@nangohq/types 0.71.4 → 0.71.6

package/dist/account/api.d.ts

@@ -1,6 +1,52 @@
+import type { AccountApiKeyScope } from '../api-keys/scopes.js';
 import type { ApiEndpoint, ApiError } from '../api.js';
 import type { AuditPolicy } from '../audit-trail/event.js';
+import type { MFACredential } from '../mfa/credential.js';
 import type { ApiUser } from '../user/api.js';
+export interface AccountApiKey {
+    id: number;
+    uuid: string;
+    display_name: string;
+    scopes: AccountApiKeyScope[];
+    secret: string;
+    last_used_at: string | null;
+    created_at: string;
+}
+export type ListAccountApiKeys = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/account/api-keys';
+    Success: {
+        data: AccountApiKey[];
+    };
+}>;
+export type CreateAccountApiKey = ApiEndpoint<{
+    Audit: AuditPolicy<'api_key', 'created', 'account'>;
+    Method: 'POST';
+    Path: '/api/v1/account/api-keys';
+    Body: {
+        display_name: string;
+    };
+    Success: {
+        data: Omit<AccountApiKey, 'last_used_at'>;
+    };
+    Error: ApiError<'conflict' | 'resource_capped'>;
+}>;
+export type DeleteAccountApiKey = ApiEndpoint<{
+    Audit: AuditPolicy<'api_key', 'deleted', 'account'>;
+    Method: 'DELETE';
+    Path: '/api/v1/account/api-keys/:keyId';
+    Params: {
+        keyId: number;
+    };
+    Success: {
+        success: true;
+    };
+    Error: ApiError<'not_found'>;
+}>;
 export type PostSignup = ApiEndpoint<{
     Audit: AuditPolicy<'app_auth', 'signup', 'account'>;
     Method: 'POST';
@@ -12,7 +58,7 @@ export type PostSignup = ApiEndpoint<{
         token?: string | undefined;
         foundUs?: string | undefined;
     };
-    Error: ApiError<'email_already_verified'> | ApiError<'error_creating_user'> | ApiError<'user_already_exists'> | ApiError<'error_creating_account'> | ApiError<'invalid_invite_token'> | ApiError<'email_not_verified'>;
+    Error: ApiError<'email_already_verified'> | ApiError<'error_creating_user'> | ApiError<'user_already_exists'> | ApiError<'error_creating_account'> | ApiError<'not_found'> | ApiError<'email_not_verified'>;
     Success: {
         data: {
             uuid: string;
@@ -144,8 +190,9 @@ export type PutResetPassword = ApiEndpoint<{
     Body: {
         token: string;
         password: string;
+        mfa?: MFACredential | undefined;
     };
-    Error: ApiError<'user_not_found'> | ApiError<'invalid_token'>;
+    Error: ApiError<'user_not_found'> | ApiError<'invalid_token'> | ApiError<'invalid_mfa_code'> | ApiError<'mfa_code_required'>;
     Success: {
         success: true;
     };

package/dist/action/api.d.ts

@@ -1,4 +1,8 @@
 import type { ApiEndpoint } from '../api.js';
+export interface AsyncFunctionResponse {
+    id: string;
+    statusUrl: string;
+}
 export interface AsyncActionResponse {
     id: string;
     statusUrl: string;

package/dist/admin/http.api.d.ts

@@ -14,7 +14,7 @@ export type PostImpersonate = ApiEndpoint<{
         loginReason: string;
         code?: string | undefined;
     };
-    Error: ApiError<'invalid_mfa_code'> | ApiError<'mfa_not_enabled'>;
+    Error: ApiError<'invalid_mfa_code'> | ApiError<'mfa_code_required'> | ApiError<'mfa_not_enabled'>;
     Success: {
         success: true;
     };

package/dist/agent/api.d.ts

@@ -0,0 +1,88 @@
+import type { ApiEndpoint, ApiError } from '../api.js';
+import type { Tags } from '../db.js';
+import type { AgentSessionUnknownPinnedConnectionsPayload } from './connections.js';
+import type { AgentSessionToolsNotInToolsetPayload, AgentSessionUnknownIntegrationsPayload, AgentSessionUnknownToolsPayload, AgentSessionUnsupportedFunctionTypesPayload } from './toolset.js';
+export interface AgentSessionToolListInput {
+    tools: string[];
+}
+export type AgentSessionIntegrationPolicyInput = '*' | {
+    allow?: AgentSessionToolListInput | '*' | undefined;
+    deny?: AgentSessionToolListInput | undefined;
+};
+export interface PostAgentSessionsBody {
+    tenant: {
+        connections: {
+            any?: {
+                tags: Tags;
+            }[] | undefined;
+            pinned?: {
+                integration_id: string;
+                connection_id: string;
+            }[] | undefined;
+        };
+    };
+    toolset?: '*' | Record<string, AgentSessionIntegrationPolicyInput> | undefined;
+    pinned_tools?: Record<string, string[]> | undefined;
+    meta_tools?: Record<string, boolean> | undefined;
+    expires_in?: string | undefined;
+}
+export interface AgentSessionToolsetSummary {
+    connected: boolean;
+    tools_pinned: number;
+    tools_searchable: number;
+}
+export interface AgentSessionMetaToolsSummary {
+    nango_tool_search: boolean;
+    nango_execute: boolean;
+}
+export interface AgentSessionUnknownMetaToolsPayload {
+    meta_tools: string[];
+}
+/**
+ * Creating a session does not require the connections read scope, so a returned candidate names the
+ * connection and nothing else. The tags that made it a candidate are on the session created
+ * operation, which is where an ambiguity gets debugged.
+ */
+export interface AgentSessionReturnedCandidate {
+    connection_id: string;
+}
+export interface AgentSessionAmbiguousConnectionsReply {
+    integrations: Record<string, {
+        match_count: number;
+        candidates: AgentSessionReturnedCandidate[];
+    }>;
+}
+export interface AgentSessionPinnedConnectionNotMatchedReply {
+    pinned: {
+        integration_id: string;
+        connection_id: string;
+        candidates: AgentSessionReturnedCandidate[];
+    }[];
+}
+export type AgentSessionCreationErrorCode = 'ambiguous_connections' | 'unknown_pinned_connection' | 'pinned_connection_not_matched' | 'unknown_integration' | 'unknown_tool' | 'unsupported_function_type' | 'tool_not_in_toolset' | 'unknown_meta_tool';
+/**
+ * The payload is not correlated to the code by the compiler on purpose. AgentSessionCreationError
+ * carries it as a plain record, so a discriminated union here would only be a cast at the caller.
+ */
+export type AgentSessionCreationErrorPayload = AgentSessionAmbiguousConnectionsReply | AgentSessionUnknownPinnedConnectionsPayload | AgentSessionPinnedConnectionNotMatchedReply | AgentSessionUnknownIntegrationsPayload | AgentSessionUnknownToolsPayload | AgentSessionUnsupportedFunctionTypesPayload | AgentSessionToolsNotInToolsetPayload | AgentSessionUnknownMetaToolsPayload;
+export type PostAgentSessionsCreationError = ApiError<AgentSessionCreationErrorCode, undefined, AgentSessionCreationErrorPayload>;
+export type PostAgentSessions = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
+    Method: 'POST';
+    Path: '/sessions';
+    Body: PostAgentSessionsBody;
+    Error: PostAgentSessionsCreationError;
+    Success: {
+        data: {
+            session_id: string;
+            session_token: string;
+            mcp_url: string;
+            expires_at: string;
+            toolset: Record<string, AgentSessionToolsetSummary>;
+            meta_tools: AgentSessionMetaToolsSummary;
+        };
+    };
+}>;

package/dist/agent/connections.d.ts

@@ -0,0 +1,44 @@
+import type { Tags } from '../db.js';
+export interface AgentSessionConnectionSelector {
+    readonly tags: Tags;
+}
+export interface AgentSessionPinnedConnection {
+    readonly integrationId: string;
+    readonly connectionId: string;
+}
+export interface AgentSessionTenantConnections {
+    readonly any: AgentSessionConnectionSelector[];
+    readonly pinned: AgentSessionPinnedConnection[];
+}
+export interface AgentSessionResolvedConnection {
+    readonly integrationId: string;
+    readonly provider: string;
+    readonly connectionId: string;
+    readonly internalConnectionId: number;
+    readonly configId: number;
+}
+export type AgentSessionResolvedConnections = Record<string, AgentSessionResolvedConnection>;
+export type AgentSessionConnectionResolutionErrorCode = 'ambiguous_connections' | 'pinned_connection_not_matched' | 'unknown_pinned_connection';
+export interface AgentSessionConnectionCandidateReport {
+    readonly connection_id: string;
+    readonly tags: Tags;
+}
+export interface AgentSessionAmbiguousConnectionsPayload {
+    readonly integrations: Record<string, {
+        readonly match_count: number;
+        readonly candidates: AgentSessionConnectionCandidateReport[];
+    }>;
+}
+export interface AgentSessionUnknownPinnedConnectionsPayload {
+    readonly pinned: {
+        readonly integration_id: string;
+        readonly connection_id: string;
+    }[];
+}
+export interface AgentSessionPinnedConnectionNotMatchedPayload {
+    readonly pinned: {
+        readonly integration_id: string;
+        readonly connection_id: string;
+        readonly candidates: AgentSessionConnectionCandidateReport[];
+    }[];
+}

package/dist/agent/mcp.api.d.ts

@@ -0,0 +1,28 @@
+import type { ApiEndpoint, ApiError } from '../api.js';
+export type AgentSessionMcpErrorCode = 'session_not_found';
+export type PostAgentSessionMcp = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
+    Method: 'POST';
+    Path: '/session/:sessionId/mcp';
+    Params: {
+        sessionId: string;
+    };
+    Body: Record<string, unknown>;
+    Success: Record<string, unknown>;
+    Error: ApiError<AgentSessionMcpErrorCode>;
+}>;
+export type GetAgentSessionMcp = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/session/:sessionId/mcp';
+    Params: {
+        sessionId: string;
+    };
+    Success: Record<string, unknown>;
+}>;

package/dist/agent/session.d.ts

@@ -0,0 +1,20 @@
+import type { AgentSessionResolvedConnections } from './connections.js';
+import type { AgentSessionCompiledToolset } from './toolset.js';
+export interface AgentSessionMetaTools {
+    readonly nangoToolSearch: boolean;
+    readonly nangoExecute: boolean;
+}
+export type AgentSessionEndedReason = 'terminated' | 'expired';
+export interface AgentSession {
+    readonly id: string;
+    readonly environmentId: number;
+    readonly accountId: number;
+    readonly resolvedConnections: AgentSessionResolvedConnections;
+    readonly compiledToolset: AgentSessionCompiledToolset;
+    readonly metaTools: AgentSessionMetaTools;
+    readonly expiresAt: Date;
+    readonly endedAt: Date | null;
+    readonly endedReason: AgentSessionEndedReason | null;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+}

package/dist/agent/toolSearch.d.ts

@@ -0,0 +1,34 @@
+import type { JSONSchema7 } from 'json-schema';
+export type AgentSessionToolConnectionState = {
+    readonly status: 'connected';
+    readonly connection_id: string;
+} | {
+    readonly status: 'not_connected';
+};
+/** `schema` carries the arguments, `none` means there are none, `unavailable` means they could not be read. */
+export type AgentSessionToolInput = {
+    readonly kind: 'schema';
+    readonly schema: JSONSchema7;
+} | {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'unavailable';
+};
+export interface AgentSessionToolMatch {
+    /** What to pass to nango_execute. Names are sanitised and clipped, so use it as given. */
+    readonly tool: string;
+    readonly integration: string;
+    readonly action: string;
+    readonly provider: string;
+    readonly description: string;
+    /** Whether the tool is in the agent's tool list, under the same name. */
+    readonly listed: boolean;
+    readonly connection: AgentSessionToolConnectionState;
+    /** Only on a best match. A soft match is a lead to narrow down, not something to call yet. */
+    readonly input?: AgentSessionToolInput;
+}
+export interface AgentSessionToolSearchResult {
+    readonly guidance: string;
+    readonly matches: AgentSessionToolMatch[];
+    readonly related: AgentSessionToolMatch[];
+}

package/dist/agent/toolset.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `allow` absent means every tool on the integration. `allow` present makes the
+ * integration an allowlist. `deny` always subtracts from whatever `allow` gave.
+ */
+export interface AgentSessionIntegrationPolicy {
+    readonly allow: '*' | readonly string[];
+    readonly deny: readonly string[];
+}
+export type AgentSessionToolsetPolicy = '*' | Readonly<Record<string, AgentSessionIntegrationPolicy>>;
+export type AgentSessionPinnedTools = Readonly<Record<string, readonly string[]>>;
+export interface AgentSessionCompiledTool {
+    readonly name: string;
+    readonly description: string;
+}
+export interface AgentSessionCompiledIntegration {
+    readonly provider: string;
+    readonly pinned: AgentSessionCompiledTool[];
+    readonly searchable: AgentSessionCompiledTool[];
+}
+export type AgentSessionCompiledToolset = Record<string, AgentSessionCompiledIntegration>;
+export type AgentSessionToolsetCompilationErrorCode = 'unknown_integration' | 'unknown_tool' | 'unsupported_function_type' | 'tool_not_in_toolset';
+export interface AgentSessionUnknownIntegrationsPayload {
+    readonly integrations: string[];
+}
+export interface AgentSessionUnknownToolsPayload {
+    readonly tools: {
+        readonly integration_id: string;
+        readonly tool: string;
+    }[];
+}
+export interface AgentSessionUnsupportedFunctionTypesPayload {
+    readonly tools: {
+        readonly integration_id: string;
+        readonly tool: string;
+        readonly type: string;
+    }[];
+}
+export interface AgentSessionToolsNotInToolsetPayload {
+    readonly pinned: {
+        readonly integration_id: string;
+        readonly tool: string;
+    }[];
+}

package/dist/api-keys/auth.d.ts

@@ -23,6 +23,8 @@ export interface ApiKeyAuthDetails {
     source: Exclude<ApiKeyAuthSource, 'connect_session'>;
     scopes?: string[];
     apiKeyId?: number;
+    /** Public identifier of a customer key; absent for the other auth sources, which have no key row. */
+    apiKeyUuid?: string;
     apiKeyDisplayName?: string;
     purpose?: 'dryrun' | 'deploy';
     dryrunId?: string;

package/dist/api-keys/scopes.d.ts

@@ -1,5 +1,10 @@
-export declare const API_KEY_SCOPES: readonly ["environment:*", "environment:integrations:list", "environment:integrations:list_credentials", "environment:integrations:list_functions", "environment:integrations:read", "environment:integrations:read_credentials", "environment:integrations:create", "environment:integrations:update", "environment:integrations:delete", "environment:integrations:*", "environment:connections:list", "environment:connections:list_credentials", "environment:connections:read", "environment:connections:read_credentials", "environment:connections:create", "environment:connections:update", "environment:connections:delete", "environment:connections:*", "environment:connect_sessions:write", "environment:syncs:read", "environment:syncs:execute", "environment:syncs:update", "environment:syncs:variant:create", "environment:syncs:variant:delete", "environment:syncs:*", "environment:functions:list", "environment:functions:read", "environment:functions:delete", "environment:functions:compile", "environment:functions:dryrun", "environment:functions:*", "environment:deploy", "environment:records:read", "environment:records:write", "environment:records:*", "environment:logs:read", "environment:actions:execute", "environment:actions:*", "environment:proxy", "environment:variables:read", "environment:mcp"];
-export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
-export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:*", "account:billing:read", "account:team:invite_member"];
-export type AccountApiKeyScope = (typeof ACCOUNT_API_KEY_SCOPES)[number];
+/** Every wildcard in a namespace: `environment:*`, `environment:connections:*`, … */
+export type WildcardsFor<Namespace extends string> = `${Namespace}:*` | `${Namespace}:${string}:*`;
+export declare const API_KEY_SCOPES: readonly ["environment:integrations:list", "environment:integrations:list_credentials", "environment:integrations:list_functions", "environment:integrations:read", "environment:integrations:read_credentials", "environment:integrations:create", "environment:integrations:update", "environment:integrations:delete", "environment:connections:list", "environment:connections:list_credentials", "environment:connections:read", "environment:connections:read_credentials", "environment:connections:create", "environment:connections:update", "environment:connections:delete", "environment:connect_sessions:write", "environment:agent_sessions:write", "environment:syncs:read", "environment:syncs:execute", "environment:syncs:update", "environment:syncs:variant:create", "environment:syncs:variant:delete", "environment:functions:list", "environment:functions:read", "environment:functions:delete", "environment:functions:compile", "environment:functions:dryrun", "environment:functions:invocations", "environment:deploy", "environment:records:read", "environment:records:write", "environment:logs:read", "environment:actions:execute", "environment:proxy", "environment:variables:read", "environment:webhook_signing_key:rotate", "environment:mcp"];
+export type ConcreteApiKeyScope = (typeof API_KEY_SCOPES)[number];
+/** A scope, or a wildcard over scopes. Which wildcards resolve to something is checked at runtime. */
+export type ApiKeyScope = ConcreteApiKeyScope | WildcardsFor<'environment'>;
+export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:environments:create", "account:environments:delete", "account:environments:set_production", "account:environments:api_keys:create", "account:environments:api_keys:delete"];
+export type ConcreteAccountApiKeyScope = (typeof ACCOUNT_API_KEY_SCOPES)[number];
+export type AccountApiKeyScope = ConcreteAccountApiKeyScope | WildcardsFor<'account'>;
 export type CustomerKeyScope = ApiKeyScope | AccountApiKeyScope;

package/dist/api.endpoints.d.ts

@@ -1,8 +1,10 @@
-import type { ConfirmEmail, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, GetOnboardingAccountDiscovery, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostOnboardingRequestInvite, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
+import type { ConfirmEmail, CreateAccountApiKey, DeleteAccountApiKey, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, GetOnboardingAccountDiscovery, ListAccountApiKeys, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostOnboardingRequestInvite, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
 import type { GetAsyncActionResult, GetPublicV1, PostInternalTriggerFunction, PostPublicTriggerAction } from './action/api.js';
 import type { PostImpersonate } from './admin/http.api.js';
+import type { PostAgentSessions } from './agent/api.js';
+import type { GetAgentSessionMcp, PostAgentSessionMcp } from './agent/mcp.api.js';
 import type { EndpointMethod } from './api.js';
-import type { GetAuditTrail } from './audit-trail/api.js';
+import type { GetAuditTrail, GetAuditTrailExport } from './audit-trail/api.js';
 import type { PostPublicApiKeyAuthorization, PostPublicAwsSigV4Authorization, PostPublicBasicAuthorization, PostPublicBillAuthorization, PostPublicJwtAuthorization, PostPublicOauthOutboundAuthorization, PostPublicSignatureAuthorization, PostPublicTbaAuthorization, PostPublicTwoStepAuthorization, PostPublicUnauthenticatedAuthorization } from './auth/http.api.js';
 import type { PostCliTelemetry } from './cli/api.js';
 import type { GetPublicClientMetadata } from './clientMetadata/http.api.js';
@@ -11,11 +13,11 @@ import type { DeleteConnection, DeletePublicConnection, GetConnection, GetConnec
 import type { PostConnectionMetadata, SetMetadata, UpdateMetadata } from './connection/api/metadata.js';
 import type { GetConnectUISettings, PutConnectUISettings } from './connectUISettings/api.js';
 import type { PostDeploy, PostDeployConfirmation, PostDeployInternal } from './deploy/api.js';
-import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, GetEnvironment, GetEnvironments, ListApiKeys, PatchApiKey, PatchEnvironment, PostEnvironment } from './environment/api/index.js';
+import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, DeletePublicApiKey, DeletePublicEnvironment, GetEnvironment, GetEnvironments, ListApiKeys, PatchApiKey, PatchEnvironment, PostEnvironment, PostPublicApiKey, PostPublicEnvironment, PostPublicRotateWebhookSigningKey, PostRotateWebhookSigningKey } from './environment/api/index.js';
 import type { PatchWebhook } from './environment/api/webhook.js';
 import type { PostEnvironmentVariables } from './environment/variable/api.js';
 import type { PatchFlowDisable, PatchFlowEnable, PatchFlowFrequency, PostPreBuiltDeploy, PutUpgradePreBuiltFlow } from './flow/http.api.js';
-import type { DeleteIntegrationFunction, DeletePublicIntegrationFunction, GetFunctionDeployment, GetFunctionDryrun, GetIntegrationFunction, GetIntegrationFunctions, GetIntegrationTemplates, GetProviderTemplates, GetPublicIntegrationFunction, GetPublicIntegrationFunctions, GetPublicProviderTemplates, PostFunctionCompile, PostFunctionDeployment, PostFunctionDeploymentBundle, PostFunctionDeploymentBundlePreview, PostFunctionDeploymentResult, PostFunctionDryrun, PostFunctionDryrunResult } from './functions/api.js';
+import type { DeleteIntegrationFunction, DeletePublicIntegrationFunction, GetFunctionDeployment, GetFunctionDryrun, GetFunctionInvocation, GetIntegrationFunction, GetIntegrationFunctions, GetIntegrationTemplates, GetProviderTemplates, GetPublicIntegrationFunction, GetPublicIntegrationFunctions, GetPublicProviderTemplates, PostFunctionCompile, PostFunctionDeployment, PostFunctionDeploymentBundle, PostFunctionDeploymentBundlePreview, PostFunctionDeploymentResult, PostFunctionDryrun, PostFunctionDryrunResult, PostFunctionInvocation } from './functions/api.js';
 import type { GetGettingStarted, PatchGettingStarted } from './gettingStarted/api.js';
 import type { DeleteIntegration, DeletePublicIntegration, GetFunctionCode, GetIntegration, GetIntegrationFlows, GetPublicFunctionCode, GetPublicIntegration, GetPublicListIntegrations, PatchIntegration, PatchPublicIntegration, PostIntegration, PostPublicIntegration, PostPublicQuickstartIntegration } from './integration/api.js';
 import type { DeleteInvite, GetInvite, PostInvite } from './invitations/api.js';
@@ -23,7 +25,7 @@ import type { GetOperation, PostInsights, SearchFilters, SearchMessages, SearchO
 import type { GetMeta } from './meta/api.js';
 import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFALoginVerification, PostMFARecoveryCodes } from './mfa/api.js';
 import type { GetPlainHmac } from './plain/api.js';
-import type { GetBillingUsage, GetBillingUsageTopDimensionValues, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails } from './plans/http.api.js';
+import type { DeleteSpendAlert, GetBillingPeriodCosts, GetBillingUsage, GetBillingUsageTopDimensionValues, GetOverdueInvoices, GetSpendAlert, GetUpcomingInvoice, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails, PutSpendAlert } from './plans/http.api.js';
 import type { GetProvider, GetProviders, GetPublicProvider, GetPublicProviders } from './providers/api.js';
 import type { AllPublicProxy } from './proxy/http.api.js';
 import type { GetConnectionRecordModels, GetConnectionRecords, GetPublicRecords, PatchPublicPruneRecords } from './record/api.js';
@@ -33,8 +35,8 @@ import type { GetPublicSyncStatus, PostPublicSyncPause, PostPublicSyncStart, Pos
 import type { DeleteTeamUser, GetTeam, PatchTeamUser, PutTeam } from './team/api.js';
 import type { GetUser, PatchUser, PutUserPassword } from './user/api.js';
 import type { PostPublicWebhook } from './webhooks/http.api.js';
-export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | AllPublicProxy;
-export type PrivateApiEndpoints = GetAuditTrail | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
+export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostAgentSessions | PostAgentSessionMcp | GetAgentSessionMcp | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionInvocation | GetFunctionInvocation | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | PostPublicRotateWebhookSigningKey | AllPublicProxy | PostPublicEnvironment | DeletePublicEnvironment | PostPublicApiKey | DeletePublicApiKey;
+export type PrivateApiEndpoints = GetAuditTrail | GetAuditTrailExport | ListAccountApiKeys | CreateAccountApiKey | DeleteAccountApiKey | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetOverdueInvoices | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUpcomingInvoice | GetBillingPeriodCosts | GetSpendAlert | PutSpendAlert | DeleteSpendAlert | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | PostRotateWebhookSigningKey | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
 export type APIEndpoints = PrivateApiEndpoints | PublicApiEndpoints;
 /**
  * Automatically narrow endpoints type with Method + Path

package/dist/audit-trail/api.d.ts

@@ -1,16 +1,17 @@
-import type { ApiEndpoint } from '../api.js';
-import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditResource, AuditTarget, AuditTrailVersion } from './event.js';
+import type { ApiEndpoint, ApiError } from '../api.js';
+import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditPolicy, AuditResource, AuditScope, AuditTarget, AuditTrailVersion, AuditVia } from './event.js';
 export interface ApiAuditTrailEvent {
     id: string;
     version: AuditTrailVersion;
     occurredAt: string;
     accountId: number;
+    scope: AuditScope;
     environment: {
-        id: number;
+        id: string;
         display: string;
     } | null;
     actor: AuditActor;
-    via?: AuditActor[];
+    via?: AuditVia[];
     targets: AuditTarget[];
     context: AuditContext;
     outcome: AuditOutcome;
@@ -19,12 +20,10 @@ export interface ApiAuditTrailEvent {
     metadata?: Record<string, unknown>;
 }
 export type GetAuditTrail = ApiEndpoint<{
-    Audit: {
-        kind: 'no-audit';
-        reason: 'non-auditable';
-    };
+    Audit: AuditPolicy<'audit_trail', 'queried', 'account'>;
     Method: 'GET';
     Path: '/api/v1/audit-trail';
+    Error: ApiError<'feature_disabled'>;
     Querystring: {
         cursor?: string;
         from?: string;
@@ -39,3 +38,17 @@ export type GetAuditTrail = ApiEndpoint<{
         };
     };
 }>;
+export type AuditExportMaxRows = 50_000;
+export type GetAuditTrailExport = ApiEndpoint<{
+    Audit: AuditPolicy<'audit_trail', 'exported', 'account'>;
+    Method: 'GET';
+    Path: '/api/v1/audit-trail/export';
+    Error: ApiError<'feature_disabled'>;
+    Querystring: {
+        from?: string;
+        to?: string;
+        resources?: string;
+        actions?: string;
+    };
+    Success: never;
+}>;