@rustrak/client 0.23.0 → 0.25.0

package/README.md

@@ -226,6 +226,19 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 <!-- api:start -->
 <!-- Generated by `pnpm generate` from openapi.json. Do not edit by hand. -->
 
+### Access
+
+| Method | Endpoint | Description |
+|---|---|---|
+| `access.catalog()` | `GET /api/access/catalog` | Lists every resource a permission can name, with its module, scope and actions. |
+| `access.me()` | `GET /api/access/me` | Returns what the caller may do, on the instance and on each project. |
+| `roles.create({ body })` | `POST /api/roles` | Creates a role from permissions the caller holds themselves. |
+| `roles.delete({ path })` | `DELETE /api/roles/{id}` | Deletes a role nobody holds. |
+| `roles.list()` | `GET /api/roles` | Lists every role with its permissions and how often it is assigned. |
+| `roles.update({ path, body })` | `PUT /api/roles/{id}` | Replaces a role's name, description and permissions. |
+| `users.assignments({ path })` | `GET /api/users/{id}/assignments` | Lists the roles a user holds, on the instance and on each project. |
+| `users.setAssignments({ path, body })` | `PUT /api/users/{id}/assignments` | Replaces every role and personal permission a user holds. |
+
 ### Agents
 
 | Method | Endpoint | Description |
@@ -250,7 +263,7 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 | `alertChannels.create({ body })` | `POST /api/integrations` |  |
 | `alertChannels.delete({ path })` | `DELETE /api/integrations/{id}` |  |
 | `alertChannels.get({ path })` | `GET /api/integrations/{id}` |  |
-| `alertChannels.list()` | `GET /api/integrations` |  |
+| `alertChannels.list()` | `GET /api/integrations` | Lists the channels alerts can go through. |
 | `alertChannels.previewTemplate({ body })` | `POST /api/integrations/preview-template` | Renders a Custom Webhook template against a sample payload and hands back the body that would be sent. |
 | `alertChannels.test({ path, body })` | `POST /api/integrations/{id}/test` |  |
 | `alertChannels.update({ path, body })` | `PATCH /api/integrations/{id}` |  |
@@ -331,9 +344,11 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 
 | Method | Endpoint | Description |
 |---|---|---|
-| `invitations.create({ body })` | `POST /api/invitations` | Create an invitation (admin only) |
-| `invitations.list()` | `GET /api/invitations` | List invitations (admin only) |
-| `invitations.revoke({ path })` | `DELETE /api/invitations/{token}` | Revoke a pending invitation (admin only) |
+| `invitations.create({ body })` | `POST /api/invitations` | Create an invitation (needs `invitations:create`) |
+| `invitations.emailStatus()` | `GET /api/invitations/email-status` | Whether invitation emails can be sent (needs `invitations:read`) |
+| `invitations.list()` | `GET /api/invitations` | List invitations (needs `invitations:read`) |
+| `invitations.resend({ path })` | `POST /api/invitations/{id}/resend` | Email the invite link again (needs `invitations:create`) |
+| `invitations.revoke({ path })` | `DELETE /api/invitations/{id}` | Revoke a pending invitation (needs `invitations:delete`) |
 
 ### Issues
 
@@ -371,9 +386,10 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 
 | Method | Endpoint | Description |
 |---|---|---|
-| `members.list({ path })` | `GET /api/projects/{project_id}/members` |  |
-| `members.remove({ path })` | `DELETE /api/projects/{project_id}/members/{user_id}` |  |
-| `members.upsert({ path, body })` | `PUT /api/projects/{project_id}/members` |  |
+| `members.candidates({ path })` | `GET /api/projects/{project_id}/members/candidates` | Lists the people and the roles the caller can give on the project, so it takes neither `users:read` nor `roles:read` to manage its members. |
+| `members.list({ path })` | `GET /api/projects/{project_id}/members` | Lists everyone holding a role on the project, with those roles; personal permissions are not roles. |
+| `members.remove({ path })` | `DELETE /api/projects/{project_id}/members/{user_id}` | Removes the roles a user holds on this project; roles on all projects and personal permissions stay. |
+| `members.upsert({ path, body })` | `PUT /api/projects/{project_id}/members` | Sets the roles a user holds on the project. |
 
 ### Monitors
 
@@ -450,7 +466,7 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 | Method | Endpoint | Description |
 |---|---|---|
 | `settings.getMcp()` | `GET /api/settings/mcp` | Whether the MCP endpoint at `/mcp` is on. |
-| `settings.updateMcp({ body })` | `PUT /api/settings/mcp` | Turns the MCP endpoint at `/mcp` on or off. |
+| `settings.updateMcp({ body })` | `PUT /api/settings/mcp` | Turns the MCP endpoint at `/mcp` on or off (needs `mcp:update`). |
 
 ### Source Maps
 
@@ -501,9 +517,9 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 
 | Method | Endpoint | Description |
 |---|---|---|
-| `team.deleteUser({ path })` | `DELETE /api/team/{user_id}` | Remove a user from the instance (admin only) |
-| `team.list()` | `GET /api/team` | List all users (admin only) |
-| `team.updateRole({ path, body })` | `PATCH /api/team/{user_id}/role` | Change a user's global role (admin only) |
+| `team.deleteUser({ path })` | `DELETE /api/team/{user_id}` | Remove a user from the instance (needs `users:delete`) |
+| `team.list()` | `GET /api/team` | List all users (needs `users:read`) |
+| `team.updateRole({ path, body })` | `PATCH /api/team/{user_id}/role` | Change a user's global role (needs `users:update`) |
 
 ### Telemetry
 
@@ -515,9 +531,9 @@ Every method, grouped as it hangs off the client (`client.issues.list(...)`).
 
 | Method | Endpoint | Description |
 |---|---|---|
-| `tokens.create({ body })` | `POST /api/tokens` | Create a new token (scoped to the acting user) |
+| `tokens.create({ body })` | `POST /api/tokens` | Create a new token (from a signed-in session only) |
 | `tokens.delete({ path })` | `DELETE /api/tokens/{id}` | Revoke a token |
-| `tokens.get({ path })` | `GET /api/tokens/{id}` | Reveal full token value |
+| `tokens.get({ path })` | `GET /api/tokens/{id}` | Token details, masked |
 | `tokens.list()` | `GET /api/tokens` | List tokens (masked) |
 
 ### Transactions

package/dist/generated/sdk.gen.cjs

@@ -521,6 +521,46 @@ var Releases = class extends HeyApiClient {
 		});
 	}
 };
+var Access = class extends HeyApiClient {
+	/**
+	* Lists every resource a permission can name, with its module, scope and actions.
+	*/
+	catalog(options) {
+		return (options?.client ?? this.client).get({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: zod.never().optional(),
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zAccessCatalogResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/access/catalog",
+			...options
+		});
+	}
+	/**
+	* Returns what the caller may do, on the instance and on each project.
+	*/
+	me(options) {
+		return (options?.client ?? this.client).get({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: zod.never().optional(),
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zAccessMeResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/access/me",
+			...options
+		});
+	}
+};
 var Github = class extends HeyApiClient {
 	/**
 	* DELETE /api/github
@@ -917,7 +957,12 @@ var Github = class extends HeyApiClient {
 };
 var AlertChannels = class extends HeyApiClient {
 	/**
-	* GET /api/alert-channels
+	* Lists the channels alerts can go through.
+	*
+	* `integrations:read` sees their credentials masked, `integrations:update` in
+	* full. Holding an alert-rules permission on any project is enough for the
+	* rest, without them: choosing where a rule notifies takes a channel's name,
+	* not its secrets.
 	*/
 	list(options) {
 		return (options?.client ?? this.client).get({
@@ -1073,7 +1118,7 @@ var AlertChannels = class extends HeyApiClient {
 };
 var Invitations = class extends HeyApiClient {
 	/**
-	* GET /api/invitations — list invitations (admin only)
+	* GET /api/invitations — list invitations (needs `invitations:read`)
 	*/
 	list(options) {
 		return (options?.client ?? this.client).get({
@@ -1092,7 +1137,11 @@ var Invitations = class extends HeyApiClient {
 		});
 	}
 	/**
-	* POST /api/invitations — create an invitation (admin only)
+	* POST /api/invitations — create an invitation (needs `invitations:create`)
+	*
+	* With `send_email: true` the invite link is also emailed. A failed send
+	* still creates the invitation, with `email_sent_at: null`, so its link can
+	* be shared by hand or the email resent.
 	*/
 	create(options) {
 		return (options.client ?? this.client).post({
@@ -1115,7 +1164,26 @@ var Invitations = class extends HeyApiClient {
 		});
 	}
 	/**
-	* DELETE /api/invitations/{token} — revoke a pending invitation (admin only)
+	* GET /api/invitations/email-status — whether invitation emails can be sent (needs `invitations:read`)
+	*/
+	emailStatus(options) {
+		return (options?.client ?? this.client).get({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: zod.never().optional(),
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zInvitationsEmailStatusResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/invitations/email-status",
+			...options
+		});
+	}
+	/**
+	* DELETE /api/invitations/{id} — revoke a pending invitation (needs `invitations:delete`)
 	*/
 	revoke(options) {
 		return (options.client ?? this.client).delete({
@@ -1129,7 +1197,26 @@ var Invitations = class extends HeyApiClient {
 				scheme: "bearer",
 				type: "http"
 			}],
-			url: "/api/invitations/{token}",
+			url: "/api/invitations/{id}",
+			...options
+		});
+	}
+	/**
+	* POST /api/invitations/{id}/resend — email the invite link again (needs `invitations:create`)
+	*/
+	resend(options) {
+		return (options.client ?? this.client).post({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: require_zod_gen.zInvitationsResendPath,
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zInvitationsResendResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/invitations/{id}/resend",
 			...options
 		});
 	}
@@ -1204,7 +1291,7 @@ var Projects = class extends HeyApiClient {
 	/**
 	* GET /api/projects - List projects with pagination
 	*
-	* Admins see every project. Non-admins see only the projects they belong to.
+	* Only the projects the caller holds a permission on.
 	*/
 	list(options) {
 		return (options?.client ?? this.client).get({
@@ -1225,8 +1312,9 @@ var Projects = class extends HeyApiClient {
 	/**
 	* POST /api/projects - Create a new project
 	*
-	* Any authenticated user may create a project. A non-admin creator is
-	* automatically granted the project `admin` role so they can access it.
+	* Needs `projects:create` and a permission on at least one project, because
+	* the creator's own roles extend to the new one. A token limited to chosen
+	* projects can create one, but its list does not grow to reach it.
 	*/
 	create(options) {
 		return (options.client ?? this.client).post({
@@ -2327,7 +2415,7 @@ var Logs = class extends HeyApiClient {
 };
 var Members = class extends HeyApiClient {
 	/**
-	* GET /api/projects/{project_id}/members
+	* Lists everyone holding a role on the project, with those roles; personal permissions are not roles.
 	*/
 	list(options) {
 		return (options.client ?? this.client).get({
@@ -2346,7 +2434,7 @@ var Members = class extends HeyApiClient {
 		});
 	}
 	/**
-	* PUT /api/projects/{project_id}/members
+	* Sets the roles a user holds on the project.
 	*/
 	upsert(options) {
 		return (options.client ?? this.client).put({
@@ -2369,7 +2457,26 @@ var Members = class extends HeyApiClient {
 		});
 	}
 	/**
-	* DELETE /api/projects/{project_id}/members/{user_id}
+	* Lists the people and the roles the caller can give on the project, so it takes neither `users:read` nor `roles:read` to manage its members.
+	*/
+	candidates(options) {
+		return (options.client ?? this.client).get({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: require_zod_gen.zMembersCandidatesPath,
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zMembersCandidatesResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/projects/{project_id}/members/candidates",
+			...options
+		});
+	}
+	/**
+	* Removes the roles a user holds on this project; roles on all projects and personal permissions stay.
 	*/
 	remove(options) {
 		return (options.client ?? this.client).delete({
@@ -2768,6 +2875,95 @@ var Transactions = class extends HeyApiClient {
 		});
 	}
 };
+var Roles = class extends HeyApiClient {
+	/**
+	* Lists every role with its permissions and how often it is assigned.
+	*/
+	list(options) {
+		return (options?.client ?? this.client).get({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: zod.never().optional(),
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zRolesListResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/roles",
+			...options
+		});
+	}
+	/**
+	* Creates a role from permissions the caller holds themselves.
+	*/
+	create(options) {
+		return (options.client ?? this.client).post({
+			requestValidator: async (data) => await zod.object({
+				body: require_zod_gen.zRolesCreateBody,
+				path: zod.never().optional(),
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zRolesCreateResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/roles",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+	/**
+	* Deletes a role nobody holds.
+	*/
+	delete(options) {
+		return (options.client ?? this.client).delete({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: require_zod_gen.zRolesDeletePath,
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zRolesDeleteResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/roles/{id}",
+			...options
+		});
+	}
+	/**
+	* Replaces a role's name, description and permissions.
+	*
+	* The caller must hold both the permissions being added and those being
+	* removed, so nobody strips a role of something they could not give back.
+	*/
+	update(options) {
+		return (options.client ?? this.client).put({
+			requestValidator: async (data) => await zod.object({
+				body: require_zod_gen.zRolesUpdateBody,
+				path: require_zod_gen.zRolesUpdatePath,
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zRolesUpdateResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/roles/{id}",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
 var Schedules = class extends HeyApiClient {
 	/**
 	* POST /api/schedules/preview
@@ -2798,7 +2994,8 @@ var Schedules = class extends HeyApiClient {
 };
 var Settings = class extends HeyApiClient {
 	/**
-	* Whether the MCP endpoint at `/mcp` is on.
+	* Whether the MCP endpoint at `/mcp` is on. Open to every member: it is what
+	* they point their own assistant at.
 	*/
 	getMcp(options) {
 		return (options?.client ?? this.client).get({
@@ -2817,7 +3014,7 @@ var Settings = class extends HeyApiClient {
 		});
 	}
 	/**
-	* Turns the MCP endpoint at `/mcp` on or off. Instance admins only.
+	* Turns the MCP endpoint at `/mcp` on or off (needs `mcp:update`).
 	*/
 	updateMcp(options) {
 		return (options.client ?? this.client).put({
@@ -3134,7 +3331,7 @@ var Storage = class extends HeyApiClient {
 };
 var Team = class extends HeyApiClient {
 	/**
-	* GET /api/team — list all users (admin only)
+	* GET /api/team — list all users (needs `users:read`)
 	*/
 	list(options) {
 		return (options?.client ?? this.client).get({
@@ -3153,7 +3350,7 @@ var Team = class extends HeyApiClient {
 		});
 	}
 	/**
-	* DELETE /api/team/{user_id} — remove a user from the instance (admin only)
+	* DELETE /api/team/{user_id} — remove a user from the instance (needs `users:delete`)
 	*/
 	deleteUser(options) {
 		return (options.client ?? this.client).delete({
@@ -3172,7 +3369,7 @@ var Team = class extends HeyApiClient {
 		});
 	}
 	/**
-	* PATCH /api/team/{user_id}/role — change a user's global role (admin only)
+	* PATCH /api/team/{user_id}/role — change a user's global role (needs `users:update`)
 	*/
 	updateRole(options) {
 		return (options.client ?? this.client).patch({
@@ -3220,7 +3417,8 @@ var Tokens = class extends HeyApiClient {
 	/**
 	* GET /api/tokens - List tokens (masked)
 	*
-	* Admins see all tokens; non-admins see only the tokens they own.
+	* Everyone sees their own tokens; `api-tokens:read` sees every token. A token
+	* limited to other permissions sees none: it must not reach its owner's others.
 	*/
 	list(options) {
 		return (options?.client ?? this.client).get({
@@ -3239,7 +3437,10 @@ var Tokens = class extends HeyApiClient {
 		});
 	}
 	/**
-	* POST /api/tokens - Create a new token (scoped to the acting user)
+	* POST /api/tokens - Create a new token (from a signed-in session only)
+	*
+	* A token cannot create tokens: a limited or expiring one could otherwise
+	* mint itself a way out of its limits.
 	*/
 	create(options) {
 		return (options.client ?? this.client).post({
@@ -3264,7 +3465,7 @@ var Tokens = class extends HeyApiClient {
 	/**
 	* DELETE /api/tokens/{id} - Revoke a token
 	*
-	* Admins may revoke any token; non-admins may only revoke their own.
+	* Everyone may revoke their own; `api-tokens:delete` revokes any.
 	*/
 	delete(options) {
 		return (options.client ?? this.client).delete({
@@ -3283,10 +3484,10 @@ var Tokens = class extends HeyApiClient {
 		});
 	}
 	/**
-	* GET /api/tokens/{id} - Reveal full token value
+	* GET /api/tokens/{id} - Token details, masked
 	*
-	* Returns the complete token string. Admins may view any token;
-	* non-admins may only view their own.
+	* Tokens are stored hashed, so the full value is only ever shown on
+	* creation. Everyone may view their own; `api-tokens:read` views any.
 	*/
 	get(options) {
 		return (options.client ?? this.client).get({
@@ -3305,6 +3506,53 @@ var Tokens = class extends HeyApiClient {
 		});
 	}
 };
+var Users = class extends HeyApiClient {
+	/**
+	* Lists the roles a user holds, on the instance and on each project.
+	*/
+	assignments(options) {
+		return (options.client ?? this.client).get({
+			requestValidator: async (data) => await zod.object({
+				body: zod.never().optional(),
+				path: require_zod_gen.zUsersAssignmentsPath,
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zUsersAssignmentsResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/users/{id}/assignments",
+			...options
+		});
+	}
+	/**
+	* Replaces every role and personal permission a user holds.
+	*
+	* The caller must hold every role being given or taken away, on the scope
+	* it applies to.
+	*/
+	setAssignments(options) {
+		return (options.client ?? this.client).put({
+			requestValidator: async (data) => await zod.object({
+				body: require_zod_gen.zUsersSetAssignmentsBody,
+				path: require_zod_gen.zUsersSetAssignmentsPath,
+				query: zod.never().optional()
+			}).parseAsync(data),
+			responseValidator: async (data) => await require_zod_gen.zUsersSetAssignmentsResponse.parseAsync(data),
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			url: "/api/users/{id}/assignments",
+			...options,
+			headers: {
+				"Content-Type": "application/json",
+				...options.headers
+			}
+		});
+	}
+};
 var Auth = class extends HeyApiClient {
 	/**
 	* POST /auth/accept-invitation
@@ -3646,6 +3894,10 @@ var Rustrak = class Rustrak extends HeyApiClient {
 	get releases() {
 		return this._releases ??= new Releases({ client: this.client });
 	}
+	_access;
+	get access() {
+		return this._access ??= new Access({ client: this.client });
+	}
 	_github;
 	get github() {
 		return this._github ??= new Github({ client: this.client });
@@ -3718,6 +3970,10 @@ var Rustrak = class Rustrak extends HeyApiClient {
 	get transactions() {
 		return this._transactions ??= new Transactions({ client: this.client });
 	}
+	_roles;
+	get roles() {
+		return this._roles ??= new Roles({ client: this.client });
+	}
 	_schedules;
 	get schedules() {
 		return this._schedules ??= new Schedules({ client: this.client });
@@ -3742,6 +3998,10 @@ var Rustrak = class Rustrak extends HeyApiClient {
 	get tokens() {
 		return this._tokens ??= new Tokens({ client: this.client });
 	}
+	_users;
+	get users() {
+		return this._users ??= new Users({ client: this.client });
+	}
 	_auth;
 	get auth() {
 		return this._auth ??= new Auth({ client: this.client });
@@ -3751,6 +4011,7 @@ var Rustrak = class Rustrak extends HeyApiClient {
 		return this._health ??= new Health({ client: this.client });
 	}
 };
+exports.Access = Access;
 exports.Agents = Agents;
 exports.AlertChannels = AlertChannels;
 exports.AlertRules = AlertRules;
@@ -3769,6 +4030,7 @@ exports.Monitors = Monitors;
 exports.Oauth = Oauth;
 exports.Projects = Projects;
 exports.Releases = Releases;
+exports.Roles = Roles;
 exports.Rustrak = Rustrak;
 exports.Schedules = Schedules;
 exports.Sentry = Sentry;
@@ -3782,5 +4044,6 @@ exports.Team = Team;
 exports.Telemetry = Telemetry;
 exports.Tokens = Tokens;
 exports.Transactions = Transactions;
+exports.Users = Users;
 
 //# sourceMappingURL=sdk.gen.cjs.map