' + visibleWhen: + - field: 'authMode' + in: + - 'access_keys' + - '' sessionToken: type: 'string' + visibleWhen: + - field: 'authMode' + in: + - 'access_keys' + - '' required: - 'bucketName' - - 'accessKeyId' - - 'secretAccessKey' type: 'object' created_at: description: 'ISO timestamp of when the destination was created.' diff --git a/.speakeasy/workflow.lock b/.speakeasy/workflow.lock index 36bfdff5e..21accfcb3 100644 --- a/.speakeasy/workflow.lock +++ b/.speakeasy/workflow.lock @@ -2,8 +2,8 @@ speakeasyVersion: 1.802.0 sources: OpenRouter API: sourceNamespace: open-router-chat-completions-api - sourceRevisionDigest: sha256:c144bf76df910b59591bbe058062e0b0002848a64215a34c051c673bc9719b48 - sourceBlobDigest: sha256:0226b4622016bfe0b06eff18076148e3ef1fcbab905b9c75ae920debd61bb692 + sourceRevisionDigest: sha256:c1365d4138116d2de3f81f9967f420cf1d40cd1b90008d9685c42d6a8fdf177c + sourceBlobDigest: sha256:85edf155c7204253bc117081802876fddb8570eb58b2db20523107d457c29691 tags: - latest - 1.0.0 @@ -11,10 +11,10 @@ targets: openrouter: source: OpenRouter API sourceNamespace: open-router-chat-completions-api - sourceRevisionDigest: sha256:c144bf76df910b59591bbe058062e0b0002848a64215a34c051c673bc9719b48 - sourceBlobDigest: sha256:0226b4622016bfe0b06eff18076148e3ef1fcbab905b9c75ae920debd61bb692 + sourceRevisionDigest: sha256:c1365d4138116d2de3f81f9967f420cf1d40cd1b90008d9685c42d6a8fdf177c + sourceBlobDigest: sha256:85edf155c7204253bc117081802876fddb8570eb58b2db20523107d457c29691 codeSamplesNamespace: open-router-chat-completions-api-typescript-code-samples - codeSamplesRevisionDigest: sha256:d7e2ef24a2f9f739a3b52cc1bbbfa5762e69ee2159ec3ce8decff23fb6187f41 + codeSamplesRevisionDigest: sha256:3d79992e18920d7960890d23a24e7746ca0b0bb9f35fa42e505f302514185396 workflow: workflowVersion: 1.0.0 speakeasyVersion: 1.802.0 diff --git a/RELEASES.md b/RELEASES.md index 0848a29da..1241c62e7 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -4476,4 +4476,14 @@ Based on: ### Generated - [typescript v1.5.9] . ### Releases -- [NPM v1.5.9] https://www.npmjs.com/package/@openrouter/sdk/v/1.5.9 - . \ No newline at end of file +- [NPM v1.5.9] https://www.npmjs.com/package/@openrouter/sdk/v/1.5.9 - . + +## 2026-10-27 00:13:19 +### Changes +Based on: +- OpenAPI Doc +- Speakeasy CLI 1.802.0 (2.948.4) https://github.com/speakeasy-api/speakeasy +### Generated +- [typescript v1.5.10] . +### Releases +- [NPM v1.5.10] https://www.npmjs.com/package/@openrouter/sdk/v/1.5.10 - . \ No newline at end of file diff --git a/docs/models/authmode.mdx b/docs/models/authmode.mdx new file mode 100644 index 000000000..2b55b6aef --- /dev/null +++ b/docs/models/authmode.mdx @@ -0,0 +1,21 @@ +--- +title: "AuthMode" +--- + +IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don't share long-lived keys. + +## Example Usage + +```typescript +import { AuthMode } from "@openrouter/sdk/models"; + +let value: AuthMode = "access_keys"; + +// Open enum: unrecognized values are captured as Unrecognized +``` + +## Values + +```typescript +"access_keys" | "iam_role" | Unrecognized +``` \ No newline at end of file diff --git a/docs/models/observabilitydestination.mdx b/docs/models/observabilitydestination.mdx index c9bf64bed..537707557 100644 --- a/docs/models/observabilitydestination.mdx +++ b/docs/models/observabilitydestination.mdx @@ -365,9 +365,7 @@ const value: models.ObservabilityS3Destination = { broadcastGenerationIdentity: false, broadcastGenerationRequestContext: false, config: { - accessKeyId: "", bucketName: "", - secretAccessKey: "", }, createdAt: "2025-08-24T10:30:00Z", enabled: true, diff --git a/docs/models/observabilitys3destination.mdx b/docs/models/observabilitys3destination.mdx index 148c06bff..1c46f95f6 100644 --- a/docs/models/observabilitys3destination.mdx +++ b/docs/models/observabilitys3destination.mdx @@ -14,9 +14,7 @@ let value: ObservabilityS3Destination = { broadcastGenerationIdentity: false, broadcastGenerationRequestContext: false, config: { - accessKeyId: "", bucketName: "", - secretAccessKey: "", }, createdAt: "2025-08-24T10:30:00Z", enabled: true, diff --git a/docs/models/observabilitys3destinationconfig.mdx b/docs/models/observabilitys3destinationconfig.mdx index 522c7ce8d..473353912 100644 --- a/docs/models/observabilitys3destinationconfig.mdx +++ b/docs/models/observabilitys3destinationconfig.mdx @@ -8,22 +8,24 @@ title: "ObservabilityS3DestinationConfig" import { ObservabilityS3DestinationConfig } from "@openrouter/sdk/models"; let value: ObservabilityS3DestinationConfig = { - accessKeyId: "", bucketName: "", - secretAccessKey: "", }; ``` ## Fields -| Field | Type | Required | Description | -| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `accessKeyId` | *string* | ✔️ | N/A | -| `bucketName` | *string* | ✔️ | N/A | -| `endpoint` | *string* | ➖ | Only for S3-compatible services like Cloudflare R2 (https://account-id.r2.cloudflarestorage.com) or MinIO. Leave blank for standard AWS S3. | -| `headers` | Record\ | ➖ | Custom HTTP headers to include in requests to this destination. | -| `pathTemplate` | *string* | ➖ | Template for S3 object path. The filename (\{traceId}-\{timestamp}.json) is automatically appended. Available variables: \{prefix}, \{date}, \{year}, \{month}, \{day}, \{apiKeyName} | -| `prefix` | *string* | ➖ | N/A | -| `region` | *string* | ➖ | N/A | -| `secretAccessKey` | *string* | ✔️ | N/A | -| `sessionToken` | *string* | ➖ | N/A | \ No newline at end of file +| Field | Type | Required | Description | +| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `accessKeyId` | *string* | ➖ | N/A | +| `authMode` | [models.AuthMode](../models/authmode.mdx) | ➖ | IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don't share long-lived keys. | +| `bucketName` | *string* | ✔️ | N/A | +| `endpoint` | *string* | ➖ | Only for S3-compatible services like Cloudflare R2 (https://account-id.r2.cloudflarestorage.com) or MinIO. Leave blank for standard AWS S3. | +| `externalId` | *string* | ➖ | Generated by OpenRouter when you save. Require it as sts:ExternalId in your role's trust policy. | +| `headers` | Record\ | ➖ | Custom HTTP headers to include in requests to this destination. | +| `pathTemplate` | *string* | ➖ | Template for S3 object path. The filename (\{traceId}-\{timestamp}.json) is automatically appended. Available variables: \{prefix}, \{date}, \{year}, \{month}, \{day}, \{apiKeyName} | +| `prefix` | *string* | ➖ | N/A | +| `provider` | [models.ProviderEnum](../models/providerenum.mdx) | ➖ | The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys. | +| `region` | *string* | ➖ | Required for IAM role authentication. With access keys, AWS S3 detects the bucket region when you leave this blank. | +| `roleArn` | *string* | ➖ | The IAM role in your account that OpenRouter assumes. Its trust policy must allow sts:AssumeRole from arn:aws:iam::536697249728:role/openrouter-broadcast-exporter and require the external ID below, and its permissions must allow s3:PutObject on the bucket and prefix (plus kms:GenerateDataKey for SSE-KMS buckets). | +| `secretAccessKey` | *string* | ➖ | N/A | +| `sessionToken` | *string* | ➖ | N/A | \ No newline at end of file diff --git a/docs/models/providerenum.mdx b/docs/models/providerenum.mdx new file mode 100644 index 000000000..fbeccb448 --- /dev/null +++ b/docs/models/providerenum.mdx @@ -0,0 +1,21 @@ +--- +title: "ProviderEnum" +--- + +The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys. + +## Example Usage + +```typescript +import { ProviderEnum } from "@openrouter/sdk/models"; + +let value: ProviderEnum = "aws"; + +// Open enum: unrecognized values are captured as Unrecognized +``` + +## Values + +```typescript +"aws" | "cloudflare_r2" | "gcs" | "other" | Unrecognized +``` \ No newline at end of file diff --git a/jsr.json b/jsr.json index 3a6bb460b..a03cbf084 100644 --- a/jsr.json +++ b/jsr.json @@ -2,7 +2,7 @@ { "name": "@openrouter/sdk", - "version": "1.5.9", + "version": "1.5.10", "exports": { ".": "./src/index.ts", "./models/errors": "./src/models/errors/index.ts", diff --git a/package.json b/package.json index b94bbd7fe..b33166d0c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@openrouter/sdk", - "version": "1.5.9", + "version": "1.5.10", "author": "OpenRouter", "description": "The OpenRouter TypeScript SDK is a type-safe toolkit for building AI applications with access to 400+ language models through a unified API.", "keywords": [ @@ -73,15 +73,15 @@ "lint": "eslint --cache --max-warnings=0 src", "build": "tsc && node scripts/unbarrel-imports.js", "prepublishOnly": "npm run build", + "compile": "tsc && node scripts/unbarrel-imports.js", + "postinstall": "node scripts/check-types.js || true", + "prepare": "npm run build", + "test": "vitest --run --project unit", "test:e2e": "vitest --run --project e2e", "test:transit": "exit 0", "test:watch": "vitest --watch --project unit", "typecheck": "tsc --noEmit", - "typecheck:transit": "exit 0", - "compile": "tsc && node scripts/unbarrel-imports.js", - "postinstall": "node scripts/check-types.js || true", - "prepare": "npm run build", - "test": "vitest --run --project unit" + "typecheck:transit": "exit 0" }, "peerDependencies": { diff --git a/src/lib/config.ts b/src/lib/config.ts index 3d2a7a4a4..cc5e65499 100644 --- a/src/lib/config.ts +++ b/src/lib/config.ts @@ -79,7 +79,7 @@ export function serverURLFromOptions(options: SDKOptions): URL | null { export const SDK_METADATA = { language: "typescript", openapiDocVersion: "1.0.0", - sdkVersion: "1.5.9", + sdkVersion: "1.5.10", genVersion: "2.948.4", - userAgent: "speakeasy-sdk/typescript 1.5.9 2.948.4 1.0.0 @openrouter/sdk", + userAgent: "speakeasy-sdk/typescript 1.5.10 2.948.4 1.0.0 @openrouter/sdk", } as const; diff --git a/src/models/observabilitys3destination.ts b/src/models/observabilitys3destination.ts index 57fd3f43e..38c0ff539 100644 --- a/src/models/observabilitys3destination.ts +++ b/src/models/observabilitys3destination.ts @@ -6,6 +6,8 @@ import * as z from "zod/v4"; import { remap as remap$ } from "../lib/primitives.js"; import { safeParse } from "../lib/schemas.js"; +import * as openEnums from "../types/enums.js"; +import { OpenEnum } from "../types/enums.js"; import { Result as SafeParseResult } from "../types/fp.js"; import { SDKValidationError } from "./errors/sdkvalidationerror.js"; import { @@ -17,13 +19,47 @@ import { ObservabilityFilterRulesConfig$inboundSchema, } from "./observabilityfilterrulesconfig.js"; +/** + * IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don't share long-lived keys. + */ +export const AuthMode = { + AccessKeys: "access_keys", + IamRole: "iam_role", +} as const; +/** + * IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don't share long-lived keys. + */ +export type AuthMode = OpenEnum; + +/** + * The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys. + */ +export const ProviderEnum = { + Aws: "aws", + CloudflareR2: "cloudflare_r2", + Gcs: "gcs", + Other: "other", +} as const; +/** + * The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys. + */ +export type ProviderEnum = OpenEnum; + export type ObservabilityS3DestinationConfig = { - accessKeyId: string; + accessKeyId?: string | undefined; + /** + * IAM role: OpenRouter assumes a role in your AWS account with short-lived STS credentials, so you don't share long-lived keys. + */ + authMode: AuthMode; bucketName: string; /** * Only for S3-compatible services like Cloudflare R2 (https://account-id.r2.cloudflarestorage.com) or MinIO. Leave blank for standard AWS S3. */ endpoint?: string | undefined; + /** + * Generated by OpenRouter when you save. Require it as sts:ExternalId in your role's trust policy. + */ + externalId?: string | undefined; /** * Custom HTTP headers to include in requests to this destination. */ @@ -33,8 +69,19 @@ export type ObservabilityS3DestinationConfig = { */ pathTemplate: string; prefix: string; + /** + * The object storage service that hosts the bucket. AWS S3 supports IAM role authentication; the other providers use access keys. + */ + provider?: ProviderEnum | undefined; + /** + * Required for IAM role authentication. With access keys, AWS S3 detects the bucket region when you leave this blank. + */ region?: string | undefined; - secretAccessKey: string; + /** + * The IAM role in your account that OpenRouter assumes. Its trust policy must allow sts:AssumeRole from arn:aws:iam::536697249728:role/openrouter-broadcast-exporter and require the external ID below, and its permissions must allow s3:PutObject on the bucket and prefix (plus kms:GenerateDataKey for SSE-KMS buckets). + */ + roleArn?: string | undefined; + secretAccessKey?: string | undefined; sessionToken?: string | undefined; }; @@ -103,19 +150,31 @@ export type ObservabilityS3Destination = { workspaceId: string; }; +/** @internal */ +export const AuthMode$inboundSchema: z.ZodType = openEnums + .inboundSchema(AuthMode); + +/** @internal */ +export const ProviderEnum$inboundSchema: z.ZodType = + openEnums.inboundSchema(ProviderEnum); + /** @internal */ export const ObservabilityS3DestinationConfig$inboundSchema: z.ZodType< ObservabilityS3DestinationConfig, unknown > = z.object({ - accessKeyId: z.string(), + accessKeyId: z.string().optional(), + authMode: AuthMode$inboundSchema.default("access_keys"), bucketName: z.string(), endpoint: z.string().optional(), + externalId: z.string().optional(), headers: z.record(z.string(), z.string()).optional(), pathTemplate: z.string().default("{prefix}/{date}"), prefix: z.string().default("openrouter-traces"), + provider: ProviderEnum$inboundSchema.optional(), region: z.string().optional(), - secretAccessKey: z.string(), + roleArn: z.string().optional(), + secretAccessKey: z.string().optional(), sessionToken: z.string().optional(), });