@nangohq/types 0.71.4 → 0.71.5

package/dist/account/api.d.ts

@@ -1,6 +1,51 @@
+import type { AccountApiKeyScope } from '../api-keys/scopes.js';
 import type { ApiEndpoint, ApiError } from '../api.js';
 import type { AuditPolicy } from '../audit-trail/event.js';
+import type { MFACredential } from '../mfa/credential.js';
 import type { ApiUser } from '../user/api.js';
+export interface AccountApiKey {
+    id: number;
+    display_name: string;
+    scopes: AccountApiKeyScope[];
+    secret: string;
+    last_used_at: string | null;
+    created_at: string;
+}
+export type ListAccountApiKeys = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/account/api-keys';
+    Success: {
+        data: AccountApiKey[];
+    };
+}>;
+export type CreateAccountApiKey = ApiEndpoint<{
+    Audit: AuditPolicy<'api_key', 'created', 'account'>;
+    Method: 'POST';
+    Path: '/api/v1/account/api-keys';
+    Body: {
+        display_name: string;
+    };
+    Success: {
+        data: Omit<AccountApiKey, 'last_used_at'>;
+    };
+    Error: ApiError<'conflict' | 'resource_capped'>;
+}>;
+export type DeleteAccountApiKey = ApiEndpoint<{
+    Audit: AuditPolicy<'api_key', 'deleted', 'account'>;
+    Method: 'DELETE';
+    Path: '/api/v1/account/api-keys/:keyId';
+    Params: {
+        keyId: number;
+    };
+    Success: {
+        success: true;
+    };
+    Error: ApiError<'not_found'>;
+}>;
 export type PostSignup = ApiEndpoint<{
     Audit: AuditPolicy<'app_auth', 'signup', 'account'>;
     Method: 'POST';
@@ -12,7 +57,7 @@ export type PostSignup = ApiEndpoint<{
         token?: string | undefined;
         foundUs?: string | undefined;
     };
-    Error: ApiError<'email_already_verified'> | ApiError<'error_creating_user'> | ApiError<'user_already_exists'> | ApiError<'error_creating_account'> | ApiError<'invalid_invite_token'> | ApiError<'email_not_verified'>;
+    Error: ApiError<'email_already_verified'> | ApiError<'error_creating_user'> | ApiError<'user_already_exists'> | ApiError<'error_creating_account'> | ApiError<'not_found'> | ApiError<'email_not_verified'>;
     Success: {
         data: {
             uuid: string;
@@ -144,8 +189,9 @@ export type PutResetPassword = ApiEndpoint<{
     Body: {
         token: string;
         password: string;
+        mfa?: MFACredential | undefined;
     };
-    Error: ApiError<'user_not_found'> | ApiError<'invalid_token'>;
+    Error: ApiError<'user_not_found'> | ApiError<'invalid_token'> | ApiError<'invalid_mfa_code'> | ApiError<'mfa_code_required'>;
     Success: {
         success: true;
     };

package/dist/action/api.d.ts

@@ -1,4 +1,8 @@
 import type { ApiEndpoint } from '../api.js';
+export interface AsyncFunctionResponse {
+    id: string;
+    statusUrl: string;
+}
 export interface AsyncActionResponse {
     id: string;
     statusUrl: string;

package/dist/admin/http.api.d.ts

@@ -14,7 +14,7 @@ export type PostImpersonate = ApiEndpoint<{
         loginReason: string;
         code?: string | undefined;
     };
-    Error: ApiError<'invalid_mfa_code'> | ApiError<'mfa_not_enabled'>;
+    Error: ApiError<'invalid_mfa_code'> | ApiError<'mfa_code_required'> | ApiError<'mfa_not_enabled'>;
     Success: {
         success: true;
     };

package/dist/agent/api.d.ts

@@ -0,0 +1,88 @@
+import type { ApiEndpoint, ApiError } from '../api.js';
+import type { Tags } from '../db.js';
+import type { AgentSessionUnknownPinnedConnectionsPayload } from './connections.js';
+import type { AgentSessionToolsNotInToolsetPayload, AgentSessionUnknownIntegrationsPayload, AgentSessionUnknownToolsPayload, AgentSessionUnsupportedFunctionTypesPayload } from './toolset.js';
+export interface AgentSessionToolListInput {
+    tools: string[];
+}
+export type AgentSessionIntegrationPolicyInput = '*' | {
+    allow?: AgentSessionToolListInput | '*' | undefined;
+    deny?: AgentSessionToolListInput | undefined;
+};
+export interface PostAgentSessionsBody {
+    tenant: {
+        connections: {
+            any?: {
+                tags: Tags;
+            }[] | undefined;
+            pinned?: {
+                integration_id: string;
+                connection_id: string;
+            }[] | undefined;
+        };
+    };
+    toolset?: '*' | Record<string, AgentSessionIntegrationPolicyInput> | undefined;
+    pinned_tools?: Record<string, string[]> | undefined;
+    meta_tools?: Record<string, boolean> | undefined;
+    expires_in?: string | undefined;
+}
+export interface AgentSessionToolsetSummary {
+    connected: boolean;
+    tools_pinned: number;
+    tools_searchable: number;
+}
+export interface AgentSessionMetaToolsSummary {
+    nango_tool_search: boolean;
+    nango_execute: boolean;
+}
+export interface AgentSessionUnknownMetaToolsPayload {
+    meta_tools: string[];
+}
+/**
+ * Creating a session does not require the connections read scope, so a returned candidate names the
+ * connection and nothing else. The tags that made it a candidate are on the session created
+ * operation, which is where an ambiguity gets debugged.
+ */
+export interface AgentSessionReturnedCandidate {
+    connection_id: string;
+}
+export interface AgentSessionAmbiguousConnectionsReply {
+    integrations: Record<string, {
+        match_count: number;
+        candidates: AgentSessionReturnedCandidate[];
+    }>;
+}
+export interface AgentSessionPinnedConnectionNotMatchedReply {
+    pinned: {
+        integration_id: string;
+        connection_id: string;
+        candidates: AgentSessionReturnedCandidate[];
+    }[];
+}
+export type AgentSessionCreationErrorCode = 'ambiguous_connections' | 'unknown_pinned_connection' | 'pinned_connection_not_matched' | 'unknown_integration' | 'unknown_tool' | 'unsupported_function_type' | 'tool_not_in_toolset' | 'unknown_meta_tool';
+/**
+ * The payload is not correlated to the code by the compiler on purpose. AgentSessionCreationError
+ * carries it as a plain record, so a discriminated union here would only be a cast at the caller.
+ */
+export type AgentSessionCreationErrorPayload = AgentSessionAmbiguousConnectionsReply | AgentSessionUnknownPinnedConnectionsPayload | AgentSessionPinnedConnectionNotMatchedReply | AgentSessionUnknownIntegrationsPayload | AgentSessionUnknownToolsPayload | AgentSessionUnsupportedFunctionTypesPayload | AgentSessionToolsNotInToolsetPayload | AgentSessionUnknownMetaToolsPayload;
+export type PostAgentSessionsCreationError = ApiError<AgentSessionCreationErrorCode, undefined, AgentSessionCreationErrorPayload>;
+export type PostAgentSessions = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
+    Method: 'POST';
+    Path: '/sessions';
+    Body: PostAgentSessionsBody;
+    Error: PostAgentSessionsCreationError;
+    Success: {
+        data: {
+            session_id: string;
+            session_token: string;
+            mcp_url: string;
+            expires_at: string;
+            toolset: Record<string, AgentSessionToolsetSummary>;
+            meta_tools: AgentSessionMetaToolsSummary;
+        };
+    };
+}>;

package/dist/agent/connections.d.ts

@@ -0,0 +1,44 @@
+import type { Tags } from '../db.js';
+export interface AgentSessionConnectionSelector {
+    readonly tags: Tags;
+}
+export interface AgentSessionPinnedConnection {
+    readonly integrationId: string;
+    readonly connectionId: string;
+}
+export interface AgentSessionTenantConnections {
+    readonly any: AgentSessionConnectionSelector[];
+    readonly pinned: AgentSessionPinnedConnection[];
+}
+export interface AgentSessionResolvedConnection {
+    readonly integrationId: string;
+    readonly provider: string;
+    readonly connectionId: string;
+    readonly internalConnectionId: number;
+    readonly configId: number;
+}
+export type AgentSessionResolvedConnections = Record<string, AgentSessionResolvedConnection>;
+export type AgentSessionConnectionResolutionErrorCode = 'ambiguous_connections' | 'pinned_connection_not_matched' | 'unknown_pinned_connection';
+export interface AgentSessionConnectionCandidateReport {
+    readonly connection_id: string;
+    readonly tags: Tags;
+}
+export interface AgentSessionAmbiguousConnectionsPayload {
+    readonly integrations: Record<string, {
+        readonly match_count: number;
+        readonly candidates: AgentSessionConnectionCandidateReport[];
+    }>;
+}
+export interface AgentSessionUnknownPinnedConnectionsPayload {
+    readonly pinned: {
+        readonly integration_id: string;
+        readonly connection_id: string;
+    }[];
+}
+export interface AgentSessionPinnedConnectionNotMatchedPayload {
+    readonly pinned: {
+        readonly integration_id: string;
+        readonly connection_id: string;
+        readonly candidates: AgentSessionConnectionCandidateReport[];
+    }[];
+}

package/dist/agent/mcp.api.d.ts

@@ -0,0 +1,28 @@
+import type { ApiEndpoint, ApiError } from '../api.js';
+export type AgentSessionMcpErrorCode = 'session_not_found';
+export type PostAgentSessionMcp = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
+    Method: 'POST';
+    Path: '/session/:sessionId/mcp';
+    Params: {
+        sessionId: string;
+    };
+    Body: Record<string, unknown>;
+    Success: Record<string, unknown>;
+    Error: ApiError<AgentSessionMcpErrorCode>;
+}>;
+export type GetAgentSessionMcp = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/session/:sessionId/mcp';
+    Params: {
+        sessionId: string;
+    };
+    Success: Record<string, unknown>;
+}>;

package/dist/agent/session.d.ts

@@ -0,0 +1,20 @@
+import type { AgentSessionResolvedConnections } from './connections.js';
+import type { AgentSessionCompiledToolset } from './toolset.js';
+export interface AgentSessionMetaTools {
+    readonly nangoToolSearch: boolean;
+    readonly nangoExecute: boolean;
+}
+export type AgentSessionEndedReason = 'terminated' | 'expired';
+export interface AgentSession {
+    readonly id: string;
+    readonly environmentId: number;
+    readonly accountId: number;
+    readonly resolvedConnections: AgentSessionResolvedConnections;
+    readonly compiledToolset: AgentSessionCompiledToolset;
+    readonly metaTools: AgentSessionMetaTools;
+    readonly expiresAt: Date;
+    readonly endedAt: Date | null;
+    readonly endedReason: AgentSessionEndedReason | null;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+}

package/dist/agent/toolset.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `allow` absent means every tool on the integration. `allow` present makes the
+ * integration an allowlist. `deny` always subtracts from whatever `allow` gave.
+ */
+export interface AgentSessionIntegrationPolicy {
+    readonly allow: '*' | readonly string[];
+    readonly deny: readonly string[];
+}
+export type AgentSessionToolsetPolicy = '*' | Readonly<Record<string, AgentSessionIntegrationPolicy>>;
+export type AgentSessionPinnedTools = Readonly<Record<string, readonly string[]>>;
+export interface AgentSessionCompiledTool {
+    readonly name: string;
+    readonly description: string;
+}
+export interface AgentSessionCompiledIntegration {
+    readonly provider: string;
+    readonly pinned: AgentSessionCompiledTool[];
+    readonly searchable: AgentSessionCompiledTool[];
+}
+export type AgentSessionCompiledToolset = Record<string, AgentSessionCompiledIntegration>;
+export type AgentSessionToolsetCompilationErrorCode = 'unknown_integration' | 'unknown_tool' | 'unsupported_function_type' | 'tool_not_in_toolset';
+export interface AgentSessionUnknownIntegrationsPayload {
+    readonly integrations: string[];
+}
+export interface AgentSessionUnknownToolsPayload {
+    readonly tools: {
+        readonly integration_id: string;
+        readonly tool: string;
+    }[];
+}
+export interface AgentSessionUnsupportedFunctionTypesPayload {
+    readonly tools: {
+        readonly integration_id: string;
+        readonly tool: string;
+        readonly type: string;
+    }[];
+}
+export interface AgentSessionToolsNotInToolsetPayload {
+    readonly pinned: {
+        readonly integration_id: string;
+        readonly tool: string;
+    }[];
+}

package/dist/api-keys/scopes.d.ts

@@ -1,5 +1,10 @@
-export declare const API_KEY_SCOPES: readonly ["environment:*", "environment:integrations:list", "environment:integrations:list_credentials", "environment:integrations:list_functions", "environment:integrations:read", "environment:integrations:read_credentials", "environment:integrations:create", "environment:integrations:update", "environment:integrations:delete", "environment:integrations:*", "environment:connections:list", "environment:connections:list_credentials", "environment:connections:read", "environment:connections:read_credentials", "environment:connections:create", "environment:connections:update", "environment:connections:delete", "environment:connections:*", "environment:connect_sessions:write", "environment:syncs:read", "environment:syncs:execute", "environment:syncs:update", "environment:syncs:variant:create", "environment:syncs:variant:delete", "environment:syncs:*", "environment:functions:list", "environment:functions:read", "environment:functions:delete", "environment:functions:compile", "environment:functions:dryrun", "environment:functions:*", "environment:deploy", "environment:records:read", "environment:records:write", "environment:records:*", "environment:logs:read", "environment:actions:execute", "environment:actions:*", "environment:proxy", "environment:variables:read", "environment:mcp"];
-export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
-export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:*", "account:billing:read", "account:team:invite_member"];
-export type AccountApiKeyScope = (typeof ACCOUNT_API_KEY_SCOPES)[number];
+/** Every wildcard in a namespace: `environment:*`, `environment:connections:*`, … */
+export type WildcardsFor<Namespace extends string> = `${Namespace}:*` | `${Namespace}:${string}:*`;
+export declare const API_KEY_SCOPES: readonly ["environment:integrations:list", "environment:integrations:list_credentials", "environment:integrations:list_functions", "environment:integrations:read", "environment:integrations:read_credentials", "environment:integrations:create", "environment:integrations:update", "environment:integrations:delete", "environment:connections:list", "environment:connections:list_credentials", "environment:connections:read", "environment:connections:read_credentials", "environment:connections:create", "environment:connections:update", "environment:connections:delete", "environment:connect_sessions:write", "environment:agent_sessions:write", "environment:syncs:read", "environment:syncs:execute", "environment:syncs:update", "environment:syncs:variant:create", "environment:syncs:variant:delete", "environment:functions:list", "environment:functions:read", "environment:functions:delete", "environment:functions:compile", "environment:functions:dryrun", "environment:functions:invocations", "environment:deploy", "environment:records:read", "environment:records:write", "environment:logs:read", "environment:actions:execute", "environment:proxy", "environment:variables:read", "environment:webhook_signing_key:rotate", "environment:mcp"];
+export type ConcreteApiKeyScope = (typeof API_KEY_SCOPES)[number];
+/** A scope, or a wildcard over scopes. Which wildcards resolve to something is checked at runtime. */
+export type ApiKeyScope = ConcreteApiKeyScope | WildcardsFor<'environment'>;
+export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:environments:create", "account:environments:delete", "account:environments:set_production", "account:environments:api_keys:create", "account:environments:api_keys:delete"];
+export type ConcreteAccountApiKeyScope = (typeof ACCOUNT_API_KEY_SCOPES)[number];
+export type AccountApiKeyScope = ConcreteAccountApiKeyScope | WildcardsFor<'account'>;
 export type CustomerKeyScope = ApiKeyScope | AccountApiKeyScope;

package/dist/api.endpoints.d.ts

@@ -1,8 +1,10 @@
-import type { ConfirmEmail, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, GetOnboardingAccountDiscovery, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostOnboardingRequestInvite, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
+import type { ConfirmEmail, CreateAccountApiKey, DeleteAccountApiKey, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, GetOnboardingAccountDiscovery, ListAccountApiKeys, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostOnboardingRequestInvite, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
 import type { GetAsyncActionResult, GetPublicV1, PostInternalTriggerFunction, PostPublicTriggerAction } from './action/api.js';
 import type { PostImpersonate } from './admin/http.api.js';
+import type { PostAgentSessions } from './agent/api.js';
+import type { GetAgentSessionMcp, PostAgentSessionMcp } from './agent/mcp.api.js';
 import type { EndpointMethod } from './api.js';
-import type { GetAuditTrail } from './audit-trail/api.js';
+import type { GetAuditTrail, GetAuditTrailExport } from './audit-trail/api.js';
 import type { PostPublicApiKeyAuthorization, PostPublicAwsSigV4Authorization, PostPublicBasicAuthorization, PostPublicBillAuthorization, PostPublicJwtAuthorization, PostPublicOauthOutboundAuthorization, PostPublicSignatureAuthorization, PostPublicTbaAuthorization, PostPublicTwoStepAuthorization, PostPublicUnauthenticatedAuthorization } from './auth/http.api.js';
 import type { PostCliTelemetry } from './cli/api.js';
 import type { GetPublicClientMetadata } from './clientMetadata/http.api.js';
@@ -11,11 +13,11 @@ import type { DeleteConnection, DeletePublicConnection, GetConnection, GetConnec
 import type { PostConnectionMetadata, SetMetadata, UpdateMetadata } from './connection/api/metadata.js';
 import type { GetConnectUISettings, PutConnectUISettings } from './connectUISettings/api.js';
 import type { PostDeploy, PostDeployConfirmation, PostDeployInternal } from './deploy/api.js';
-import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, GetEnvironment, GetEnvironments, ListApiKeys, PatchApiKey, PatchEnvironment, PostEnvironment } from './environment/api/index.js';
+import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, DeletePublicApiKey, DeletePublicEnvironment, GetEnvironment, GetEnvironments, ListApiKeys, PatchApiKey, PatchEnvironment, PostEnvironment, PostPublicApiKey, PostPublicEnvironment, PostPublicRotateWebhookSigningKey, PostRotateWebhookSigningKey } from './environment/api/index.js';
 import type { PatchWebhook } from './environment/api/webhook.js';
 import type { PostEnvironmentVariables } from './environment/variable/api.js';
 import type { PatchFlowDisable, PatchFlowEnable, PatchFlowFrequency, PostPreBuiltDeploy, PutUpgradePreBuiltFlow } from './flow/http.api.js';
-import type { DeleteIntegrationFunction, DeletePublicIntegrationFunction, GetFunctionDeployment, GetFunctionDryrun, GetIntegrationFunction, GetIntegrationFunctions, GetIntegrationTemplates, GetProviderTemplates, GetPublicIntegrationFunction, GetPublicIntegrationFunctions, GetPublicProviderTemplates, PostFunctionCompile, PostFunctionDeployment, PostFunctionDeploymentBundle, PostFunctionDeploymentBundlePreview, PostFunctionDeploymentResult, PostFunctionDryrun, PostFunctionDryrunResult } from './functions/api.js';
+import type { DeleteIntegrationFunction, DeletePublicIntegrationFunction, GetFunctionDeployment, GetFunctionDryrun, GetFunctionInvocation, GetIntegrationFunction, GetIntegrationFunctions, GetIntegrationTemplates, GetProviderTemplates, GetPublicIntegrationFunction, GetPublicIntegrationFunctions, GetPublicProviderTemplates, PostFunctionCompile, PostFunctionDeployment, PostFunctionDeploymentBundle, PostFunctionDeploymentBundlePreview, PostFunctionDeploymentResult, PostFunctionDryrun, PostFunctionDryrunResult, PostFunctionInvocation } from './functions/api.js';
 import type { GetGettingStarted, PatchGettingStarted } from './gettingStarted/api.js';
 import type { DeleteIntegration, DeletePublicIntegration, GetFunctionCode, GetIntegration, GetIntegrationFlows, GetPublicFunctionCode, GetPublicIntegration, GetPublicListIntegrations, PatchIntegration, PatchPublicIntegration, PostIntegration, PostPublicIntegration, PostPublicQuickstartIntegration } from './integration/api.js';
 import type { DeleteInvite, GetInvite, PostInvite } from './invitations/api.js';
@@ -23,7 +25,7 @@ import type { GetOperation, PostInsights, SearchFilters, SearchMessages, SearchO
 import type { GetMeta } from './meta/api.js';
 import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFALoginVerification, PostMFARecoveryCodes } from './mfa/api.js';
 import type { GetPlainHmac } from './plain/api.js';
-import type { GetBillingUsage, GetBillingUsageTopDimensionValues, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails } from './plans/http.api.js';
+import type { DeleteSpendAlert, GetBillingPeriodCosts, GetBillingUsage, GetBillingUsageTopDimensionValues, GetOverdueInvoices, GetSpendAlert, GetUpcomingInvoice, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails, PutSpendAlert } from './plans/http.api.js';
 import type { GetProvider, GetProviders, GetPublicProvider, GetPublicProviders } from './providers/api.js';
 import type { AllPublicProxy } from './proxy/http.api.js';
 import type { GetConnectionRecordModels, GetConnectionRecords, GetPublicRecords, PatchPublicPruneRecords } from './record/api.js';
@@ -33,8 +35,8 @@ import type { GetPublicSyncStatus, PostPublicSyncPause, PostPublicSyncStart, Pos
 import type { DeleteTeamUser, GetTeam, PatchTeamUser, PutTeam } from './team/api.js';
 import type { GetUser, PatchUser, PutUserPassword } from './user/api.js';
 import type { PostPublicWebhook } from './webhooks/http.api.js';
-export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | AllPublicProxy;
-export type PrivateApiEndpoints = GetAuditTrail | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
+export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostAgentSessions | PostAgentSessionMcp | GetAgentSessionMcp | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionInvocation | GetFunctionInvocation | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | PostPublicRotateWebhookSigningKey | AllPublicProxy | PostPublicEnvironment | DeletePublicEnvironment | PostPublicApiKey | DeletePublicApiKey;
+export type PrivateApiEndpoints = GetAuditTrail | GetAuditTrailExport | ListAccountApiKeys | CreateAccountApiKey | DeleteAccountApiKey | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetOverdueInvoices | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUpcomingInvoice | GetBillingPeriodCosts | GetSpendAlert | PutSpendAlert | DeleteSpendAlert | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | PostRotateWebhookSigningKey | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
 export type APIEndpoints = PrivateApiEndpoints | PublicApiEndpoints;
 /**
  * Automatically narrow endpoints type with Method + Path

package/dist/audit-trail/api.d.ts

@@ -1,5 +1,5 @@
-import type { ApiEndpoint } from '../api.js';
-import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditResource, AuditTarget, AuditTrailVersion } from './event.js';
+import type { ApiEndpoint, ApiError } from '../api.js';
+import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditPolicy, AuditResource, AuditTarget, AuditTrailVersion, AuditVia } from './event.js';
 export interface ApiAuditTrailEvent {
     id: string;
     version: AuditTrailVersion;
@@ -10,7 +10,7 @@ export interface ApiAuditTrailEvent {
         display: string;
     } | null;
     actor: AuditActor;
-    via?: AuditActor[];
+    via?: AuditVia[];
     targets: AuditTarget[];
     context: AuditContext;
     outcome: AuditOutcome;
@@ -19,12 +19,10 @@ export interface ApiAuditTrailEvent {
     metadata?: Record<string, unknown>;
 }
 export type GetAuditTrail = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'non-auditable';
-    };
+    Audit: AuditPolicy<'audit_trail', 'queried', 'account'>;
     Method: 'GET';
     Path: '/api/v1/audit-trail';
+    Error: ApiError<'feature_disabled'>;
     Querystring: {
         cursor?: string;
         from?: string;
@@ -39,3 +37,17 @@ export type GetAuditTrail = ApiEndpoint<{
         };
     };
 }>;
+export type AuditExportMaxRows = 50_000;
+export type GetAuditTrailExport = ApiEndpoint<{
+    Audit: AuditPolicy<'audit_trail', 'exported', 'account'>;
+    Method: 'GET';
+    Path: '/api/v1/audit-trail/export';
+    Error: ApiError<'feature_disabled'>;
+    Querystring: {
+        from?: string;
+        to?: string;
+        resources?: string;
+        actions?: string;
+    };
+    Success: never;
+}>;

package/dist/audit-trail/event.d.ts

@@ -1,6 +1,7 @@
 export type AuditTrailVersion = '2026-07-16';
-export type AuditActorType = 'user' | 'api_key' | 'system' | 'anonymous';
+export type AuditActorType = 'user' | 'api_key' | 'connect_session' | 'anonymous' | 'unknown';
 export type AuditOutcome = 'success' | 'failure' | 'denied';
+export type AuditViaType = 'impersonation';
 export type AuditInterface = 'api' | 'mcp';
 interface AuditEventTable {
     connection: 'created' | 'updated' | 'metadata_updated' | 'refreshed' | 'deleted';
@@ -11,10 +12,11 @@ interface AuditEventTable {
     member: 'invited' | 'invite_accepted' | 'invite_declined' | 'invite_revoked' | 'role_changed' | 'removed';
     team: 'updated';
     user: 'updated';
-    environment: 'created' | 'updated' | 'variables_changed' | 'webhook_urls_changed' | 'deleted';
+    environment: 'created' | 'updated' | 'variables_changed' | 'webhook_urls_changed' | 'webhook_signing_key_rotated' | 'deleted';
     app_auth: 'login' | 'logout' | 'signup' | 'password_changed' | 'password_reset';
     mfa: 'enrolled' | 'enabled' | 'disabled' | 'verified' | 'recovery_regenerated';
-    billing: 'plan_changed' | 'trial_extended' | 'details_changed' | 'payment_method_added' | 'payment_method_removed';
+    billing: 'plan_changed' | 'trial_extended' | 'details_changed' | 'payment_method_added' | 'payment_method_removed' | 'spend_alert_changed' | 'spend_alert_removed';
+    audit_trail: 'exported' | 'queried';
 }
 export type AuditResource = keyof AuditEventTable;
 export type AuditActionOf<R extends AuditResource> = AuditEventTable[R];
@@ -29,6 +31,12 @@ export interface AuditActor {
     id: string;
     display?: string;
 }
+export interface AuditVia {
+    type: AuditViaType;
+    id: string;
+    display?: string;
+    actorId?: string;
+}
 export interface AuditTarget {
     type: AuditTargetType;
     id: string;
@@ -39,6 +47,15 @@ export interface AuditContext {
     ip?: string;
     userAgent?: string;
 }
+export interface AuditAttribution {
+    kind: 'request';
+    actor: AuditActor;
+    context: AuditContext;
+}
+export interface NoAttribution {
+    kind: 'no-attribution';
+    reason: string;
+}
 export interface AuditPolicy<R extends AuditResource = AuditResource, A extends AuditActionOf<R> = AuditActionOf<R>, S extends AuditScope = AuditScope> {
     kind: 'audit';
     resource: R;

package/dist/auth/http.api.d.ts

@@ -1,4 +1,5 @@
 import type { ApiEndpoint, ApiError } from '../api.js';
+import type { AuditPolicy } from '../audit-trail/event.js';
 export type ConnectionQueryString = {
     connection_id?: string | undefined;
     params?: Record<string, any> | undefined;
@@ -35,10 +36,7 @@ export interface WebSocketConnectionResponseSuccess {
 }
 type AuthErrors = ApiError<'invalid_body'> | ApiError<'invalid_query_params'> | ApiError<'unknown_provider_config'> | ApiError<'unknown_provider_template'> | ApiError<'invalid_auth_mode'> | ApiError<'invalid_credentials'> | ApiError<'integration_not_allowed'> | ApiError<'invalid_connection'> | ApiError<'connection_test_failed'> | ApiError<'connection_validation_failed'>;
 export type PostPublicApiKeyAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         apiKey: string;
@@ -52,10 +50,7 @@ export type PostPublicApiKeyAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicBasicAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         username: string;
@@ -70,10 +65,7 @@ export type PostPublicBasicAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicTbaAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         token_id: string;
@@ -91,10 +83,7 @@ export type PostPublicTbaAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicJwtAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: Record<string, any>;
     Querystring: ConnectionQueryString;
@@ -106,10 +95,7 @@ export type PostPublicJwtAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicUnauthenticatedAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Querystring: ConnectionQueryString;
     Params: {
@@ -120,10 +106,7 @@ export type PostPublicUnauthenticatedAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicBillAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         username: string;
@@ -140,10 +123,7 @@ export type PostPublicBillAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicTwoStepAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: Record<string, any>;
     Querystring: ConnectionQueryString;
@@ -155,10 +135,7 @@ export type PostPublicTwoStepAuthorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicSignatureAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         username: string;
@@ -174,10 +151,7 @@ export type PostPublicSignatureAuthorization = ApiEndpoint<{
 }>;
 type AwsSigV4AuthErrors = AuthErrors | ApiError<'invalid_aws_sigv4_config'> | ApiError<'missing_aws_sigv4_service'> | ApiError<'missing_aws_sigv4_sts_endpoint'> | ApiError<'missing_aws_sigv4_builtin_credentials'> | ApiError<'missing_aws_sigv4_region'> | ApiError<'aws_sigv4_sts_request_failed'>;
 export type PostPublicAwsSigV4Authorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         role_arn: string;
@@ -192,10 +166,7 @@ export type PostPublicAwsSigV4Authorization = ApiEndpoint<{
     Success: ConnectionResponseSuccess;
 }>;
 export type PostPublicOauthOutboundAuthorization = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'TODO: audit coverage pending';
-    };
+    Audit: AuditPolicy<'connection', 'created', 'environment'>;
     Method: 'POST';
     Body: {
         username: string;

package/dist/authz/types.d.ts

@@ -1,6 +1,6 @@
 import type { Role } from '../user/db.js';
 export type Action = 'create' | 'read' | 'update' | 'delete' | '*';
-export type Resource = 'team' | 'team_member' | 'invite' | 'connect_ui_settings' | 'billing' | 'plan' | 'environment' | 'environment_production_flag' | 'environment_key' | 'environment_variable' | 'webhook' | 'integration' | 'connection' | 'flow' | 'sync_command' | 'secret_key' | 'connection_credential' | 'log' | 'audit_trail' | '*';
+export type Resource = 'team' | 'team_member' | 'invite' | 'connect_ui_settings' | 'billing' | 'plan' | 'environment' | 'environment_production_flag' | 'environment_key' | 'account_key' | 'environment_variable' | 'webhook' | 'integration' | 'connection' | 'flow' | 'sync_command' | 'secret_key' | 'connection_credential' | 'log' | 'audit_trail' | '*';
 export type Scope = 'production' | 'non-production' | 'global';
 export interface Permission {
     action: Action;