@nangohq/types 0.71.2 → 0.71.4

package/dist/account/api.d.ts

@@ -1,6 +1,8 @@
-import type { ApiError, Endpoint } from '../api.js';
+import type { ApiEndpoint, ApiError } from '../api.js';
+import type { AuditPolicy } from '../audit-trail/event.js';
 import type { ApiUser } from '../user/api.js';
-export type PostSignup = Endpoint<{
+export type PostSignup = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'signup', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/signup';
     Body: {
@@ -18,19 +20,26 @@ export type PostSignup = Endpoint<{
         };
     };
 }>;
-export type ValidateEmailAndLogin = Endpoint<{
+export type ConfirmEmail = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/verify/code';
     Body: {
         token: string;
     };
-    Error: ApiError<'error_logging_in'> | ApiError<'error_validating_user'> | ApiError<'invalid_token'> | ApiError<'token_expired'> | ApiError<'error_refreshing_token'>;
+    Error: ApiError<'error_validating_user'> | ApiError<'invalid_token'> | ApiError<'token_expired'>;
     Success: {
         user: ApiUser;
-        showHearAboutUs?: boolean;
     };
 }>;
-export type ResendVerificationEmailByUuid = Endpoint<{
+export type ResendVerificationEmailByUuid = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/resend-verification-email/by-uuid';
     Body: {
@@ -41,7 +50,11 @@ export type ResendVerificationEmailByUuid = Endpoint<{
         success: boolean;
     };
 }>;
-export type ResendVerificationEmailByEmail = Endpoint<{
+export type ResendVerificationEmailByEmail = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/resend-verification-email/by-email';
     Body: {
@@ -52,7 +65,11 @@ export type ResendVerificationEmailByEmail = Endpoint<{
         success: boolean;
     };
 }>;
-export type GetEmailByUuid = Endpoint<{
+export type GetEmailByUuid = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: '/api/v1/account/email/:uuid';
     Params: {
@@ -64,7 +81,11 @@ export type GetEmailByUuid = Endpoint<{
         verified: boolean;
     };
 }>;
-export type GetEmailByExpiredToken = Endpoint<{
+export type GetEmailByExpiredToken = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: '/api/v1/account/email/expired-token/:token';
     Params: {
@@ -77,24 +98,36 @@ export type GetEmailByExpiredToken = Endpoint<{
         uuid: string;
     };
 }>;
-export type PostSignin = Endpoint<{
+export type PostSignin = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'login', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/signin';
     Body: {
         email: string;
         password: string;
+        returnTo?: string;
     };
     Error: ApiError<'email_not_verified'> | ApiError<'user_suspended'> | ApiError<'unauthorized'>;
     Success: {
         user: ApiUser;
+        url: string;
+    } | {
+        data: {
+            mfaRequired: true;
+        };
     };
 }>;
-export type PostLogout = Endpoint<{
+export type PostLogout = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'logout', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/logout';
     Success: never;
 }>;
-export type PostForgotPassword = Endpoint<{
+export type PostForgotPassword = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/forgot-password';
     Body: {
@@ -104,7 +137,8 @@ export type PostForgotPassword = Endpoint<{
         success: true;
     };
 }>;
-export type PutResetPassword = Endpoint<{
+export type PutResetPassword = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'password_reset', 'account'>;
     Method: 'PUT';
     Path: '/api/v1/account/reset-password';
     Body: {
@@ -116,7 +150,11 @@ export type PutResetPassword = Endpoint<{
         success: true;
     };
 }>;
-export type PostManagedSignup = Endpoint<{
+export type PostManagedSignup = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'initiates SSO redirect, no auth state change';
+    };
     Method: 'POST';
     Path: '/api/v1/account/managed/signup';
     Body: {
@@ -129,7 +167,11 @@ export type PostManagedSignup = Endpoint<{
         };
     };
 }>;
-export type GetManagedEmailVerification = Endpoint<{
+export type GetManagedEmailVerification = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'read-only, no auth state change';
+    };
     Method: 'GET';
     Path: '/api/v1/account/managed/verification';
     Error: ApiError<'not_found'>;
@@ -139,7 +181,8 @@ export type GetManagedEmailVerification = Endpoint<{
         };
     };
 }>;
-export type PostManagedEmailVerification = Endpoint<{
+export type PostManagedEmailVerification = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'login' | 'signup', 'account'>;
     Method: 'POST';
     Path: '/api/v1/account/managed/verification';
     Body: {
@@ -152,7 +195,8 @@ export type PostManagedEmailVerification = Endpoint<{
         };
     };
 }>;
-export type GetManagedCallback = Endpoint<{
+export type GetManagedCallback = ApiEndpoint<{
+    Audit: AuditPolicy<'app_auth', 'login' | 'signup', 'account'>;
     Method: 'GET';
     Path: '/api/v1/login/callback';
     Querystring: {
@@ -166,7 +210,11 @@ export type GetManagedCallback = Endpoint<{
         };
     };
 }>;
-export type GetOnboardingHearAboutUs = Endpoint<{
+export type GetOnboardingHearAboutUs = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: '/api/v1/account/onboarding/hear-about-us';
     Error: ApiError<'unauthorized'>;
@@ -176,7 +224,40 @@ export type GetOnboardingHearAboutUs = Endpoint<{
         };
     };
 }>;
-export type PostOnboardingHearAboutUs = Endpoint<{
+export type GetOnboardingAccountDiscovery = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/account/onboarding/account-discovery';
+    Error: ApiError<'forbidden'>;
+    Success: {
+        data: {
+            suggestedAccountName: string | null;
+        };
+    };
+}>;
+export type PostOnboardingRequestInvite = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'POST';
+    Path: '/api/v1/account/onboarding/request-invite';
+    Body: never;
+    Error: ApiError<'not_found'> | ApiError<'email_delivery_failed'>;
+    Success: {
+        data: {
+            success: true;
+        };
+    };
+}>;
+export type PostOnboardingHearAboutUs = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/account/onboarding/hear-about-us';
     Body: {

package/dist/action/api.d.ts

@@ -1,9 +1,13 @@
-import type { Endpoint } from '../api.js';
+import type { ApiEndpoint } from '../api.js';
 export interface AsyncActionResponse {
     id: string;
     statusUrl: string;
 }
-export type GetAsyncActionResult = Endpoint<{
+export type GetAsyncActionResult = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: `/action/:id`;
     Params: {
@@ -11,7 +15,11 @@ export type GetAsyncActionResult = Endpoint<{
     };
     Success: Record<string, any>;
 }>;
-export type PostPublicTriggerAction = Endpoint<{
+export type PostPublicTriggerAction = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/action/trigger';
     Body: {
@@ -26,7 +34,11 @@ export type PostPublicTriggerAction = Endpoint<{
     };
     Success: any;
 }>;
-export type PostInternalTriggerFunction = Endpoint<{
+export type PostInternalTriggerFunction = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'POST';
     Path: '/api/v1/trigger/function';
     Body: {
@@ -42,7 +54,11 @@ export type PostInternalTriggerFunction = Endpoint<{
     Success: any;
 }>;
 /** @deprecated Use POST /action/trigger to trigger actions and GET /records to fetch sync records instead. */
-export type GetPublicV1 = Endpoint<{
+export type GetPublicV1 = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
     Method: 'GET';
     Path: `/v1/:path`;
     Params: any;

package/dist/admin/http.api.d.ts

@@ -1,5 +1,9 @@
-import type { Endpoint } from '../index.js';
-export type PostImpersonate = Endpoint<{
+import type { ApiEndpoint, ApiError } from '../index.js';
+export type PostImpersonate = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
     Method: 'POST';
     Path: `/api/v1/admin/impersonate`;
     Querystring: {
@@ -8,7 +12,9 @@ export type PostImpersonate = Endpoint<{
     Body: {
         accountUUID: string;
         loginReason: string;
+        code?: string | undefined;
     };
+    Error: ApiError<'invalid_mfa_code'> | ApiError<'mfa_not_enabled'>;
     Success: {
         success: true;
     };

package/dist/api-keys/auth.d.ts

@@ -0,0 +1,38 @@
+import type { DBAPISecret, DBEnvironment } from '../environment/db.js';
+import type { DBPlan } from '../plans/db.js';
+import type { DBTeam } from '../team/db.js';
+export type ApiKeyAuthSource = 'customer_key' | 'sandbox_token' | 'api_secret' | 'env_var' | 'connect_session';
+export interface ApiKeyPrincipal {
+    type: 'api_key';
+    source: ApiKeyAuthSource;
+    accountId: number;
+    scopes: string[];
+    environmentIds: number[];
+    keyId?: number;
+    displayName?: string;
+}
+export type ApiKeyAuthorizationTarget = {
+    type: 'account';
+    accountId: number;
+} | {
+    type: 'environment';
+    accountId: number;
+    environmentId: number;
+};
+export interface ApiKeyAuthDetails {
+    source: Exclude<ApiKeyAuthSource, 'connect_session'>;
+    scopes?: string[];
+    apiKeyId?: number;
+    apiKeyDisplayName?: string;
+    purpose?: 'dryrun' | 'deploy';
+    dryrunId?: string;
+    deploymentId?: string;
+}
+export interface ApiKeyContext {
+    account: DBTeam;
+    environment?: DBEnvironment;
+    secret?: DBAPISecret;
+    plan: DBPlan | null;
+    principal: ApiKeyPrincipal;
+    auth: ApiKeyAuthDetails;
+}

package/dist/api-keys/scopes.d.ts

@@ -1,3 +1,5 @@
 export declare const API_KEY_SCOPES: readonly ["environment:*", "environment:integrations:list", "environment:integrations:list_credentials", "environment:integrations:list_functions", "environment:integrations:read", "environment:integrations:read_credentials", "environment:integrations:create", "environment:integrations:update", "environment:integrations:delete", "environment:integrations:*", "environment:connections:list", "environment:connections:list_credentials", "environment:connections:read", "environment:connections:read_credentials", "environment:connections:create", "environment:connections:update", "environment:connections:delete", "environment:connections:*", "environment:connect_sessions:write", "environment:syncs:read", "environment:syncs:execute", "environment:syncs:update", "environment:syncs:variant:create", "environment:syncs:variant:delete", "environment:syncs:*", "environment:functions:list", "environment:functions:read", "environment:functions:delete", "environment:functions:compile", "environment:functions:dryrun", "environment:functions:*", "environment:deploy", "environment:records:read", "environment:records:write", "environment:records:*", "environment:logs:read", "environment:actions:execute", "environment:actions:*", "environment:proxy", "environment:variables:read", "environment:mcp"];
 export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
-export declare const ALL_SCOPES: string[];
+export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:*", "account:billing:read", "account:team:invite_member"];
+export type AccountApiKeyScope = (typeof ACCOUNT_API_KEY_SCOPES)[number];
+export type CustomerKeyScope = ApiKeyScope | AccountApiKeyScope;

package/dist/api.d.ts

@@ -1,3 +1,4 @@
+import type { EndpointAudit } from './audit-trail/event.js';
 import type { RunnerOutputError } from './runner/index.js';
 export interface ApiError<TCode extends string, TErrors = Error[] | ValidationError[] | undefined, TPayload = unknown> {
     error: {
@@ -65,6 +66,12 @@ export interface Endpoint<T extends EndpointDefinition> {
      */
     Reply: ResDefaultErrors | (T['Error'] extends ApiError<any> ? T['Error'] | T['Success'] : T['Success']);
 }
+export interface ApiEndpointDefinition extends EndpointDefinition {
+    Audit: EndpointAudit;
+}
+export type ApiEndpoint<T extends ApiEndpointDefinition> = Endpoint<T> & {
+    Audit: T['Audit'];
+};
 export interface ErrorPayload {
     type: string;
     description: string;

package/dist/api.endpoints.d.ts

@@ -1,8 +1,9 @@
-import type { GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
+import type { ConfirmEmail, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, GetOnboardingAccountDiscovery, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostOnboardingRequestInvite, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
 import type { GetAsyncActionResult, GetPublicV1, PostInternalTriggerFunction, PostPublicTriggerAction } from './action/api.js';
 import type { PostImpersonate } from './admin/http.api.js';
 import type { EndpointMethod } from './api.js';
-import type { PostPublicApiKeyAuthorization, PostPublicAppStoreAuthorization, PostPublicAwsSigV4Authorization, PostPublicBasicAuthorization, PostPublicBillAuthorization, PostPublicJwtAuthorization, PostPublicOauthOutboundAuthorization, PostPublicSignatureAuthorization, PostPublicTbaAuthorization, PostPublicTwoStepAuthorization, PostPublicUnauthenticatedAuthorization } from './auth/http.api.js';
+import type { GetAuditTrail } from './audit-trail/api.js';
+import type { PostPublicApiKeyAuthorization, PostPublicAwsSigV4Authorization, PostPublicBasicAuthorization, PostPublicBillAuthorization, PostPublicJwtAuthorization, PostPublicOauthOutboundAuthorization, PostPublicSignatureAuthorization, PostPublicTbaAuthorization, PostPublicTwoStepAuthorization, PostPublicUnauthenticatedAuthorization } from './auth/http.api.js';
 import type { PostCliTelemetry } from './cli/api.js';
 import type { GetPublicClientMetadata } from './clientMetadata/http.api.js';
 import type { DeleteConnectSession, GetConnectSession, PostConnectSessions, PostInternalConnectSessions, PostPublicConnectSessionsReconnect, PostPublicConnectTelemetry } from './connect/api.js';
@@ -14,13 +15,13 @@ import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, GetEnvironment, Get
 import type { PatchWebhook } from './environment/api/webhook.js';
 import type { PostEnvironmentVariables } from './environment/variable/api.js';
 import type { PatchFlowDisable, PatchFlowEnable, PatchFlowFrequency, PostPreBuiltDeploy, PutUpgradePreBuiltFlow } from './flow/http.api.js';
-import type { DeleteIntegrationFunction, DeletePublicIntegrationFunction, GetFunctionDeployment, GetFunctionDryrun, GetIntegrationFunction, GetIntegrationFunctions, GetIntegrationTemplates, GetProviderTemplates, GetPublicIntegrationFunction, GetPublicIntegrationFunctions, GetPublicProviderTemplates, PostFunctionCompile, PostFunctionDeployment, PostFunctionDeploymentResult, PostFunctionDryrun, PostFunctionDryrunResult } from './functions/api.js';
+import type { DeleteIntegrationFunction, DeletePublicIntegrationFunction, GetFunctionDeployment, GetFunctionDryrun, GetIntegrationFunction, GetIntegrationFunctions, GetIntegrationTemplates, GetProviderTemplates, GetPublicIntegrationFunction, GetPublicIntegrationFunctions, GetPublicProviderTemplates, PostFunctionCompile, PostFunctionDeployment, PostFunctionDeploymentBundle, PostFunctionDeploymentBundlePreview, PostFunctionDeploymentResult, PostFunctionDryrun, PostFunctionDryrunResult } from './functions/api.js';
 import type { GetGettingStarted, PatchGettingStarted } from './gettingStarted/api.js';
 import type { DeleteIntegration, DeletePublicIntegration, GetFunctionCode, GetIntegration, GetIntegrationFlows, GetPublicFunctionCode, GetPublicIntegration, GetPublicListIntegrations, PatchIntegration, PatchPublicIntegration, PostIntegration, PostPublicIntegration, PostPublicQuickstartIntegration } from './integration/api.js';
 import type { DeleteInvite, GetInvite, PostInvite } from './invitations/api.js';
 import type { GetOperation, PostInsights, SearchFilters, SearchMessages, SearchOperations } from './logs/api.js';
 import type { GetMeta } from './meta/api.js';
-import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFARecoveryCodes } from './mfa/api.js';
+import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFALoginVerification, PostMFARecoveryCodes } from './mfa/api.js';
 import type { GetPlainHmac } from './plain/api.js';
 import type { GetBillingUsage, GetBillingUsageTopDimensionValues, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails } from './plans/http.api.js';
 import type { GetProvider, GetProviders, GetPublicProvider, GetPublicProviders } from './providers/api.js';
@@ -32,8 +33,8 @@ import type { GetPublicSyncStatus, PostPublicSyncPause, PostPublicSyncStart, Pos
 import type { DeleteTeamUser, GetTeam, PatchTeamUser, PutTeam } from './team/api.js';
 import type { GetUser, PatchUser, PutUserPassword } from './user/api.js';
 import type { PostPublicWebhook } from './webhooks/http.api.js';
-export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | PostPublicAppStoreAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | AllPublicProxy;
-export type PrivateApiEndpoints = PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | DeleteMFA | GetPlainHmac;
+export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | AllPublicProxy;
+export type PrivateApiEndpoints = GetAuditTrail | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
 export type APIEndpoints = PrivateApiEndpoints | PublicApiEndpoints;
 /**
  * Automatically narrow endpoints type with Method + Path

package/dist/audit-trail/api.d.ts

@@ -0,0 +1,41 @@
+import type { ApiEndpoint } from '../api.js';
+import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditResource, AuditTarget, AuditTrailVersion } from './event.js';
+export interface ApiAuditTrailEvent {
+    id: string;
+    version: AuditTrailVersion;
+    occurredAt: string;
+    accountId: number;
+    environment: {
+        id: number;
+        display: string;
+    } | null;
+    actor: AuditActor;
+    via?: AuditActor[];
+    targets: AuditTarget[];
+    context: AuditContext;
+    outcome: AuditOutcome;
+    resource: AuditResource;
+    action: AuditAction;
+    metadata?: Record<string, unknown>;
+}
+export type GetAuditTrail = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/audit-trail';
+    Querystring: {
+        cursor?: string;
+        from?: string;
+        to?: string;
+        resources?: string;
+        actions?: string;
+    };
+    Success: {
+        data: ApiAuditTrailEvent[];
+        pagination: {
+            nextCursor: string | null;
+        };
+    };
+}>;

package/dist/audit-trail/event.d.ts

@@ -0,0 +1,56 @@
+export type AuditTrailVersion = '2026-07-16';
+export type AuditActorType = 'user' | 'api_key' | 'system' | 'anonymous';
+export type AuditOutcome = 'success' | 'failure' | 'denied';
+export type AuditInterface = 'api' | 'mcp';
+interface AuditEventTable {
+    connection: 'created' | 'updated' | 'metadata_updated' | 'refreshed' | 'deleted';
+    sync: 'enabled' | 'disabled' | 'paused' | 'started' | 'triggered' | 'cancelled' | 'frequency_changed' | 'variant_created' | 'variant_deleted';
+    function: 'deployed' | 'upgraded' | 'deleted';
+    integration: 'created' | 'updated' | 'deleted';
+    api_key: 'created' | 'updated' | 'deleted';
+    member: 'invited' | 'invite_accepted' | 'invite_declined' | 'invite_revoked' | 'role_changed' | 'removed';
+    team: 'updated';
+    user: 'updated';
+    environment: 'created' | 'updated' | 'variables_changed' | 'webhook_urls_changed' | 'deleted';
+    app_auth: 'login' | 'logout' | 'signup' | 'password_changed' | 'password_reset';
+    mfa: 'enrolled' | 'enabled' | 'disabled' | 'verified' | 'recovery_regenerated';
+    billing: 'plan_changed' | 'trial_extended' | 'details_changed' | 'payment_method_added' | 'payment_method_removed';
+}
+export type AuditResource = keyof AuditEventTable;
+export type AuditActionOf<R extends AuditResource> = AuditEventTable[R];
+export type AuditAction = AuditActionOf<AuditResource>;
+export type AuditEventKey = {
+    [R in AuditResource]: `${R}.${AuditEventTable[R]}`;
+}[AuditResource];
+export type AuditScope = 'account' | 'environment';
+export type AuditTargetType = 'connection' | 'sync' | 'function' | 'integration' | 'api_key' | 'member' | 'team' | 'user' | 'environment';
+export interface AuditActor {
+    type: AuditActorType;
+    id: string;
+    display?: string;
+}
+export interface AuditTarget {
+    type: AuditTargetType;
+    id: string;
+    display?: string;
+}
+export interface AuditContext {
+    interface?: AuditInterface;
+    ip?: string;
+    userAgent?: string;
+}
+export interface AuditPolicy<R extends AuditResource = AuditResource, A extends AuditActionOf<R> = AuditActionOf<R>, S extends AuditScope = AuditScope> {
+    kind: 'audit';
+    resource: R;
+    action: A;
+    scope: S;
+}
+export interface NoAudit<Reason extends string = 'non-auditable'> {
+    kind: 'no-audit';
+    reason: Reason;
+}
+export type EndpointAudit = AuditPolicy | NoAudit<string>;
+export type SerializedAuditEvent = {
+    event: string;
+};
+export {};

package/dist/auth/api.d.ts

@@ -6,7 +6,6 @@ export interface AuthModes {
     OAuth2CC: 'OAUTH2_CC';
     Basic: 'BASIC';
     ApiKey: 'API_KEY';
-    AppStore: 'APP_STORE';
     Custom: 'CUSTOM';
     App: 'APP';
     None: 'NONE';
@@ -66,13 +65,6 @@ export interface AppCredentials {
     raw: Record<string, any>;
     jwtToken?: string;
 }
-export interface AppStoreCredentials {
-    type?: AuthModes['AppStore'];
-    access_token: string;
-    expires_at?: Date | undefined;
-    raw: Record<string, any>;
-    private_key: string;
-}
 export interface OAuth2Credentials extends CredentialsCommon {
     type: AuthModes['OAuth2'];
     access_token: string;
@@ -170,6 +162,6 @@ export interface AuthorizationTokenResponse extends Omit<OAuth2Credentials, 'typ
     expires_in?: number;
 }
 export type TestableCredentials = ApiKeyCredentials | BasicApiCredentials | TbaCredentials | JwtCredentials | SignatureCredentials;
-export type RefreshableCredentials = OAuth2Credentials | AppCredentials | AppStoreCredentials | OAuth2ClientCredentials | JwtCredentials | TwoStepCredentials | BillCredentials | SignatureCredentials | AwsSigV4Credentials;
-export type AllAuthCredentials = OAuth1Credentials | OAuth2Credentials | OAuth2ClientCredentials | BasicApiCredentials | ApiKeyCredentials | AppCredentials | AppStoreCredentials | UnauthCredentials | CustomCredentials | TbaCredentials | JwtCredentials | BillCredentials | TwoStepCredentials | CombinedOauth2AppCredentials | SignatureCredentials | InstallPluginCredentials | AwsSigV4Credentials;
+export type RefreshableCredentials = OAuth2Credentials | AppCredentials | OAuth2ClientCredentials | JwtCredentials | TwoStepCredentials | BillCredentials | SignatureCredentials | AwsSigV4Credentials;
+export type AllAuthCredentials = OAuth1Credentials | OAuth2Credentials | OAuth2ClientCredentials | BasicApiCredentials | ApiKeyCredentials | AppCredentials | UnauthCredentials | CustomCredentials | TbaCredentials | JwtCredentials | BillCredentials | TwoStepCredentials | CombinedOauth2AppCredentials | SignatureCredentials | InstallPluginCredentials | AwsSigV4Credentials;
 export type ApiPublicAllAuthCredentials = ReplaceInObjectDeep<AllAuthCredentials, Date, string>;