@nangohq/types 0.71.5 → 0.71.7

package/dist/account/api.d.ts

@@ -5,6 +5,7 @@ import type { MFACredential } from '../mfa/credential.js';
 import type { ApiUser } from '../user/api.js';
 export interface AccountApiKey {
     id: number;
+    uuid: string;
     display_name: string;
     scopes: AccountApiKeyScope[];
     secret: string;

package/dist/agent/api.d.ts

@@ -1,6 +1,7 @@
 import type { ApiEndpoint, ApiError } from '../api.js';
 import type { Tags } from '../db.js';
 import type { AgentSessionUnknownPinnedConnectionsPayload } from './connections.js';
+import type { AgentSessionEndedReason } from './session.js';
 import type { AgentSessionToolsNotInToolsetPayload, AgentSessionUnknownIntegrationsPayload, AgentSessionUnknownToolsPayload, AgentSessionUnsupportedFunctionTypesPayload } from './toolset.js';
 export interface AgentSessionToolListInput {
     tools: string[];
@@ -34,6 +35,7 @@ export interface AgentSessionToolsetSummary {
 export interface AgentSessionMetaToolsSummary {
     nango_tool_search: boolean;
     nango_execute: boolean;
+    nango_proxy: boolean;
 }
 export interface AgentSessionUnknownMetaToolsPayload {
     meta_tools: string[];
@@ -86,3 +88,22 @@ export type PostAgentSessions = ApiEndpoint<{
         };
     };
 }>;
+export interface ApiTerminatedAgentSession {
+    session_id: string;
+    ended_at: string;
+    reason: AgentSessionEndedReason;
+}
+export type DeleteAgentSession = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'TODO: audit coverage pending';
+    };
+    Method: 'DELETE';
+    Path: '/sessions/:sessionId';
+    Params: {
+        sessionId: string;
+    };
+    Success: {
+        data: ApiTerminatedAgentSession;
+    };
+}>;

package/dist/agent/session.d.ts

@@ -3,6 +3,7 @@ import type { AgentSessionCompiledToolset } from './toolset.js';
 export interface AgentSessionMetaTools {
     readonly nangoToolSearch: boolean;
     readonly nangoExecute: boolean;
+    readonly nangoProxy: boolean;
 }
 export type AgentSessionEndedReason = 'terminated' | 'expired';
 export interface AgentSession {

package/dist/agent/toolSearch.d.ts

@@ -0,0 +1,34 @@
+import type { JSONSchema7 } from 'json-schema';
+export type AgentSessionToolConnectionState = {
+    readonly status: 'connected';
+    readonly connection_id: string;
+} | {
+    readonly status: 'not_connected';
+};
+/** `schema` carries the arguments, `none` means there are none, `unavailable` means they could not be read. */
+export type AgentSessionToolInput = {
+    readonly kind: 'schema';
+    readonly schema: JSONSchema7;
+} | {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'unavailable';
+};
+export interface AgentSessionToolMatch {
+    /** What to pass to nango_execute. Names are sanitised and clipped, so use it as given. */
+    readonly tool: string;
+    readonly integration: string;
+    readonly action: string;
+    readonly provider: string;
+    readonly description: string;
+    /** Whether the tool is in the agent's tool list, under the same name. */
+    readonly listed: boolean;
+    readonly connection: AgentSessionToolConnectionState;
+    /** Only on a best match. A soft match is a lead to narrow down, not something to call yet. */
+    readonly input?: AgentSessionToolInput;
+}
+export interface AgentSessionToolSearchResult {
+    readonly guidance: string;
+    readonly matches: AgentSessionToolMatch[];
+    readonly related: AgentSessionToolMatch[];
+}

package/dist/api-keys/auth.d.ts

@@ -23,6 +23,8 @@ export interface ApiKeyAuthDetails {
     source: Exclude<ApiKeyAuthSource, 'connect_session'>;
     scopes?: string[];
     apiKeyId?: number;
+    /** Public identifier of a customer key; absent for the other auth sources, which have no key row. */
+    apiKeyUuid?: string;
     apiKeyDisplayName?: string;
     purpose?: 'dryrun' | 'deploy';
     dryrunId?: string;

package/dist/api-keys/scopes.d.ts

@@ -4,7 +4,7 @@ export declare const API_KEY_SCOPES: readonly ["environment:integrations:list",
 export type ConcreteApiKeyScope = (typeof API_KEY_SCOPES)[number];
 /** A scope, or a wildcard over scopes. Which wildcards resolve to something is checked at runtime. */
 export type ApiKeyScope = ConcreteApiKeyScope | WildcardsFor<'environment'>;
-export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:environments:create", "account:environments:delete", "account:environments:set_production", "account:environments:api_keys:create", "account:environments:api_keys:delete"];
+export declare const ACCOUNT_API_KEY_SCOPES: readonly ["account:environments:list", "account:environments:create", "account:environments:delete", "account:environments:set_production", "account:environments:api_keys:list", "account:environments:api_keys:read", "account:environments:api_keys:create", "account:environments:api_keys:delete"];
 export type ConcreteAccountApiKeyScope = (typeof ACCOUNT_API_KEY_SCOPES)[number];
 export type AccountApiKeyScope = ConcreteAccountApiKeyScope | WildcardsFor<'account'>;
 export type CustomerKeyScope = ApiKeyScope | AccountApiKeyScope;

package/dist/api.endpoints.d.ts

@@ -1,7 +1,7 @@
 import type { ConfirmEmail, CreateAccountApiKey, DeleteAccountApiKey, GetEmailByExpiredToken, GetEmailByUuid, GetManagedCallback, GetManagedEmailVerification, GetOnboardingAccountDiscovery, ListAccountApiKeys, PostForgotPassword, PostLogout, PostManagedEmailVerification, PostManagedSignup, PostOnboardingRequestInvite, PostSignin, PostSignup, PutResetPassword } from './account/api.js';
 import type { GetAsyncActionResult, GetPublicV1, PostInternalTriggerFunction, PostPublicTriggerAction } from './action/api.js';
 import type { PostImpersonate } from './admin/http.api.js';
-import type { PostAgentSessions } from './agent/api.js';
+import type { DeleteAgentSession, PostAgentSessions } from './agent/api.js';
 import type { GetAgentSessionMcp, PostAgentSessionMcp } from './agent/mcp.api.js';
 import type { EndpointMethod } from './api.js';
 import type { GetAuditTrail, GetAuditTrailExport } from './audit-trail/api.js';
@@ -13,7 +13,7 @@ import type { DeleteConnection, DeletePublicConnection, GetConnection, GetConnec
 import type { PostConnectionMetadata, SetMetadata, UpdateMetadata } from './connection/api/metadata.js';
 import type { GetConnectUISettings, PutConnectUISettings } from './connectUISettings/api.js';
 import type { PostDeploy, PostDeployConfirmation, PostDeployInternal } from './deploy/api.js';
-import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, DeletePublicApiKey, DeletePublicEnvironment, GetEnvironment, GetEnvironments, ListApiKeys, PatchApiKey, PatchEnvironment, PostEnvironment, PostPublicApiKey, PostPublicEnvironment, PostPublicRotateWebhookSigningKey, PostRotateWebhookSigningKey } from './environment/api/index.js';
+import type { CreateApiKey, DeleteApiKey, DeleteEnvironment, DeletePublicApiKey, DeletePublicEnvironment, GetEnvironment, GetEnvironments, GetPublicApiKey, GetPublicApiKeys, GetPublicEnvironments, ListApiKeys, PatchApiKey, PatchEnvironment, PostEnvironment, PostPublicApiKey, PostPublicEnvironment, PostPublicRotateWebhookSigningKey, PostRotateWebhookSigningKey } from './environment/api/index.js';
 import type { PatchWebhook } from './environment/api/webhook.js';
 import type { PostEnvironmentVariables } from './environment/variable/api.js';
 import type { PatchFlowDisable, PatchFlowEnable, PatchFlowFrequency, PostPreBuiltDeploy, PutUpgradePreBuiltFlow } from './flow/http.api.js';
@@ -25,18 +25,18 @@ import type { GetOperation, PostInsights, SearchFilters, SearchMessages, SearchO
 import type { GetMeta } from './meta/api.js';
 import type { DeleteMFA, GetMFAStatus, PostMFAActivation, PostMFAEnrollment, PostMFALoginVerification, PostMFARecoveryCodes } from './mfa/api.js';
 import type { GetPlainHmac } from './plain/api.js';
-import type { DeleteSpendAlert, GetBillingPeriodCosts, GetBillingUsage, GetBillingUsageTopDimensionValues, GetOverdueInvoices, GetSpendAlert, GetUpcomingInvoice, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails, PutSpendAlert } from './plans/http.api.js';
+import type { DeleteSpendAlert, GetBillingPeriodCosts, GetBillingUsage, GetBillingUsageTopDimensionValues, GetOverdueInvoices, GetProjectedCosts, GetSpendAlert, GetUpcomingInvoice, PostPlanChange, PostPlanExtendTrial, PutBillingInvoicingDetails, PutSpendAlert } from './plans/http.api.js';
 import type { GetProvider, GetProviders, GetPublicProvider, GetPublicProviders } from './providers/api.js';
 import type { AllPublicProxy } from './proxy/http.api.js';
 import type { GetConnectionRecordModels, GetConnectionRecords, GetPublicRecords, PatchPublicPruneRecords } from './record/api.js';
 import type { GetPublicScriptsConfig } from './scripts/http.api.js';
 import type { GetSharedCredentialsProvider, GetSharedCredentialsProviders, PatchSharedCredentialsProvider, PostSharedCredentialsProvider } from './sharedCredentials/api.js';
-import type { GetPublicSyncStatus, PostPublicSyncPause, PostPublicSyncStart, PostPublicTrigger, PutPublicSyncConnectionFrequency } from './sync/api.js';
+import type { GetConnectionSyncs, GetPublicSyncStatus, PostPublicSyncPause, PostPublicSyncStart, PostPublicTrigger, PutPublicSyncConnectionFrequency } from './sync/api.js';
 import type { DeleteTeamUser, GetTeam, PatchTeamUser, PutTeam } from './team/api.js';
 import type { GetUser, PatchUser, PutUserPassword } from './user/api.js';
 import type { PostPublicWebhook } from './webhooks/http.api.js';
-export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostAgentSessions | PostAgentSessionMcp | GetAgentSessionMcp | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionInvocation | GetFunctionInvocation | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | PostPublicRotateWebhookSigningKey | AllPublicProxy | PostPublicEnvironment | DeletePublicEnvironment | PostPublicApiKey | DeletePublicApiKey;
-export type PrivateApiEndpoints = GetAuditTrail | GetAuditTrailExport | ListAccountApiKeys | CreateAccountApiKey | DeleteAccountApiKey | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetOverdueInvoices | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUpcomingInvoice | GetBillingPeriodCosts | GetSpendAlert | PutSpendAlert | DeleteSpendAlert | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | PostRotateWebhookSigningKey | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
+export type PublicApiEndpoints = SetMetadata | UpdateMetadata | PostDeploy | PostDeployConfirmation | PostPublicTrigger | PostPublicTbaAuthorization | PostPublicJwtAuthorization | PostPublicUnauthenticatedAuthorization | PostPublicApiKeyAuthorization | PostPublicBasicAuthorization | GetPublicProviders | GetPublicProvider | GetPublicListIntegrations | GetPublicIntegration | DeletePublicIntegration | PostConnectSessions | PostAgentSessions | DeleteAgentSession | PostAgentSessionMcp | GetAgentSessionMcp | PostPublicConnectSessionsReconnect | GetPublicConnections | GetPublicConnection | GetConnectSession | DeleteConnectSession | PostDeployInternal | PostPublicBillAuthorization | DeletePublicConnection | DeleteConnection | PostPublicSignatureAuthorization | PostPublicTwoStepAuthorization | PostPublicWebhook | GetPublicClientMetadata | GetPublicRecords | PatchPublicPruneRecords | GetPublicScriptsConfig | PostPublicConnectTelemetry | PostCliTelemetry | PutPublicSyncConnectionFrequency | PostPublicIntegration | PostPublicQuickstartIntegration | PatchPublicIntegration | GetAsyncActionResult | PostPublicOauthOutboundAuthorization | PostPublicAwsSigV4Authorization | PostPublicConnection | PatchPublicConnection | PostPublicSyncStart | PostPublicSyncPause | GetPublicSyncStatus | GetPublicV1 | PostPublicTriggerAction | PostFunctionCompile | PostFunctionDryrun | GetFunctionDryrun | PostFunctionDryrunResult | PostFunctionDeployment | GetFunctionDeployment | PostFunctionDeploymentResult | PostFunctionInvocation | GetFunctionInvocation | PostFunctionDeploymentBundle | PostFunctionDeploymentBundlePreview | GetPublicFunctionCode | GetPublicIntegrationFunctions | GetPublicIntegrationFunction | DeletePublicIntegrationFunction | GetPublicProviderTemplates | PostPublicRotateWebhookSigningKey | AllPublicProxy | PostPublicEnvironment | DeletePublicEnvironment | GetPublicEnvironments | GetPublicApiKey | GetPublicApiKeys | PostPublicApiKey | DeletePublicApiKey;
+export type PrivateApiEndpoints = GetAuditTrail | GetAuditTrailExport | ListAccountApiKeys | CreateAccountApiKey | DeleteAccountApiKey | ConfirmEmail | PostSignup | PostSignin | PostLogout | GetTeam | PutTeam | PostPlanExtendTrial | PostPlanChange | PutBillingInvoicingDetails | GetOverdueInvoices | GetBillingUsage | GetBillingUsageTopDimensionValues | GetUpcomingInvoice | GetBillingPeriodCosts | GetProjectedCosts | GetSpendAlert | PutSpendAlert | DeleteSpendAlert | GetUser | PatchUser | PutUserPassword | PostInvite | DeleteInvite | DeleteTeamUser | PatchTeamUser | PostInsights | PostForgotPassword | PutResetPassword | SearchOperations | GetOperation | SearchMessages | SearchFilters | PostInternalConnectSessions | GetIntegrationFlows | GetIntegrationFunction | GetIntegrationFunctions | GetFunctionCode | DeleteIntegrationFunction | GetIntegrationTemplates | GetProviderTemplates | DeleteIntegration | PatchIntegration | GetIntegration | PostIntegration | GetConnections | GetConnectionsCount | GetConnection | PatchConnection | PostConnectionMetadata | GetConnectionRecordModels | GetConnectionRecords | GetConnectionSyncs | GetInvite | GetMeta | GetEmailByExpiredToken | GetEmailByUuid | GetManagedCallback | GetManagedEmailVerification | GetOnboardingAccountDiscovery | PostOnboardingRequestInvite | PatchFlowDisable | PatchFlowEnable | PatchFlowFrequency | PutUpgradePreBuiltFlow | PostConnectionRefresh | PostManagedEmailVerification | PostManagedSignup | PostPreBuiltDeploy | PostEnvironment | PatchEnvironment | DeleteEnvironment | GetEnvironments | GetEnvironment | PostRotateWebhookSigningKey | ListApiKeys | CreateApiKey | DeleteApiKey | PatchApiKey | PatchWebhook | PostEnvironmentVariables | PostImpersonate | GetSharedCredentialsProviders | GetSharedCredentialsProvider | PostSharedCredentialsProvider | PatchSharedCredentialsProvider | GetGettingStarted | PatchGettingStarted | GetConnectUISettings | PutConnectUISettings | GetProviders | GetProvider | PostInternalTriggerFunction | GetMFAStatus | PostMFAEnrollment | PostMFAActivation | PostMFARecoveryCodes | PostMFALoginVerification | DeleteMFA | GetPlainHmac;
 export type APIEndpoints = PrivateApiEndpoints | PublicApiEndpoints;
 /**
  * Automatically narrow endpoints type with Method + Path

package/dist/audit-trail/api.d.ts

@@ -1,12 +1,13 @@
 import type { ApiEndpoint, ApiError } from '../api.js';
-import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditPolicy, AuditResource, AuditTarget, AuditTrailVersion, AuditVia } from './event.js';
+import type { AuditAction, AuditActor, AuditContext, AuditOutcome, AuditPolicy, AuditResource, AuditScope, AuditTarget, AuditTrailVersion, AuditVia } from './event.js';
 export interface ApiAuditTrailEvent {
     id: string;
     version: AuditTrailVersion;
     occurredAt: string;
     accountId: number;
+    scope: AuditScope;
     environment: {
-        id: number;
+        id: string;
         display: string;
     } | null;
     actor: AuditActor;
@@ -29,14 +30,28 @@ export type GetAuditTrail = ApiEndpoint<{
         to?: string;
         resources?: string;
         actions?: string;
+        showTotal?: boolean | undefined;
     };
     Success: {
         data: ApiAuditTrailEvent[];
+        total?: AuditTrailTotal;
         pagination: {
             nextCursor: string | null;
         };
     };
 }>;
+/**
+ * How many events the filters match, not how many the page holds. Absent unless `showTotal` was
+ * asked for, and when the count failed.
+ *
+ * The read is bounded, so `relation` says whether `value` is the answer or a floor — `gte` means the
+ * account has at least this many and the count stopped looking. Shaped after Elasticsearch's `hits.total`
+ * so a caller cannot read the number without seeing which it is.
+ */
+export interface AuditTrailTotal {
+    value: number;
+    relation: 'eq' | 'gte';
+}
 export type AuditExportMaxRows = 50_000;
 export type GetAuditTrailExport = ApiEndpoint<{
     Audit: AuditPolicy<'audit_trail', 'exported', 'account'>;

package/dist/audit-trail/event.d.ts

@@ -1,29 +1,101 @@
+import type { ApiKeyUpdatedMetadata, AppAuthLoginMetadata, AuditTrailFiltersMetadata, AuditTrailQueriedMetadata, BillingPaymentMethodRemovedMetadata, BillingPlanChangedMetadata, BillingSpendAlertChangedMetadata, ConnectionMetadata, ConnectionUpdatedMetadata, EnvironmentCreatedMetadata, EnvironmentUpdatedMetadata, EnvironmentVariablesChangedMetadata, EnvironmentWebhookMetadata, FunctionDeletedMetadata, FunctionDeployedMetadata, FunctionUpgradedMetadata, IntegrationProviderMetadata, IntegrationUpdatedMetadata, MemberInvitedMetadata, MemberRoleChangedMetadata, MfaVerifiedMetadata, SyncBaseMetadata, SyncFrequencyChangedMetadata, SyncTriggeredMetadata, SyncVariantMetadata, TeamUpdatedMetadata, UserUpdatedMetadata } from './metadata.js';
 export type AuditTrailVersion = '2026-07-16';
-export type AuditActorType = 'user' | 'api_key' | 'connect_session' | 'anonymous' | 'unknown';
+export type AuditActorType = 'user' | 'api_key' | 'public_key' | 'connect_session' | 'anonymous' | 'unknown';
 export type AuditOutcome = 'success' | 'failure' | 'denied';
 export type AuditViaType = 'impersonation';
 export type AuditInterface = 'api' | 'mcp';
 interface AuditEventTable {
-    connection: 'created' | 'updated' | 'metadata_updated' | 'refreshed' | 'deleted';
-    sync: 'enabled' | 'disabled' | 'paused' | 'started' | 'triggered' | 'cancelled' | 'frequency_changed' | 'variant_created' | 'variant_deleted';
-    function: 'deployed' | 'upgraded' | 'deleted';
-    integration: 'created' | 'updated' | 'deleted';
-    api_key: 'created' | 'updated' | 'deleted';
-    member: 'invited' | 'invite_accepted' | 'invite_declined' | 'invite_revoked' | 'role_changed' | 'removed';
-    team: 'updated';
-    user: 'updated';
-    environment: 'created' | 'updated' | 'variables_changed' | 'webhook_urls_changed' | 'webhook_signing_key_rotated' | 'deleted';
-    app_auth: 'login' | 'logout' | 'signup' | 'password_changed' | 'password_reset';
-    mfa: 'enrolled' | 'enabled' | 'disabled' | 'verified' | 'recovery_regenerated';
-    billing: 'plan_changed' | 'trial_extended' | 'details_changed' | 'payment_method_added' | 'payment_method_removed' | 'spend_alert_changed' | 'spend_alert_removed';
-    audit_trail: 'exported' | 'queried';
+    connection: {
+        created: ConnectionMetadata;
+        updated: ConnectionUpdatedMetadata;
+        metadata_updated: ConnectionMetadata;
+        refreshed: ConnectionMetadata;
+        deleted: ConnectionMetadata;
+    };
+    sync: {
+        enabled: SyncBaseMetadata;
+        disabled: SyncBaseMetadata;
+        paused: SyncBaseMetadata;
+        started: SyncBaseMetadata;
+        triggered: SyncTriggeredMetadata;
+        cancelled: SyncBaseMetadata;
+        frequency_changed: SyncFrequencyChangedMetadata;
+        variant_created: SyncVariantMetadata;
+        variant_deleted: SyncVariantMetadata;
+    };
+    function: {
+        deployed: FunctionDeployedMetadata;
+        upgraded: FunctionUpgradedMetadata;
+        deleted: FunctionDeletedMetadata;
+    };
+    integration: {
+        created: IntegrationProviderMetadata;
+        updated: IntegrationProviderMetadata & IntegrationUpdatedMetadata;
+        deleted: IntegrationProviderMetadata;
+    };
+    api_key: {
+        created: ApiKeyUpdatedMetadata;
+        updated: ApiKeyUpdatedMetadata;
+        deleted: never;
+    };
+    member: {
+        invited: MemberInvitedMetadata;
+        invite_accepted: never;
+        invite_declined: never;
+        invite_revoked: never;
+        role_changed: MemberRoleChangedMetadata;
+        removed: never;
+    };
+    team: {
+        updated: TeamUpdatedMetadata;
+    };
+    user: {
+        updated: UserUpdatedMetadata;
+    };
+    environment: {
+        created: EnvironmentCreatedMetadata;
+        updated: EnvironmentUpdatedMetadata;
+        variables_changed: EnvironmentVariablesChangedMetadata;
+        webhook_urls_changed: EnvironmentWebhookMetadata;
+        webhook_signing_key_rotated: never;
+        deleted: never;
+    };
+    app_auth: {
+        login: AppAuthLoginMetadata;
+        logout: never;
+        signup: never;
+        password_changed: never;
+        password_reset: never;
+    };
+    mfa: {
+        enrolled: never;
+        enabled: never;
+        disabled: never;
+        verified: MfaVerifiedMetadata;
+        recovery_regenerated: never;
+    };
+    billing: {
+        plan_changed: BillingPlanChangedMetadata;
+        trial_extended: never;
+        details_changed: never;
+        payment_method_added: never;
+        payment_method_removed: BillingPaymentMethodRemovedMetadata;
+        spend_alert_changed: BillingSpendAlertChangedMetadata;
+        spend_alert_removed: never;
+    };
+    audit_trail: {
+        exported: AuditTrailFiltersMetadata;
+        queried: AuditTrailQueriedMetadata;
+    };
 }
 export type AuditResource = keyof AuditEventTable;
-export type AuditActionOf<R extends AuditResource> = AuditEventTable[R];
+export type AuditActionOf<R extends AuditResource> = R extends AuditResource ? keyof AuditEventTable[R] & string : never;
 export type AuditAction = AuditActionOf<AuditResource>;
 export type AuditEventKey = {
-    [R in AuditResource]: `${R}.${AuditEventTable[R]}`;
+    [R in AuditResource]: `${R}.${AuditActionOf<R>}`;
 }[AuditResource];
+/** The metadata an action may carry. `never` for the actions that carry none. */
+export type AuditMetadataFor<R extends AuditResource, A> = A extends keyof AuditEventTable[R] ? AuditEventTable[R][A] : never;
 export type AuditScope = 'account' | 'environment';
 export type AuditTargetType = 'connection' | 'sync' | 'function' | 'integration' | 'api_key' | 'member' | 'team' | 'user' | 'environment';
 export interface AuditActor {
@@ -70,4 +142,35 @@ export type EndpointAudit = AuditPolicy | NoAudit<string>;
 export type SerializedAuditEvent = {
     event: string;
 };
+export type AuditResourceAction = {
+    [R in AuditResource]: {
+        [A in AuditActionOf<R>]: [AuditMetadataFor<R, A>] extends [never] ? {
+            resource: R;
+            action: A;
+        } : {
+            resource: R;
+            action: A;
+            metadata?: AuditMetadataFor<R, A>;
+        };
+    }[AuditActionOf<R>];
+}[AuditResource];
+interface AuditEventCommon {
+    occurredAt: string;
+    accountId: number;
+    scope: AuditScope;
+    environment: {
+        id: string;
+        display: string;
+    } | null;
+    actor: AuditActor;
+    via?: AuditVia[];
+    targets: AuditTarget[];
+    context: AuditContext;
+    outcome: AuditOutcome;
+}
+export type AuditEvent = AuditEventCommon & AuditResourceAction;
+export type StoredAuditEvent = AuditEvent & {
+    id: string;
+    version: AuditTrailVersion;
+};
 export {};

package/dist/audit-trail/metadata.d.ts

@@ -0,0 +1,99 @@
+import type { FunctionSource } from '../syncConfigs/db.js';
+export interface ConnectionMetadata {
+    providerConfigKey?: string;
+}
+export interface ConnectionUpdatedMetadata {
+    providerConfigKey?: string;
+    changedFields?: string[];
+}
+export interface IntegrationProviderMetadata {
+    provider?: string;
+}
+export interface IntegrationUpdatedMetadata {
+    changedFields?: string[];
+}
+export interface EnvironmentCreatedMetadata {
+    name?: string;
+}
+export interface AuditTrailFiltersMetadata {
+    from?: string;
+    to?: string;
+    resources?: string[];
+    actions?: string[];
+}
+export interface AuditTrailQueriedMetadata extends AuditTrailFiltersMetadata {
+    continued?: boolean;
+}
+export interface MemberInvitedMetadata {
+    role?: string;
+}
+export interface FunctionDeployedMetadata {
+    source?: FunctionSource;
+    type?: string;
+}
+export interface FunctionUpgradedMetadata {
+    upgradeVersion?: string;
+}
+export interface FunctionDeletedMetadata {
+    type?: string;
+}
+export interface ApiKeyUpdatedMetadata {
+    displayName?: string;
+    scopes?: string[];
+}
+export interface SyncBaseMetadata {
+    providerConfigKey?: string;
+    connectionId?: string;
+}
+export interface SyncFrequencyChangedMetadata extends SyncBaseMetadata {
+    frequency?: string;
+}
+export interface SyncVariantMetadata extends SyncBaseMetadata {
+    variant?: string;
+}
+export interface SyncTriggeredMetadata extends SyncBaseMetadata {
+    reset?: boolean;
+    emptyCache?: boolean;
+}
+export interface MemberRoleChangedMetadata {
+    fromRole?: string;
+    toRole?: string;
+}
+export interface TeamUpdatedMetadata {
+    name?: string;
+}
+export interface UserUpdatedMetadata {
+    name?: string;
+    gettingStartedClosed?: boolean;
+}
+export interface EnvironmentUpdatedMetadata {
+    name?: string;
+    changedFields?: string[];
+}
+export interface EnvironmentVariablesChangedMetadata {
+    variableCount?: number;
+    variableNames?: string[];
+}
+export interface EnvironmentWebhookMetadata {
+    changedFields?: string[];
+    primaryUrl?: string;
+    secondaryUrl?: string;
+}
+export interface BillingPlanChangedMetadata {
+    fromPlan?: string;
+    toPlan?: string;
+}
+export type AppAuthLoginMethod = 'local' | 'sso' | 'managed';
+export interface AppAuthLoginMetadata {
+    mfaRequired?: boolean;
+    method?: AppAuthLoginMethod;
+}
+export interface BillingPaymentMethodRemovedMetadata {
+    paymentMethodId?: string;
+}
+export interface MfaVerifiedMetadata {
+    method?: 'totp' | 'recovery_code';
+}
+export interface BillingSpendAlertChangedMetadata {
+    thresholdInCents?: number;
+}

package/dist/auth/api.d.ts

@@ -20,7 +20,7 @@ export interface AuthModes {
     AwsSigV4: 'AWS_SIGV4';
 }
 export type AuthModeType = AuthModes[keyof AuthModes];
-export type AuthOperationType = 'creation' | 'override' | 'refresh' | 'unknown';
+export type AuthOperationType = 'creation' | 'override' | 'refresh' | 'deletion' | 'unknown';
 export interface OAuthAuthorizationMethod {
     BODY: 'body';
     HEADER: 'header';

package/dist/billing/types.d.ts

@@ -2,15 +2,17 @@ import type { Result } from '../result.js';
 import type { DBTeam } from '../team/db.js';
 import type { UsageMetric } from '../usage/index.js';
 export interface BillingClient {
-    ingest: (events: BillingEvent[]) => Promise<Result<void>>;
     linkStripeToCustomer(teamId: number, customerId: string): Promise<Result<void>>;
     getOrCreateCustomer: (accountId: number, defaultTo: Pick<BillingInvoicingDetails, 'legalEntityName' | 'email'>) => Promise<Result<BillingCustomer>>;
     getCustomer: (accountId: number) => Promise<Result<BillingCustomer>>;
     putCustomer: (accountId: number, invoicingDetails: BillingInvoicingDetails) => Promise<Result<BillingCustomer>>;
-    getSubscription: (accountId: number) => Promise<Result<BillingSubscription | null>>;
+    getSubscription: (accountId: number) => Promise<Result<BillingSubscription>>;
     getOverdueInvoices: (accountId: number) => Promise<Result<BillingOverdueInvoices>>;
     getUpcomingInvoice: (subscriptionId: string) => Promise<Result<BillingUpcomingInvoice | null>>;
-    getPeriodCosts: (subscriptionId: string) => Promise<Result<BillingPeriodCosts | null>>;
+    getPeriodCosts: (subscriptionId: string, timeframe?: {
+        start: Date;
+        end: Date;
+    }) => Promise<Result<BillingPeriodCosts | null>>;
     getSpendAlert: (subscriptionId: string) => Promise<Result<BillingSpendAlert | null>>;
     setSpendAlert: (subscriptionId: string, opts: {
         thresholdInCents: number;
@@ -18,30 +20,35 @@ export interface BillingClient {
     removeSpendAlert: (subscriptionId: string) => Promise<Result<void>>;
     createSubscription: (team: DBTeam, planExternalId: string) => Promise<Result<BillingSubscription>>;
     getUsage: (subscriptionId: string, opts?: GetBillingUsageOpts) => Promise<Result<BillingUsageMetrics>>;
-    upgrade: (opts: {
-        subscriptionId: string;
-        planExternalId: string;
-    }) => Promise<Result<{
+    upgrade: (opts: PlanChangeRequest) => Promise<Result<{
         pendingChangeId: string;
         amountInCents: number | null;
     }>>;
-    downgrade: (opts: {
+    downgrade: (opts: PlanChangeRequest) => Promise<Result<void>>;
+    startGrowthAddon: (opts: {
         subscriptionId: string;
-        planExternalId: string;
-    }) => Promise<Result<void>>;
+    }) => Promise<Result<{
+        priceIntervalId: string | null;
+    }>>;
+    endGrowthAddon: (opts: {
+        subscriptionId: string;
+        priceIntervalId: string;
+    }) => Promise<Result<{
+        growthFeaturesEndsAt: Date | null;
+    }>>;
     applyPendingChanges: (opts: {
         pendingChangeId: string;
         /**
-         * Stripe PaymentIntent ID, used to cross-reference the payment in Orb.
-         */
-        paymentExternalId: string;
-        /**
-         * Amount collected via Stripe in dollars (e.g. "25.00"). Orb uses this
-         * to credit the customer the difference vs. the actual invoice amount,
-         * so overcharges (e.g. when falling back to the base fee) are corrected
-         * automatically. No credit is issued if the amounts match exactly.
+         * Payment collected up front.
+         *
+         * Omitted for a plan billed fully in arrears, where nothing is collected when the change is applied.
          */
-        amountCollected: string;
+        payment?: {
+            /** The external payment ID; for Stripe, it's the PaymentIntent ID. */
+            externalId: string;
+            /** Amount collected in dollars. */
+            amountCollected: string;
+        } | undefined;
     }) => Promise<Result<BillingSubscription>>;
     cancelPendingChanges: (opts: {
         pendingChangeId: string;
@@ -49,6 +56,10 @@ export interface BillingClient {
     verifyWebhookSignature(body: string, headers: Record<string, unknown>, secret: string): Result<true>;
     getPlanById(planId: string): Promise<Result<BillingPlan>>;
 }
+export interface PlanChangeRequest {
+    subscriptionId: string;
+    planExternalId: string;
+}
 export interface BillingCustomer {
     id: string;
     invoicingDetails: BillingInvoicingDetails;
@@ -78,6 +89,13 @@ export interface BillingSubscription {
     id: string;
     pendingChangeId?: string | undefined;
     planExternalId: string;
+    hasGrowthFeatures: boolean;
+    growthFeaturesEndsAt: Date | null;
+    /** Orb's price interval is the allocation of a price for a given time period.
+     * The Growth add-on is an external price that gets attached to the plan, so we must parse
+     * its interval in order to know whether there's a scheduled operation in the future.
+     */
+    growthFeaturesPriceIntervalId: string | null;
 }
 export interface BillingOverdueInvoices {
     hasOverdue: boolean;
@@ -113,6 +131,7 @@ export interface BillingPeriodCosts {
         metric: UsageMetric | null;
         amountInCents: number | null;
     }[];
+    fixedInCents: number;
     currency: string;
 }
 export type CounterUsageMetric = Exclude<UsageMetric, 'records' | 'connections'>;
@@ -126,7 +145,7 @@ export interface BreakdownDimensions {
     webhook_forwards: 'environment_id' | 'integration_id' | 'connection_id' | 'success';
     records: 'environment_id' | 'integration_id' | 'connection_id' | 'model';
     connections: 'environment_id' | 'integration_id';
-    data_transfer: 'environment_id' | 'integration_id' | 'connection_id' | 'package' | 'callsite';
+    data_transfer: 'environment_id' | 'integration_id' | 'connection_id' | 'source';
 }
 export type DimensionFor<M extends UsageMetric> = 'none' | BreakdownDimensions[M];
 export interface GetBillingUsageOpts {
@@ -221,73 +240,3 @@ export interface BillingPlan {
     id: string;
     external_plan_id: string;
 }
-type BillingPropertyValue = string | number | boolean | Date | undefined;
-type BillingProperties = Record<string, BillingPropertyValue | Record<string, BillingPropertyValue>>;
-interface BillingEventBase<TType extends string, TProperties extends BillingProperties = BillingProperties> {
-    type: TType;
-    properties: {
-        timestamp: Date;
-        idempotencyKey?: string | undefined;
-        accountId: number;
-        count: number;
-    } & TProperties;
-}
-export type MarBillingEvent = BillingEventBase<'monthly_active_records', {
-    environmentId: number;
-    environmentName: string;
-    integrationId: string;
-    syncId: string;
-    model: string;
-}>;
-export type RecordsBillingEvent = BillingEventBase<'records', {
-    frequencyMs: number;
-    telemetry: {
-        sizeBytes: number;
-    };
-}>;
-export type ActionsBillingEvent = BillingEventBase<'billable_actions', {
-    environmentId: number;
-    environmentName: string;
-    integrationId: string;
-    actionName: string;
-}>;
-export type FunctionExecutionsBillingEvent = BillingEventBase<'function_executions', {
-    environmentId: number;
-    environmentName: string;
-    integrationId: string;
-    type: string;
-    functionName: string;
-    telemetry: {
-        successes: number;
-        failures: number;
-        durationMs: number;
-        compute: number;
-        customLogs: number;
-        proxyCalls: number;
-    };
-    frequencyMs?: number | undefined;
-}>;
-export type ProxyBillingEvent = BillingEventBase<'proxy', {
-    environmentId: number;
-    environmentName: string;
-    integrationId: string;
-    telemetry: {
-        successes: number;
-        failures: number;
-    };
-}>;
-export type WebhookForwardBillingEvent = BillingEventBase<'webhook_forwards', {
-    environmentId: number;
-    environmentName: string;
-    integrationId: string;
-    telemetry: {
-        successes: number;
-        failures: number;
-    };
-}>;
-export type ConnectionsBillingEvent = BillingEventBase<'billable_connections'>;
-export type ConnectionsBillingEventV2 = BillingEventBase<'billable_connections_v2', {
-    frequencyMs: number;
-}>;
-export type BillingEvent = MarBillingEvent | RecordsBillingEvent | ActionsBillingEvent | ProxyBillingEvent | WebhookForwardBillingEvent | FunctionExecutionsBillingEvent | ConnectionsBillingEvent | ConnectionsBillingEventV2;
-export {};

package/dist/connect/api.d.ts

@@ -114,8 +114,13 @@ export type PostInternalConnectSessions = ApiEndpoint<{
     };
     Method: 'POST';
     Path: '/api/v1/connect/sessions';
+    Querystring: {
+        env: string;
+    };
     Success: PostConnectSessions['Success'];
-    Body: Pick<ConnectSessionInput, 'allowed_integrations' | 'end_user' | 'organization' | 'integrations_config_defaults' | 'overrides' | 'webhook_url_override'>;
+    Body: Pick<ConnectSessionInput, 'allowed_integrations' | 'end_user' | 'organization' | 'integrations_config_defaults' | 'overrides' | 'webhook_url_override'> & {
+        is_preview?: boolean | undefined;
+    };
 }>;
 export type PostPublicConnectTelemetry = ApiEndpoint<{
     Audit: {

package/dist/environment/api/index.d.ts

@@ -20,6 +20,20 @@ export type GetEnvironments = ApiEndpoint<{
         data: Pick<DBEnvironment, 'name' | 'is_production'>[];
     };
 }>;
+export type GetPublicEnvironments = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/environments';
+    Querystring: {
+        name?: string | undefined;
+    };
+    Success: {
+        data: Pick<DBEnvironment, 'id' | 'uuid' | 'name' | 'is_production'>[];
+    };
+}>;
 export type PostEnvironment = ApiEndpoint<{
     Audit: AuditPolicy<'environment', 'created', 'account'>;
     Method: 'POST';
@@ -28,7 +42,7 @@ export type PostEnvironment = ApiEndpoint<{
         name: string;
     };
     Success: {
-        data: Pick<DBEnvironment, 'id' | 'name'>;
+        data: Pick<DBEnvironment, 'id' | 'uuid' | 'name'>;
     };
     Error: ApiError<'conflict' | 'resource_capped' | 'invalid_is_prod_flag'>;
 }>;
@@ -50,16 +64,16 @@ export type PostPublicEnvironment = ApiEndpoint<{
         }[] | undefined;
     };
     Success: {
-        data: Pick<DBEnvironment, 'id' | 'name'>;
+        data: Pick<DBEnvironment, 'id' | 'uuid' | 'name'>;
     };
     Error: ApiError<'conflict' | 'resource_capped' | 'invalid_is_prod_flag'>;
 }>;
 export type DeletePublicEnvironment = ApiEndpoint<{
     Audit: AuditPolicy<'environment', 'deleted', 'account'>;
     Method: 'DELETE';
-    Path: '/environments/:environmentId';
+    Path: '/environments/:environmentUuid';
     Params: {
-        environmentId: number;
+        environmentUuid: string;
     };
     Success: never;
     Error: ApiError<'cannot_delete_prod_environment'>;
@@ -159,6 +173,7 @@ export type ListApiKeys = ApiEndpoint<{
     Success: {
         data: {
             id: number;
+            uuid: string;
             display_name: string;
             scopes: ApiKeyScope[];
             secret: string;
@@ -178,6 +193,7 @@ export type CreateApiKey = ApiEndpoint<{
     Success: {
         data: {
             id: number;
+            uuid: string;
             display_name: string;
             scopes: ApiKeyScope[];
             secret: string;
@@ -189,14 +205,17 @@ export type CreateApiKey = ApiEndpoint<{
 export type PostPublicApiKey = ApiEndpoint<{
     Audit: AuditPolicy<'api_key', 'created', 'environment'>;
     Method: 'POST';
-    Path: '/environment/api-keys';
+    Path: '/environments/:environmentUuid/api-keys';
+    Params: {
+        environmentUuid: string;
+    };
     Body: {
-        environment_id: number;
         display_name: string;
     };
     Success: {
         data: {
             id: number;
+            uuid: string;
             display_name: string;
             scopes: ApiKeyScope[];
             secret: string;
@@ -205,13 +224,60 @@ export type PostPublicApiKey = ApiEndpoint<{
     };
     Error: ApiError<'conflict' | 'resource_capped'>;
 }>;
+export type GetPublicApiKeys = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/environments/:environmentUuid/api-keys';
+    Params: {
+        environmentUuid: string;
+    };
+    Querystring: {
+        display_name?: string | undefined;
+    };
+    Success: {
+        data: {
+            id: number;
+            uuid: string;
+            display_name: string;
+            scopes: ApiKeyScope[];
+            last_used_at: string | null;
+            created_at: string;
+        }[];
+    };
+}>;
+export type GetPublicApiKey = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/environments/:environmentUuid/api-keys/:keyUuid';
+    Params: {
+        environmentUuid: string;
+        keyUuid: string;
+    };
+    Success: {
+        data: {
+            id: number;
+            uuid: string;
+            display_name: string;
+            scopes: ApiKeyScope[];
+            secret: string;
+            last_used_at: string | null;
+            created_at: string;
+        };
+    };
+}>;
 export type DeletePublicApiKey = ApiEndpoint<{
     Audit: AuditPolicy<'api_key', 'deleted', 'environment'>;
     Method: 'DELETE';
-    Path: '/environment/api-keys';
-    Body: {
-        environment_id: number;
-        key_id: number;
+    Path: '/environments/:environmentUuid/api-keys/:keyUuid';
+    Params: {
+        environmentUuid: string;
+        keyUuid: string;
     };
     Success: {
         success: true;

package/dist/environment/api/webhook.d.ts

@@ -15,6 +15,7 @@ export type PatchWebhook = ApiEndpoint<{
         on_auth_refresh_error?: boolean | undefined;
         on_sync_error?: boolean | undefined;
         on_async_action_completion?: boolean | undefined;
+        on_connection_deletion?: boolean | undefined;
     };
     Success: {
         success: boolean;

package/dist/environment/db.d.ts

@@ -63,6 +63,7 @@ export interface DBExternalWebhook extends Timestamps {
     on_auth_refresh_error: boolean;
     on_sync_error: boolean;
     on_async_action_completion: boolean;
+    on_connection_deletion: boolean;
 }
 export interface DBAPISecret extends Timestamps {
     id: number;
@@ -77,6 +78,7 @@ export interface DBAPISecret extends Timestamps {
 export type CustomerKeyType = 'api' | 'webhook_signing';
 export interface DBCustomerKey extends Timestamps {
     id: number;
+    uuid: string;
     account_id: number;
     key_type: CustomerKeyType;
     display_name: string;

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export type * from './api.js';
 export type * from './api.endpoints.js';
 export type * from './audit-trail/api.js';
 export type * from './audit-trail/event.js';
+export type * from './audit-trail/metadata.js';
 export type * from './gettingStarted/db.js';
 export type * from './gettingStarted/dto.js';
 export type * from './gettingStarted/api.js';
@@ -15,6 +16,7 @@ export type * from './agent/api.js';
 export type * from './agent/connections.js';
 export type * from './agent/mcp.api.js';
 export type * from './agent/session.js';
+export type * from './agent/toolSearch.js';
 export type * from './agent/toolset.js';
 export type * from './admin/http.api.js';
 export type * from './account/api.js';
@@ -107,5 +109,4 @@ export type * from './function/trigger.js';
 export type * from './functions/api.js';
 export type * from './functions/domain.js';
 export type * from './lambda/index.js';
-export type * from './authz/types.js';
 export type * from './pubsub/events.js';

package/dist/logs/messages.d.ts

@@ -50,7 +50,7 @@ export interface OperationAdmin {
 }
 export interface OperationWebhook {
     type: 'webhook';
-    action: 'incoming' | 'forward' | 'sync' | 'connection_create' | 'connection_refresh';
+    action: 'incoming' | 'forward' | 'sync' | 'connection_create' | 'connection_refresh' | 'connection_delete';
 }
 export interface OperationDeploy {
     type: 'deploy';
@@ -58,7 +58,7 @@ export interface OperationDeploy {
 }
 export interface OperationAgentSession {
     type: 'agent_session';
-    action: 'create';
+    action: 'create' | 'terminate';
 }
 export type OperationList = OperationFunction | OperationSync | OperationProxy | OperationAction | OperationWebhook | OperationOnEvents | OperationDeploy | OperationAuth | OperationAdmin | OperationAgentSession;
 /**

package/dist/meta/api.d.ts

@@ -1,5 +1,6 @@
 import type { ApiEndpoint, ApiError } from '../api.js';
 import type { DBEnvironment } from '../environment/db.js';
+export type ApiEnvironmentSummary = Pick<DBEnvironment, 'id' | 'account_id' | 'name' | 'is_production'>;
 export type GetMeta = ApiEndpoint<{
     Audit: {
         kind: 'no-audit';
@@ -13,7 +14,7 @@ export type GetMeta = ApiEndpoint<{
     Error: ApiError<'user_not_found'>;
     Success: {
         data: {
-            environments: Pick<DBEnvironment, 'name' | 'is_production'>[];
+            environments: ApiEnvironmentSummary[];
             version: string;
             baseUrl: string;
             debugMode: boolean;

package/dist/plans/db.d.ts

@@ -3,7 +3,7 @@ type FunctionRuntime = 'runner' | 'lambda';
 export interface DBPlan extends Timestamps {
     id: number;
     account_id: number;
-    name: 'free' | 'free-uncapped' | 'startup-deal' | 'starter-v2' | 'growth-v2' | 'enterprise' | 'enterprise-cloud-hosted' | 'starter' | 'growth' | 'starter-legacy' | 'scale-legacy' | 'growth-legacy';
+    name: 'free' | 'free-uncapped' | 'startup-deal' | 'pay-as-you-go' | 'starter-v2' | 'growth-v2' | 'enterprise' | 'enterprise-cloud-hosted' | 'starter' | 'growth' | 'starter-legacy' | 'scale-legacy' | 'growth-legacy';
     stripe_customer_id: string | null;
     stripe_payment_id: string | null;
     orb_customer_id: string | null;
@@ -11,6 +11,8 @@ export interface DBPlan extends Timestamps {
     orb_future_plan: string | null;
     orb_future_plan_at: Date | null;
     orb_subscribed_at: Date | null;
+    has_growth_features: boolean;
+    growth_features_ends_at: Date | null;
     trial_start_at: Date | null;
     trial_end_at: Date | null;
     trial_extension_count: number;

package/dist/plans/http.api.d.ts

@@ -29,8 +29,11 @@ export interface PlanDefinition {
     nextPlan: string[] | null;
     prevPlan: string[] | null;
     basePrice?: number;
+    keepsGrowthAddOnOnMigration?: boolean;
     cta?: string;
     hidden?: boolean;
+    /** No longer sold, but accounts already on it keep it. */
+    retired?: boolean;
     flags: Omit<Partial<DBPlan>, 'id' | 'account_id' | 'name'>;
 }
 export type GetPlans = ApiEndpoint<{
@@ -175,8 +178,11 @@ export type GetBillingPeriodCosts = ApiEndpoint<{
     };
     Method: 'GET';
     Path: '/api/v1/plans/billing/period-costs';
+    /** Omitting `from` and `to` uses the current billing period. */
     Querystring: {
         env: string;
+        from?: string;
+        to?: string;
     };
     Success: {
         data: {
@@ -186,6 +192,7 @@ export type GetBillingPeriodCosts = ApiEndpoint<{
             /** False when some usage price mapped to no metric of ours — an absent metric can't safely
              *  read as $0, since the money might be one of theirs. */
             fullyAttributed: boolean;
+            fixedInCents: number;
             currency: string | null;
             /** True when there's no billing period to report costs for — a free plan, no linked
              *  subscription, or an ended one. `metrics`/`currency` are otherwise never empty/null. */
@@ -193,6 +200,35 @@ export type GetBillingPeriodCosts = ApiEndpoint<{
         };
     };
 }>;
+export type GetProjectedCosts = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/plans/billing/projected-costs';
+    Querystring: {
+        env: string;
+    } | {
+        env: string;
+        from: string;
+        to: string;
+    };
+    Success: {
+        data: {
+            metrics: Partial<Record<UsageMetric, number>>;
+            subtotalInCents: number;
+            minimumInCents: number;
+            minimumApplied: boolean;
+            growthAddOnInCents: number;
+            totalInCents: number;
+            periodComplete: boolean;
+            currency: string;
+            /** True when no Pay-as-you-go migration is scheduled. */
+            notApplicable: boolean;
+        };
+    };
+}>;
 export type GetSpendAlert = ApiEndpoint<{
     Audit: {
         kind: 'no-audit';
@@ -264,6 +300,7 @@ export type PostPlanChange = ApiEndpoint<{
     };
     Body: {
         orbId: string;
+        withGrowthFeatures: boolean;
     };
     Success: {
         data: {

package/dist/providers/provider.d.ts

@@ -220,6 +220,7 @@ export interface ProviderTwoStep extends Omit<BaseProvider, 'body_format'> {
         recipient?: string;
         header?: Record<string, string>;
         payload?: Record<string, string>;
+        singleUse?: boolean;
     };
     assertion_option?: Record<string, SimplifiedJSONSchema>;
     token_expires_in_ms?: number;

package/dist/sync/api.d.ts

@@ -1,6 +1,53 @@
 import type { ApiEndpoint, ApiError } from '../api.js';
 import type { AuditPolicy } from '../audit-trail/event.js';
-import type { ReportedSyncJobStatus } from './index.js';
+import type { ReportedSyncJobStatus, SyncResultByModel, SyncStatus } from './index.js';
+export interface ApiConnectionSyncJob {
+    created_at: string;
+    updated_at: string;
+    status: SyncStatus;
+    result: SyncResultByModel | null;
+}
+export interface ApiConnectionSync {
+    id: string;
+    name: string;
+    variant: string;
+    nango_connection_id: number;
+    models: string[];
+    frequency: string | null;
+    /** null when the orchestrator has no schedule for the sync, or could not be reached. */
+    schedule_status: 'STARTED' | 'PAUSED' | 'DELETED' | null;
+    status: SyncStatus;
+    /** Unix seconds. */
+    futureActionTimes: number[];
+    latest_sync: ApiConnectionSyncJob | null;
+    /** Keyed by bare model name; null when the record store could not be reached. */
+    record_count: Record<string, number> | null;
+}
+export type GetConnectionSyncs = ApiEndpoint<{
+    Audit: {
+        kind: 'no-audit';
+        reason: 'non-auditable';
+    };
+    Method: 'GET';
+    Path: '/api/v1/sync';
+    Querystring: {
+        env: string;
+        connection_id: string;
+        provider_config_key: string;
+        name?: string | undefined;
+        variant?: string | undefined;
+        page?: number | undefined;
+        limit?: number | undefined;
+    };
+    Success: {
+        data: ApiConnectionSync[];
+        pagination: {
+            total: number;
+            page: number;
+            limit: number;
+        };
+    };
+}>;
 export type PostPublicTrigger = ApiEndpoint<{
     Audit: {
         kind: 'no-audit';

package/dist/team/api.d.ts

@@ -21,7 +21,6 @@ export type GetTeam = ApiEndpoint<{
             users: ApiTeamUser[];
             invitedUsers: ApiInvitation[];
             isAdminTeam: boolean;
-            mfaFeatureEnabled: boolean;
         };
     };
 }>;

package/dist/user/api.d.ts

@@ -10,7 +10,7 @@ export type GetUser = ApiEndpoint<{
     Method: 'GET';
     Path: `/api/v1/user`;
     Success: {
-        data: ApiUserWithPermissions;
+        data: ApiUserWithGrants;
     };
 }>;
 export type InternalGetUsers = Endpoint<{
@@ -44,10 +44,12 @@ export interface ApiUser {
     role: Role;
     gettingStartedClosed: boolean;
 }
-export type AllowedPermissions = Partial<Record<string, Partial<Record<'production' | 'non-production' | 'global', ('create' | 'read' | 'update' | 'delete' | '*')[]>>>>;
-export type ApiUserWithPermissions = ApiUser & {
-    role: Role;
-    permissions: AllowedPermissions;
+export type ApiGrant = {
+    can: string[];
+    where: string[];
+};
+export type ApiUserWithGrants = ApiUser & {
+    grants: readonly ApiGrant[];
     hasPassword: boolean;
 };
 export type PutUserPassword = ApiEndpoint<{

package/dist/webhooks/api.d.ts

@@ -39,7 +39,8 @@ export type NangoSyncWebhookBody = NangoSyncWebhookBodySuccess | NangoSyncWebhoo
 export interface NangoAuthWebhookBodyBase extends NangoWebhookBase {
     type: 'auth';
     connectionId: string;
-    authMode: AuthModeType;
+    /** 'unknown' when the connection's integration could no longer be resolved (e.g. it was deleted). */
+    authMode: AuthModeType | 'unknown';
     providerConfigKey: string;
     provider: string;
     environment: string;

package/dist/webhooks/dispatch.d.ts

@@ -1,28 +1,12 @@
+import type { FunctionTrigger } from '../function/trigger.js';
 import type { JsonValue } from 'type-fest';
-/**
- * SQS message envelope for the webhook task-dispatch queue.
- *
- * The server produces one of these per (syncConfig × webhook subscription × connection)
- * triple resulting from an inbound provider webhook. The jobs consumer parses these and
- * calls the orchestrator to schedule the actual webhook task using `taskName` as the
- * idempotency key.
- */
-export interface WebhookDispatchMessage {
+interface DispatchMessageBase {
     version: 1;
-    kind: 'webhook';
-    /**
-     * Deterministic scheduler task name; used by the orchestrator as the
-     * idempotency key so duplicate SQS deliveries resolve to the same task.
-     */
-    taskName: string;
     createdAt: string;
     accountId: number;
     integrationId: number;
     provider: string;
-    parentSyncName: string;
-    /** Webhook subscription name matched on the inbound payload; passed to executeWebhook as args.webhookName. */
-    webhookName: string;
-    /** Activity log id created before enqueue; reused so redelivery of this published message keeps the same taskName. */
+    /** Activity log created before enqueue and reused by the eventual execution. */
     activityLogId: string;
     connection: {
         id: number;
@@ -30,5 +14,41 @@ export interface WebhookDispatchMessage {
         provider_config_key: string;
         environment_id: number;
     };
+}
+/**
+ * SQS message envelope for the webhook task-dispatch queue.
+ *
+ * The server produces one of these per (syncConfig × webhook subscription × connection)
+ * triple resulting from an inbound provider webhook. The jobs consumer parses these and
+ * calls the orchestrator to schedule the legacy webhook task using `taskName` as its
+ * task name.
+ */
+export interface LegacyDispatchMessage extends DispatchMessageBase {
+    kind: 'webhook';
+    /** Deterministic scheduler task name used to deduplicate queue redeliveries. */
+    taskName: string;
+    parentSyncName: string;
+    /** Webhook subscription name matched on the inbound payload; passed to executeWebhook as args.webhookName. */
+    webhookName: string;
     payload: JsonValue;
 }
+export interface FunctionDispatchMessage extends DispatchMessageBase {
+    kind: 'function';
+    /** Deterministic key used to deduplicate queue redeliveries. */
+    idempotencyKey: string;
+    functionName: string;
+    trigger: Omit<Extract<FunctionTrigger, {
+        kind: 'http';
+    }>, 'request' | 'connection'> & {
+        request: Extract<FunctionTrigger, {
+            kind: 'http';
+        }>['request'];
+        subscriptions: string[];
+        connection: NonNullable<Extract<FunctionTrigger, {
+            kind: 'http';
+        }>['connection']>;
+    };
+    maxConcurrency: number;
+}
+export type DispatchMessage = LegacyDispatchMessage | FunctionDispatchMessage;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nangohq/types",
-    "version": "0.71.5",
+    "version": "0.71.7",
     "description": "Types used in Nango applications",
     "type": "module",
     "typings": "dist/index.d.ts",

package/dist/authz/types.d.ts

@@ -1,12 +0,0 @@
-import type { Role } from '../user/db.js';
-export type Action = 'create' | 'read' | 'update' | 'delete' | '*';
-export type Resource = 'team' | 'team_member' | 'invite' | 'connect_ui_settings' | 'billing' | 'plan' | 'environment' | 'environment_production_flag' | 'environment_key' | 'account_key' | 'environment_variable' | 'webhook' | 'integration' | 'connection' | 'flow' | 'sync_command' | 'secret_key' | 'connection_credential' | 'log' | 'audit_trail' | '*';
-export type Scope = 'production' | 'non-production' | 'global';
-export interface Permission {
-    action: Action;
-    resource: Resource;
-    scope: Scope;
-}
-export interface PermissionEvaluator {
-    evaluate(role: Role, permission: Permission): Promise<boolean>;
-}