Retracted: v1.832.18 seals the SECRET MASK as a provider key.
It carries sealPastedKey without the guard that recognises object.SecretMask
("***"), which is what the admin API returns for a stored secret and therefore
what the console posts back when an operator saves a provider form WITHOUT
touching the key field. On that save the literal "***" is sealed into KMS under
the provider's own secret name, and because resolution is KMS-first the store
then answers "***" for every subsequent read — outranking the environment
variable that was serving the real key. The provider stops authenticating
upstream, and the row looks correct while it does.
Fixed in the next release. Nothing shipped this version: cloud was pinned to
v1.832.10 throughout.
Documentation
¶
Overview ¶
Command openapi renders the resource surface into the canonical spec.
go run ./cmd/openapi -spec ../openapi/ai/openapi.yaml # write go run ./cmd/openapi -spec ../openapi/ai/openapi.yaml -verify # check only
The canonical spec (hanzoai/openapi, OpenAPI 3.1, "v1.0.0 locked in") is the published contract every SDK and the docs site are generated from. The resource half of it is DERIVED from routers/resources.go — the same table that registers the routes — so the contract cannot describe a surface the service does not serve. That is the failure this replaces: the repo's swagger.json still documents `/api/<verb>-<noun>`, a base path nothing has ever served.
Only the region between the generated markers is touched. The inference paths above it are hand-authored with real request/response schemas and stay that way: they are ten stable endpoints whose bodies are the OpenAI wire format, not something a table can know. Generation is for the part that repeats.
Source Files