@composio/client 2.0.0-rc.5 → 2.0.0-rc.6

package/README.md

@@ -26,8 +26,9 @@ const composio = Composio.fromEnv(config, { environment: 'staging' })
 ```
 
 `fromEnv` recognizes `COMPOSIO_API_KEY`, `COMPOSIO_USER_API_KEY`, `COMPOSIO_ORG_API_KEY`,
-`COMPOSIO_BASE_URL`, `COMPOSIO_CUSTOM_HEADERS`, and `COMPOSIO_LOG`. Derived clients created with
-`withOptions()` keep using the resolved snapshot and do not fall back to ambient values.
+`COMPOSIO_BASE_URL`, `COMPOSIO_ALLOW_INSECURE_HTTP`, `COMPOSIO_CUSTOM_HEADERS`, and
+`COMPOSIO_LOG`. Derived clients created with `withOptions()` keep using the resolved snapshot and do
+not fall back to ambient values.
 
 Inject a `Transport` when an application or test needs to own HTTP dispatch. The transport receives
 a complete `Request`; retries, credential-safe redirects, timeouts, and response parsing stay in the
@@ -43,6 +44,31 @@ const composio = new Composio({ apiKey, transport })
 Existing `fetch` and `fetchOptions` constructor options remain supported. They cannot be combined
 with `transport` because a request can have only one HTTP dispatcher.
 
+## Upgrade from Stainless 0.1.x to 2.0
+
+By default, the 2.0 client refuses to send credentials over plain HTTP unless the hostname is
+loopback. For a trusted development backend such as Docker's host gateway, opt in to the exact
+configured origin:
+
+```ts
+const composio = new Composio({
+  apiKey,
+  baseURL: 'http://host.docker.internal:9900',
+  allowInsecureHTTP: true,
+})
+```
+
+The equivalent environment configuration is:
+
+```sh
+COMPOSIO_BASE_URL=http://host.docker.internal:9900 \
+COMPOSIO_ALLOW_INSECURE_HTTP=1
+```
+
+The opt-in records the resolved scheme, hostname, and port. Mutating `baseURL` cannot broaden it,
+and `withOptions({ baseURL: ... })` requires `allowInsecureHTTP: true` again when the origin
+changes. Redirects to another origin remain credential-free.
+
 ## Development
 
 Toolchain is pinned via [mise](https://mise.jdx.dev) (`mise install`): Node 24, pnpm 11, Python 3.13, uv. ESM-only, TypeScript 7 (native compiler for typechecking, `typescript@6` retained for tooling until 7.1 restores the compiler API).

package/dist/{api-key-revocation-qTsznJmF.mjs → api-key-revocation-CSNyQo6m.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/api-key-revocation.ts
 const OP_CREATE = generatedOperation("apiKeyRevocation.create");

package/dist/{auth-Dw30Hpb_.mjs → auth-BpeKOtkr.mjs}

@@ -1,4 +1,4 @@
-import { t as Session } from "./session-CJLfSQti.mjs";
+import { t as Session } from "./session-Byj-qri0.mjs";
 
 //#region src/compat/resources/auth/auth.ts
 /**

package/dist/{auth-configs-B0IbEao2.mjs → auth-configs-DAS68quO.mjs}

@@ -1,4 +1,4 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/auth-configs.ts
 const OP_CREATE = generatedOperation("authConfigs.create");

package/dist/{clanker-BJNgPfZ2.mjs → clanker-CdTX3VrN.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/org/clanker.ts
 const OP_CREATE_CLAIM = generatedOperation("org.clanker.createClaim");

package/dist/{cli-CUWplx80.mjs → cli-BwAcGYUv.mjs}

@@ -1,5 +1,5 @@
-import { c as withOperation, f as mergeHeaders, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
-import { t as Realtime } from "./realtime-D7OslBiN.mjs";
+import { c as withOperation, n as generatedOperation, p as mergeHeaders } from "./generated-operations-BQO2JR1q.mjs";
+import { t as Realtime } from "./realtime-CtLFFEf8.mjs";
 
 //#region src/compat/resources/cli/cli.ts
 const OP_CREATE_CODACT_FAILURE = generatedOperation("cli.createCodactFailure");

package/dist/{client-CtqZaY-5.d.mts → client-Cu0FrKmX.d.mts}

@@ -22711,6 +22711,14 @@ interface ClientOptions {
   environment?: Environment | undefined;
   /** Override the base URL. Defaults to `process.env['COMPOSIO_BASE_URL']`. */
   baseURL?: string | null | undefined;
+  /**
+   * Allows credentials to be sent to this client's configured plain-HTTP
+   * origin. The permission is limited to the resolved scheme, host, and port.
+   *
+   * Not part of the Stainless surface: a sanctioned security superset.
+   * Defaults to `process.env['COMPOSIO_ALLOW_INSECURE_HTTP'] === '1'`.
+   */
+  allowInsecureHTTP?: boolean | undefined;
   /** Per-request time budget in milliseconds (each retry attempt gets its own). */
   timeout?: number | undefined;
   /** Additional `RequestInit` options merged into every `fetch` call. */

package/dist/{connected-accounts-hwz_Ahf8.mjs → connected-accounts-Bri1c8_y.mjs}

@@ -1,4 +1,4 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/connected-accounts.ts
 const OP_CREATE = generatedOperation("connectedAccounts.create");

package/dist/{consumer-BX9lVqTG.mjs → consumer-C-Sr8ilJ.mjs}

@@ -1,5 +1,5 @@
-import { c as withOperation, f as mergeHeaders, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
-import { t as Project } from "./project-BrbKVCdG.mjs";
+import { c as withOperation, n as generatedOperation, p as mergeHeaders } from "./generated-operations-BQO2JR1q.mjs";
+import { t as Project } from "./project-D0caI7O8.mjs";
 
 //#region src/compat/resources/org/consumer/consumer.ts
 const OP_LIST_CONNECTED_TOOLKITS = generatedOperation("org.consumer.listConnectedToolkits");

package/dist/{custom-tBFB6wwF.mjs → custom-CZ41HKuF.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/mcp/custom.ts
 const OP_CREATE = generatedOperation("mcp.custom.create");

package/dist/{files-vyDo0NH0.mjs → files-Bw-q9jvQ.mjs}

@@ -1,4 +1,4 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/tool-router/session/files.ts
 const OP_LIST = generatedOperation("toolRouter.session.files.list");

package/dist/{files-Blm1q37V.mjs → files-nKAca7MP.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/files.ts
 const OP_LIST = generatedOperation("files.list");

package/dist/{generate-DnzpeBp5.mjs → generate-22I_8m4Q.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/mcp/generate.ts
 const OP_URL = generatedOperation("mcp.generate.url");

package/dist/{generated-operations-DEPr4e2f.mjs → generated-operations-BQO2JR1q.mjs}

@@ -158,8 +158,9 @@ const buildHeaders = (sources) => mergeHeaders(sources).values;
 *    decides which one that is. See wayfinder ticket 48 and §4 of
 *    `docs/research/drop-in-contract.md`.
 * 1. **A credentialed API origin must use HTTPS.** Plain `http:` is permitted
-*    only for loopback development endpoints — which is exactly what the
-*    sanctioned `environment: 'local'` default (`http://localhost:9900`) is.
+*    only for loopback development endpoints, or for the exact origin a
+*    caller opts into with `allowInsecureHTTP` or
+*    `COMPOSIO_ALLOW_INSECURE_HTTP=1`.
 *    Enforced by {@link assertCredentialTransport} at construction and again
 *    by {@link credentialForRequest} at dispatch, because `apiKey` and
 *    `baseURL` are both public mutable fields on the client.
@@ -340,9 +341,9 @@ const resolveHTTPURL = (target, base) => {
 	}
 };
 /** Whether a credential may be sent to this origin at all. */
-const isCredentialSafeOrigin = (url) => url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
+const isCredentialSafeOrigin = (url, allowedHTTPOrigin = null) => url.protocol === "https:" || url.protocol === "http:" && (isLoopbackHostname(url.hostname) || allowedHTTPOrigin !== null && url.origin === allowedHTTPOrigin);
 const LOOPBACK_DESCRIPTION = "localhost, *.localhost, 127.0.0.0/8, [::1]";
-const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. Plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// baseURL, use environment: 'local', or construct the client without credentials.`;
+const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. By default, plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// baseURL, use environment: 'local', set allowInsecureHTTP: true (or COMPOSIO_ALLOW_INSECURE_HTTP=1) for the configured development origin, or construct the client without credentials.`;
 /** Whether the client holds anything at all that rule 1 has to protect. */
 const anyCredential = (credentials) => credentials.apiKey !== null || hasAlternateCredential(credentials);
 /**
@@ -358,10 +359,10 @@ const anyCredential = (credentials) => credentials.apiKey !== null || hasAlterna
 * request carries is decided per operation, so a client holding *any* of them
 * is a client that can put one on the wire.
 */
-const assertCredentialTransport = (baseURL, credentials) => {
+const assertCredentialTransport = (baseURL, credentials, allowedHTTPOrigin = null) => {
 	if (!anyCredential(credentials)) return;
 	const url = parseHTTPURL(baseURL);
-	if (url === null || !isCredentialSafeOrigin(url)) throw new ComposioError(insecureOriginMessage(baseURL));
+	if (url === null || !isCredentialSafeOrigin(url, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
 };
 /**
 * The credential this request may carry, or `null` for none.
@@ -381,14 +382,14 @@ const assertCredentialTransport = (baseURL, credentials) => {
 * with credentials, so that one dies at the transport instead. httpx has no
 * such objection, which is why the Python port checks the same thing.)
 */
-const credentialForRequest = (baseURL, scheme, credentials, requestURL) => {
+const credentialForRequest = (baseURL, scheme, credentials, requestURL, allowedHTTPOrigin = null) => {
 	const value = valueFor(scheme, credentials);
 	if (value === null) return null;
 	const base = parseHTTPURL(baseURL);
 	const target = parseHTTPURL(requestURL);
 	if (base === null || target === null) return null;
 	if (base.origin !== target.origin) return null;
-	if (!isCredentialSafeOrigin(target)) throw new ComposioError(insecureOriginMessage(baseURL));
+	if (!isCredentialSafeOrigin(target, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
 	return {
 		name: SCHEME_HEADERS[scheme],
 		value
@@ -1277,7 +1278,7 @@ const kernelInternals = { sleep };
 * chose and are dropped once the *server* has chosen one.
 */
 const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, scheme, callerPlaced) => {
-	const credential = withdrawn || callerPlaced ? null : credentialForRequest(config.baseURL, scheme, config.credentials, requestURL);
+	const credential = withdrawn || callerPlaced ? null : credentialForRequest(config.baseURL, scheme, config.credentials, requestURL, config.allowedHTTPOrigin);
 	if (!withdrawn && bodyHeaders === void 0 && !config.defaultHeaders && !options.headers) {
 		const direct = new Headers({
 			accept: "application/json",
@@ -2272,4 +2273,4 @@ const generatedOperation = (chainKey) => {
 };
 
 //#endregion
-export { PermissionDeniedError as C, NotFoundError as S, UnprocessableEntityError as T, AuthenticationError as _, path as a, ConflictError as b, withOperation as c, assertCredentialTransport as d, mergeHeaders as f, APIUserAbortError as g, APIError as h, makeRequest as i, inspectDeprecatedInputs as l, APIConnectionTimeoutError as m, generatedOperation as n, readOperation as o, APIConnectionError as p, castToError as r, safeJSON as s, GENERATED_OPERATIONS as t, inspectDeprecation as u, BadRequestError as v, RateLimitError as w, InternalServerError as x, ComposioError as y };
+export { NotFoundError as C, UnprocessableEntityError as E, InternalServerError as S, RateLimitError as T, APIUserAbortError as _, path as a, ComposioError as b, withOperation as c, assertCredentialTransport as d, parseHTTPURL as f, APIError as g, APIConnectionTimeoutError as h, makeRequest as i, inspectDeprecatedInputs as l, APIConnectionError as m, generatedOperation as n, readOperation as o, mergeHeaders as p, castToError as r, safeJSON as s, GENERATED_OPERATIONS as t, inspectDeprecation as u, AuthenticationError as v, PermissionDeniedError as w, ConflictError as x, BadRequestError as y };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { $r as FileListParams, Ar as SessionExecuteMetaParams, Br as SessionRetrieveResponse, Cr as SessionAttachParams, Dr as SessionCreateParams, Er as SessionConfigHistoryResponse, Fr as SessionLinkResponse, Gr as SessionToolsParams, Hr as SessionSearchResponse, Ir as SessionPatchParams, Jr as FileCreateDownloadURLResponse, Kr as SessionToolsResponse, Lr as SessionPatchResponse, Mr as SessionExecuteParams, Nr as SessionExecuteResponse, Or as SessionCreateResponse, Pr as SessionLinkParams, Qr as FileDeleteResponse, Rr as SessionProxyExecuteParams, Sr as Session, Tr as SessionConfigHistoryParams, Ur as SessionToolkitsParams, Vr as SessionSearchParams, Wr as SessionToolkitsResponse, Xr as FileCreateUploadURLResponse, Yr as FileCreateUploadURLParams, Zr as FileDeleteParams, _i as RateLimitError, a as Logger, ai as createFetchTransport, ci as APIError, di as BadRequestError, ei as FileListResponse, fi as ComposioError, gi as PermissionDeniedError, hi as NotFoundError, i as LogLevel, ii as Transport, jr as SessionExecuteMetaResponse, kr as SessionDeleteResponse, li as APIUserAbortError, mi as InternalServerError, n as Composio, ni as RequestOptions, oi as APIConnectionError, pi as ConflictError, qr as FileCreateDownloadURLParams, r as EnvironmentMap, ri as FetchTransportDefaults, si as APIConnectionTimeoutError, t as ClientOptions, ti as Files, ui as AuthenticationError, vi as UnprocessableEntityError, wr as SessionAttachResponse, xr as ToolRouter, yi as APIPromise, zr as SessionProxyExecuteResponse } from "./client-CtqZaY-5.mjs";
+import { $r as FileListParams, Ar as SessionExecuteMetaParams, Br as SessionRetrieveResponse, Cr as SessionAttachParams, Dr as SessionCreateParams, Er as SessionConfigHistoryResponse, Fr as SessionLinkResponse, Gr as SessionToolsParams, Hr as SessionSearchResponse, Ir as SessionPatchParams, Jr as FileCreateDownloadURLResponse, Kr as SessionToolsResponse, Lr as SessionPatchResponse, Mr as SessionExecuteParams, Nr as SessionExecuteResponse, Or as SessionCreateResponse, Pr as SessionLinkParams, Qr as FileDeleteResponse, Rr as SessionProxyExecuteParams, Sr as Session, Tr as SessionConfigHistoryParams, Ur as SessionToolkitsParams, Vr as SessionSearchParams, Wr as SessionToolkitsResponse, Xr as FileCreateUploadURLResponse, Yr as FileCreateUploadURLParams, Zr as FileDeleteParams, _i as RateLimitError, a as Logger, ai as createFetchTransport, ci as APIError, di as BadRequestError, ei as FileListResponse, fi as ComposioError, gi as PermissionDeniedError, hi as NotFoundError, i as LogLevel, ii as Transport, jr as SessionExecuteMetaResponse, kr as SessionDeleteResponse, li as APIUserAbortError, mi as InternalServerError, n as Composio, ni as RequestOptions, oi as APIConnectionError, pi as ConflictError, qr as FileCreateDownloadURLParams, r as EnvironmentMap, ri as FetchTransportDefaults, si as APIConnectionTimeoutError, t as ClientOptions, ti as Files, ui as AuthenticationError, vi as UnprocessableEntityError, wr as SessionAttachResponse, xr as ToolRouter, yi as APIPromise, zr as SessionProxyExecuteResponse } from "./client-Cu0FrKmX.mjs";
 //#region src/version.d.ts
-declare const VERSION = "2.0.0-rc.5";
+declare const VERSION = "2.0.0-rc.6";
 //#endregion
 export { APIConnectionError, APIConnectionTimeoutError, APIError, APIPromise, APIUserAbortError, AuthenticationError, BadRequestError, type ClientOptions, Composio, Composio as default, ComposioError, ConflictError, type EnvironmentMap, type FetchTransportDefaults, type FileCreateDownloadURLParams, type FileCreateDownloadURLResponse, type FileCreateUploadURLParams, type FileCreateUploadURLResponse, type FileDeleteParams, type FileDeleteResponse, type FileListParams, type FileListResponse, Files, InternalServerError, type LogLevel, type Logger, NotFoundError, PermissionDeniedError, RateLimitError, type RequestOptions, Session, type SessionAttachParams, type SessionAttachResponse, type SessionConfigHistoryParams, type SessionConfigHistoryResponse, type SessionCreateParams, type SessionCreateResponse, type SessionDeleteResponse, type SessionExecuteMetaParams, type SessionExecuteMetaResponse, type SessionExecuteParams, type SessionExecuteResponse, type SessionLinkParams, type SessionLinkResponse, type SessionPatchParams, type SessionPatchResponse, type SessionProxyExecuteParams, type SessionProxyExecuteResponse, type SessionRetrieveResponse, type SessionSearchParams, type SessionSearchResponse, type SessionToolkitsParams, type SessionToolkitsResponse, type SessionToolsParams, type SessionToolsResponse, ToolRouter, type Transport, UnprocessableEntityError, VERSION, createFetchTransport };

package/dist/index.mjs

@@ -1,25 +1,25 @@
-import { C as PermissionDeniedError, S as NotFoundError, T as UnprocessableEntityError, _ as AuthenticationError, b as ConflictError, d as assertCredentialTransport, f as mergeHeaders, g as APIUserAbortError, h as APIError, i as makeRequest, l as inspectDeprecatedInputs, m as APIConnectionTimeoutError, o as readOperation, p as APIConnectionError, r as castToError, s as safeJSON, t as GENERATED_OPERATIONS, u as inspectDeprecation, v as BadRequestError, w as RateLimitError, x as InternalServerError, y as ComposioError } from "./generated-operations-DEPr4e2f.mjs";
-import { t as ApiKeyRevocation } from "./api-key-revocation-qTsznJmF.mjs";
-import { t as AuthConfigs } from "./auth-configs-B0IbEao2.mjs";
-import { t as Auth } from "./auth-Dw30Hpb_.mjs";
-import { t as Cli } from "./cli-CUWplx80.mjs";
-import { t as ConnectedAccounts } from "./connected-accounts-hwz_Ahf8.mjs";
-import { t as Files$1 } from "./files-Blm1q37V.mjs";
-import { t as Link } from "./link-UHD4M7zo.mjs";
-import { t as Logs } from "./logs-B61ufb_6.mjs";
-import { t as Mcp } from "./mcp-C9IT8Cpv.mjs";
+import { C as NotFoundError, E as UnprocessableEntityError, S as InternalServerError, T as RateLimitError, _ as APIUserAbortError, b as ComposioError, d as assertCredentialTransport, f as parseHTTPURL, g as APIError, h as APIConnectionTimeoutError, i as makeRequest, l as inspectDeprecatedInputs, m as APIConnectionError, o as readOperation, p as mergeHeaders, r as castToError, s as safeJSON, t as GENERATED_OPERATIONS, u as inspectDeprecation, v as AuthenticationError, w as PermissionDeniedError, x as ConflictError, y as BadRequestError } from "./generated-operations-BQO2JR1q.mjs";
+import { t as ApiKeyRevocation } from "./api-key-revocation-CSNyQo6m.mjs";
+import { t as AuthConfigs } from "./auth-configs-DAS68quO.mjs";
+import { t as Auth } from "./auth-BpeKOtkr.mjs";
+import { t as Cli } from "./cli-BwAcGYUv.mjs";
+import { t as ConnectedAccounts } from "./connected-accounts-Bri1c8_y.mjs";
+import { t as Files$1 } from "./files-nKAca7MP.mjs";
+import { t as Link } from "./link-D68LLK4Z.mjs";
+import { t as Logs } from "./logs-D51p26Kb.mjs";
+import { t as Mcp } from "./mcp-YTLiywS3.mjs";
 import { t as Migration } from "./migration-CBhnoN-Y.mjs";
-import { t as Org } from "./org-Bj5m1nn8.mjs";
-import { t as Project } from "./project-84ETQ8s3.mjs";
-import { t as Files } from "./files-vyDo0NH0.mjs";
-import { t as Session } from "./session-HQf03_ub.mjs";
-import { t as ToolRouter } from "./tool-router-kFw8Xqp9.mjs";
-import { t as Toolkits } from "./toolkits-wapurMFl.mjs";
-import { t as Tools } from "./tools-KN8T5BtJ.mjs";
-import { t as TriggerInstances } from "./trigger-instances-DeRL4DhM.mjs";
-import { t as TriggersTypes } from "./triggers-types-DLap3EOR.mjs";
-import { t as WebhookEndpoints } from "./webhook-endpoints-DbIlhiI-.mjs";
-import { t as WebhookSubscriptions } from "./webhook-subscriptions-CXC0oAhI.mjs";
+import { t as Org } from "./org-Cutt-dnU.mjs";
+import { t as Project } from "./project-DKhGV5KP.mjs";
+import { t as Files } from "./files-Bw-q9jvQ.mjs";
+import { t as Session } from "./session-BFEAeE9G.mjs";
+import { t as ToolRouter } from "./tool-router-CyuTk9t-.mjs";
+import { t as Toolkits } from "./toolkits-Bck41m7-.mjs";
+import { t as Tools } from "./tools-Bvbrgij6.mjs";
+import { t as TriggerInstances } from "./trigger-instances-B3oj-IJW.mjs";
+import { t as TriggersTypes } from "./triggers-types-CHJxtojA.mjs";
+import { t as WebhookEndpoints } from "./webhook-endpoints-gTzzFJ1c.mjs";
+import { t as WebhookSubscriptions } from "./webhook-subscriptions-bZFki65N.mjs";
 
 //#region src/compat/api-promise.ts
 /**
@@ -216,7 +216,7 @@ const createClientResources = (client) => ({
 
 //#endregion
 //#region src/version.ts
-const VERSION = "2.0.0-rc.5";
+const VERSION = "2.0.0-rc.6";
 
 //#endregion
 //#region src/compat/client.ts
@@ -289,6 +289,8 @@ const resolveClientOptions = (input) => {
 		apiKey,
 		userApiKey,
 		orgApiKey,
+		allowInsecureHTTP: input.allowInsecureHTTP ?? readEnvironment("COMPOSIO_ALLOW_INSECURE_HTTP") === "1",
+		allowedHTTPOrigin: input.allowedHTTPOrigin ?? null,
 		baseURL,
 		environment: input.environment ?? "production",
 		logLevel: input.logLevel ?? readEnvironment("COMPOSIO_LOG") ?? "warn"
@@ -335,11 +337,12 @@ var Composio = class Composio {
 		this.maxRetries = options.maxRetries ?? 2;
 		this.#fetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
 		this.#transport = options.transport;
+		options.allowedHTTPOrigin = options.allowInsecureHTTP ? options.allowedHTTPOrigin ?? parseHTTPURL(this.baseURL)?.origin ?? null : null;
 		this.#options = options;
 		this.apiKey = options.apiKey;
 		this.userApiKey = options.userApiKey;
 		this.orgApiKey = options.orgApiKey;
-		assertCredentialTransport(this.baseURL, this.#credentials());
+		assertCredentialTransport(this.baseURL, this.#credentials(), options.allowedHTTPOrigin);
 		Object.assign(this, createClientResources(this));
 	}
 	/**
@@ -365,7 +368,8 @@ var Composio = class Composio {
 		const transport = Object.hasOwn(options, "transport") ? options.transport : replacesTransport ? void 0 : this.#transport;
 		const fetch = transport === void 0 ? hasFetch ? options.fetch : this.#fetch : void 0;
 		const fetchOptions = transport === void 0 ? hasFetchOptions ? options.fetchOptions : this.fetchOptions : void 0;
-		const client = new this.constructor({
+		const allowedHTTPOrigin = options.allowInsecureHTTP === true ? void 0 : this.#options.allowedHTTPOrigin;
+		const derivedOptions = {
 			...this.#options,
 			environment: options.environment ? options.environment : void 0,
 			baseURL: options.environment ? void 0 : this.baseURL,
@@ -377,10 +381,12 @@ var Composio = class Composio {
 			userApiKey: this.userApiKey,
 			orgApiKey: this.orgApiKey,
 			...options,
+			allowedHTTPOrigin,
 			transport,
 			fetch,
 			fetchOptions
-		});
+		};
+		const client = new this.constructor(derivedOptions);
 		client.#deprecationSeen = this.#deprecationSeen;
 		return client;
 	}
@@ -453,6 +459,7 @@ var Composio = class Composio {
 		return {
 			baseURL: this.baseURL,
 			credentials: this.#credentials(),
+			allowedHTTPOrigin: this.#options.allowedHTTPOrigin,
 			operations: GENERATED_OPERATIONS,
 			maxRetries: this.maxRetries,
 			timeout: this.timeout,

package/dist/{link-UHD4M7zo.mjs → link-D68LLK4Z.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/link.ts
 const OP_CREATE = generatedOperation("link.create");

package/dist/{logs-B61ufb_6.mjs → logs-D51p26Kb.mjs}

@@ -1,6 +1,6 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
-import { t as Triggers } from "./triggers-DZWXfIwq.mjs";
-import { t as Tools } from "./tools-BmHuPUvd.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
+import { t as Triggers } from "./triggers-CirhOG03.mjs";
+import { t as Tools } from "./tools-D8kKy_iy.mjs";
 
 //#region src/compat/resources/logs/logs.ts
 const OP_CREATE_TOOL_EXECUTION = generatedOperation("logs.createToolExecution");

package/dist/{manage-6ysZI9l4.mjs → manage-D8yy7vO-.mjs}

@@ -1,4 +1,4 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/trigger-instances/manage.ts
 const OP_UPDATE = generatedOperation("triggerInstances.manage.update");

package/dist/{mcp-C9IT8Cpv.mjs → mcp-YTLiywS3.mjs}

@@ -1,6 +1,6 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
-import { t as Custom } from "./custom-tBFB6wwF.mjs";
-import { t as Generate } from "./generate-DnzpeBp5.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
+import { t as Custom } from "./custom-CZ41HKuF.mjs";
+import { t as Generate } from "./generate-22I_8m4Q.mjs";
 
 //#region src/compat/resources/mcp/mcp.ts
 const OP_CREATE = generatedOperation("mcp.create");

package/dist/{org-Bj5m1nn8.mjs → org-Cutt-dnU.mjs}

@@ -1,9 +1,9 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
-import { t as Clanker } from "./clanker-BJNgPfZ2.mjs";
-import { t as Consumer } from "./consumer-BX9lVqTG.mjs";
-import { t as Owner } from "./owner-BSIXkRF0.mjs";
-import { t as Project } from "./project-BfNWC2nb.mjs";
-import { t as Usage } from "./usage-DwYx7p-o.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
+import { t as Clanker } from "./clanker-CdTX3VrN.mjs";
+import { t as Consumer } from "./consumer-C-Sr8ilJ.mjs";
+import { t as Owner } from "./owner-ZVJeAZpU.mjs";
+import { t as Project } from "./project-BObd0xOa.mjs";
+import { t as Usage } from "./usage-CD53euIq.mjs";
 
 //#region src/compat/resources/org/org.ts
 const OP_LIST = generatedOperation("org.list");

package/dist/{owner-BSIXkRF0.mjs → owner-ZVJeAZpU.mjs}

@@ -1,4 +1,4 @@
-import { t as Project } from "./project-CPmAuLg4.mjs";
+import { t as Project } from "./project-C8ZpAfnV.mjs";
 
 //#region src/compat/resources/org/owner/owner.ts
 /**

package/dist/{project-BfNWC2nb.mjs → project-BObd0xOa.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/org/project.ts
 const OP_LIST = generatedOperation("org.project.list");

package/dist/{project-CPmAuLg4.mjs → project-C8ZpAfnV.mjs}

@@ -1,4 +1,4 @@
-import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { a as path, c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/org/owner/project.ts
 const OP_CREATE = generatedOperation("org.owner.project.create");

package/dist/{project-BrbKVCdG.mjs → project-D0caI7O8.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, f as mergeHeaders, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation, p as mergeHeaders } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/org/consumer/project.ts
 const OP_RESOLVE = generatedOperation("org.consumer.project.resolve");

package/dist/{project-84ETQ8s3.mjs → project-DKhGV5KP.mjs}

@@ -1,5 +1,5 @@
 import { t as Config } from "./config-BLBbhLe1.mjs";
-import { t as Usage } from "./usage-Buq-FwCY.mjs";
+import { t as Usage } from "./usage-C5VBnFfd.mjs";
 
 //#region src/compat/resources/project/project.ts
 /**

package/dist/{realtime-D7OslBiN.mjs → realtime-CtLFFEf8.mjs}

@@ -1,4 +1,4 @@
-import { c as withOperation, n as generatedOperation } from "./generated-operations-DEPr4e2f.mjs";
+import { c as withOperation, n as generatedOperation } from "./generated-operations-BQO2JR1q.mjs";
 
 //#region src/compat/resources/cli/realtime.ts
 const OP_AUTH = generatedOperation("cli.realtime.auth");

package/dist/resources/api-key-revocation.d.mts

@@ -1,2 +1,2 @@
-import { c as ApiKeyRevocationCreateResponse, o as ApiKeyRevocation, s as ApiKeyRevocationCreateParams } from "../client-CtqZaY-5.mjs";
+import { c as ApiKeyRevocationCreateResponse, o as ApiKeyRevocation, s as ApiKeyRevocationCreateParams } from "../client-Cu0FrKmX.mjs";
 export { ApiKeyRevocation, type ApiKeyRevocationCreateParams, type ApiKeyRevocationCreateResponse };

package/dist/resources/api-key-revocation.mjs

@@ -1,3 +1,3 @@
-import { t as ApiKeyRevocation } from "../api-key-revocation-qTsznJmF.mjs";
+import { t as ApiKeyRevocation } from "../api-key-revocation-CSNyQo6m.mjs";
 
 export { ApiKeyRevocation };

package/dist/resources/auth/auth.d.mts

@@ -1,2 +1,2 @@
-import { l as Auth } from "../../client-CtqZaY-5.mjs";
+import { l as Auth } from "../../client-Cu0FrKmX.mjs";
 export { Auth };

package/dist/resources/auth/auth.mjs

@@ -1,3 +1,3 @@
-import { t as Auth } from "../../auth-Dw30Hpb_.mjs";
+import { t as Auth } from "../../auth-BpeKOtkr.mjs";
 
 export { Auth };

package/dist/resources/auth/index.d.mts

@@ -1,2 +1,2 @@
-import { d as SessionRetrieveInfoResponse, l as Auth, u as Session } from "../../client-CtqZaY-5.mjs";
+import { d as SessionRetrieveInfoResponse, l as Auth, u as Session } from "../../client-Cu0FrKmX.mjs";
 export { Auth, Session, type SessionRetrieveInfoResponse };

package/dist/resources/auth/index.mjs

@@ -1,4 +1,4 @@
-import { t as Session } from "../../session-CJLfSQti.mjs";
-import { t as Auth } from "../../auth-Dw30Hpb_.mjs";
+import { t as Session } from "../../session-Byj-qri0.mjs";
+import { t as Auth } from "../../auth-BpeKOtkr.mjs";
 
 export { Auth, Session };

package/dist/resources/auth/session.d.mts

@@ -1,2 +1,2 @@
-import { d as SessionRetrieveInfoResponse, u as Session } from "../../client-CtqZaY-5.mjs";
+import { d as SessionRetrieveInfoResponse, u as Session } from "../../client-Cu0FrKmX.mjs";
 export { Session, type SessionRetrieveInfoResponse };

package/dist/resources/auth/session.mjs

@@ -1,3 +1,3 @@
-import { t as Session } from "../../session-CJLfSQti.mjs";
+import { t as Session } from "../../session-Byj-qri0.mjs";
 
 export { Session };

package/dist/resources/auth-configs.d.mts

@@ -1,2 +1,2 @@
-import { An as AuthConfigUpdateParams, Cn as AuthConfigCreateParams, Dn as AuthConfigListParams, En as AuthConfigDeleteResponse, Mn as AuthConfigUpdateStatusParams, Nn as AuthConfigUpdateStatusResponse, On as AuthConfigListResponse, Pn as AuthConfigs, Tn as AuthConfigDeleteParams, jn as AuthConfigUpdateResponse, kn as AuthConfigRetrieveResponse, wn as AuthConfigCreateResponse } from "../client-CtqZaY-5.mjs";
+import { An as AuthConfigUpdateParams, Cn as AuthConfigCreateParams, Dn as AuthConfigListParams, En as AuthConfigDeleteResponse, Mn as AuthConfigUpdateStatusParams, Nn as AuthConfigUpdateStatusResponse, On as AuthConfigListResponse, Pn as AuthConfigs, Tn as AuthConfigDeleteParams, jn as AuthConfigUpdateResponse, kn as AuthConfigRetrieveResponse, wn as AuthConfigCreateResponse } from "../client-Cu0FrKmX.mjs";
 export { type AuthConfigCreateParams, type AuthConfigCreateResponse, type AuthConfigDeleteParams, type AuthConfigDeleteResponse, type AuthConfigListParams, type AuthConfigListResponse, type AuthConfigRetrieveResponse, type AuthConfigUpdateParams, type AuthConfigUpdateResponse, type AuthConfigUpdateStatusParams, type AuthConfigUpdateStatusResponse, AuthConfigs };

package/dist/resources/auth-configs.mjs

@@ -1,3 +1,3 @@
-import { t as AuthConfigs } from "../auth-configs-B0IbEao2.mjs";
+import { t as AuthConfigs } from "../auth-configs-DAS68quO.mjs";
 
 export { AuthConfigs };

package/dist/resources/auth.d.mts

@@ -1,2 +1,2 @@
-import { d as SessionRetrieveInfoResponse, l as Auth, u as Session } from "../client-CtqZaY-5.mjs";
+import { d as SessionRetrieveInfoResponse, l as Auth, u as Session } from "../client-Cu0FrKmX.mjs";
 export { Auth, Session, type SessionRetrieveInfoResponse };

package/dist/resources/auth.mjs

@@ -1,5 +1,5 @@
-import { t as Session } from "../session-CJLfSQti.mjs";
-import { t as Auth } from "../auth-Dw30Hpb_.mjs";
+import { t as Session } from "../session-Byj-qri0.mjs";
+import { t as Auth } from "../auth-BpeKOtkr.mjs";
 import "./auth/index.mjs";
 
 export { Auth, Session };

package/dist/resources/cli/cli.d.mts

@@ -1,2 +1,2 @@
-import { At as CliCreateCodactFailureResponse, Mt as CliCreateSessionResponse, Nt as CliGetSessionParams, Ot as Cli, Pt as CliGetSessionResponse, jt as CliCreateSessionParams, kt as CliCreateCodactFailureParams } from "../../client-CtqZaY-5.mjs";
+import { At as CliCreateCodactFailureResponse, Mt as CliCreateSessionResponse, Nt as CliGetSessionParams, Ot as Cli, Pt as CliGetSessionResponse, jt as CliCreateSessionParams, kt as CliCreateCodactFailureParams } from "../../client-Cu0FrKmX.mjs";
 export { Cli, CliCreateCodactFailureParams, CliCreateCodactFailureResponse, CliCreateSessionParams, CliCreateSessionResponse, CliGetSessionParams, CliGetSessionResponse };

package/dist/resources/cli/cli.mjs

@@ -1,3 +1,3 @@
-import { t as Cli } from "../../cli-CUWplx80.mjs";
+import { t as Cli } from "../../cli-BwAcGYUv.mjs";
 
 export { Cli };

package/dist/resources/cli/index.d.mts

@@ -1,2 +1,2 @@
-import { At as CliCreateCodactFailureResponse, Ft as Realtime, It as RealtimeAuthParams, Lt as RealtimeAuthResponse, Mt as CliCreateSessionResponse, Nt as CliGetSessionParams, Ot as Cli, Pt as CliGetSessionResponse, Rt as RealtimeCredentialsResponse, jt as CliCreateSessionParams, kt as CliCreateCodactFailureParams } from "../../client-CtqZaY-5.mjs";
+import { At as CliCreateCodactFailureResponse, Ft as Realtime, It as RealtimeAuthParams, Lt as RealtimeAuthResponse, Mt as CliCreateSessionResponse, Nt as CliGetSessionParams, Ot as Cli, Pt as CliGetSessionResponse, Rt as RealtimeCredentialsResponse, jt as CliCreateSessionParams, kt as CliCreateCodactFailureParams } from "../../client-Cu0FrKmX.mjs";
 export { Cli, type CliCreateCodactFailureParams, type CliCreateCodactFailureResponse, type CliCreateSessionParams, type CliCreateSessionResponse, type CliGetSessionParams, type CliGetSessionResponse, Realtime, type RealtimeAuthParams, type RealtimeAuthResponse, type RealtimeCredentialsResponse };

package/dist/resources/cli/index.mjs

@@ -1,4 +1,4 @@
-import { t as Realtime } from "../../realtime-D7OslBiN.mjs";
-import { t as Cli } from "../../cli-CUWplx80.mjs";
+import { t as Realtime } from "../../realtime-CtLFFEf8.mjs";
+import { t as Cli } from "../../cli-BwAcGYUv.mjs";
 
 export { Cli, Realtime };

package/dist/resources/cli/realtime.d.mts

@@ -1,2 +1,2 @@
-import { Ft as Realtime, It as RealtimeAuthParams, Lt as RealtimeAuthResponse, Rt as RealtimeCredentialsResponse } from "../../client-CtqZaY-5.mjs";
+import { Ft as Realtime, It as RealtimeAuthParams, Lt as RealtimeAuthResponse, Rt as RealtimeCredentialsResponse } from "../../client-Cu0FrKmX.mjs";
 export { Realtime, RealtimeAuthParams, RealtimeAuthResponse, RealtimeCredentialsResponse };

package/dist/resources/cli/realtime.mjs

@@ -1,3 +1,3 @@
-import { t as Realtime } from "../../realtime-D7OslBiN.mjs";
+import { t as Realtime } from "../../realtime-CtLFFEf8.mjs";
 
 export { Realtime };

package/dist/resources/cli.d.mts

@@ -1,2 +1,2 @@
-import { At as CliCreateCodactFailureResponse, Ft as Realtime, It as RealtimeAuthParams, Lt as RealtimeAuthResponse, Mt as CliCreateSessionResponse, Nt as CliGetSessionParams, Ot as Cli, Pt as CliGetSessionResponse, Rt as RealtimeCredentialsResponse, jt as CliCreateSessionParams, kt as CliCreateCodactFailureParams } from "../client-CtqZaY-5.mjs";
+import { At as CliCreateCodactFailureResponse, Ft as Realtime, It as RealtimeAuthParams, Lt as RealtimeAuthResponse, Mt as CliCreateSessionResponse, Nt as CliGetSessionParams, Ot as Cli, Pt as CliGetSessionResponse, Rt as RealtimeCredentialsResponse, jt as CliCreateSessionParams, kt as CliCreateCodactFailureParams } from "../client-Cu0FrKmX.mjs";
 export { Cli, type CliCreateCodactFailureParams, type CliCreateCodactFailureResponse, type CliCreateSessionParams, type CliCreateSessionResponse, type CliGetSessionParams, type CliGetSessionResponse, Realtime, type RealtimeAuthParams, type RealtimeAuthResponse, type RealtimeCredentialsResponse };

package/dist/resources/cli.mjs

@@ -1,5 +1,5 @@
-import { t as Realtime } from "../realtime-D7OslBiN.mjs";
-import { t as Cli } from "../cli-CUWplx80.mjs";
+import { t as Realtime } from "../realtime-CtLFFEf8.mjs";
+import { t as Cli } from "../cli-BwAcGYUv.mjs";
 import "./cli/index.mjs";
 
 export { Cli, Realtime };

package/dist/resources/connected-accounts.d.mts

@@ -1,2 +1,2 @@
-import { $n as ConnectedAccountRefreshResponse, Gn as ConnectedAccountCreateResponse, Jn as ConnectedAccountListParams, Kn as ConnectedAccountDeleteParams, Qn as ConnectedAccountRefreshParams, Wn as ConnectedAccountCreateParams, Xn as ConnectedAccountPatchParams, Yn as ConnectedAccountListResponse, Zn as ConnectedAccountPatchResponse, er as ConnectedAccountRetrieveResponse, nr as ConnectedAccountUpdateStatusResponse, qn as ConnectedAccountDeleteResponse, rr as ConnectedAccounts, tr as ConnectedAccountUpdateStatusParams } from "../client-CtqZaY-5.mjs";
+import { $n as ConnectedAccountRefreshResponse, Gn as ConnectedAccountCreateResponse, Jn as ConnectedAccountListParams, Kn as ConnectedAccountDeleteParams, Qn as ConnectedAccountRefreshParams, Wn as ConnectedAccountCreateParams, Xn as ConnectedAccountPatchParams, Yn as ConnectedAccountListResponse, Zn as ConnectedAccountPatchResponse, er as ConnectedAccountRetrieveResponse, nr as ConnectedAccountUpdateStatusResponse, qn as ConnectedAccountDeleteResponse, rr as ConnectedAccounts, tr as ConnectedAccountUpdateStatusParams } from "../client-Cu0FrKmX.mjs";
 export { type ConnectedAccountCreateParams, type ConnectedAccountCreateResponse, type ConnectedAccountDeleteParams, type ConnectedAccountDeleteResponse, type ConnectedAccountListParams, type ConnectedAccountListResponse, type ConnectedAccountPatchParams, type ConnectedAccountPatchResponse, type ConnectedAccountRefreshParams, type ConnectedAccountRefreshResponse, type ConnectedAccountRetrieveResponse, type ConnectedAccountUpdateStatusParams, type ConnectedAccountUpdateStatusResponse, ConnectedAccounts };

package/dist/resources/connected-accounts.mjs

@@ -1,3 +1,3 @@
-import { t as ConnectedAccounts } from "../connected-accounts-hwz_Ahf8.mjs";
+import { t as ConnectedAccounts } from "../connected-accounts-Bri1c8_y.mjs";
 
 export { ConnectedAccounts };

package/dist/resources/files.d.mts

@@ -1,2 +1,2 @@
-import { ar as FileCreatePresignedURLResponse, cr as Files, ir as FileCreatePresignedURLParams, or as FileListParams, sr as FileListResponse } from "../client-CtqZaY-5.mjs";
+import { ar as FileCreatePresignedURLResponse, cr as Files, ir as FileCreatePresignedURLParams, or as FileListParams, sr as FileListResponse } from "../client-Cu0FrKmX.mjs";
 export { type FileCreatePresignedURLParams, type FileCreatePresignedURLResponse, type FileListParams, type FileListResponse, Files };

package/dist/resources/files.mjs

@@ -1,3 +1,3 @@
-import { t as Files } from "../files-Blm1q37V.mjs";
+import { t as Files } from "../files-nKAca7MP.mjs";
 
 export { Files };