@naturali/sdk 0.110.1 → 0.111.1

package/dist/index.cjs

@@ -1055,6 +1055,7 @@ var Admin = class {
 	* Puts the account on a rung of the infra ladder. Needs the `admin` role.
 	* `PUT` because an account is on exactly one rung at a time, but the change is **recorded rather than overwritten**: the plan history is append-only and the newest line is the account's plan. Setting the rung it already holds still writes a line — a re-confirmation is an act worth a record, and the `reason` given with it would otherwise have nowhere to go. Read the history back with `GET` on this path.
 	* The rung is what the feature gate and the resource caps resolve against. Downgrading is the same call with a lower rung; what becomes of resources a lower plan would not hold is a separate mechanism that is not built.
+	* A rung whose content-retention window a contract sets — `enterprise` — **requires `retention_days`**, since nothing else can answer what that window is and an unanswered one bounds nothing. Every other rung sets its own and refuses the field.
 	*
 	*/
 	static grantUserPlan(options) {
@@ -1434,6 +1435,7 @@ var ApiKeys = class {
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
 	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
 	static createApiKey(options) {
@@ -1487,6 +1489,7 @@ var ApiKeys = class {
 	* Rotate an API key
 	*
 	* Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+	* Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
 	*
 	*/
 	static rotateApiKey(options) {
@@ -4236,9 +4239,9 @@ var Users = class {
 	/**
 	* Get the current account's billing standing
 	*
-	* The plan the account is on and the credit it has left — the two figures the platform already enforces against, readable by the account they are enforced against.
+	* The plan the account is on, how long its projects may keep content, and the credit it has left — the figures the platform already enforces against, readable by the account they are enforced against.
 	*
-	* A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`. Both refusals name what is missing; this is where the numbers behind them are read.
+	* A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`, as is a retention window wider than `retention_days`. Every refusal names what is missing; this is where the numbers behind them are read.
 	*
 	* Answers for the caller's own account only, and always the account the credential resolves to — an API key answers for the user that minted it. The plan gating a *project* is that project's billing owner's, so a member of someone else's project reads their own rung here, not that project's.
 	*

package/dist/index.d.cts

@@ -487,6 +487,10 @@ type AdminUser = User & {
    * The rung of the infra ladder the account is on. `free` for an account with no subscription. It gates the feature lines and the resource counts of the pricing table.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The longest content-retention window this account's projects may keep content for, in days. On a plan whose window a contract sets, this is the figure recorded with the grant; `null` means nothing bounds it. Resolved the same way the refusal is — the widest window held during the current billing cycle.
+   */
+  retention_days: number | null;
   /**
    * Model credit left, in US dollars — the ledger's sum, less the part of a past cycle's allowance that lapsed. `0` for an account that has never been credited, and negative for one that has overspent, which refuses its managed generations.
    */
@@ -508,6 +512,10 @@ type UserPlanGrant = {
    * The rung to put the account on.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The content-retention window the contract negotiated, in days. **Required on `enterprise`**, whose window the pricing table leaves to a contract: without one nothing bounds what the account's projects store, so it is refused rather than defaulted. Send `null` for a contract that keeps content indefinitely — that is a decision the field records, not the absence of one. **Refused on every other rung**, whose window the plan itself sets.
+   */
+  retention_days?: number | null;
   /**
    * Why the account was moved. Recorded on the line and never edited, so it is the only account of intent the history carries.
    */
@@ -522,6 +530,10 @@ type PlanEvent = {
    * The rung the account was put on by this line.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The contract window recorded with this line, in days. `null` on every rung whose window the plan itself sets, and on a contract that keeps content indefinitely — `plan` is what tells the two apart.
+   */
+  retention_days: number | null;
   reason: string | null;
   /**
    * The operator who recorded it. Null for a line no person wrote.
@@ -6305,6 +6317,10 @@ type UserBilling = {
    * The rung of the infra subscription this account is on. `free` for an account with no subscription, which is also the least-privileged rung. It gates the feature lines and the resource counts of the pricing table.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The longest window a project of this account may keep trace and generation content for, in days. A `PATCH` asking for a wider one — `null` included, which keeps content indefinitely — is refused with `403 plan_limit_reached`; anything shorter is always allowed. On a plan whose window a contract sets, this is that contract's figure, and `null` means nothing bounds it. A plan change that shortens the window applies at the end of the billing cycle, so this reads as the widest window held during the current one.
+   */
+  retention_days: number | null;
   /**
    * Model credit left, in US dollars — granted and purchased credit plus the plan's monthly allowance, less managed-model spend. A managed generation is refused while this is negative; a zero balance still generates, and the generation that crosses zero is absorbed. Only as current as `spend_reconciled_at`, so read the two together.
    */
@@ -19059,6 +19075,7 @@ declare class Admin {
    * Puts the account on a rung of the infra ladder. Needs the `admin` role.
    * `PUT` because an account is on exactly one rung at a time, but the change is **recorded rather than overwritten**: the plan history is append-only and the newest line is the account's plan. Setting the rung it already holds still writes a line — a re-confirmation is an act worth a record, and the `reason` given with it would otherwise have nowhere to go. Read the history back with `GET` on this path.
    * The rung is what the feature gate and the resource caps resolve against. Downgrading is the same call with a lower rung; what becomes of resources a lower plan would not hold is a separate mechanism that is not built.
+   * A rung whose content-retention window a contract sets — `enterprise` — **requires `retention_days`**, since nothing else can answer what that window is and an unanswered one bounds nothing. Every other rung sets its own and refuses the field.
    *
    */
   static grantUserPlan<ThrowOnError extends boolean = false>(options: Options<GrantUserPlanData, ThrowOnError>): RequestResult<GrantUserPlanResponses, GrantUserPlanErrors, ThrowOnError>;
@@ -19260,6 +19277,7 @@ declare class ApiKeys {
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
    * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
   static createApiKey<ThrowOnError extends boolean = false>(options: Options<CreateApiKeyData, ThrowOnError>): RequestResult<CreateApiKeyResponses, CreateApiKeyErrors, ThrowOnError>;
@@ -19285,6 +19303,7 @@ declare class ApiKeys {
    * Rotate an API key
    *
    * Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+   * Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
    *
    */
   static rotateApiKey<ThrowOnError extends boolean = false>(options: Options<RotateApiKeyData, ThrowOnError>): RequestResult<RotateApiKeyResponses, RotateApiKeyErrors, ThrowOnError>;
@@ -20702,9 +20721,9 @@ declare class Users {
   /**
    * Get the current account's billing standing
    *
-   * The plan the account is on and the credit it has left — the two figures the platform already enforces against, readable by the account they are enforced against.
+   * The plan the account is on, how long its projects may keep content, and the credit it has left — the figures the platform already enforces against, readable by the account they are enforced against.
    *
-   * A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`. Both refusals name what is missing; this is where the numbers behind them are read.
+   * A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`, as is a retention window wider than `retention_days`. Every refusal names what is missing; this is where the numbers behind them are read.
    *
    * Answers for the caller's own account only, and always the account the credential resolves to — an API key answers for the user that minted it. The plan gating a *project* is that project's billing owner's, so a member of someone else's project reads their own rung here, not that project's.
    *

package/dist/index.d.mts

@@ -487,6 +487,10 @@ type AdminUser = User & {
    * The rung of the infra ladder the account is on. `free` for an account with no subscription. It gates the feature lines and the resource counts of the pricing table.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The longest content-retention window this account's projects may keep content for, in days. On a plan whose window a contract sets, this is the figure recorded with the grant; `null` means nothing bounds it. Resolved the same way the refusal is — the widest window held during the current billing cycle.
+   */
+  retention_days: number | null;
   /**
    * Model credit left, in US dollars — the ledger's sum, less the part of a past cycle's allowance that lapsed. `0` for an account that has never been credited, and negative for one that has overspent, which refuses its managed generations.
    */
@@ -508,6 +512,10 @@ type UserPlanGrant = {
    * The rung to put the account on.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The content-retention window the contract negotiated, in days. **Required on `enterprise`**, whose window the pricing table leaves to a contract: without one nothing bounds what the account's projects store, so it is refused rather than defaulted. Send `null` for a contract that keeps content indefinitely — that is a decision the field records, not the absence of one. **Refused on every other rung**, whose window the plan itself sets.
+   */
+  retention_days?: number | null;
   /**
    * Why the account was moved. Recorded on the line and never edited, so it is the only account of intent the history carries.
    */
@@ -522,6 +530,10 @@ type PlanEvent = {
    * The rung the account was put on by this line.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The contract window recorded with this line, in days. `null` on every rung whose window the plan itself sets, and on a contract that keeps content indefinitely — `plan` is what tells the two apart.
+   */
+  retention_days: number | null;
   reason: string | null;
   /**
    * The operator who recorded it. Null for a line no person wrote.
@@ -6305,6 +6317,10 @@ type UserBilling = {
    * The rung of the infra subscription this account is on. `free` for an account with no subscription, which is also the least-privileged rung. It gates the feature lines and the resource counts of the pricing table.
    */
   plan: 'free' | 'pro' | 'business' | 'enterprise';
+  /**
+   * The longest window a project of this account may keep trace and generation content for, in days. A `PATCH` asking for a wider one — `null` included, which keeps content indefinitely — is refused with `403 plan_limit_reached`; anything shorter is always allowed. On a plan whose window a contract sets, this is that contract's figure, and `null` means nothing bounds it. A plan change that shortens the window applies at the end of the billing cycle, so this reads as the widest window held during the current one.
+   */
+  retention_days: number | null;
   /**
    * Model credit left, in US dollars — granted and purchased credit plus the plan's monthly allowance, less managed-model spend. A managed generation is refused while this is negative; a zero balance still generates, and the generation that crosses zero is absorbed. Only as current as `spend_reconciled_at`, so read the two together.
    */
@@ -19059,6 +19075,7 @@ declare class Admin {
    * Puts the account on a rung of the infra ladder. Needs the `admin` role.
    * `PUT` because an account is on exactly one rung at a time, but the change is **recorded rather than overwritten**: the plan history is append-only and the newest line is the account's plan. Setting the rung it already holds still writes a line — a re-confirmation is an act worth a record, and the `reason` given with it would otherwise have nowhere to go. Read the history back with `GET` on this path.
    * The rung is what the feature gate and the resource caps resolve against. Downgrading is the same call with a lower rung; what becomes of resources a lower plan would not hold is a separate mechanism that is not built.
+   * A rung whose content-retention window a contract sets — `enterprise` — **requires `retention_days`**, since nothing else can answer what that window is and an unanswered one bounds nothing. Every other rung sets its own and refuses the field.
    *
    */
   static grantUserPlan<ThrowOnError extends boolean = false>(options: Options<GrantUserPlanData, ThrowOnError>): RequestResult<GrantUserPlanResponses, GrantUserPlanErrors, ThrowOnError>;
@@ -19260,6 +19277,7 @@ declare class ApiKeys {
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
    * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
   static createApiKey<ThrowOnError extends boolean = false>(options: Options<CreateApiKeyData, ThrowOnError>): RequestResult<CreateApiKeyResponses, CreateApiKeyErrors, ThrowOnError>;
@@ -19285,6 +19303,7 @@ declare class ApiKeys {
    * Rotate an API key
    *
    * Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+   * Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
    *
    */
   static rotateApiKey<ThrowOnError extends boolean = false>(options: Options<RotateApiKeyData, ThrowOnError>): RequestResult<RotateApiKeyResponses, RotateApiKeyErrors, ThrowOnError>;
@@ -20702,9 +20721,9 @@ declare class Users {
   /**
    * Get the current account's billing standing
    *
-   * The plan the account is on and the credit it has left — the two figures the platform already enforces against, readable by the account they are enforced against.
+   * The plan the account is on, how long its projects may keep content, and the credit it has left — the figures the platform already enforces against, readable by the account they are enforced against.
    *
-   * A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`. Both refusals name what is missing; this is where the numbers behind them are read.
+   * A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`, as is a retention window wider than `retention_days`. Every refusal names what is missing; this is where the numbers behind them are read.
    *
    * Answers for the caller's own account only, and always the account the credential resolves to — an API key answers for the user that minted it. The plan gating a *project* is that project's billing owner's, so a member of someone else's project reads their own rung here, not that project's.
    *

package/dist/index.mjs

@@ -1054,6 +1054,7 @@ var Admin = class {
 	* Puts the account on a rung of the infra ladder. Needs the `admin` role.
 	* `PUT` because an account is on exactly one rung at a time, but the change is **recorded rather than overwritten**: the plan history is append-only and the newest line is the account's plan. Setting the rung it already holds still writes a line — a re-confirmation is an act worth a record, and the `reason` given with it would otherwise have nowhere to go. Read the history back with `GET` on this path.
 	* The rung is what the feature gate and the resource caps resolve against. Downgrading is the same call with a lower rung; what becomes of resources a lower plan would not hold is a separate mechanism that is not built.
+	* A rung whose content-retention window a contract sets — `enterprise` — **requires `retention_days`**, since nothing else can answer what that window is and an unanswered one bounds nothing. Every other rung sets its own and refuses the field.
 	*
 	*/
 	static grantUserPlan(options) {
@@ -1433,6 +1434,7 @@ var ApiKeys = class {
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
 	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
 	static createApiKey(options) {
@@ -1486,6 +1488,7 @@ var ApiKeys = class {
 	* Rotate an API key
 	*
 	* Issues a new secret for the same key record (same id, scope and capabilities) and invalidates the previous secret. The new raw `key` is returned only in this response.
+	* Refused for a connected app, like creation: rotation returns a raw secret for a key the caller need never have held, so it reaches the same place by another door.
 	*
 	*/
 	static rotateApiKey(options) {
@@ -4235,9 +4238,9 @@ var Users = class {
 	/**
 	* Get the current account's billing standing
 	*
-	* The plan the account is on and the credit it has left — the two figures the platform already enforces against, readable by the account they are enforced against.
+	* The plan the account is on, how long its projects may keep content, and the credit it has left — the figures the platform already enforces against, readable by the account they are enforced against.
 	*
-	* A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`. Both refusals name what is missing; this is where the numbers behind them are read.
+	* A managed-model generation is refused with `402 insufficient_credit` while `credit_balance_usd` is negative, and a feature or a resource count outside the plan is refused with `403`, as is a retention window wider than `retention_days`. Every refusal names what is missing; this is where the numbers behind them are read.
 	*
 	* Answers for the caller's own account only, and always the account the credential resolves to — an API key answers for the user that minted it. The plan gating a *project* is that project's billing owner's, so a member of someone else's project reads their own rung here, not that project's.
 	*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.110.1",
+  "version": "0.111.1",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "sideEffects": false,
@@ -37,7 +37,7 @@
     "tsx": "^4.23.1",
     "typescript": "~6.0.3",
     "vitest": "^4.1.10",
-    "@naturali/api": "0.110.1"
+    "@naturali/api": "0.111.1"
   },
   "scripts": {
     "generate": "tsx scripts/generate.ts",