@permute/sdk 0.8.1 → 0.10.0

package/README.md

@@ -20,6 +20,18 @@ bunx @permute/sdk auth logout
 
 Choose an organization, optionally limit the connection to one workspace, then select resources and permissions to approve in Permute. The CLI stores renewable credentials in your operating system’s credential store (no plaintext fallback). Active logins have no fixed maximum lifetime and expire after 30 days without renewal; company sign-in rules can require earlier authentication. Logging out revokes access before removing the local credential. Signing in again revokes the previous stored CLI session.
 
+To request a particular scope, add `--organization ID`, `--workspace ID`, or `--access-file PATH` to login. The JSON file uses the same resource/permission selections as API-key creation:
+
+```json
+{
+  "organizationId": "org_...",
+  "workspaceId": "wksp_...",
+  "permissions": [{ "resourceId": "dbas_...", "resourceType": "database", "level": "read" }]
+}
+```
+
+An SDK login can supply the same object as `new OAuthLogin({ requestedAccess })` before calling `beginDevice()` or `beginBrowser(...)`. The browser prefills the request and permits only narrower selections. When available in the same browser, reauthentication recalls settings from a prior session. Each login still requires confirmation, and current resource permissions apply (saved selections create no resource grants). The browser stores only a non-secret session ID; it does not create another grant or change existing sessions. Logout and Connections disconnect individual logins.
+
 The SDK reuses credentials in memory between requests and reloads the OS store before renewal or when another process changes the saved login. The local auth directory holds only a lock and a non-secret change marker; tokens stay out of ordinary files. Current server permissions and revocation still apply to every request.
 
 The CLI prints the issuer and `permute-cli` entry name to stderr before accessing the OS store. macOS controls its own permission dialog, which may identify the Node or Bun process. SDK applications stay silent by default and can supply `onCredentialStoreAccess: (issuer) => { /* show a notice */ }` to `OAuthLogin`; the callback runs once before the default OS store is accessed and receives no credentials.
@@ -130,8 +142,9 @@ Data Flow and operation authoring are REST/SDK only. MCP does not expose their c
 editing, draft inspection, execution, or publication. Hosted MCP access uses
 selected sources or a hosted app's current grants and published action bindings,
 intersected with the user's permissions. App actions require confirmation in
-Permute; see the [MCP guide](https://permute.ai/docs/mcp). Flow scheduling and
-standalone operation creation are not part of this surface.
+Permute; see the [MCP guide](https://permute.ai/docs/mcp). MCP does not expose flow
+scheduling or standalone operation creation; schedule operations and flows with
+`client.operations.update`.
 
 ## Publish write syncs
 
@@ -325,10 +338,8 @@ const dataset = await client.datasets.create({
   context: [Context.QUICKBOOKS],
 });
 
-await dataset.replace({
-  orders: [{ id: 1 }, { id: 2 }],
-  customers: [{ id: 10 }],
-});
+await dataset.replaceTable('orders', [{ id: 1 }, { id: 2 }]);
+await dataset.replaceTable('customers', [{ id: 10 }]);
 
 console.log(dataset.sourceId, dataset.version, dataset.data.tables);
 ```
@@ -337,15 +348,30 @@ Dataset `context` accepts string identifiers, with `Context` providing named
 constants for known contexts (such as `Context.QUICKBOOKS`). It is not restricted
 to the connector provider list. Use `Providers` when selecting a connector.
 
-`replace()` sends the complete dataset snapshot. Tables omitted from the call
-are removed, while tables with the same name keep their stable identity for
-reports and dashboards. Retrying an identical replacement is a no-op.
+### Add or replace one table
 
-Use `replaceTable()` when the supplied rows are the complete current contents
-of one table. Existing rows not supplied are removed; other tables are unchanged:
+Use `replaceTable()` to add a new named table or replace the complete contents
+of an existing table. Existing rows not supplied are removed; other tables stay
+in the dataset. Await each write before starting the next write to that dataset:
 
 ```ts
 await dataset.replaceTable('orders', allOrders);
+await dataset.replaceTable('customers', allCustomers);
+// Both tables now belong to the same dataset.
+```
+
+### Replace the complete snapshot or append new rows
+
+`replace()` sends the complete dataset snapshot. Tables omitted from the call
+are removed, while tables with the same name keep their stable identity for
+reports and dashboards. Retrying an identical replacement is a no-op:
+
+```ts
+await dataset.replace({
+  orders: [{ id: 1 }, { id: 2 }],
+  customers: [{ id: 10 }],
+});
+// Only orders and customers remain in this dataset.
 ```
 
 Use `appendTable()` only when every supplied row is new and previously written
@@ -363,14 +389,68 @@ and use a new value for a new append. It prevents a retried request from being
 applied twice; reusing it with different rows fails. It does not remove duplicate
 rows sent in different batches.
 
-When source records can change or disappear, collect the source's current rows
-and use `replaceTable()` instead. The SDK serializes custom writes as chunked
-NDJSON, uploads them directly to a signed S3 target, and waits for processing;
-it does not build Parquet locally. The REST upload supports up to 1,000 tables and
-1 GB, but the current SDK object helper encodes the supplied rows in memory, so
-callers should stay comfortably within their process memory. `appendTable()`
-accepts up to 10,000 rows per batch. Durable SDK operations stop polling after
-20 minutes by default; pass `pollTimeoutMs` to set a different bound.
+### Upload a local CSV
+
+With SDK 0.9.0 or later, pass a disk-backed Blob to the same `replaceTable()` method.
+Use Node.js 24 or later with `openAsBlob`; the SDK hashes the file in small blocks,
+uploads it to S3, and waits for processing without loading the whole file into
+memory:
+
+```ts
+import { openAsBlob } from 'node:fs';
+
+await dataset.replaceTable('customers', await openAsBlob('./customers.csv'), {
+  format: 'csv',
+});
+```
+
+Supply comma-separated UTF-8 CSV with unique, nonempty column names in its first row.
+Permute derives the row count and infers column types; an optional `rowCount`
+checks an expected count. Keep the local file unchanged until its upload finishes.
+Header-only CSV can create an empty table.
+
+### Upload a gzipped CSV
+
+Pass an existing CSV.gz file with `compression: 'gzip'`. The SDK sends the file
+as-is (it does not gzip a plain CSV when you set the option). Unpack ZIP archives
+before importing individual table files:
+
+```ts
+await dataset.replaceTable('order_history', await openAsBlob('./order_history.csv.gz'), {
+  format: 'csv',
+  compression: 'gzip',
+});
+```
+
+### Import a large export
+
+The row-array overload still serializes objects as NDJSON and holds both the
+rows and encoded upload in memory. Use the Blob overload for large CSV exports.
+
+Each uploaded file can be at most 5 GiB (5,368,709,120 bytes), with at most 10 GiB
+(10,737,418,240 bytes) after decompression. The upload limit measures compressed
+bytes when using gzip. Raw REST NDJSON writes also accept `compression: 'gzip'`;
+`sizeBytes` and `contentHash` describe the exact uploaded bytes. Each complete
+table replacement can contain at most 10,000,000 rows. A full `replace()` accepts
+up to 1,000 tables within that same upload limit. The byte limit is per write,
+so separate table writes can accumulate several GB in one dataset. Table-by-table
+imports become visible as each write completes; they are not an atomic snapshot
+of the whole export. New empty NDJSON tables require an existing schema.
+
+For CSV exports with hundreds of tables, await each `replaceTable()` call while
+reusing the same dataset key. Use a different key for each separate source export.
+The guide includes [folder imports](https://permute.ai/docs/guides/custom-dataset#folder-of-tables),
+[multiple datasets](https://permute.ai/docs/guides/custom-dataset#multiple-datasets), and
+[signed REST uploads](https://permute.ai/docs/guides/custom-dataset#csv-export-to-s3).
+Validate imported column names, counts, and types before loading the full export.
+These limits apply to custom table writes; `type: 'file'` creates a separate file
+dataset with its own upload limits.
+
+`appendTable()` accepts up to 10,000 rows per batch. Repeated small appends are
+inefficient for a large snapshot; upload its complete CSV with `replaceTable()`.
+Durable SDK operations stop polling after 20 minutes by default; pass
+`pollTimeoutMs` to change the client wait. A polling timeout does not prove the
+server write failed; inspect its status before retrying.
 
 ## Recommended Flow
 
@@ -814,7 +894,8 @@ account’s access even when the caller has no connector access. Permute enforce
 declared execution capabilities and validates input/output schemas; the handler
 defines the operation exposed to callers.
 
-Handlers receive trusted `caller: { id, type }` (`type` is `user` or `apiKey`).
+Handlers receive trusted `caller: { id, type }` (`type` is `user`, `apiKey`, or
+`system`; a scheduled trigger run passes `{ type: 'system', id: '<triggerId>' }`).
 An action can use that identity and server-side business data to check or deny a
 request when its rules warrant it (such as an ownership rule or allowed state transition).
 Apply those checks before the affected reads or writes. They supplement the
@@ -929,6 +1010,49 @@ replay saved responses. Steps with uncertain outcomes block automatic resend and
 provider-state reconciliation. There is no automatic rollback, reconciliation API, or
 long-running workflow runner. Connector-only actions can use `sources: []`.
 
+### Schedule triggers
+
+A trigger invokes a published action automatically. Schedule triggers use the same UTC
+schedule format as operations and a fixed input which must match the published input contract.
+Schedule values are whole numbers: `hourly { minute }`, `daily { hour, minute }`,
+`weekly { hour, minute, dayOfWeek }` (0 is Sunday), and `monthly { hour, minute, dayOfMonth }`.
+Use `dayOfMonth` 1–28 to run in every month.
+
+```ts
+const trigger = await client.actionTriggers.create('actn_example', {
+  type: 'schedule',
+  config: { schedule: { type: 'daily', hour: 9, minute: 0 }, input: { region: 'EMEA' } },
+});
+await client.actionTriggers.update('actn_example', trigger.id, { isEnabled: false });
+const { items } = await client.actionTriggers.runs('actn_example', trigger.id);
+```
+
+Trigger routes require API key authentication. A trigger has no owner and runs as the workspace
+system identity, so its runs do not recheck anyone's access. Instead, creating, editing, or enabling a
+trigger requires invocation permission and authority to delegate every capability which the action
+declares (SDK permissions, connectors, and sources), and publishing an action with an enabled trigger
+requires the publisher to be able to invoke the new revision. Every reader of the action can see its
+triggers, and invokers can change them. Scheduled runs pass `caller: { type: 'system', id: '<triggerId>' }`.
+Resources which a scheduled run creates through the SDK belong to the action owner (the user who
+created the action, or the user who created its API key); scheduled runs cannot create or delete
+hosted resources (managed databases and apps) or create connector sessions. Each run uses the action's current published revision and the
+request ID `<triggerId>_<slot epoch ms>`, so a retried slot never runs twice. Runs start within about
+five minutes of their slot. Missed slots run once, as the newest missed slot, and the skipped
+slots appear as a `businessAction.trigger.skipped` audit event. A deleted or
+unpublished action, or input which no longer matches the contract, disables the trigger and
+sets `disabledReason`; enable it again with `update` after fixing the cause. A slot which cannot
+start for 24 hours, for example because of a persistent platform error, also disables the trigger.
+Publishing a new action revision does not check trigger input; an incompatible trigger turns
+off at its next run. A disable records no run, so read `isEnabled` and `disabledReason`; `nextRunAt`
+is `null` while the trigger is off. Updating `config` replaces the whole config and repeats the
+access and input checks, like enabling. Pausing with `isEnabled: false` keeps `disabledReason` `null`.
+`runs` returns the newest 50 runs with status, revision, and failure, but not their output; to keep a
+run's results, write them inside the handler. Saved receipts belong to their caller, so invoking with a
+run's request ID runs the action again.
+Failures inside the action do not disable the trigger and are not retried; the next slot runs as
+scheduled. They appear in `runs`, as `lastRun` on the trigger, and as a
+`businessAction.trigger.failed` audit event.
+
 ## Hosted app visitor access (next release)
 
 App admins can read `client.apps.access(appId)` and update access with

package/dist/auth/oauth.d.ts

@@ -1,3 +1,5 @@
+import { type RequestedAccess } from './request.js';
+export type { RequestedAccess } from './request.js';
 import { PermuteClient } from '../client.js';
 import { type CredentialStore, type LoginCredentials } from './store.js';
 export { SystemCredentialStore, type CredentialStore, type LoginCredentials } from './store.js';
@@ -6,6 +8,7 @@ export declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_cod
 export interface OAuthOptions {
     issuer?: string;
     apiUrl?: string;
+    requestedAccess?: RequestedAccess;
     store?: CredentialStore;
     fetch?: typeof fetch;
     /** Called once before the default OS credential store is accessed; no tokens are passed. */
@@ -16,6 +19,7 @@ export declare class OAuthLogin {
     readonly apiUrl: string;
     private readonly store;
     private readonly fetchImpl;
+    private readonly requested;
     constructor(options?: OAuthOptions);
     private endpoint;
     private post;

package/dist/auth/oauth.js

@@ -1,3 +1,4 @@
+import { authorizationDetails } from './request.js';
 import { z } from 'zod';
 import { createHash, randomBytes } from 'node:crypto';
 import { setTimeout } from 'node:timers/promises';
@@ -27,11 +28,13 @@ export class OAuthLogin {
     apiUrl;
     store;
     fetchImpl;
+    requested;
     constructor(options = {}) {
         this.issuer = this.endpoint(options.issuer ?? DEFAULT_ISSUER);
         this.apiUrl = this.endpoint(options.apiUrl ?? 'https://api.permute.ai');
         this.store = options.store ?? new SystemCredentialStore(this.issuer, options.onCredentialStoreAccess);
         this.fetchImpl = options.fetch ?? fetch;
+        this.requested = authorizationDetails(options.requestedAccess);
     }
     endpoint(value) {
         const url = new URL(value);
@@ -90,7 +93,7 @@ export class OAuthLogin {
         return credentials;
     }
     async beginDevice() {
-        const parsed = DeviceSchema.safeParse(await this.post('/cli/device/authorization', { client_id: CLIENT_ID, scope: 'workspace' }));
+        const parsed = DeviceSchema.safeParse(await this.post('/cli/device/authorization', { client_id: CLIENT_ID, scope: 'workspace', ...this.requested }));
         if (!parsed.success)
             throw new Error('Invalid device login response');
         const result = parsed.data;
@@ -139,6 +142,7 @@ export class OAuthLogin {
         url.search = new URLSearchParams({
             client_id: CLIENT_ID,
             scope: 'workspace',
+            ...this.requested,
             response_type: 'code',
             redirect_uri: redirectURI,
             state,

package/dist/auth/request.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+import type { components } from '../generated/openapi.js';
+export type RequestedAccess = components['schemas']['OAuthRequestedAccess'];
+export declare const RequestedAccessSchema: z.ZodCustom<{
+    organizationId?: string;
+    permissions?: {
+        level: 'read' | 'write' | 'admin';
+        operations?: ('application.read_metadata' | 'application.update_metadata' | 'application.read_implementation' | 'application.update_draft' | 'application.publish' | 'application.manage_access' | 'application.manage_hosting' | 'application.delete' | 'business_action.read_metadata' | 'business_action.invoke' | 'business_action.read_implementation' | 'business_action.update_draft' | 'business_action.publish' | 'business_action.manage_access' | 'business_action.delegate_access' | 'business_action.delete')[];
+        resourceId: string;
+        resourceType: string;
+    }[];
+    workspaceId?: string;
+}, {
+    organizationId?: string;
+    permissions?: {
+        level: 'read' | 'write' | 'admin';
+        operations?: ('application.read_metadata' | 'application.update_metadata' | 'application.read_implementation' | 'application.update_draft' | 'application.publish' | 'application.manage_access' | 'application.manage_hosting' | 'application.delete' | 'business_action.read_metadata' | 'business_action.invoke' | 'business_action.read_implementation' | 'business_action.update_draft' | 'business_action.publish' | 'business_action.manage_access' | 'business_action.delegate_access' | 'business_action.delete')[];
+        resourceId: string;
+        resourceType: string;
+    }[];
+    workspaceId?: string;
+}>;
+/** RFC 9396 carries structured permissions without inventing a second operation catalog. */
+export declare function authorizationDetails(request: RequestedAccess | undefined): Record<string, string>;

package/dist/auth/request.js

@@ -0,0 +1,15 @@
+import { Ajv } from 'ajv';
+import { z } from 'zod';
+import { authorizationRequestSchema } from '../generated/runtime-contract.js';
+const validate = new Ajv({ strict: false }).compile(authorizationRequestSchema);
+export const RequestedAccessSchema = z.custom((value) => validate(value), 'Invalid requested access');
+/** RFC 9396 carries structured permissions without inventing a second operation catalog. */
+export function authorizationDetails(request) {
+    if (!request)
+        return {};
+    return {
+        authorization_details: JSON.stringify([
+            { type: 'https://permute.ai/permissions', ...RequestedAccessSchema.parse(request) },
+        ]),
+    };
+}

package/dist/cli.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { readFile } from 'node:fs/promises';
+import { RequestedAccessSchema } from './auth/request.js';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { parseArgs } from 'node:util';
@@ -75,6 +77,9 @@ export async function runCli(args = process.argv.slice(2)) {
         allowPositionals: true,
         options: {
             issuer: { type: 'string' },
+            'access-file': { type: 'string' },
+            organization: { type: 'string' },
+            workspace: { type: 'string' },
             'api-url': { type: 'string' },
             'device-code': { type: 'boolean' },
             'no-browser': { type: 'boolean' },
@@ -83,14 +88,21 @@ export async function runCli(args = process.argv.slice(2)) {
     });
     const [area, command] = positionals;
     if (values.help || area !== 'auth' || !['login', 'logout', 'status'].includes(command ?? '')) {
-        console.log('permute auth login [--device-code] [--no-browser]\npermute auth status\npermute auth logout\n\nUse --issuer and --api-url together for a development environment.');
+        console.log('permute auth login [--device-code] [--no-browser] [--organization ID] [--workspace ID] [--access-file PATH]\npermute auth status\npermute auth logout\n\nUse --issuer and --api-url together for a development environment.');
         if (!values.help)
             process.exitCode = 1;
         return;
     }
     if (!!values.issuer !== !!values['api-url'])
         throw new Error('Provide both --issuer and --api-url for another environment.');
+    const requestedAccess = {
+        ...(values['access-file'] &&
+            RequestedAccessSchema.parse(JSON.parse(await readFile(values['access-file'], 'utf8')))),
+        ...(values.organization && { organizationId: values.organization }),
+        ...(values.workspace && { workspaceId: values.workspace }),
+    };
     const login = new OAuthLogin({
+        ...(Object.keys(requestedAccess).length > 0 && { requestedAccess }),
         issuer: values.issuer,
         apiUrl: values['api-url'],
         onCredentialStoreAccess: (issuer) => {

package/dist/client.d.ts

@@ -1,7 +1,7 @@
-import type { EmailSender, EmailSendRequest, EmailReceipt, PermissionGrant, PermissionGrantInput, PermissionGrantUpdate, PermissionGrantQuery, PermissionGrantList, PermissionGrantRevoked, PermissionInspectionInput, PermissionInspection, AccessRequest, AccessRequestInput, AccessRequestQuery, AccessRequestList, AccessRequestDecision } from './types.js';
+import type { EmailSender, EmailSendRequest, EmailReceipt, PermissionGrant, PermissionGrantInput, PermissionGrantUpdate, PermissionGrantQuery, PermissionGrantList, PermissionGrantRevoked, PermissionInspectionInput, PermissionInspection, AccessRequest, AccessRequestInput, AccessRequestQuery, AccessRequestList, AccessRequestDecision, MemberList, OrganizationMemberInvite, WorkspaceMemberInvite, OrganizationMemberRoleUpdate, WorkspaceMemberRoleUpdate, MemberInvitation, MemberInvitationDelivery, MemberRoleUpdated, MemberRemoved, Organization, OrganizationList } from './types.js';
 export { PermuteApiError } from './errors.js';
-import type { BusinessAction, BusinessActionDetail, BusinessActionList, ActionCreateRequest, ActionDefinition, ActionDefinitionSaveRequest, ActionDefinitionSaved, ActionRequest, ActionReceipt, ActionPublicationRequest, ActionPublicationRequestInput, ActionPublicationRequestList, ActionPublicationDecision } from './types.js';
-import type { ConnectorSession, ConnectorSessionCreated, ConnectorSessionCreateRequest, Database, AppPublicationRequest, AppPublicationRequestInput, AppPublicationRequestList, AppPublicationDecision, AppDraft, AppAccess, AppAddressSettings, AppAddressSetRequest, AppAccessSetRequest, AppDraftList, AppCreateRequest, AppUpdateRequest, AppDeleted, AppUploadsRequest, AppUploads, AppSiteSaveRequest, AppSourceFileQuery, AppSourceFileContent, AppGrants, AppGrantSetRequest, AppUploadFile, DatabaseList, DatabaseCreateRequest, DatabaseDefinition, DatabaseDefinitionSaveRequest, DatabaseDefinitionSaved, DatabaseTables, DatabaseTableCreateRequest, DatabaseTableCreated, DatabaseRecords, DatabaseRecordsQuery, DatabaseTransactionRequest, DatabaseTransactionReceipt, WriteSync, WriteSyncCreateRequest, WriteSyncUpdateRequest, WriteSyncDetail, WriteSyncList, WriteSyncDeleted, WriteSyncDestinations, WriteSyncRun, WriteSyncRunList, WriteSyncRunQuery, WriteSyncExecution, ResourceVersionState, ResourceRevisionList, ResourceRevision, ResourceVersionRequest, ResourcePublishRequest, Fact, FactList, FactWriteRequest, SkillList, SkillContent, SkillWriteRequest, KnowledgeWriteResponse, OperationRunGroup, OperationRunQuery, Operation, OperationList, OperationListQuery, OperationSource, OperationSourceUpdateRequest, OperationUpdateRequest, OperationRunRequest, OperationRunStarted, OperationRunList, OperationRunOutput, DataFlow, DataFlowCreateRequest, DataFlowCommandRequest, DataFlowCommandResponse, Workspace, WorkspaceCreateRequest, WorkspaceDeleteResponse, WorkspaceList, WorkspaceUpdateRequest, AnswerRequest, AnswerResponse, PermuteClientOptions, PermuteRequestOptions, QueryRequest, SearchRequest, SourceDetail, CatalogTable, SourceList, CustomDatasetCreateRequest, DatasetDeleteResponse, DatasetResponse, FileDatasetCreateRequest, FileDatasetMetadataCreateRequest, FileDatasetResponse, DatasetRows, CustomDatasetResponse, DashboardSource, DashboardSourceUpdateRequest } from './types.js';
+import type { BusinessAction, BusinessActionDetail, BusinessActionList, ActionCreateRequest, ActionDefinition, ActionDefinitionSaveRequest, ActionDefinitionSaved, ActionRequest, ActionReceipt, ActionTrigger, ActionTriggerList, ActionTriggerCreateRequest, ActionTriggerUpdateRequest, ActionTriggerRunList, ActionPublicationRequest, ActionPublicationRequestInput, ActionPublicationRequestList, ActionPublicationDecision } from './types.js';
+import type { ConnectorSession, ConnectorSessionCreated, ConnectorSessionCreateRequest, Database, AppPublicationRequest, AppPublicationRequestInput, AppPublicationRequestList, AppPublicationDecision, AppDraft, AppAccess, AppAddressSettings, AppAddressSetRequest, AppAccessSetRequest, AppDraftList, AppCreateRequest, AppUpdateRequest, AppDeleted, AppUploadsRequest, AppUploads, AppSiteSaveRequest, AppSourceFileQuery, AppSourceFileContent, AppGrants, AppGrantSetRequest, AppUploadFile, DatabaseList, DatabaseCreateRequest, DatabaseDefinition, DatabaseDefinitionSaveRequest, DatabaseDefinitionSaved, DatabaseTables, DatabaseTableCreateRequest, DatabaseTableCreated, DatabaseRecords, DatabaseRecordsQuery, DatabaseTransactionRequest, DatabaseTransactionReceipt, WriteSync, WriteSyncCreateRequest, WriteSyncUpdateRequest, WriteSyncDetail, WriteSyncList, WriteSyncDeleted, WriteSyncDestinations, WriteSyncRun, WriteSyncRunList, WriteSyncRunQuery, WriteSyncExecution, ResourceVersionState, ResourceRevisionList, ResourceRevision, ResourceVersionRequest, ResourcePublishRequest, Fact, FactList, FactWriteRequest, SkillList, SkillContent, SkillWriteRequest, KnowledgeWriteResponse, OperationRunGroup, OperationRunQuery, Operation, OperationList, OperationListQuery, OperationSource, OperationSourceUpdateRequest, OperationUpdateRequest, OperationRunRequest, OperationRunStarted, OperationRunList, OperationRunOutput, DataFlow, DataFlowCreateRequest, DataFlowCommandRequest, DataFlowCommandResponse, Workspace, WorkspaceCreateRequest, WorkspaceDeleteResponse, WorkspaceList, WorkspaceUpdateRequest, AnswerRequest, AnswerResponse, PermuteClientOptions, PermuteRequestOptions, QueryRequest, SearchRequest, SourceDetail, CatalogTable, SourceList, CustomDatasetCreateRequest, DatasetDeleteResponse, DatasetResponse, FileDatasetCreateRequest, FileDatasetMetadataCreateRequest, FileDatasetResponse, DatasetRows, DatasetCsvUploadOptions, CustomDatasetResponse, DashboardSource, DashboardSourceUpdateRequest } from './types.js';
 type DatasetWriteInput = {
     tables: Record<string, DatasetRows>;
     mode: 'replace';
@@ -14,7 +14,11 @@ type DatasetWriteInput = {
     rows: DatasetRows;
     batchId: string;
     mode: 'appendTable';
-};
+} | ({
+    tableName: string;
+    file: Blob;
+    mode: 'replaceTable';
+} & DatasetCsvUploadOptions);
 type DatasetWriter = (id: string, request: DatasetWriteInput, options?: PermuteRequestOptions) => Promise<CustomDatasetResponse>;
 type DatasetReader = (id: string, options?: PermuteRequestOptions) => Promise<DatasetResponse>;
 export declare class PermuteDataset {
@@ -33,6 +37,7 @@ export declare class PermuteDataset {
     get version(): number;
     replace(tables: Record<string, DatasetRows>, options?: PermuteRequestOptions): Promise<this>;
     replaceTable(tableName: string, rows: DatasetRows, options?: PermuteRequestOptions): Promise<this>;
+    replaceTable(tableName: string, file: Blob, options: DatasetCsvUploadOptions & PermuteRequestOptions): Promise<this>;
     appendTable(tableName: string, rows: DatasetRows, options: {
         batchId: string;
     } & PermuteRequestOptions): Promise<this>;
@@ -57,6 +62,24 @@ export interface SkillsClient {
     delete(path: string, options?: PermuteRequestOptions): Promise<KnowledgeWriteResponse>;
 }
 export declare class PermuteClient {
+    readonly organizations: {
+        list(options?: PermuteRequestOptions): Promise<OrganizationList>;
+        get(organizationId: string, options?: PermuteRequestOptions): Promise<Organization>;
+    };
+    readonly organizationMembers: {
+        list(organizationId: string, options?: PermuteRequestOptions): Promise<MemberList>;
+        invite(organizationId: string, body: OrganizationMemberInvite, options?: PermuteRequestOptions): Promise<MemberInvitation>;
+        resendInvitation(organizationId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberInvitationDelivery>;
+        updateRole(organizationId: string, userId: string, body: OrganizationMemberRoleUpdate, options?: PermuteRequestOptions): Promise<MemberRoleUpdated>;
+        remove(organizationId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberRemoved>;
+    };
+    readonly workspaceMembers: {
+        list(workspaceId: string, options?: PermuteRequestOptions): Promise<MemberList>;
+        invite(workspaceId: string, body: WorkspaceMemberInvite, options?: PermuteRequestOptions): Promise<MemberInvitation>;
+        resendInvitation(workspaceId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberInvitationDelivery>;
+        updateRole(workspaceId: string, userId: string, body: WorkspaceMemberRoleUpdate, options?: PermuteRequestOptions): Promise<MemberRoleUpdated>;
+        remove(workspaceId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberRemoved>;
+    };
     readonly permissions: {
         update(permissionId: string, body: PermissionGrantUpdate, options?: PermuteRequestOptions): Promise<PermissionGrant>;
         list(query?: PermissionGrantQuery, options?: PermuteRequestOptions): Promise<PermissionGrantList>;
@@ -97,6 +120,14 @@ export declare class PermuteClient {
         saveDefinition(actionId: string, body: ActionDefinitionSaveRequest, options?: PermuteRequestOptions): Promise<ActionDefinitionSaved>;
         invoke(actionId: string, body: ActionRequest, options?: PermuteRequestOptions): Promise<ActionReceipt>;
     };
+    readonly actionTriggers: {
+        list(actionId: string, options?: PermuteRequestOptions): Promise<ActionTriggerList>;
+        create(actionId: string, body: ActionTriggerCreateRequest, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        get(actionId: string, triggerId: string, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        update(actionId: string, triggerId: string, body: ActionTriggerUpdateRequest, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        delete(actionId: string, triggerId: string, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        runs(actionId: string, triggerId: string, options?: PermuteRequestOptions): Promise<ActionTriggerRunList>;
+    };
     readonly emails: {
         get(options?: PermuteRequestOptions): Promise<EmailSender>;
         /** Only callable from Business Actions through platform.withStep(stepId). */

package/dist/client.js

@@ -93,12 +93,45 @@ function inferUploadSize(data) {
     return undefined;
 }
 const DATASET_WRITE_CHUNK_ROWS = 500;
+const DATASET_WRITE_CHUNK_BYTES = 16 * 1024 * 1024;
+async function hashDatasetFile(file, signal) {
+    const hash = createHash('sha256');
+    const reader = file.stream().getReader();
+    try {
+        while (true) {
+            if (signal?.aborted) {
+                await reader.cancel();
+                throw new PermuteApiError({ status: 0, code: 'request_aborted', message: 'Request was aborted' });
+            }
+            const { done, value } = await reader.read();
+            if (done)
+                return hash.digest('hex');
+            hash.update(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
 function encodeDatasetWrite(request) {
     const entries = request.mode === 'replace' ? Object.entries(request.tables) : [[request.tableName, request.rows]];
     const parts = [];
     const hash = createHash('sha256');
     const addChunk = (tableName, rows) => {
         const line = `${JSON.stringify({ tableName, rows })}\n`;
+        if (new TextEncoder().encode(line).byteLength > DATASET_WRITE_CHUNK_BYTES) {
+            if (rows.length <= 1) {
+                throw new PermuteApiError({
+                    status: 0,
+                    code: 'dataset_row_too_large',
+                    message: 'A dataset row exceeds the 16 MiB upload chunk limit',
+                });
+            }
+            const middle = Math.floor(rows.length / 2);
+            addChunk(tableName, rows.slice(0, middle));
+            addChunk(tableName, rows.slice(middle));
+            return;
+        }
         parts.push(line);
         hash.update(line);
     };
@@ -113,7 +146,6 @@ function encodeDatasetWrite(request) {
     return {
         data,
         contentHash: hash.digest('hex'),
-        tables: entries.map(([name, rows]) => ({ name, rowCount: rows.length })),
     };
 }
 function pollingDeadline(options) {
@@ -208,8 +240,20 @@ export class PermuteDataset {
         this.snapshot = await this.writeTables(this.id, { tables, mode: 'replace' }, options);
         return this;
     }
-    async replaceTable(tableName, rows, options) {
-        this.snapshot = await this.writeTables(this.id, { tableName, rows, mode: 'replaceTable' }, options);
+    async replaceTable(tableName, data, options) {
+        if (data instanceof Blob) {
+            if (!options || !('format' in options)) {
+                throw new PermuteApiError({
+                    status: 0,
+                    code: 'invalid_upload_format',
+                    message: 'CSV file uploads require format: csv',
+                });
+            }
+            const { format, compression, rowCount, ...requestOptions } = options;
+            this.snapshot = await this.writeTables(this.id, { tableName, file: data, mode: 'replaceTable', format, compression, rowCount }, requestOptions);
+            return this;
+        }
+        this.snapshot = await this.writeTables(this.id, { tableName, rows: data, mode: 'replaceTable' }, options);
         return this;
     }
     async appendTable(tableName, rows, options) {
@@ -251,6 +295,9 @@ export class PermuteFileDataset {
     }
 }
 export class PermuteClient {
+    organizations;
+    organizationMembers;
+    workspaceMembers;
     permissions;
     accessRequests;
     revisions;
@@ -258,6 +305,7 @@ export class PermuteClient {
     skills;
     organizationSkills;
     actions;
+    actionTriggers;
     emails;
     databases;
     apps;
@@ -305,6 +353,24 @@ export class PermuteClient {
             delete: this.bindMethod('permissionsDelete', (request) => (permissionId, options) => request({ pathParams: { permissionId } }, options)),
             inspect: this.bindMethod('permissionsInspect', (request) => (body, options) => request({ body }, options)),
         };
+        this.organizations = {
+            list: this.bindMethod('organizationsList', (apiRequest) => (options) => apiRequest({}, options)),
+            get: this.bindMethod('organizationsGet', (apiRequest) => (organizationId, options) => apiRequest({ pathParams: { organizationId } }, options)),
+        };
+        this.organizationMembers = {
+            list: this.bindMethod('organizationMembersList', (apiRequest) => (organizationId, options) => apiRequest({ pathParams: { organizationId } }, options)),
+            invite: this.bindMethod('organizationMembersInvite', (request) => (organizationId, body, options) => request({ pathParams: { organizationId }, body }, options)),
+            resendInvitation: this.bindMethod('organizationMembersResendInvitation', (request) => (organizationId, userId, options) => request({ pathParams: { organizationId, userId } }, options)),
+            updateRole: this.bindMethod('organizationMembersUpdateRole', (request) => (organizationId, userId, body, options) => request({ pathParams: { organizationId, userId }, body }, options)),
+            remove: this.bindMethod('organizationMembersRemove', (request) => (organizationId, userId, options) => request({ pathParams: { organizationId, userId } }, options)),
+        };
+        this.workspaceMembers = {
+            list: this.bindMethod('workspaceMembersList', (apiRequest) => (workspaceId, options) => apiRequest({ pathParams: { workspaceId } }, options)),
+            invite: this.bindMethod('workspaceMembersInvite', (request) => (workspaceId, body, options) => request({ pathParams: { workspaceId }, body }, options)),
+            resendInvitation: this.bindMethod('workspaceMembersResendInvitation', (request) => (workspaceId, userId, options) => request({ pathParams: { workspaceId, userId } }, options)),
+            updateRole: this.bindMethod('workspaceMembersUpdateRole', (request) => (workspaceId, userId, body, options) => request({ pathParams: { workspaceId, userId }, body }, options)),
+            remove: this.bindMethod('workspaceMembersRemove', (request) => (workspaceId, userId, options) => request({ pathParams: { workspaceId, userId } }, options)),
+        };
         this.accessRequests = {
             create: this.bindMethod('accessRequestsCreate', (request) => (body, options) => request({ body }, options)),
             list: this.bindMethod('accessRequestsList', (request) => (query, options) => request({ query }, options)),
@@ -344,6 +410,14 @@ export class PermuteClient {
             saveDefinition: this.bindMethod('actionDefinitionSave', (apiRequest) => (actionId, body, options) => apiRequest({ pathParams: { actionId }, body }, options)),
             invoke: this.bindMethod('actionsInvoke', (apiRequest) => (actionId, body, options) => apiRequest({ pathParams: { actionId }, body }, options)),
         };
+        this.actionTriggers = {
+            list: this.bindMethod('actionTriggersList', (apiRequest) => (actionId, options) => apiRequest({ pathParams: { actionId } }, options)),
+            create: this.bindMethod('actionTriggersCreate', (apiRequest) => (actionId, body, options) => apiRequest({ pathParams: { actionId }, body }, options)),
+            get: this.bindMethod('actionTriggersGet', (apiRequest) => (actionId, triggerId, options) => apiRequest({ pathParams: { actionId, triggerId } }, options)),
+            update: this.bindMethod('actionTriggersUpdate', (apiRequest) => (actionId, triggerId, body, options) => apiRequest({ pathParams: { actionId, triggerId }, body }, options)),
+            delete: this.bindMethod('actionTriggersDelete', (apiRequest) => (actionId, triggerId, options) => apiRequest({ pathParams: { actionId, triggerId } }, options)),
+            runs: this.bindMethod('actionTriggerRunsList', (apiRequest) => (actionId, triggerId, options) => apiRequest({ pathParams: { actionId, triggerId } }, options)),
+        };
         this.emails = {
             get: this.bindMethod('emailsGet', (request) => (options) => request({}, options)),
             send: this.bindMethod('emailsSend', (request) => (body, options) => request({ body }, options)),
@@ -475,30 +549,39 @@ export class PermuteClient {
         };
         const readDataset = this.bindMethod('datasetsGet', (apiRequest) => (datasetId, requestOptions) => apiRequest({ pathParams: { datasetId } }, requestOptions));
         const writeDatasetTables = async (datasetId, request, requestOptions) => {
-            const encoded = encodeDatasetWrite(request);
-            const body = request.mode === 'replace'
+            const encoded = 'file' in request
+                ? { data: request.file, contentHash: await hashDatasetFile(request.file, requestOptions?.signal) }
+                : encodeDatasetWrite(request);
+            const uploadMetadata = { sizeBytes: encoded.data.size, contentHash: encoded.contentHash };
+            const body = 'file' in request
                 ? {
-                    mode: request.mode,
-                    tables: encoded.tables,
-                    sizeBytes: encoded.data.size,
-                    contentHash: encoded.contentHash,
+                    mode: 'replaceTable',
+                    tableName: request.tableName,
+                    format: request.format,
+                    compression: request.compression,
+                    rowCount: request.rowCount,
+                    ...uploadMetadata,
                 }
-                : request.mode === 'replaceTable'
+                : request.mode === 'replace'
                     ? {
                         mode: request.mode,
-                        tableName: request.tableName,
-                        rowCount: request.rows.length,
-                        sizeBytes: encoded.data.size,
-                        contentHash: encoded.contentHash,
+                        tables: Object.entries(request.tables).map(([name, rows]) => ({ name, rowCount: rows.length })),
+                        ...uploadMetadata,
                     }
-                    : {
-                        mode: request.mode,
-                        tableName: request.tableName,
-                        rowCount: request.rows.length,
-                        sizeBytes: encoded.data.size,
-                        contentHash: encoded.contentHash,
-                        batchId: request.batchId,
-                    };
+                    : request.mode === 'replaceTable'
+                        ? {
+                            mode: request.mode,
+                            tableName: request.tableName,
+                            rowCount: request.rows.length,
+                            ...uploadMetadata,
+                        }
+                        : {
+                            mode: request.mode,
+                            tableName: request.tableName,
+                            rowCount: request.rows.length,
+                            ...uploadMetadata,
+                            batchId: request.batchId,
+                        };
             const initialized = await this.request('datasetsWriteTables', { pathParams: { datasetId }, body }, requestOptions);
             if (initialized.write.status === 'completed')
                 return initialized.dataset;
@@ -662,7 +745,7 @@ export class PermuteClient {
             ...options?.headers,
         };
         const workspaceId = options?.workspaceId ?? this.workspaceId;
-        if (route.scope === 'workspace' && workspaceId) {
+        if (route.scope === 'workspace' && workspaceId && !input.pathParams?.workspaceId) {
             headers['X-Workspace-Id'] = workspaceId;
         }
         if (body !== undefined) {