@naturali/sdk 0.211.9 → 0.212.0

package/dist/index.cjs

@@ -1973,7 +1973,7 @@ var Auth = class {
 	/**
 	* Log out
 	*
-	* Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
+	* Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user; only a signed-in user's session may, not an API key or a connected app.
 	*
 	*/
 	static logout(options) {

package/dist/index.d.cts

@@ -1860,7 +1860,7 @@ type CreateToolRequest = {
   guardrail_ids?: Array<string> | null;
 };
 /**
- * Execution config for http tools. An `http` tool without a non-empty `url` is `400 VALIDATION_FAILED`, on create and on an update that would leave it without one. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.
+ * Execution config for http tools. An `http` tool without a non-empty `url` is `400 VALIDATION_FAILED`, on create and on an update that would leave it without one. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none. In either mode a 2xx body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`; a non-2xx body over it is cut to it.
  *
  * `auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:
  *
@@ -8827,7 +8827,7 @@ type Tool = {
     [key: string]: unknown;
   } | null;
   /**
-   * Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.
+   * Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none. In either mode a 2xx body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`; a non-2xx body over it is cut to it.
    *
    * `auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:
    *
@@ -9191,7 +9191,7 @@ type TriggerFiring = {
    */
   error?: StoredError | null;
   /**
-   * `<event_id>:<trigger_id>` for an `event` firing, where `event_id` is the `id` in `input`; null for every other source. The same event reaching the same trigger twice produces one firing under this key, so a consumer reading firings can recognise a redelivery.
+   * `<event_id>:<trigger_id>` for an `event` firing, where `event_id` is the `id` in `input`; `<v1>:<trigger_id>` for a `webhook` firing whose delivery carried the timestamped `t=,v1=` signature; null otherwise. The same event reaching the same trigger twice produces one firing under this key, so a consumer reading firings can recognise a redelivery; a replayed signed delivery is refused.
    */
   idempotency_key?: string | null;
   /**
@@ -12247,7 +12247,7 @@ type ListAiProvidersResponses = {
        */
       base_url?: string;
       /**
-       * Additional provider-specific configuration. Absent when the record sets none.
+       * Additional provider-specific configuration. Absent when the record sets none. A `config.apiKey` reads as `{"no_echo": true}`.
        */
       config?: {
         [key: string]: unknown;
@@ -12282,7 +12282,7 @@ type CreateAiProviderData = {
      */
     base_url?: string;
     /**
-     * Additional provider-specific configuration
+     * Additional provider-specific configuration. `config.apiKey`, when set, must be a string; every read returns it as `{"no_echo": true}`.
      */
     config?: {
       [key: string]: unknown;
@@ -12457,6 +12457,9 @@ type GetAiProviderResponses = {
     project_id?: string;
     secret_id?: string | null;
     base_url?: string;
+    /**
+     * Additional provider-specific configuration. A `config.apiKey` reads as `{"no_echo": true}`.
+     */
     config?: {
       [key: string]: unknown;
     };
@@ -12475,6 +12478,9 @@ type UpdateAiProviderData = {
     default_model?: string;
     secret_id?: string | null;
     base_url?: string;
+    /**
+     * Replaces the whole configuration, so a `config.apiKey` the record keeps is sent again as a string; the masked `{"no_echo": true}` a read returns is refused.
+     */
     config?: {
       [key: string]: unknown;
     };
@@ -13959,6 +13965,10 @@ type LogoutErrors = {
    * Missing or invalid credentials.
    */
   401: ErrorResponse;
+  /**
+   * `all: true` sent with an API key or a connected app's token.
+   */
+  403: ErrorResponse;
 };
 type LogoutError = LogoutErrors[keyof LogoutErrors];
 type LogoutResponses = {
@@ -33222,7 +33232,7 @@ export declare class Auth {
   /**
    * Log out
    *
-   * Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
+   * Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user; only a signed-in user's session may, not an API key or a connected app.
    *
    */
   static logout<ThrowOnError extends boolean = false>(options?: Options<LogoutData, ThrowOnError>): RequestResult<LogoutResponses, LogoutErrors, ThrowOnError>;

package/dist/index.d.mts

@@ -1860,7 +1860,7 @@ type CreateToolRequest = {
   guardrail_ids?: Array<string> | null;
 };
 /**
- * Execution config for http tools. An `http` tool without a non-empty `url` is `400 VALIDATION_FAILED`, on create and on an update that would leave it without one. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.
+ * Execution config for http tools. An `http` tool without a non-empty `url` is `400 VALIDATION_FAILED`, on create and on an update that would leave it without one. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none. In either mode a 2xx body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`; a non-2xx body over it is cut to it.
  *
  * `auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:
  *
@@ -8827,7 +8827,7 @@ type Tool = {
     [key: string]: unknown;
   } | null;
   /**
-   * Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.
+   * Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none. In either mode a 2xx body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`; a non-2xx body over it is cut to it.
    *
    * `auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:
    *
@@ -9191,7 +9191,7 @@ type TriggerFiring = {
    */
   error?: StoredError | null;
   /**
-   * `<event_id>:<trigger_id>` for an `event` firing, where `event_id` is the `id` in `input`; null for every other source. The same event reaching the same trigger twice produces one firing under this key, so a consumer reading firings can recognise a redelivery.
+   * `<event_id>:<trigger_id>` for an `event` firing, where `event_id` is the `id` in `input`; `<v1>:<trigger_id>` for a `webhook` firing whose delivery carried the timestamped `t=,v1=` signature; null otherwise. The same event reaching the same trigger twice produces one firing under this key, so a consumer reading firings can recognise a redelivery; a replayed signed delivery is refused.
    */
   idempotency_key?: string | null;
   /**
@@ -12247,7 +12247,7 @@ type ListAiProvidersResponses = {
        */
       base_url?: string;
       /**
-       * Additional provider-specific configuration. Absent when the record sets none.
+       * Additional provider-specific configuration. Absent when the record sets none. A `config.apiKey` reads as `{"no_echo": true}`.
        */
       config?: {
         [key: string]: unknown;
@@ -12282,7 +12282,7 @@ type CreateAiProviderData = {
      */
     base_url?: string;
     /**
-     * Additional provider-specific configuration
+     * Additional provider-specific configuration. `config.apiKey`, when set, must be a string; every read returns it as `{"no_echo": true}`.
      */
     config?: {
       [key: string]: unknown;
@@ -12457,6 +12457,9 @@ type GetAiProviderResponses = {
     project_id?: string;
     secret_id?: string | null;
     base_url?: string;
+    /**
+     * Additional provider-specific configuration. A `config.apiKey` reads as `{"no_echo": true}`.
+     */
     config?: {
       [key: string]: unknown;
     };
@@ -12475,6 +12478,9 @@ type UpdateAiProviderData = {
     default_model?: string;
     secret_id?: string | null;
     base_url?: string;
+    /**
+     * Replaces the whole configuration, so a `config.apiKey` the record keeps is sent again as a string; the masked `{"no_echo": true}` a read returns is refused.
+     */
     config?: {
       [key: string]: unknown;
     };
@@ -13959,6 +13965,10 @@ type LogoutErrors = {
    * Missing or invalid credentials.
    */
   401: ErrorResponse;
+  /**
+   * `all: true` sent with an API key or a connected app's token.
+   */
+  403: ErrorResponse;
 };
 type LogoutError = LogoutErrors[keyof LogoutErrors];
 type LogoutResponses = {
@@ -33222,7 +33232,7 @@ export declare class Auth {
   /**
    * Log out
    *
-   * Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
+   * Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user; only a signed-in user's session may, not an API key or a connected app.
    *
    */
   static logout<ThrowOnError extends boolean = false>(options?: Options<LogoutData, ThrowOnError>): RequestResult<LogoutResponses, LogoutErrors, ThrowOnError>;

package/dist/index.mjs

@@ -1972,7 +1972,7 @@ var Auth = class {
 	/**
 	* Log out
 	*
-	* Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user.
+	* Revokes the current refresh token (and its rotation family) and clears the `refresh_token` cookie. Pass `all: true` to revoke every active session for the user; only a signed-in user's session may, not an API key or a connected app.
 	*
 	*/
 	static logout(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.211.9",
+  "version": "0.212.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "keywords": [
     "naturali",
@@ -38,7 +38,7 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@naturali/api": "0.211.9",
+    "@naturali/api": "0.212.0",
     "@ttoss/openapi-codegen": "^0.10.0",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",