@nangohq/types 0.71.1 → 0.71.3

package/dist/account/api.d.ts

@@ -1,6 +1,8 @@
-import type { ApiError, Endpoint } from '../api.js';
+import type { ApiEndpoint, ApiError } from '../api.js';
+import type { AuditPolicy } from '../audit-trail/event.js';
 import type { ApiUser } from '../user/api.js';
-export type PostSignup = Endpoint<{
+export type PostSignup = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'signup', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/signup';
     Body: {
@@ -18,19 +20,29 @@ export type PostSignup = Endpoint<{
         };
     };
 }>;
-export type ValidateEmailAndLogin = Endpoint<{
+export type ConfirmEmail = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/verify/code';
     Body: {
         token: string;
     };
-    Error: ApiError<'error_logging_in'> | ApiError<'error_validating_user'> | ApiError<'invalid_token'> | ApiError<'token_expired'> | ApiError<'error_refreshing_token'>;
+    Error: ApiError<'error_validating_user'> | ApiError<'invalid_token'> | ApiError<'token_expired'>;
     Success: {
-        user: ApiUser;
+        email: string;
+        userId: number;
+        accountId: number;
         showHearAboutUs?: boolean;
     };
 }>;
-export type ResendVerificationEmailByUuid = Endpoint<{
+export type ResendVerificationEmailByUuid = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/resend-verification-email/by-uuid';
     Body: {
@@ -41,7 +53,11 @@ export type ResendVerificationEmailByUuid = Endpoint<{
         success: boolean;
     };
 }>;
-export type ResendVerificationEmailByEmail = Endpoint<{
+export type ResendVerificationEmailByEmail = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/resend-verification-email/by-email';
     Body: {
@@ -52,7 +68,11 @@ export type ResendVerificationEmailByEmail = Endpoint<{
         success: boolean;
     };
 }>;
-export type GetEmailByUuid = Endpoint<{
+export type GetEmailByUuid = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: '/api/v1/account/email/:uuid';
     Params: {
@@ -64,7 +84,11 @@ export type GetEmailByUuid = Endpoint<{
         verified: boolean;
     };
 }>;
-export type GetEmailByExpiredToken = Endpoint<{
+export type GetEmailByExpiredToken = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: '/api/v1/account/email/expired-token/:token';
     Params: {
@@ -77,24 +101,35 @@ export type GetEmailByExpiredToken = Endpoint<{
         uuid: string;
     };
 }>;
-export type PostSignin = Endpoint<{
+export type PostSignin = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'login', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/signin';
     Body: {
         email: string;
         password: string;
+        returnTo?: string;
     };
     Error: ApiError<'email_not_verified'> | ApiError<'user_suspended'> | ApiError<'unauthorized'>;
     Success: {
         user: ApiUser;
+    } | {
+        data: {
+            mfaRequired: true;
+        };
     };
 }>;
-export type PostLogout = Endpoint<{
+export type PostLogout = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'logout', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/logout';
     Success: never;
 }>;
-export type PostForgotPassword = Endpoint<{
+export type PostForgotPassword = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/forgot-password';
     Body: {
@@ -104,7 +139,8 @@ export type PostForgotPassword = Endpoint<{
         success: true;
     };
 }>;
-export type PutResetPassword = Endpoint<{
+export type PutResetPassword = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'password_reset', 'account'>;
     Method: 'PUT';
     Path: '/api/v1/account/reset-password';
     Body: {
@@ -116,7 +152,11 @@ export type PutResetPassword = Endpoint<{
         success: true;
     };
 }>;
-export type PostManagedSignup = Endpoint<{
+export type PostManagedSignup = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'initiates SSO redirect, no auth state change';
+    };
     Method: 'POST';
     Path: '/api/v1/account/managed/signup';
     Body: {
@@ -129,7 +169,11 @@ export type PostManagedSignup = Endpoint<{
         };
     };
 }>;
-export type GetManagedEmailVerification = Endpoint<{
+export type GetManagedEmailVerification = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'read-only, no auth state change';
+    };
     Method: 'GET';
     Path: '/api/v1/account/managed/verification';
     Error: ApiError<'not_found'>;
@@ -139,7 +183,8 @@ export type GetManagedEmailVerification = Endpoint<{
         };
     };
 }>;
-export type PostManagedEmailVerification = Endpoint<{
+export type PostManagedEmailVerification = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'login' | 'signup', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/managed/verification';
     Body: {
@@ -152,7 +197,8 @@ export type PostManagedEmailVerification = Endpoint<{
         };
     };
 }>;
-export type GetManagedCallback = Endpoint<{
+export type GetManagedCallback = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'login' | 'signup', 'account'>;
     Method: 'GET';
     Path: '/api/v1/login/callback';
     Querystring: {
@@ -166,7 +212,11 @@ export type GetManagedCallback = Endpoint<{
         };
     };
 }>;
-export type GetOnboardingHearAboutUs = Endpoint<{
+export type GetOnboardingHearAboutUs = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: '/api/v1/account/onboarding/hear-about-us';
     Error: ApiError<'unauthorized'>;
@@ -176,7 +226,11 @@ export type GetOnboardingHearAboutUs = Endpoint<{
         };
     };
 }>;
-export type PostOnboardingHearAboutUs = Endpoint<{
+export type PostOnboardingHearAboutUs = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/onboarding/hear-about-us';
     Body: {

package/dist/action/api.d.ts

@@ -1,9 +1,13 @@
-import type { Endpoint } from '../api.js';
+import type { ApiEndpoint } from '../api.js';
 export interface AsyncActionResponse {
     id: string;
     statusUrl: string;
 }
-export type GetAsyncActionResult = Endpoint<{
+export type GetAsyncActionResult = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: `/action/:id`;
     Params: {
@@ -11,7 +15,11 @@ export type GetAsyncActionResult = Endpoint<{
     };
     Success: Record<string, any>;
 }>;
-export type PostPublicTriggerAction = Endpoint<{
+export type PostPublicTriggerAction = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/action/trigger';
     Body: {
@@ -26,7 +34,11 @@ export type PostPublicTriggerAction = Endpoint<{
     };
     Success: any;
 }>;
-export type PostInternalTriggerFunction = Endpoint<{
+export type PostInternalTriggerFunction = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/trigger/function';
     Body: {
@@ -42,7 +54,11 @@ export type PostInternalTriggerFunction = Endpoint<{
     Success: any;
 }>;
 /** @deprecated Use POST /action/trigger to trigger actions and GET /records to fetch sync records instead. */
-export type GetPublicV1 = Endpoint<{
+export type GetPublicV1 = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: `/v1/:path`;
     Params: any;

package/dist/admin/http.api.d.ts

@@ -1,5 +1,9 @@
-import type { Endpoint } from '../index.js';
-export type PostImpersonate = Endpoint<{
+import type { ApiEndpoint, ApiError } from '../index.js';
+export type PostImpersonate = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Path: `/api/v1/admin/impersonate`;
     Querystring: {
@@ -8,7 +12,9 @@ export type PostImpersonate = Endpoint<{
     Body: {
         accountUUID: string;
         loginReason: string;
+        code?: string | undefined;
     };
+    Error: ApiError<'invalid_mfa_code'> | ApiError<'mfa_not_enabled'>;
     Success: {
         success: true;
     };

package/dist/api.d.ts

@@ -1,3 +1,4 @@
+import type { EndpointAudit } from './audit-trail/event.js';
 import type { RunnerOutputError } from './runner/index.js';
 export interface ApiError<TCode extends string, TErrors = Error[] | ValidationError[] | undefined, TPayload = unknown> {
     error: {
@@ -65,6 +66,12 @@ export interface Endpoint<T extends EndpointDefinition> {
      */
     Reply: ResDefaultErrors | (T['Error'] extends ApiError<any> ? T['Error'] | T['Success'] : T['Success']);
 }
+export interface ApiEndpointDefinition extends EndpointDefinition {
+    Audit: EndpointAudit;
+}
+export type ApiEndpoint<T extends ApiEndpointDefinition> = Endpoint<T> & {
+    Audit: T['Audit'];
+};
 export interface ErrorPayload {
     type: string;
     description: string;

package/dist/api.endpoints.d.ts

@@ -1,8 +1,9 @@
-import type { GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
+import type { ConfirmEmail, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
 import type { GetAsyncActionResult, GetPublicV1, PostInternalTriggerFunction, PostPublicTriggerAction } from './action/api.js';
 import type { PostImpersonate } from './admin/http.api.js';
 import type { EndpointMethod } from './api.js';
-import type { PostPublicApiKeyAuthorization, PostPublicAppStoreAuthorization, PostPublicAwsSigV4Authorization, PostPublicBasicAuthorization, PostPublicBillAuthorization, PostPublicJwtAuthorization, PostPublicOauthOutboundAuthorization, PostPublicSignatureAuthorization, PostPublicTbaAuthorization, PostPublicTwoStepAuthorization, PostPublicUnauthenticatedAuthorization } from './auth/http.api.js';
+import type { GetAuditTrail } from './audit-trail/api.js';
+import type { PostPublicApiKeyAuthorization, PostPublicAwsSigV4Authorization, PostPublicBasicAuthorization, PostPublicBillAuthorization, PostPublicJwtAuthorization, PostPublicOauthOutboundAuthorization, PostPublicSignatureAuthorization, PostPublicTbaAuthorization, PostPublicTwoStepAuthorization, PostPublicUnauthenticatedAuthorization } from './auth/http.api.js';
 import type { PostCliTelemetry } from './cli/api.js';
 import type { GetPublicClientMetadata } from './clientMetadata/http.api.js';
 import type { DeleteConnectSession, GetConnectSession, PostConnectSessions, PostInternalConnectSessions, PostPublicConnectSessionsReconnect, PostPublicConnectTelemetry } from './connect/api.js';
@@ -20,7 +21,7 @@ import type { DeleteIntegration, DeletePublicIntegration, GetFunctionCode, GetIn
 import type { DeleteInvite, GetInvite, PostInvite } from './invitations/api.js';
 import type { GetOperation, PostInsights, SearchFilters, SearchMessages, SearchOperations } from './logs/api.js';
 import type { GetMeta } from './meta/api.js';
-import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFARecoveryCodes } from './mfa/api.js';
+import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFALoginVerification, PostMFARecoveryCodes } from './mfa/api.js';
 import type { GetPlainHmac } from './plain/api.js';
 import type { GetBillingUsage, GetBillingUsageTopDimensionValues, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails } from './plans/http.api.js';
 import type { GetProvider, GetProviders, GetPublicProvider, GetPublicProviders } from './providers/api.js';
@@ -32,8 +33,8 @@ import type { GetPublicSyncStatus, PostPublicSyncPause, PostPublicSyncStart, Pos
 import type { DeleteTeamUser, GetTeam, PatchTeamUser, PutTeam } from './team/api.js';
 import type { GetUser, PatchUser, PutUserPassword } from './user/api.js';
 import type { PostPublicWebhook } from './webhooks/http.api.js';
-export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | PostPublicAppStoreAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | AllPublicProxy;
-export type PrivateApiEndpoints = PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | DeleteMFA | GetPlainHmac;
+export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | AllPublicProxy;
+export type PrivateApiEndpoints = GetAuditTrail | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
 export type APIEndpoints = PrivateApiEndpoints | PublicApiEndpoints;
 /**
  * Automatically narrow endpoints type with Method + Path

package/dist/audit-trail/api.d.ts

@@ -0,0 +1,39 @@
+import type { ApiEndpoint } from '../api.js';
+import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditResource, AuditTarget, AuditTrailVersion } from './event.js';
+export interface ApiAuditTrailEvent {
+    id: string;
+    version: AuditTrailVersion;
+    occurredAt: string;
+    accountId: number;
+    environment: {
+        id: number;
+        display: string;
+    } | null;
+    actor: AuditActor;
+    via?: AuditActor[];
+    targets: AuditTarget[];
+    context: AuditContext;
+    outcome: AuditOutcome;
+    resource: AuditResource;
+    action: AuditAction;
+    metadata?: Record<string, unknown>;
+}
+export type GetAuditTrail = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/audit-trail';
+    Querystring: {
+        cursor?: string;
+        from?: string;
+        to?: string;
+    };
+    Success: {
+        data: ApiAuditTrailEvent[];
+        pagination: {
+            nextCursor: string | null;
+        };
+    };
+}>;

package/dist/audit-trail/event.d.ts

@@ -0,0 +1,54 @@
+export type AuditTrailVersion = '2026-07-16';
+export type AuditActorType = 'user' | 'api_key' | 'system' | 'anonymous';
+export type AuditOutcome = 'success' | 'failure' | 'denied';
+interface AuditEventTable {
+    connection: 'created' | 'updated' | 'metadata_updated' | 'refreshed' | 'deleted';
+    sync: 'enabled' | 'disabled' | 'paused' | 'started' | 'triggered' | 'cancelled' | 'frequency_changed' | 'variant_created' | 'variant_deleted';
+    function: 'deployed' | 'upgraded' | 'deleted';
+    integration: 'created' | 'updated' | 'deleted';
+    api_key: 'created' | 'updated' | 'deleted';
+    member: 'invited' | 'invite_accepted' | 'invite_declined' | 'invite_revoked' | 'role_changed' | 'removed';
+    team: 'updated';
+    user: 'updated';
+    environment: 'created' | 'updated' | 'variables_changed' | 'webhook_urls_changed' | 'deleted';
+    app_auth: 'login' | 'logout' | 'signup' | 'password_changed' | 'password_reset';
+    mfa: 'enrolled' | 'enabled' | 'disabled' | 'verified' | 'recovery_regenerated';
+    billing: 'plan_changed' | 'trial_extended' | 'details_changed' | 'payment_method_added' | 'payment_method_removed';
+}
+export type AuditResource = keyof AuditEventTable;
+export type AuditActionOf<R extends AuditResource> = AuditEventTable[R];
+export type AuditAction = AuditActionOf<AuditResource>;
+export type AuditEventKey = {
+    [R in AuditResource]: `${R}.${AuditEventTable[R]}`;
+}[AuditResource];
+export type AuditScope = 'account' | 'environment';
+export type AuditTargetType = 'connection' | 'sync' | 'function' | 'integration' | 'api_key' | 'member' | 'team' | 'user' | 'environment';
+export interface AuditActor {
+    type: AuditActorType;
+    id: string;
+    display?: string;
+}
+export interface AuditTarget {
+    type: AuditTargetType;
+    id: string;
+    display?: string;
+}
+export interface AuditContext {
+    ip?: string;
+    userAgent?: string;
+}
+export interface AuditPolicy<R extends AuditResource = AuditResource, A extends AuditActionOf<R> = AuditActionOf<R>, S extends AuditScope = AuditScope> {
+    kind: 'audit';
+    resource: R;
+    action: A;
+    scope: S;
+}
+export interface NoAudit<Reason extends string = 'non-auditable'> {
+    kind: 'no-audit';
+    reason: Reason;
+}
+export type EndpointAudit = AuditPolicy | NoAudit<string>;
+export type SerializedAuditEvent = {
+    event: string;
+};
+export {};

package/dist/auth/api.d.ts

@@ -1,11 +1,11 @@
 import type { DBConnection } from '../connection/db.js';
+import type { ReplaceInObjectDeep } from '../utils.js';
 export interface AuthModes {
     OAuth1: 'OAUTH1';
     OAuth2: 'OAUTH2';
     OAuth2CC: 'OAUTH2_CC';
     Basic: 'BASIC';
     ApiKey: 'API_KEY';
-    AppStore: 'APP_STORE';
     Custom: 'CUSTOM';
     App: 'APP';
     None: 'NONE';
@@ -65,13 +65,6 @@ export interface AppCredentials {
     raw: Record<string, any>;
     jwtToken?: string;
 }
-export interface AppStoreCredentials {
-    type?: AuthModes['AppStore'];
-    access_token: string;
-    expires_at?: Date | undefined;
-    raw: Record<string, any>;
-    private_key: string;
-}
 export interface OAuth2Credentials extends CredentialsCommon {
     type: AuthModes['OAuth2'];
     access_token: string;
@@ -169,5 +162,6 @@ export interface AuthorizationTokenResponse extends Omit<OAuth2Credentials, 'typ
     expires_in?: number;
 }
 export type TestableCredentials = ApiKeyCredentials | BasicApiCredentials | TbaCredentials | JwtCredentials | SignatureCredentials;
-export type RefreshableCredentials = OAuth2Credentials | AppCredentials | AppStoreCredentials | OAuth2ClientCredentials | JwtCredentials | TwoStepCredentials | BillCredentials | SignatureCredentials | AwsSigV4Credentials;
-export type AllAuthCredentials = OAuth1Credentials | OAuth2Credentials | OAuth2ClientCredentials | BasicApiCredentials | ApiKeyCredentials | AppCredentials | AppStoreCredentials | UnauthCredentials | CustomCredentials | TbaCredentials | JwtCredentials | BillCredentials | TwoStepCredentials | CombinedOauth2AppCredentials | SignatureCredentials | InstallPluginCredentials | AwsSigV4Credentials;
+export type RefreshableCredentials = OAuth2Credentials | AppCredentials | OAuth2ClientCredentials | JwtCredentials | TwoStepCredentials | BillCredentials | SignatureCredentials | AwsSigV4Credentials;
+export type AllAuthCredentials = OAuth1Credentials | OAuth2Credentials | OAuth2ClientCredentials | BasicApiCredentials | ApiKeyCredentials | AppCredentials | UnauthCredentials | CustomCredentials | TbaCredentials | JwtCredentials | BillCredentials | TwoStepCredentials | CombinedOauth2AppCredentials | SignatureCredentials | InstallPluginCredentials | AwsSigV4Credentials;
+export type ApiPublicAllAuthCredentials = ReplaceInObjectDeep<AllAuthCredentials, Date, string>;

package/dist/auth/http.api.d.ts

@@ -1,4 +1,4 @@
-import type { ApiError, Endpoint } from '../api.js';
+import type { ApiEndpoint, ApiError } from '../api.js';
 export type ConnectionQueryString = {
     connection_id?: string | undefined;
     params?: Record<string, any> | undefined;
@@ -34,7 +34,11 @@ export interface WebSocketConnectionResponseSuccess {
     private_key?: string | undefined;
 }
 type AuthErrors = ApiError<'invalid_body'> | ApiError<'invalid_query_params'> | ApiError<'unknown_provider_config'> | ApiError<'unknown_provider_template'> | ApiError<'invalid_auth_mode'> | ApiError<'invalid_credentials'> | ApiError<'integration_not_allowed'> | ApiError<'invalid_connection'> | ApiError<'connection_test_failed'> | ApiError<'connection_validation_failed'>;
-export type PostPublicApiKeyAuthorization = Endpoint<{
+export type PostPublicApiKeyAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: {
         apiKey: string;
@@ -47,23 +51,11 @@ export type PostPublicApiKeyAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicAppStoreAuthorization = Endpoint<{
-    Method: 'POST';
-    Body: {
-        privateKeyId: string;
-        privateKey: string;
-        issuerId: string;
-        scope?: string | undefined;
+export type PostPublicBasicAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
     };
-    Querystring: ConnectionQueryString;
-    Params: {
-        providerConfigKey: string;
-    };
-    Path: '/app-store-auth/:providerConfigKey';
-    Error: AuthErrors;
-    Success: ConnectionResponseSuccess;
-}>;
-export type PostPublicBasicAuthorization = Endpoint<{
     Method: 'POST';
     Body: {
         username: string;
@@ -77,7 +69,11 @@ export type PostPublicBasicAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicTbaAuthorization = Endpoint<{
+export type PostPublicTbaAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: {
         token_id: string;
@@ -94,7 +90,11 @@ export type PostPublicTbaAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicJwtAuthorization = Endpoint<{
+export type PostPublicJwtAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: Record<string, any>;
     Querystring: ConnectionQueryString;
@@ -105,7 +105,11 @@ export type PostPublicJwtAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicUnauthenticatedAuthorization = Endpoint<{
+export type PostPublicUnauthenticatedAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Querystring: ConnectionQueryString;
     Params: {
@@ -115,7 +119,11 @@ export type PostPublicUnauthenticatedAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicBillAuthorization = Endpoint<{
+export type PostPublicBillAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: {
         username: string;
@@ -131,7 +139,11 @@ export type PostPublicBillAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicTwoStepAuthorization = Endpoint<{
+export type PostPublicTwoStepAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: Record<string, any>;
     Querystring: ConnectionQueryString;
@@ -142,7 +154,11 @@ export type PostPublicTwoStepAuthorization = Endpoint<{
     Error: AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicSignatureAuthorization = Endpoint<{
+export type PostPublicSignatureAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: {
         username: string;
@@ -157,7 +173,11 @@ export type PostPublicSignatureAuthorization = Endpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 type AwsSigV4AuthErrors = AuthErrors | ApiError<'invalid_aws_sigv4_config'> | ApiError<'missing_aws_sigv4_service'> | ApiError<'missing_aws_sigv4_sts_endpoint'> | ApiError<'missing_aws_sigv4_builtin_credentials'> | ApiError<'missing_aws_sigv4_region'> | ApiError<'aws_sigv4_sts_request_failed'>;
-export type PostPublicAwsSigV4Authorization = Endpoint<{
+export type PostPublicAwsSigV4Authorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: {
         role_arn: string;
@@ -171,7 +191,11 @@ export type PostPublicAwsSigV4Authorization = Endpoint<{
     Error: AwsSigV4AuthErrors;
     Success: ConnectionResponseSuccess;
 }>;
-export type PostPublicOauthOutboundAuthorization = Endpoint<{
+export type PostPublicOauthOutboundAuthorization = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Body: {
         username: string;

package/dist/authz/types.d.ts

@@ -1,6 +1,6 @@
 import type { Role } from '../user/db.js';
 export type Action = 'create' | 'read' | 'update' | 'delete' | '*';
-export type Resource = 'team' | 'team_member' | 'invite' | 'connect_ui_settings' | 'billing' | 'plan' | 'environment' | 'environment_production_flag' | 'environment_key' | 'environment_variable' | 'webhook' | 'integration' | 'connection' | 'flow' | 'sync_command' | 'secret_key' | 'connection_credential' | 'log' | '*';
+export type Resource = 'team' | 'team_member' | 'invite' | 'connect_ui_settings' | 'billing' | 'plan' | 'environment' | 'environment_production_flag' | 'environment_key' | 'environment_variable' | 'webhook' | 'integration' | 'connection' | 'flow' | 'sync_command' | 'secret_key' | 'connection_credential' | 'log' | 'audit_trail' | '*';
 export type Scope = 'production' | 'non-production' | 'global';
 export interface Permission {
     action: Action;

package/dist/billing/http.api.d.ts

@@ -1,5 +1,9 @@
-import type { Endpoint } from '../api.js';
-export type PostOrbWebhooks = Endpoint<{
+import type { ApiEndpoint } from '../api.js';
+export type PostOrbWebhooks = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/orb/webhooks';
     Body: any;